diff --git a/pkg/api/defaults.go b/pkg/api/defaults.go
index b2305f9a64d..aa89c4d6004 100644
--- a/pkg/api/defaults.go
+++ b/pkg/api/defaults.go
@@ -7,7 +7,7 @@ package api
 // when interacting with newer api versions. This together with
 // database migration will make sure we have right values in the cluster documents
 // when moving between old and new versions
-func SetDefaults(doc *OpenShiftClusterDocument) {
+func SetDefaults(doc *OpenShiftClusterDocument, defaultOperatorFlags func() map[string]string) {
 	if doc.OpenShiftCluster != nil {
 		// EncryptionAtHost was introduced in 2021-09-01-preview.
 		// It can't be changed post cluster creation
@@ -40,7 +40,7 @@ func SetDefaults(doc *OpenShiftClusterDocument) {
 
 		// If there's no operator flags, set the default ones
 		if doc.OpenShiftCluster.Properties.OperatorFlags == nil {
-			doc.OpenShiftCluster.Properties.OperatorFlags = DefaultOperatorFlags()
+			doc.OpenShiftCluster.Properties.OperatorFlags = OperatorFlags(defaultOperatorFlags())
 		}
 
 		// If there's no OutboundType, set default one
@@ -63,49 +63,3 @@ func SetDefaults(doc *OpenShiftClusterDocument) {
 		}
 	}
 }
-
-// shorthand
-const flagTrue string = "true"
-const flagFalse string = "false"
-
-// DefaultOperatorFlags returns flags for new clusters
-// and ones that have not been AdminUpdated.
-func DefaultOperatorFlags() OperatorFlags {
-	// TODO: Get rid of magic strings.
-	// We already have constants for all of the below strings.
-	// For example `controllerEnabled` in `github.com/Azure/ARO-RP/pkg/operator/controllers/machine`.
-	// But if we import packages with constants here we will have a cyclic import issue because controllers
-	// import this package. We should probably move this somewhere else.
-	// Maybe into a subpackage like `github.com/Azure/ARO-RP/pkg/api/defaults`?
-	return OperatorFlags{
-		"aro.alertwebhook.enabled":                 flagTrue,
-		"aro.azuresubnets.enabled":                 flagTrue,
-		"aro.azuresubnets.nsg.managed":             flagTrue,
-		"aro.azuresubnets.serviceendpoint.managed": flagTrue,
-		"aro.banner.enabled":                       flagFalse,
-		"aro.checker.enabled":                      flagTrue,
-		"aro.dnsmasq.enabled":                      flagTrue,
-		"aro.restartdnsmasq.enabled":               flagFalse,
-		"aro.genevalogging.enabled":                flagTrue,
-		"aro.imageconfig.enabled":                  flagTrue,
-		"aro.ingress.enabled":                      flagTrue,
-		"aro.machine.enabled":                      flagTrue,
-		"aro.machineset.enabled":                   flagTrue,
-		"aro.machinehealthcheck.enabled":           flagTrue,
-		"aro.machinehealthcheck.managed":           flagTrue,
-		"aro.monitoring.enabled":                   flagTrue,
-		"aro.nodedrainer.enabled":                  flagTrue,
-		"aro.pullsecret.enabled":                   flagTrue,
-		"aro.pullsecret.managed":                   flagTrue,
-		"aro.rbac.enabled":                         flagTrue,
-		"aro.routefix.enabled":                     flagTrue,
-		"aro.storageaccounts.enabled":              flagTrue,
-		"aro.workaround.enabled":                   flagTrue,
-		"aro.autosizednodes.enabled":               flagTrue,
-		"rh.srep.muo.enabled":                      flagTrue,
-		"rh.srep.muo.managed":                      flagTrue,
-		"aro.guardrails.enabled":                   flagFalse,
-		"aro.guardrails.deploy.managed":            flagFalse,
-		"aro.cloudproviderconfig.enabled":          flagTrue,
-	}
-}
diff --git a/pkg/api/defaults_test.go b/pkg/api/defaults_test.go
index 5dbe7d0b00c..a2103773cfe 100644
--- a/pkg/api/defaults_test.go
+++ b/pkg/api/defaults_test.go
@@ -39,7 +39,7 @@ func validOpenShiftClusterDocument() *OpenShiftClusterDocument {
 				ClusterProfile: ClusterProfile{
 					FipsValidatedModules: FipsValidatedModulesDisabled,
 				},
-				OperatorFlags: DefaultOperatorFlags(),
+				OperatorFlags: OperatorFlags{"testflag": "testvalue"},
 			},
 		},
 	}
@@ -136,7 +136,7 @@ func TestSetDefaults(t *testing.T) {
 				tt.input(doc)
 			}
 
-			SetDefaults(doc)
+			SetDefaults(doc, func() map[string]string { return map[string]string{"testflag": "testvalue"} })
 
 			if !reflect.DeepEqual(&doc, &want) {
 				t.Error(fmt.Errorf("\n%+v\n !=\n%+v", doc, want)) // can't use cmp due to cycle imports
diff --git a/pkg/cluster/defaults.go b/pkg/cluster/defaults.go
index fe7a48d5c82..ea01eebe273 100644
--- a/pkg/cluster/defaults.go
+++ b/pkg/cluster/defaults.go
@@ -7,6 +7,7 @@ import (
 	"context"
 
 	"github.com/Azure/ARO-RP/pkg/api"
+	"github.com/Azure/ARO-RP/pkg/operator"
 )
 
 // ensureDefaults will ensure cluster documents has all default values
@@ -14,7 +15,7 @@ import (
 func (m *manager) ensureDefaults(ctx context.Context) error {
 	var err error
 	m.doc, err = m.db.PatchWithLease(ctx, m.doc.Key, func(doc *api.OpenShiftClusterDocument) error {
-		api.SetDefaults(doc)
+		api.SetDefaults(doc, operator.DefaultOperatorFlags)
 		return nil
 	})
 	if err != nil {
@@ -31,7 +32,7 @@ func (m *manager) ensurePreconfiguredNSG(ctx context.Context) error {
 		var err error
 		m.doc, err = m.db.PatchWithLease(ctx, m.doc.Key, func(doc *api.OpenShiftClusterDocument) error {
 			flags := doc.OpenShiftCluster.Properties.OperatorFlags
-			flags["aro.azuresubnets.nsg.managed"] = "false"
+			flags[operator.AzureSubnetsNsgManaged] = operator.FlagFalse
 			return nil
 		})
 		if err != nil {
diff --git a/pkg/frontend/openshiftcluster_putorpatch.go b/pkg/frontend/openshiftcluster_putorpatch.go
index fc5c7c38542..5fe58897874 100644
--- a/pkg/frontend/openshiftcluster_putorpatch.go
+++ b/pkg/frontend/openshiftcluster_putorpatch.go
@@ -21,6 +21,7 @@ import (
 	"github.com/Azure/ARO-RP/pkg/database/cosmosdb"
 	"github.com/Azure/ARO-RP/pkg/env"
 	"github.com/Azure/ARO-RP/pkg/frontend/middleware"
+	"github.com/Azure/ARO-RP/pkg/operator"
 	"github.com/Azure/ARO-RP/pkg/util/feature"
 	"github.com/Azure/ARO-RP/pkg/util/version"
 )
@@ -207,7 +208,7 @@ func (f *frontend) _putOrPatchOpenShiftCluster(ctx context.Context, log *logrus.
 	}
 
 	// SetDefaults will set defaults on cluster document
-	api.SetDefaults(doc)
+	api.SetDefaults(doc, operator.DefaultOperatorFlags)
 
 	doc.AsyncOperationID, err = f.newAsyncOperation(ctx, subId, resourceProviderNamespace, doc)
 	if err != nil {
diff --git a/pkg/frontend/openshiftcluster_putorpatch_test.go b/pkg/frontend/openshiftcluster_putorpatch_test.go
index d649ffe1b2e..4dbb25fcf2e 100644
--- a/pkg/frontend/openshiftcluster_putorpatch_test.go
+++ b/pkg/frontend/openshiftcluster_putorpatch_test.go
@@ -20,6 +20,7 @@ import (
 	v20200430 "github.com/Azure/ARO-RP/pkg/api/v20200430"
 	v20220401 "github.com/Azure/ARO-RP/pkg/api/v20220401"
 	"github.com/Azure/ARO-RP/pkg/metrics/noop"
+	"github.com/Azure/ARO-RP/pkg/operator"
 	"github.com/Azure/ARO-RP/pkg/util/bucket"
 	"github.com/Azure/ARO-RP/pkg/util/cmp"
 	mock_frontend "github.com/Azure/ARO-RP/pkg/util/mocks/frontend"
@@ -319,7 +320,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 							MasterProfile: api.MasterProfile{
 								EncryptionAtHost: api.EncryptionAtHostDisabled,
 							},
-							OperatorFlags:    api.DefaultOperatorFlags(),
+							OperatorFlags:    operator.DefaultOperatorFlags(),
 							MaintenanceState: api.MaintenanceStateUnplanned,
 						},
 					},
@@ -349,7 +350,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 					ClusterProfile: admin.ClusterProfile{
 						FipsValidatedModules: admin.FipsValidatedModulesDisabled,
 					},
-					OperatorFlags:    admin.OperatorFlags(api.DefaultOperatorFlags()),
+					OperatorFlags:    admin.OperatorFlags(operator.DefaultOperatorFlags()),
 					MaintenanceState: admin.MaintenanceStateUnplanned,
 				},
 			},
@@ -414,7 +415,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 							MasterProfile: api.MasterProfile{
 								EncryptionAtHost: api.EncryptionAtHostDisabled,
 							},
-							OperatorFlags:    api.DefaultOperatorFlags(),
+							OperatorFlags:    operator.DefaultOperatorFlags(),
 							MaintenanceState: api.MaintenanceStateUnplanned,
 						},
 					},
@@ -444,7 +445,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 					MasterProfile: admin.MasterProfile{
 						EncryptionAtHost: admin.EncryptionAtHostDisabled,
 					},
-					OperatorFlags:    admin.OperatorFlags(api.DefaultOperatorFlags()),
+					OperatorFlags:    admin.OperatorFlags(operator.DefaultOperatorFlags()),
 					MaintenanceState: admin.MaintenanceStateUnplanned,
 				},
 			},
@@ -691,7 +692,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 								EncryptionAtHost: api.EncryptionAtHostDisabled,
 							},
 							MaintenanceState: api.MaintenanceStatePending,
-							OperatorFlags:    api.DefaultOperatorFlags(),
+							OperatorFlags:    operator.DefaultOperatorFlags(),
 						},
 					},
 				})
@@ -721,7 +722,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 					MasterProfile: admin.MasterProfile{
 						EncryptionAtHost: admin.EncryptionAtHostDisabled,
 					},
-					OperatorFlags: admin.OperatorFlags(api.DefaultOperatorFlags()),
+					OperatorFlags: admin.OperatorFlags(operator.DefaultOperatorFlags()),
 				},
 			},
 		},
@@ -789,7 +790,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 								EncryptionAtHost: api.EncryptionAtHostDisabled,
 							},
 							MaintenanceState: api.MaintenanceStatePending,
-							OperatorFlags:    api.DefaultOperatorFlags(),
+							OperatorFlags:    operator.DefaultOperatorFlags(),
 						},
 					},
 				})
@@ -819,7 +820,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 					MasterProfile: admin.MasterProfile{
 						EncryptionAtHost: admin.EncryptionAtHostDisabled,
 					},
-					OperatorFlags: admin.OperatorFlags(api.DefaultOperatorFlags()),
+					OperatorFlags: admin.OperatorFlags(operator.DefaultOperatorFlags()),
 				},
 			},
 		},
@@ -885,7 +886,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 							MasterProfile: api.MasterProfile{
 								EncryptionAtHost: api.EncryptionAtHostDisabled,
 							},
-							OperatorFlags:    api.DefaultOperatorFlags(),
+							OperatorFlags:    operator.DefaultOperatorFlags(),
 							MaintenanceState: api.MaintenanceStatePlanned,
 						},
 					},
@@ -915,7 +916,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 					MasterProfile: admin.MasterProfile{
 						EncryptionAtHost: admin.EncryptionAtHostDisabled,
 					},
-					OperatorFlags:    admin.OperatorFlags(api.DefaultOperatorFlags()),
+					OperatorFlags:    admin.OperatorFlags(operator.DefaultOperatorFlags()),
 					MaintenanceState: admin.MaintenanceStatePlanned,
 				},
 			},
@@ -984,7 +985,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 								EncryptionAtHost: api.EncryptionAtHostDisabled,
 							},
 							MaintenanceState: api.MaintenanceStateNone,
-							OperatorFlags:    api.DefaultOperatorFlags(),
+							OperatorFlags:    operator.DefaultOperatorFlags(),
 						},
 					},
 				})
@@ -1014,7 +1015,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 					MasterProfile: admin.MasterProfile{
 						EncryptionAtHost: admin.EncryptionAtHostDisabled,
 					},
-					OperatorFlags: admin.OperatorFlags(api.DefaultOperatorFlags()),
+					OperatorFlags: admin.OperatorFlags(operator.DefaultOperatorFlags()),
 				},
 			},
 		},
@@ -1082,7 +1083,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 								EncryptionAtHost: api.EncryptionAtHostDisabled,
 							},
 							MaintenanceState: api.MaintenanceStateNone,
-							OperatorFlags:    api.DefaultOperatorFlags(),
+							OperatorFlags:    operator.DefaultOperatorFlags(),
 						},
 					},
 				})
@@ -1112,7 +1113,7 @@ func TestPutOrPatchOpenShiftClusterAdminAPI(t *testing.T) {
 					MasterProfile: admin.MasterProfile{
 						EncryptionAtHost: admin.EncryptionAtHostDisabled,
 					},
-					OperatorFlags: admin.OperatorFlags(api.DefaultOperatorFlags()),
+					OperatorFlags: admin.OperatorFlags(operator.DefaultOperatorFlags()),
 				},
 			},
 		},
@@ -1393,7 +1394,7 @@ func TestPutOrPatchOpenShiftCluster(t *testing.T) {
 							FeatureProfile: api.FeatureProfile{
 								GatewayEnabled: true,
 							},
-							OperatorFlags: api.DefaultOperatorFlags(),
+							OperatorFlags: operator.DefaultOperatorFlags(),
 						},
 					},
 				})
diff --git a/pkg/monitor/cluster/clusterflagsandbanner.go b/pkg/monitor/cluster/clusterflagsandbanner.go
index a29f0db6b8f..55d8db3d0e7 100644
--- a/pkg/monitor/cluster/clusterflagsandbanner.go
+++ b/pkg/monitor/cluster/clusterflagsandbanner.go
@@ -8,7 +8,7 @@ import (
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"github.com/Azure/ARO-RP/pkg/api"
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 )
 
@@ -27,7 +27,7 @@ func (mon *Monitor) emitOperatorFlagsAndSupportBanner(ctx context.Context) error
 
 		for _, cluster := range clusters.Items {
 			if cluster.Spec.OperatorFlags != nil {
-				defaultFlags := api.DefaultOperatorFlags()
+				defaultFlags := operator.DefaultOperatorFlags()
 				nonStandardOperatorFlagDims := make(map[string]string, len(defaultFlags))
 
 				//check if the current set flags matches the default ones
diff --git a/pkg/monitor/cluster/clusterflagsandbanner_test.go b/pkg/monitor/cluster/clusterflagsandbanner_test.go
index 8f6c19616c1..4bc182c9a6d 100644
--- a/pkg/monitor/cluster/clusterflagsandbanner_test.go
+++ b/pkg/monitor/cluster/clusterflagsandbanner_test.go
@@ -10,7 +10,7 @@ import (
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"github.com/Azure/ARO-RP/pkg/api"
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	arofake "github.com/Azure/ARO-RP/pkg/operator/clientset/versioned/fake"
 )
@@ -45,7 +45,7 @@ func (e *fakeMetricsEmitter) EmitFloat(topic string, value float64, dims map[str
 
 func generateDefaultFlags() arov1alpha1.OperatorFlags {
 	df := make(arov1alpha1.OperatorFlags)
-	for k, v := range api.DefaultOperatorFlags() {
+	for k, v := range operator.DefaultOperatorFlags() {
 		df[k] = v
 	}
 	return df
@@ -53,7 +53,7 @@ func generateDefaultFlags() arov1alpha1.OperatorFlags {
 
 func generateNonStandardFlags(nonDefualtFlagNames []string) arov1alpha1.OperatorFlags {
 	nsf := make(arov1alpha1.OperatorFlags)
-	for k, v := range api.DefaultOperatorFlags() {
+	for k, v := range operator.DefaultOperatorFlags() {
 		nsf[k] = v
 	}
 	for _, n := range nonDefualtFlagNames {
@@ -68,7 +68,7 @@ func generateNonStandardFlags(nonDefualtFlagNames []string) arov1alpha1.Operator
 
 func generateFlagsWithMissingEntries(missingFlagNames []string) arov1alpha1.OperatorFlags {
 	mf := make(arov1alpha1.OperatorFlags)
-	for k, v := range api.DefaultOperatorFlags() {
+	for k, v := range operator.DefaultOperatorFlags() {
 		mf[k] = v
 	}
 	for _, n := range missingFlagNames {
@@ -117,32 +117,32 @@ func TestEmitOperatorFlagsAndSupportBanner(t *testing.T) {
 		},
 		{
 			name:          "cluster with non-standard operator flags",
-			operatorFlags: generateNonStandardFlags([]string{"aro.imageconfig.enabled", "aro.dnsmasq.enabled", "aro.genevalogging.enabled", "aro.autosizednodes.enabled"}),
+			operatorFlags: generateNonStandardFlags([]string{operator.ImageConfigEnabled, operator.DnsmasqEnabled, operator.GenevaLoggingEnabled, operator.AutosizedNodesEnabled}),
 			clusterBanner: arov1alpha1.Banner{
 				Content: "",
 			},
 			expectFlagsMetricsValue: 1,
 			expectFlagsMetricsDims: map[string]string{
-				"aro.imageconfig.enabled":    "false",
-				"aro.dnsmasq.enabled":        "false",
-				"aro.genevalogging.enabled":  "false",
-				"aro.autosizednodes.enabled": "false",
+				operator.ImageConfigEnabled:    operator.FlagFalse,
+				operator.DnsmasqEnabled:        operator.FlagFalse,
+				operator.GenevaLoggingEnabled:  operator.FlagFalse,
+				operator.AutosizedNodesEnabled: operator.FlagFalse,
 			},
 			expectBannerMetricsValue: 0,
 			expectBannerMetricsDims:  nil,
 		},
 		{
 			name:          "cluster with missing operator flags",
-			operatorFlags: generateFlagsWithMissingEntries([]string{"aro.imageconfig.enabled", "aro.dnsmasq.enabled", "aro.genevalogging.enabled", "aro.autosizednodes.enabled"}),
+			operatorFlags: generateFlagsWithMissingEntries([]string{operator.ImageConfigEnabled, operator.DnsmasqEnabled, operator.GenevaLoggingEnabled, operator.AutosizedNodesEnabled}),
 			clusterBanner: arov1alpha1.Banner{
 				Content: "",
 			},
 			expectFlagsMetricsValue: 1,
 			expectFlagsMetricsDims: map[string]string{
-				"aro.imageconfig.enabled":    "DNE",
-				"aro.dnsmasq.enabled":        "DNE",
-				"aro.genevalogging.enabled":  "DNE",
-				"aro.autosizednodes.enabled": "DNE",
+				operator.ImageConfigEnabled:    "DNE",
+				operator.DnsmasqEnabled:        "DNE",
+				operator.GenevaLoggingEnabled:  "DNE",
+				operator.AutosizedNodesEnabled: "DNE",
 			},
 			expectBannerMetricsValue: 0,
 			expectBannerMetricsDims:  nil,
@@ -160,16 +160,16 @@ func TestEmitOperatorFlagsAndSupportBanner(t *testing.T) {
 		},
 		{
 			name:          "cluster with non-standard operator flags and activated support banner",
-			operatorFlags: generateNonStandardFlags([]string{"aro.imageconfig.enabled", "aro.dnsmasq.enabled", "aro.genevalogging.enabled", "aro.autosizednodes.enabled"}),
+			operatorFlags: generateNonStandardFlags([]string{operator.ImageConfigEnabled, operator.DnsmasqEnabled, operator.GenevaLoggingEnabled, operator.AutosizedNodesEnabled}),
 			clusterBanner: arov1alpha1.Banner{
 				Content: arov1alpha1.BannerContactSupport,
 			},
 			expectFlagsMetricsValue: 1,
 			expectFlagsMetricsDims: map[string]string{
-				"aro.imageconfig.enabled":    "false",
-				"aro.dnsmasq.enabled":        "false",
-				"aro.genevalogging.enabled":  "false",
-				"aro.autosizednodes.enabled": "false",
+				operator.ImageConfigEnabled:    operator.FlagFalse,
+				operator.DnsmasqEnabled:        operator.FlagFalse,
+				operator.GenevaLoggingEnabled:  operator.FlagFalse,
+				operator.AutosizedNodesEnabled: operator.FlagFalse,
 			},
 			expectBannerMetricsValue: 1,
 			expectBannerMetricsDims:  map[string]string{"msg": "contact support"},
diff --git a/pkg/operator/controllers/alertwebhook/alertwebhook_controller.go b/pkg/operator/controllers/alertwebhook/alertwebhook_controller.go
index 6e3dc24ee4d..248e84d8374 100644
--- a/pkg/operator/controllers/alertwebhook/alertwebhook_controller.go
+++ b/pkg/operator/controllers/alertwebhook/alertwebhook_controller.go
@@ -17,13 +17,12 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 )
 
 const (
 	ControllerName = "Alertwebhook"
-
-	controllerEnabled = "aro.alertwebhook.enabled"
 )
 
 var alertManagerName = types.NamespacedName{Name: "alertmanager-main", Namespace: "openshift-monitoring"}
@@ -50,7 +49,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.AlertWebhookEnabled) {
 		r.log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/alertwebhook/alertwebhook_controller_test.go b/pkg/operator/controllers/alertwebhook/alertwebhook_controller_test.go
index 7ed48da1c81..3bab586856b 100644
--- a/pkg/operator/controllers/alertwebhook/alertwebhook_controller_test.go
+++ b/pkg/operator/controllers/alertwebhook/alertwebhook_controller_test.go
@@ -15,6 +15,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	_ "github.com/Azure/ARO-RP/pkg/util/scheme"
 )
@@ -180,13 +181,13 @@ func TestSetAlertManagerWebhook(t *testing.T) {
 				},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: "false",
+						operator.AlertWebhookEnabled: operator.FlagFalse,
 					},
 				},
 			}
 
 			if tt.controllerEnabled {
-				instance.Spec.OperatorFlags[controllerEnabled] = "true"
+				instance.Spec.OperatorFlags[operator.AlertWebhookEnabled] = operator.FlagTrue
 			}
 
 			secret := &corev1.Secret{
diff --git a/pkg/operator/controllers/autosizednodes/autosizednodes_controller.go b/pkg/operator/controllers/autosizednodes/autosizednodes_controller.go
index 60b7ce254e1..cd2f571aca6 100644
--- a/pkg/operator/controllers/autosizednodes/autosizednodes_controller.go
+++ b/pkg/operator/controllers/autosizednodes/autosizednodes_controller.go
@@ -19,6 +19,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 )
 
@@ -30,9 +31,7 @@ type Reconciler struct {
 
 const (
 	ControllerName = "AutoSizedNodes"
-
-	ControllerEnabled = "aro.autosizednodes.enabled"
-	configName        = "dynamic-node"
+	configName     = "dynamic-node"
 )
 
 func NewReconciler(log *logrus.Entry, client client.Client) *Reconciler {
@@ -53,14 +52,14 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return ctrl.Result{}, client.IgnoreNotFound(err)
 	}
 
-	r.log.Infof("Config changed, autoSize: %t\n", aro.Spec.OperatorFlags.GetSimpleBoolean(ControllerEnabled))
+	r.log.Infof("Config changed, autoSize: %t\n", aro.Spec.OperatorFlags.GetSimpleBoolean(operator.AutosizedNodesEnabled))
 
 	// key is used to locate the object in the etcd
 	key := types.NamespacedName{
 		Name: configName,
 	}
 
-	if !aro.Spec.OperatorFlags.GetSimpleBoolean(ControllerEnabled) {
+	if !aro.Spec.OperatorFlags.GetSimpleBoolean(operator.AutosizedNodesEnabled) {
 		// defaults to deleting the config
 		config := mcv1.KubeletConfig{
 			ObjectMeta: metav1.ObjectMeta{
diff --git a/pkg/operator/controllers/autosizednodes/autosizednodes_controller_test.go b/pkg/operator/controllers/autosizednodes/autosizednodes_controller_test.go
index fd51e42713e..916e2738469 100644
--- a/pkg/operator/controllers/autosizednodes/autosizednodes_controller_test.go
+++ b/pkg/operator/controllers/autosizednodes/autosizednodes_controller_test.go
@@ -22,6 +22,7 @@ import (
 
 	// This "_" import is counterintuitive but is required to initialize the scheme
 	// ARO unfortunately relies on implicit import and its side effect for this
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	_ "github.com/Azure/ARO-RP/pkg/util/scheme"
 	utilerror "github.com/Azure/ARO-RP/test/util/error"
@@ -36,7 +37,7 @@ func TestAutosizednodesReconciler(t *testing.T) {
 			},
 			Spec: arov1alpha1.ClusterSpec{
 				OperatorFlags: arov1alpha1.OperatorFlags{
-					ControllerEnabled: strconv.FormatBool(autoSizeEnabled),
+					operator.AutosizedNodesEnabled: strconv.FormatBool(autoSizeEnabled),
 				},
 			},
 		}
diff --git a/pkg/operator/controllers/banner/banner_controller.go b/pkg/operator/controllers/banner/banner_controller.go
index e6622493fb7..11357560def 100644
--- a/pkg/operator/controllers/banner/banner_controller.go
+++ b/pkg/operator/controllers/banner/banner_controller.go
@@ -17,13 +17,12 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 )
 
 const (
 	ControllerName = "Banner"
-
-	controllerEnabled = "aro.banner.enabled"
 )
 
 // BannerReconciler is the controller struct
@@ -49,7 +48,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.BannerEnabled) {
 		r.log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/banner/banner_controller_test.go b/pkg/operator/controllers/banner/banner_controller_test.go
index 801a7fee07c..48ab7f5952f 100644
--- a/pkg/operator/controllers/banner/banner_controller_test.go
+++ b/pkg/operator/controllers/banner/banner_controller_test.go
@@ -16,6 +16,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	utillog "github.com/Azure/ARO-RP/pkg/util/log"
 	_ "github.com/Azure/ARO-RP/pkg/util/scheme"
@@ -143,7 +144,7 @@ func TestBannerReconcile(t *testing.T) {
 						Content: arov1alpha1.BannerContent(tt.bannerSetting),
 					},
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: strconv.FormatBool(tt.featureFlag),
+						operator.BannerEnabled: strconv.FormatBool(tt.featureFlag),
 					},
 				},
 			}
diff --git a/pkg/operator/controllers/checkers/clusterdnschecker/controller.go b/pkg/operator/controllers/checkers/clusterdnschecker/controller.go
index 772f6f67b43..d761aeba612 100644
--- a/pkg/operator/controllers/checkers/clusterdnschecker/controller.go
+++ b/pkg/operator/controllers/checkers/clusterdnschecker/controller.go
@@ -18,8 +18,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
-	checkercommon "github.com/Azure/ARO-RP/pkg/operator/controllers/checkers/common"
 	"github.com/Azure/ARO-RP/pkg/util/conditions"
 )
 
@@ -62,7 +62,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(checkercommon.ControllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.CheckerEnabled) {
 		r.log.Debug("controller is disabled")
 		return r.reconcileDisabled(ctx)
 	}
diff --git a/pkg/operator/controllers/checkers/clusterdnschecker/controller_test.go b/pkg/operator/controllers/checkers/clusterdnschecker/controller_test.go
index 64fe0b518c5..a234354c19d 100644
--- a/pkg/operator/controllers/checkers/clusterdnschecker/controller_test.go
+++ b/pkg/operator/controllers/checkers/clusterdnschecker/controller_test.go
@@ -17,8 +17,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
-	checkercommon "github.com/Azure/ARO-RP/pkg/operator/controllers/checkers/common"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/cmp"
 	utillog "github.com/Azure/ARO-RP/pkg/util/log"
@@ -75,12 +75,12 @@ func TestReconcile(t *testing.T) {
 				Spec: arov1alpha1.ClusterSpec{
 					AZEnvironment: azureclient.PublicCloud.Environment.Name,
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						checkercommon.ControllerEnabled: "true",
+						operator.CheckerEnabled: operator.FlagTrue,
 					},
 				},
 			}
 			if tt.controllerDisabled {
-				instance.Spec.OperatorFlags[checkercommon.ControllerEnabled] = "false"
+				instance.Spec.OperatorFlags[operator.CheckerEnabled] = operator.FlagFalse
 			}
 
 			clientFake := fake.NewClientBuilder().WithObjects(instance).Build()
diff --git a/pkg/operator/controllers/checkers/common/const.go b/pkg/operator/controllers/checkers/common/const.go
deleted file mode 100644
index 8322ccd83b2..00000000000
--- a/pkg/operator/controllers/checkers/common/const.go
+++ /dev/null
@@ -1,8 +0,0 @@
-package common
-
-// Copyright (c) Microsoft Corporation.
-// Licensed under the Apache License 2.0.
-
-const (
-	ControllerEnabled = "aro.checker.enabled"
-)
diff --git a/pkg/operator/controllers/checkers/ingresscertificatechecker/controller.go b/pkg/operator/controllers/checkers/ingresscertificatechecker/controller.go
index 115ae4136d2..945b8e04f98 100644
--- a/pkg/operator/controllers/checkers/ingresscertificatechecker/controller.go
+++ b/pkg/operator/controllers/checkers/ingresscertificatechecker/controller.go
@@ -20,8 +20,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
-	checkercommon "github.com/Azure/ARO-RP/pkg/operator/controllers/checkers/common"
 	"github.com/Azure/ARO-RP/pkg/util/conditions"
 )
 
@@ -60,7 +60,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !cluster.Spec.OperatorFlags.GetSimpleBoolean(checkercommon.ControllerEnabled) {
+	if !cluster.Spec.OperatorFlags.GetSimpleBoolean(operator.CheckerEnabled) {
 		r.log.Debug("controller is disabled")
 		return r.reconcileDisabled(ctx)
 	}
diff --git a/pkg/operator/controllers/checkers/ingresscertificatechecker/controller_test.go b/pkg/operator/controllers/checkers/ingresscertificatechecker/controller_test.go
index 105f4bfa4be..76dcbfed811 100644
--- a/pkg/operator/controllers/checkers/ingresscertificatechecker/controller_test.go
+++ b/pkg/operator/controllers/checkers/ingresscertificatechecker/controller_test.go
@@ -16,8 +16,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
-	checkercommon "github.com/Azure/ARO-RP/pkg/operator/controllers/checkers/common"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/cmp"
 	utillog "github.com/Azure/ARO-RP/pkg/util/log"
@@ -75,12 +75,12 @@ func TestReconcile(t *testing.T) {
 				Spec: arov1alpha1.ClusterSpec{
 					AZEnvironment: azureclient.PublicCloud.Environment.Name,
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						checkercommon.ControllerEnabled: "true",
+						operator.CheckerEnabled: operator.FlagTrue,
 					},
 				},
 			}
 			if tt.controllerDisabled {
-				instance.Spec.OperatorFlags[checkercommon.ControllerEnabled] = "false"
+				instance.Spec.OperatorFlags[operator.CheckerEnabled] = operator.FlagFalse
 			}
 
 			clientFake := fake.NewClientBuilder().WithObjects(instance).Build()
diff --git a/pkg/operator/controllers/checkers/internetchecker/controller.go b/pkg/operator/controllers/checkers/internetchecker/controller.go
index 5a5ec19c49a..d0ad31434a4 100644
--- a/pkg/operator/controllers/checkers/internetchecker/controller.go
+++ b/pkg/operator/controllers/checkers/internetchecker/controller.go
@@ -16,8 +16,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
-	checkercommon "github.com/Azure/ARO-RP/pkg/operator/controllers/checkers/common"
 	"github.com/Azure/ARO-RP/pkg/util/conditions"
 )
 
@@ -60,7 +60,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(checkercommon.ControllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.CheckerEnabled) {
 		r.log.Debug("controller is disabled")
 		return r.reconcileDisabled(ctx)
 	}
diff --git a/pkg/operator/controllers/checkers/internetchecker/controller_test.go b/pkg/operator/controllers/checkers/internetchecker/controller_test.go
index 9a868329e21..6cda5ca25df 100644
--- a/pkg/operator/controllers/checkers/internetchecker/controller_test.go
+++ b/pkg/operator/controllers/checkers/internetchecker/controller_test.go
@@ -19,7 +19,6 @@ import (
 
 	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
-	checkercommon "github.com/Azure/ARO-RP/pkg/operator/controllers/checkers/common"
 	"github.com/Azure/ARO-RP/pkg/util/cmp"
 	utillog "github.com/Azure/ARO-RP/pkg/util/log"
 	_ "github.com/Azure/ARO-RP/pkg/util/scheme"
@@ -82,12 +81,12 @@ func TestReconcile(t *testing.T) {
 								URLs: urlsToCheck,
 							},
 							OperatorFlags: arov1alpha1.OperatorFlags{
-								checkercommon.ControllerEnabled: "true",
+								operator.CheckerEnabled: operator.FlagTrue,
 							},
 						},
 					}
 					if tt.controllerDisabled {
-						instance.Spec.OperatorFlags[checkercommon.ControllerEnabled] = "false"
+						instance.Spec.OperatorFlags[operator.CheckerEnabled] = operator.FlagFalse
 					}
 
 					clientFake := fake.NewClientBuilder().WithObjects(instance).Build()
diff --git a/pkg/operator/controllers/checkers/serviceprincipalchecker/controller.go b/pkg/operator/controllers/checkers/serviceprincipalchecker/controller.go
index b188633ffaf..13cf1777d32 100644
--- a/pkg/operator/controllers/checkers/serviceprincipalchecker/controller.go
+++ b/pkg/operator/controllers/checkers/serviceprincipalchecker/controller.go
@@ -19,8 +19,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
-	checkercommon "github.com/Azure/ARO-RP/pkg/operator/controllers/checkers/common"
 	"github.com/Azure/ARO-RP/pkg/util/clusterauthorizer"
 	"github.com/Azure/ARO-RP/pkg/util/conditions"
 )
@@ -64,7 +64,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(checkercommon.ControllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.CheckerEnabled) {
 		r.log.Debug("controller is disabled")
 		return r.reconcileDisabled(ctx)
 	}
diff --git a/pkg/operator/controllers/checkers/serviceprincipalchecker/controller_test.go b/pkg/operator/controllers/checkers/serviceprincipalchecker/controller_test.go
index a3ca547b2ef..c14d0f36b45 100644
--- a/pkg/operator/controllers/checkers/serviceprincipalchecker/controller_test.go
+++ b/pkg/operator/controllers/checkers/serviceprincipalchecker/controller_test.go
@@ -17,8 +17,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
-	checkercommon "github.com/Azure/ARO-RP/pkg/operator/controllers/checkers/common"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/cmp"
 	utillog "github.com/Azure/ARO-RP/pkg/util/log"
@@ -75,12 +75,12 @@ func TestReconcile(t *testing.T) {
 				Spec: arov1alpha1.ClusterSpec{
 					AZEnvironment: azureclient.PublicCloud.Environment.Name,
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						checkercommon.ControllerEnabled: "true",
+						operator.CheckerEnabled: operator.FlagTrue,
 					},
 				},
 			}
 			if tt.controllerDisabled {
-				instance.Spec.OperatorFlags[checkercommon.ControllerEnabled] = "false"
+				instance.Spec.OperatorFlags[operator.CheckerEnabled] = operator.FlagFalse
 			}
 
 			clientFake := fake.NewClientBuilder().WithObjects(instance).Build()
diff --git a/pkg/operator/controllers/cloudproviderconfig/cloudproviderconfig_controller.go b/pkg/operator/controllers/cloudproviderconfig/cloudproviderconfig_controller.go
index 13b92749c94..52e6fdd866d 100644
--- a/pkg/operator/controllers/cloudproviderconfig/cloudproviderconfig_controller.go
+++ b/pkg/operator/controllers/cloudproviderconfig/cloudproviderconfig_controller.go
@@ -20,13 +20,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 )
 
 const (
-	ControllerName    = "CloudProviderConfig"
-	controllerEnabled = "aro.cloudproviderconfig.enabled"
+	ControllerName = "CloudProviderConfig"
 )
 
 var cloudProviderConfigName = types.NamespacedName{Name: "cloud-provider-config", Namespace: "openshift-config"}
@@ -151,7 +151,7 @@ func (r *CloudProviderConfigReconciler) Reconcile(ctx context.Context, request c
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.CloudProviderConfigEnabled) {
 		r.Log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/cloudproviderconfig/cloudproviderconfig_controller_test.go b/pkg/operator/controllers/cloudproviderconfig/cloudproviderconfig_controller_test.go
index f11566e07a7..0f79bb07381 100644
--- a/pkg/operator/controllers/cloudproviderconfig/cloudproviderconfig_controller_test.go
+++ b/pkg/operator/controllers/cloudproviderconfig/cloudproviderconfig_controller_test.go
@@ -17,6 +17,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 	_ "github.com/Azure/ARO-RP/pkg/util/scheme"
@@ -105,7 +106,7 @@ func TestReconcileCloudProviderConfig(t *testing.T) {
 			},
 			Spec: arov1alpha1.ClusterSpec{
 				OperatorFlags: arov1alpha1.OperatorFlags{
-					controllerEnabled: "true",
+					operator.CloudProviderConfigEnabled: operator.FlagTrue,
 				},
 			},
 		}
diff --git a/pkg/operator/controllers/dnsmasq/cluster_controller.go b/pkg/operator/controllers/dnsmasq/cluster_controller.go
index 56dca6d1d8e..a83a534f031 100644
--- a/pkg/operator/controllers/dnsmasq/cluster_controller.go
+++ b/pkg/operator/controllers/dnsmasq/cluster_controller.go
@@ -15,6 +15,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 	"github.com/Azure/ARO-RP/pkg/util/dynamichelper"
@@ -22,9 +23,6 @@ import (
 
 const (
 	ClusterControllerName = "DnsmasqCluster"
-
-	controllerEnabled     = "aro.dnsmasq.enabled"
-	restartDnsmasqEnabled = "aro.restartdnsmasq.enabled"
 )
 
 type ClusterReconciler struct {
@@ -51,12 +49,12 @@ func (r *ClusterReconciler) Reconcile(ctx context.Context, request ctrl.Request)
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.DnsmasqEnabled) {
 		r.Log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
 
-	restartDnsmasq := instance.Spec.OperatorFlags.GetSimpleBoolean(restartDnsmasqEnabled)
+	restartDnsmasq := instance.Spec.OperatorFlags.GetSimpleBoolean(operator.RestartDnsmasqEnabled)
 	if restartDnsmasq {
 		r.Log.Debug("restartDnsmasq is enabled")
 	}
diff --git a/pkg/operator/controllers/dnsmasq/cluster_controller_test.go b/pkg/operator/controllers/dnsmasq/cluster_controller_test.go
index f2830ac5cb3..3239641acf8 100644
--- a/pkg/operator/controllers/dnsmasq/cluster_controller_test.go
+++ b/pkg/operator/controllers/dnsmasq/cluster_controller_test.go
@@ -17,6 +17,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	mock_dynamichelper "github.com/Azure/ARO-RP/pkg/util/mocks/dynamichelper"
 	utilconditions "github.com/Azure/ARO-RP/test/util/conditions"
@@ -59,7 +60,7 @@ func TestClusterReconciler(t *testing.T) {
 					},
 					Spec: arov1alpha1.ClusterSpec{
 						OperatorFlags: arov1alpha1.OperatorFlags{
-							controllerEnabled: "false",
+							operator.DnsmasqEnabled: operator.FlagFalse,
 						},
 					},
 				},
@@ -87,7 +88,7 @@ func TestClusterReconciler(t *testing.T) {
 					},
 					Spec: arov1alpha1.ClusterSpec{
 						OperatorFlags: arov1alpha1.OperatorFlags{
-							controllerEnabled: "true",
+							operator.DnsmasqEnabled: operator.FlagTrue,
 						},
 					},
 				},
@@ -109,7 +110,7 @@ func TestClusterReconciler(t *testing.T) {
 					},
 					Spec: arov1alpha1.ClusterSpec{
 						OperatorFlags: arov1alpha1.OperatorFlags{
-							controllerEnabled: "true",
+							operator.DnsmasqEnabled: operator.FlagTrue,
 						},
 					},
 				},
diff --git a/pkg/operator/controllers/dnsmasq/machineconfig_controller.go b/pkg/operator/controllers/dnsmasq/machineconfig_controller.go
index b68cc29cd28..3f0fe88f71d 100644
--- a/pkg/operator/controllers/dnsmasq/machineconfig_controller.go
+++ b/pkg/operator/controllers/dnsmasq/machineconfig_controller.go
@@ -15,6 +15,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 	"github.com/Azure/ARO-RP/pkg/util/dynamichelper"
 )
@@ -50,12 +51,12 @@ func (r *MachineConfigReconciler) Reconcile(ctx context.Context, request ctrl.Re
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.DnsmasqEnabled) {
 		r.Log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
 
-	if instance.Spec.OperatorFlags.GetSimpleBoolean(restartDnsmasqEnabled) {
+	if instance.Spec.OperatorFlags.GetSimpleBoolean(operator.RestartDnsmasqEnabled) {
 		r.Log.Debug("restart dnsmasq machineconfig enabled")
 	}
 
@@ -81,7 +82,7 @@ func (r *MachineConfigReconciler) Reconcile(ctx context.Context, request ctrl.Re
 		return reconcile.Result{}, nil
 	}
 
-	err = reconcileMachineConfigs(ctx, instance, r.dh, instance.Spec.OperatorFlags.GetSimpleBoolean(restartDnsmasqEnabled), *mcp)
+	err = reconcileMachineConfigs(ctx, instance, r.dh, instance.Spec.OperatorFlags.GetSimpleBoolean(operator.RestartDnsmasqEnabled), *mcp)
 	if err != nil {
 		r.Log.Error(err)
 		r.SetDegraded(ctx, err)
diff --git a/pkg/operator/controllers/dnsmasq/machineconfig_controller_test.go b/pkg/operator/controllers/dnsmasq/machineconfig_controller_test.go
index e47638d4f92..318da59a958 100644
--- a/pkg/operator/controllers/dnsmasq/machineconfig_controller_test.go
+++ b/pkg/operator/controllers/dnsmasq/machineconfig_controller_test.go
@@ -18,6 +18,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	mock_dynamichelper "github.com/Azure/ARO-RP/pkg/util/mocks/dynamichelper"
 	utilconditions "github.com/Azure/ARO-RP/test/util/conditions"
@@ -59,7 +60,7 @@ func TestMachineConfigReconciler(t *testing.T) {
 					},
 					Spec: arov1alpha1.ClusterSpec{
 						OperatorFlags: arov1alpha1.OperatorFlags{
-							controllerEnabled: "false",
+							operator.DnsmasqEnabled: operator.FlagFalse,
 						},
 					},
 				},
@@ -87,7 +88,7 @@ func TestMachineConfigReconciler(t *testing.T) {
 					},
 					Spec: arov1alpha1.ClusterSpec{
 						OperatorFlags: arov1alpha1.OperatorFlags{
-							controllerEnabled: "true",
+							operator.DnsmasqEnabled: "true",
 						},
 					},
 				},
@@ -112,7 +113,7 @@ func TestMachineConfigReconciler(t *testing.T) {
 					},
 					Spec: arov1alpha1.ClusterSpec{
 						OperatorFlags: arov1alpha1.OperatorFlags{
-							controllerEnabled: "true",
+							operator.DnsmasqEnabled: "true",
 						},
 					},
 				},
diff --git a/pkg/operator/controllers/dnsmasq/machineconfigpool_controller.go b/pkg/operator/controllers/dnsmasq/machineconfigpool_controller.go
index 907cf79bf06..c1e9d511d0c 100644
--- a/pkg/operator/controllers/dnsmasq/machineconfigpool_controller.go
+++ b/pkg/operator/controllers/dnsmasq/machineconfigpool_controller.go
@@ -14,6 +14,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 	"github.com/Azure/ARO-RP/pkg/util/dynamichelper"
 )
@@ -47,12 +48,12 @@ func (r *MachineConfigPoolReconciler) Reconcile(ctx context.Context, request ctr
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.DnsmasqEnabled) {
 		r.Log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
 
-	restartDnsmasq := instance.Spec.OperatorFlags.GetSimpleBoolean(restartDnsmasqEnabled)
+	restartDnsmasq := instance.Spec.OperatorFlags.GetSimpleBoolean(operator.RestartDnsmasqEnabled)
 	if restartDnsmasq {
 		r.Log.Debug("restart dnsmasq machineconfig enabled")
 	}
diff --git a/pkg/operator/controllers/dnsmasq/machineconfigpool_controller_test.go b/pkg/operator/controllers/dnsmasq/machineconfigpool_controller_test.go
index f6d0ee32cbb..4eb50a02c1b 100644
--- a/pkg/operator/controllers/dnsmasq/machineconfigpool_controller_test.go
+++ b/pkg/operator/controllers/dnsmasq/machineconfigpool_controller_test.go
@@ -18,6 +18,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	mock_dynamichelper "github.com/Azure/ARO-RP/pkg/util/mocks/dynamichelper"
 	utilconditions "github.com/Azure/ARO-RP/test/util/conditions"
@@ -60,7 +61,7 @@ func TestMachineConfigPoolReconciler(t *testing.T) {
 					},
 					Spec: arov1alpha1.ClusterSpec{
 						OperatorFlags: arov1alpha1.OperatorFlags{
-							controllerEnabled: "false",
+							operator.DnsmasqEnabled: operator.FlagFalse,
 						},
 					},
 				},
@@ -87,7 +88,7 @@ func TestMachineConfigPoolReconciler(t *testing.T) {
 					},
 					Spec: arov1alpha1.ClusterSpec{
 						OperatorFlags: arov1alpha1.OperatorFlags{
-							controllerEnabled: "true",
+							operator.DnsmasqEnabled: operator.FlagTrue,
 						},
 					},
 				},
@@ -112,7 +113,7 @@ func TestMachineConfigPoolReconciler(t *testing.T) {
 					},
 					Spec: arov1alpha1.ClusterSpec{
 						OperatorFlags: arov1alpha1.OperatorFlags{
-							controllerEnabled: "true",
+							operator.DnsmasqEnabled: operator.FlagTrue,
 						},
 					},
 				},
diff --git a/pkg/operator/controllers/genevalogging/genevalogging_controller.go b/pkg/operator/controllers/genevalogging/genevalogging_controller.go
index 15ee6626e50..aea57646689 100644
--- a/pkg/operator/controllers/genevalogging/genevalogging_controller.go
+++ b/pkg/operator/controllers/genevalogging/genevalogging_controller.go
@@ -26,7 +26,6 @@ import (
 const (
 	ControllerName = "GenevaLogging"
 
-	controllerEnabled = "aro.genevalogging.enabled"
 	// full pullspec of fluentbit image
 	controllerFluentbitPullSpec = "aro.genevalogging.fluentbit.pullSpec"
 	// full pullspec of mdsd image
@@ -93,7 +92,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.GenevaLoggingEnabled) {
 		r.Log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/genevalogging/genevalogging_test.go b/pkg/operator/controllers/genevalogging/genevalogging_test.go
index 298657f6537..22435409655 100644
--- a/pkg/operator/controllers/genevalogging/genevalogging_test.go
+++ b/pkg/operator/controllers/genevalogging/genevalogging_test.go
@@ -74,7 +74,7 @@ func TestGenevaLoggingDaemonset(t *testing.T) {
 		{
 			name: "no flags given",
 			operatorFlags: arov1alpha1.OperatorFlags{
-				controllerEnabled: "true",
+				operator.GenevaLoggingEnabled: operator.FlagTrue,
 			},
 			validateDaemonset: func(d *appsv1.DaemonSet) (errs []error) {
 				if len(d.Spec.Template.Spec.Containers) != 2 {
@@ -110,8 +110,8 @@ func TestGenevaLoggingDaemonset(t *testing.T) {
 		{
 			name: "fluentbit changed",
 			operatorFlags: arov1alpha1.OperatorFlags{
-				controllerEnabled:           "true",
-				controllerFluentbitPullSpec: "otherurl/fluentbit",
+				operator.GenevaLoggingEnabled: operator.FlagTrue,
+				controllerFluentbitPullSpec:   "otherurl/fluentbit",
 			},
 			validateDaemonset: func(d *appsv1.DaemonSet) (errs []error) {
 				if len(d.Spec.Template.Spec.Containers) != 2 {
@@ -147,8 +147,8 @@ func TestGenevaLoggingDaemonset(t *testing.T) {
 		{
 			name: "mdsd changed",
 			operatorFlags: arov1alpha1.OperatorFlags{
-				controllerEnabled:      "true",
-				controllerMDSDPullSpec: "otherurl/mdsd",
+				operator.GenevaLoggingEnabled: operator.FlagTrue,
+				controllerMDSDPullSpec:        "otherurl/mdsd",
 			},
 			validateDaemonset: func(d *appsv1.DaemonSet) (errs []error) {
 				if len(d.Spec.Template.Spec.Containers) != 2 {
@@ -261,7 +261,7 @@ func TestGenevaConfigMapResources(t *testing.T) {
 		{
 			name: "enabled",
 			operatorFlags: arov1alpha1.OperatorFlags{
-				controllerEnabled: "true",
+				operator.GenevaLoggingEnabled: operator.FlagTrue,
 			},
 			validate: func(r []runtime.Object) (errs []error) {
 				maps := make(map[string]*corev1.ConfigMap)
diff --git a/pkg/operator/controllers/guardrails/guardrails_config.go b/pkg/operator/controllers/guardrails/guardrails_config.go
index 5a5160b4d51..be4f4cf1bf7 100644
--- a/pkg/operator/controllers/guardrails/guardrails_config.go
+++ b/pkg/operator/controllers/guardrails/guardrails_config.go
@@ -20,9 +20,7 @@ import (
 
 const (
 	ControllerName               = "GuardRails"
-	controllerEnabled            = "aro.guardrails.enabled"
 	controllerNamespace          = "aro.guardrails.namespace"
-	controllerManaged            = "aro.guardrails.deploy.managed"
 	controllerPullSpec           = "aro.guardrails.deploy.pullspec"
 	controllerManagerRequestsCPU = "aro.guardrails.deploy.manager.requests.cpu"
 	controllerManagerRequestsMem = "aro.guardrails.deploy.manager.requests.mem"
diff --git a/pkg/operator/controllers/guardrails/guardrails_controller.go b/pkg/operator/controllers/guardrails/guardrails_controller.go
index a09efebddf1..95399eb745c 100644
--- a/pkg/operator/controllers/guardrails/guardrails_controller.go
+++ b/pkg/operator/controllers/guardrails/guardrails_controller.go
@@ -19,6 +19,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/guardrails/config"
 	"github.com/Azure/ARO-RP/pkg/util/deployer"
@@ -66,14 +67,14 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 	}
 
 	// how to handle the enable/disable sequence of enabled and managed?
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.GuardrailsEnabled) {
 		r.log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
 
 	r.log.Debug("running")
 
-	managed := instance.Spec.OperatorFlags.GetWithDefault(controllerManaged, "")
+	managed := instance.Spec.OperatorFlags.GetWithDefault(operator.GuardrailsDeployManaged, "")
 
 	// If enabled and managed=true, install GuardRails
 	// If enabled and managed=false, remove the GuardRails deployment
diff --git a/pkg/operator/controllers/guardrails/guardrails_controller_test.go b/pkg/operator/controllers/guardrails/guardrails_controller_test.go
index 1f3ec1d4a08..ceb3b56051a 100644
--- a/pkg/operator/controllers/guardrails/guardrails_controller_test.go
+++ b/pkg/operator/controllers/guardrails/guardrails_controller_test.go
@@ -15,6 +15,7 @@ import (
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/guardrails/config"
 	mock_deployer "github.com/Azure/ARO-RP/pkg/util/mocks/deployer"
@@ -32,26 +33,26 @@ func TestGuardRailsReconciler(t *testing.T) {
 		{
 			name: "disabled",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "false",
-				controllerManaged:  "false",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.GuardrailsEnabled:       operator.FlagFalse,
+				operator.GuardrailsDeployManaged: operator.FlagFalse,
+				controllerPullSpec:               "wonderfulPullspec",
 			},
 		},
 		{
 			name: "managed",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:            "true",
-				controllerManaged:            "true",
-				controllerPullSpec:           "wonderfulPullspec",
-				controllerNamespace:          "wonderful-namespace",
-				controllerManagerRequestsCPU: "10m",
-				controllerManagerLimitCPU:    "100m",
-				controllerManagerRequestsMem: "512Mi",
-				controllerManagerLimitMem:    "512Mi",
-				controllerAuditRequestsCPU:   "10m",
-				controllerAuditLimitCPU:      "100m",
-				controllerAuditRequestsMem:   "512Mi",
-				controllerAuditLimitMem:      "512Mi",
+				operator.GuardrailsEnabled:       operator.FlagTrue,
+				operator.GuardrailsDeployManaged: operator.FlagTrue,
+				controllerPullSpec:               "wonderfulPullspec",
+				controllerNamespace:              "wonderful-namespace",
+				controllerManagerRequestsCPU:     "10m",
+				controllerManagerLimitCPU:        "100m",
+				controllerManagerRequestsMem:     "512Mi",
+				controllerManagerLimitMem:        "512Mi",
+				controllerAuditRequestsCPU:       "10m",
+				controllerAuditLimitCPU:          "100m",
+				controllerAuditRequestsMem:       "512Mi",
+				controllerAuditLimitMem:          "512Mi",
 			},
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
 				expectedConfig := &config.GuardRailsDeploymentConfig{
@@ -79,8 +80,8 @@ func TestGuardRailsReconciler(t *testing.T) {
 		{
 			name: "managed, no pullspec & namespace (uses default)",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled: "true",
-				controllerManaged: "true",
+				operator.GuardrailsEnabled:       operator.FlagTrue,
+				operator.GuardrailsDeployManaged: operator.FlagTrue,
 			},
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
 				expectedConfig := &config.GuardRailsDeploymentConfig{
@@ -108,9 +109,9 @@ func TestGuardRailsReconciler(t *testing.T) {
 		{
 			name: "managed, GuardRails does not become ready",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "true",
-				controllerManaged:  "true",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.GuardrailsEnabled:       operator.FlagTrue,
+				operator.GuardrailsDeployManaged: operator.FlagTrue,
+				controllerPullSpec:               "wonderfulPullspec",
 			},
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
 				expectedConfig := &config.GuardRailsDeploymentConfig{
@@ -138,9 +139,9 @@ func TestGuardRailsReconciler(t *testing.T) {
 		{
 			name: "managed, CreateOrUpdate() fails",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "true",
-				controllerManaged:  "true",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.GuardrailsEnabled:       operator.FlagTrue,
+				operator.GuardrailsDeployManaged: operator.FlagTrue,
+				controllerPullSpec:               "wonderfulPullspec",
 			},
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
 				md.EXPECT().CreateOrUpdate(gomock.Any(), cluster, gomock.AssignableToTypeOf(&config.GuardRailsDeploymentConfig{})).Return(errors.New("failed ensure"))
@@ -150,9 +151,9 @@ func TestGuardRailsReconciler(t *testing.T) {
 		{
 			name: "managed=false (removal)",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "true",
-				controllerManaged:  "false",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.GuardrailsEnabled:       operator.FlagTrue,
+				operator.GuardrailsDeployManaged: operator.FlagFalse,
+				controllerPullSpec:               "wonderfulPullspec",
 			},
 			cleanupNeeded: true,
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
@@ -162,9 +163,9 @@ func TestGuardRailsReconciler(t *testing.T) {
 		{
 			name: "managed=false (removal), Remove() fails",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "true",
-				controllerManaged:  "false",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.GuardrailsEnabled:       operator.FlagTrue,
+				operator.GuardrailsDeployManaged: operator.FlagFalse,
+				controllerPullSpec:               "wonderfulPullspec",
 			},
 			cleanupNeeded: true,
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
@@ -175,9 +176,9 @@ func TestGuardRailsReconciler(t *testing.T) {
 		{
 			name: "managed=blank (no action)",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "true",
-				controllerManaged:  "",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.GuardrailsEnabled:       operator.FlagTrue,
+				operator.GuardrailsDeployManaged: "",
+				controllerPullSpec:               "wonderfulPullspec",
 			},
 		},
 	}
diff --git a/pkg/operator/controllers/imageconfig/image_controller.go b/pkg/operator/controllers/imageconfig/image_controller.go
index c9275053478..0c2e68699cb 100644
--- a/pkg/operator/controllers/imageconfig/image_controller.go
+++ b/pkg/operator/controllers/imageconfig/image_controller.go
@@ -19,6 +19,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient"
@@ -26,9 +27,6 @@ import (
 
 const (
 	ControllerName = "ImageConfig"
-
-	controllerEnabled = "aro.imageconfig.enabled"
-
 	// Kubernetes object name
 	imageConfigResource = "cluster"
 )
@@ -58,7 +56,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.ImageConfigEnabled) {
 		r.Log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/imageconfig/image_controller_test.go b/pkg/operator/controllers/imageconfig/image_controller_test.go
index c621f5c7795..4287bce5576 100644
--- a/pkg/operator/controllers/imageconfig/image_controller_test.go
+++ b/pkg/operator/controllers/imageconfig/image_controller_test.go
@@ -6,7 +6,6 @@ package imageconfig
 import (
 	"context"
 	"reflect"
-	"strconv"
 	"testing"
 	"time"
 
@@ -18,6 +17,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/cmp"
@@ -53,7 +53,7 @@ func TestImageConfigReconciler(t *testing.T) {
 					ACRDomain:     "arointsvc.azurecr.io",
 					AZEnvironment: azureclient.PublicCloud.Environment.Name,
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: strconv.FormatBool(false),
+						operator.ImageConfigEnabled: operator.FlagFalse,
 					},
 					Location: "eastus",
 				},
@@ -140,7 +140,7 @@ func TestImageConfigReconciler(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{Name: arov1alpha1.SingletonClusterName},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: strconv.FormatBool(true),
+						operator.ImageConfigEnabled: operator.FlagTrue,
 					},
 				},
 				Status: arov1alpha1.ClusterStatus{
@@ -211,7 +211,7 @@ func TestImageConfigReconciler(t *testing.T) {
 					ACRDomain:     "fakesvc.azurecr.io",
 					AZEnvironment: azureclient.PublicCloud.Environment.Name,
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: strconv.FormatBool(true),
+						operator.ImageConfigEnabled: operator.FlagTrue,
 					},
 					Location: "anyplace",
 				},
@@ -242,7 +242,7 @@ func TestImageConfigReconciler(t *testing.T) {
 					ACRDomain:     "fakesvc.azurecr.us",
 					AZEnvironment: azureclient.USGovernmentCloud.Environment.Name,
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: strconv.FormatBool(true),
+						operator.ImageConfigEnabled: operator.FlagTrue,
 					},
 					Location: "anyplace",
 				},
@@ -275,7 +275,7 @@ func TestImageConfigReconciler(t *testing.T) {
 					ACRDomain:     "arointsvc.azurecr.io",
 					AZEnvironment: azureclient.PublicCloud.Environment.Name,
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: strconv.FormatBool(true),
+						operator.ImageConfigEnabled: operator.FlagTrue,
 					},
 					Location: "eastus",
 				},
diff --git a/pkg/operator/controllers/ingress/ingress_controller.go b/pkg/operator/controllers/ingress/ingress_controller.go
index 1f4b618ef64..c575b67ffd0 100644
--- a/pkg/operator/controllers/ingress/ingress_controller.go
+++ b/pkg/operator/controllers/ingress/ingress_controller.go
@@ -16,14 +16,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 )
 
 const (
-	ControllerName = "IngressControllerARO"
-
-	controllerEnabled                   = "aro.ingress.enabled"
+	ControllerName                      = "IngressControllerARO"
 	openshiftIngressControllerNamespace = "openshift-ingress-operator"
 	openshiftIngressControllerName      = "default"
 	minimumReplicas                     = 2
@@ -51,7 +50,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.IngressEnabled) {
 		r.Log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/ingress/ingress_controller_test.go b/pkg/operator/controllers/ingress/ingress_controller_test.go
index 132f600b91b..fe0cd432432 100644
--- a/pkg/operator/controllers/ingress/ingress_controller_test.go
+++ b/pkg/operator/controllers/ingress/ingress_controller_test.go
@@ -16,6 +16,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	_ "github.com/Azure/ARO-RP/pkg/util/scheme"
 	utilconditions "github.com/Azure/ARO-RP/test/util/conditions"
@@ -36,7 +37,7 @@ func TestReconciler(t *testing.T) {
 			},
 			Spec: arov1alpha1.ClusterSpec{
 				OperatorFlags: arov1alpha1.OperatorFlags{
-					"aro.ingress.enabled": controllerEnabledFlag,
+					operator.IngressEnabled: controllerEnabledFlag,
 				},
 			},
 		}
diff --git a/pkg/operator/controllers/machine/machine_controller.go b/pkg/operator/controllers/machine/machine_controller.go
index 3f40c93e703..1a9c37ff2f8 100644
--- a/pkg/operator/controllers/machine/machine_controller.go
+++ b/pkg/operator/controllers/machine/machine_controller.go
@@ -15,14 +15,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/util/conditions"
 )
 
 const (
 	ControllerName = "Machine"
-
-	controllerEnabled = "aro.machine.enabled"
 )
 
 type Reconciler struct {
@@ -50,7 +49,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.MachineEnabled) {
 		r.log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/machine/machine_controller_test.go b/pkg/operator/controllers/machine/machine_controller_test.go
index 828eaedd72c..aad4984ff1e 100644
--- a/pkg/operator/controllers/machine/machine_controller_test.go
+++ b/pkg/operator/controllers/machine/machine_controller_test.go
@@ -20,6 +20,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	_ "github.com/Azure/ARO-RP/pkg/util/scheme"
 )
@@ -154,7 +155,7 @@ func TestMachineReconciler(t *testing.T) {
 				Status:     arov1alpha1.ClusterStatus{Conditions: []operatorv1.OperatorCondition{}},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: "true",
+						operator.MachineEnabled: operator.FlagTrue,
 					},
 				},
 			}
diff --git a/pkg/operator/controllers/machinehealthcheck/machinehealthcheck_controller.go b/pkg/operator/controllers/machinehealthcheck/machinehealthcheck_controller.go
index 8b0f7e73cd4..4f67f7449f8 100644
--- a/pkg/operator/controllers/machinehealthcheck/machinehealthcheck_controller.go
+++ b/pkg/operator/controllers/machinehealthcheck/machinehealthcheck_controller.go
@@ -24,6 +24,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 	"github.com/Azure/ARO-RP/pkg/util/dynamichelper"
@@ -37,8 +38,6 @@ var mhcremediationalertYaml []byte
 
 const (
 	ControllerName      string = "MachineHealthCheck"
-	managed             string = "aro.machinehealthcheck.managed"
-	enabled             string = "aro.machinehealthcheck.enabled"
 	MHCPausedAnnotation string = "cluster.x-k8s.io/paused"
 )
 
@@ -68,13 +67,13 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(enabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.MachineHealthCheckEnabled) {
 		r.Log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
 
 	r.Log.Debug("running")
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(managed) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.MachineHealthCheckManaged) {
 		err := r.dh.EnsureDeleted(ctx, "MachineHealthCheck", "openshift-machine-api", "aro-machinehealthcheck")
 		if err != nil {
 			r.Log.Error(err)
diff --git a/pkg/operator/controllers/machinehealthcheck/machinehealthcheck_controller_test.go b/pkg/operator/controllers/machinehealthcheck/machinehealthcheck_controller_test.go
index 0394dbddc4a..d47478aab21 100644
--- a/pkg/operator/controllers/machinehealthcheck/machinehealthcheck_controller_test.go
+++ b/pkg/operator/controllers/machinehealthcheck/machinehealthcheck_controller_test.go
@@ -6,7 +6,6 @@ package machinehealthcheck
 import (
 	"context"
 	"errors"
-	"strconv"
 	"testing"
 	"time"
 
@@ -20,6 +19,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	mock_dynamichelper "github.com/Azure/ARO-RP/pkg/util/mocks/dynamichelper"
 	_ "github.com/Azure/ARO-RP/pkg/util/scheme"
@@ -82,7 +82,7 @@ func TestMachineHealthCheckReconciler(t *testing.T) {
 				},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						enabled: strconv.FormatBool(false),
+						operator.MachineHealthCheckEnabled: operator.FlagFalse,
 					},
 				},
 				Status: arov1alpha1.ClusterStatus{
@@ -104,8 +104,8 @@ func TestMachineHealthCheckReconciler(t *testing.T) {
 				},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						enabled: strconv.FormatBool(true),
-						managed: strconv.FormatBool(false),
+						operator.MachineHealthCheckEnabled: operator.FlagTrue,
+						operator.MachineHealthCheckManaged: operator.FlagFalse,
 					},
 				},
 				Status: arov1alpha1.ClusterStatus{
@@ -127,8 +127,8 @@ func TestMachineHealthCheckReconciler(t *testing.T) {
 				},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						enabled: strconv.FormatBool(true),
-						managed: strconv.FormatBool(false),
+						operator.MachineHealthCheckEnabled: operator.FlagTrue,
+						operator.MachineHealthCheckManaged: operator.FlagFalse,
 					},
 				},
 				Status: arov1alpha1.ClusterStatus{
@@ -159,8 +159,8 @@ func TestMachineHealthCheckReconciler(t *testing.T) {
 				},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						enabled: strconv.FormatBool(true),
-						managed: strconv.FormatBool(false),
+						operator.MachineHealthCheckEnabled: operator.FlagTrue,
+						operator.MachineHealthCheckManaged: operator.FlagFalse,
 					},
 				},
 				Status: arov1alpha1.ClusterStatus{
@@ -192,8 +192,8 @@ func TestMachineHealthCheckReconciler(t *testing.T) {
 				},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						enabled: strconv.FormatBool(true),
-						managed: strconv.FormatBool(true),
+						operator.MachineHealthCheckEnabled: operator.FlagTrue,
+						operator.MachineHealthCheckManaged: operator.FlagTrue,
 					},
 				},
 			},
@@ -211,8 +211,8 @@ func TestMachineHealthCheckReconciler(t *testing.T) {
 				},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						enabled: strconv.FormatBool(true),
-						managed: strconv.FormatBool(true),
+						operator.MachineHealthCheckEnabled: operator.FlagTrue,
+						operator.MachineHealthCheckManaged: operator.FlagTrue,
 					},
 				},
 			},
@@ -230,8 +230,8 @@ func TestMachineHealthCheckReconciler(t *testing.T) {
 				},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						enabled: strconv.FormatBool(true),
-						managed: strconv.FormatBool(true),
+						operator.MachineHealthCheckEnabled: operator.FlagTrue,
+						operator.MachineHealthCheckManaged: operator.FlagTrue,
 					},
 				},
 				Status: arov1alpha1.ClusterStatus{
diff --git a/pkg/operator/controllers/machineset/machineset_controller.go b/pkg/operator/controllers/machineset/machineset_controller.go
index 3aba44a5e25..1ab53e7aade 100644
--- a/pkg/operator/controllers/machineset/machineset_controller.go
+++ b/pkg/operator/controllers/machineset/machineset_controller.go
@@ -18,13 +18,12 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 )
 
 const (
 	ControllerName = "MachineSet"
-
-	ControllerEnabled = "aro.machineset.enabled"
 )
 
 type Reconciler struct {
@@ -48,7 +47,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(ControllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.MachineSetEnabled) {
 		r.Log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/machineset/machineset_controller_test.go b/pkg/operator/controllers/machineset/machineset_controller_test.go
index f58e49797df..257a8c7511d 100644
--- a/pkg/operator/controllers/machineset/machineset_controller_test.go
+++ b/pkg/operator/controllers/machineset/machineset_controller_test.go
@@ -19,6 +19,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/util/cmp"
 	_ "github.com/Azure/ARO-RP/pkg/util/scheme"
@@ -202,7 +203,7 @@ func TestReconciler(t *testing.T) {
 				Spec: arov1alpha1.ClusterSpec{
 					InfraID: "aro-fake",
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						ControllerEnabled: strconv.FormatBool(tt.featureFlag),
+						operator.MachineSetEnabled: strconv.FormatBool(tt.featureFlag),
 					},
 				},
 				Status: arov1alpha1.ClusterStatus{
diff --git a/pkg/operator/controllers/monitoring/monitoring_controller.go b/pkg/operator/controllers/monitoring/monitoring_controller.go
index 4d8a23940bb..8b5867933ae 100644
--- a/pkg/operator/controllers/monitoring/monitoring_controller.go
+++ b/pkg/operator/controllers/monitoring/monitoring_controller.go
@@ -24,14 +24,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
 	"github.com/Azure/ARO-RP/pkg/api"
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 )
 
 const (
 	ControllerName = "Monitoring"
-
-	controllerEnabled = "aro.monitoring.enabled"
 )
 
 var (
@@ -78,7 +77,7 @@ func (r *MonitoringReconciler) Reconcile(ctx context.Context, request ctrl.Reque
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.MonitoringEnabled) {
 		r.Log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/monitoring/monitoring_controller_test.go b/pkg/operator/controllers/monitoring/monitoring_controller_test.go
index 8fae53d4fd3..1b0065efc46 100644
--- a/pkg/operator/controllers/monitoring/monitoring_controller_test.go
+++ b/pkg/operator/controllers/monitoring/monitoring_controller_test.go
@@ -19,6 +19,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 	"github.com/Azure/ARO-RP/pkg/util/cmp"
@@ -156,7 +157,7 @@ somethingElse:
 				},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: "true",
+						operator.MonitoringEnabled: operator.FlagTrue,
 					},
 				},
 			}
@@ -290,7 +291,7 @@ func TestReconcilePVC(t *testing.T) {
 				},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: "true",
+						operator.MonitoringEnabled: operator.FlagTrue,
 					},
 				},
 			}
diff --git a/pkg/operator/controllers/muo/muo_controller.go b/pkg/operator/controllers/muo/muo_controller.go
index e62036d5055..81a80b208e3 100644
--- a/pkg/operator/controllers/muo/muo_controller.go
+++ b/pkg/operator/controllers/muo/muo_controller.go
@@ -22,6 +22,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/muo/config"
 	"github.com/Azure/ARO-RP/pkg/util/deployer"
@@ -31,10 +32,7 @@ import (
 )
 
 const (
-	ControllerName = "ManagedUpgradeOperator"
-
-	controllerEnabled                = "rh.srep.muo.enabled"
-	controllerManaged                = "rh.srep.muo.managed"
+	ControllerName                   = "ManagedUpgradeOperator"
 	controllerPullSpec               = "rh.srep.muo.deploy.pullspec"
 	controllerForceLocalOnly         = "rh.srep.muo.deploy.forceLocalOnly"
 	controllerOcmBaseURL             = "rh.srep.muo.deploy.ocmBaseUrl"
@@ -85,14 +83,14 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.MuoEnabled) {
 		r.log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
 
 	r.log.Debug("running")
 
-	managed := instance.Spec.OperatorFlags.GetWithDefault(controllerManaged, "")
+	managed := instance.Spec.OperatorFlags.GetWithDefault(operator.MuoManaged, "")
 
 	// If enabled and managed=true, install MUO
 	// If enabled and managed=false, remove the MUO deployment
diff --git a/pkg/operator/controllers/muo/muo_controller_test.go b/pkg/operator/controllers/muo/muo_controller_test.go
index 65378aea751..e45c09c46f4 100644
--- a/pkg/operator/controllers/muo/muo_controller_test.go
+++ b/pkg/operator/controllers/muo/muo_controller_test.go
@@ -16,6 +16,7 @@ import (
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/muo/config"
 	mock_deployer "github.com/Azure/ARO-RP/pkg/util/mocks/deployer"
@@ -36,17 +37,17 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "disabled",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "false",
-				controllerManaged:  "false",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.MuoEnabled: operator.FlagFalse,
+				operator.MuoManaged: operator.FlagFalse,
+				controllerPullSpec:  "wonderfulPullspec",
 			},
 		},
 		{
 			name: "managed",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "true",
-				controllerManaged:  "true",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.MuoEnabled: operator.FlagTrue,
+				operator.MuoManaged: operator.FlagTrue,
+				controllerPullSpec:  "wonderfulPullspec",
 			},
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
 				expectedConfig := &config.MUODeploymentConfig{
@@ -60,8 +61,8 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed, no pullspec (uses default)",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled: "true",
-				controllerManaged: "true",
+				operator.MuoEnabled: operator.FlagTrue,
+				operator.MuoManaged: operator.FlagTrue,
 			},
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
 				expectedConfig := &config.MUODeploymentConfig{
@@ -75,8 +76,8 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed, OCM allowed but pull secret entirely missing",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:        "true",
-				controllerManaged:        "true",
+				operator.MuoEnabled:      operator.FlagTrue,
+				operator.MuoManaged:      operator.FlagTrue,
 				controllerForceLocalOnly: "false",
 				controllerPullSpec:       "wonderfulPullspec",
 			},
@@ -92,8 +93,8 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed, OCM allowed but empty pullsecret",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:        "true",
-				controllerManaged:        "true",
+				operator.MuoEnabled:      operator.FlagTrue,
+				operator.MuoManaged:      operator.FlagTrue,
 				controllerForceLocalOnly: "false",
 				controllerPullSpec:       "wonderfulPullspec",
 			},
@@ -110,8 +111,8 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed, OCM allowed but mangled pullsecret",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:        "true",
-				controllerManaged:        "true",
+				operator.MuoEnabled:      operator.FlagTrue,
+				operator.MuoManaged:      operator.FlagTrue,
 				controllerForceLocalOnly: "false",
 				controllerPullSpec:       "wonderfulPullspec",
 			},
@@ -128,8 +129,8 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed, OCM connected mode",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:        "true",
-				controllerManaged:        "true",
+				operator.MuoEnabled:      operator.FlagTrue,
+				operator.MuoManaged:      operator.FlagTrue,
 				controllerForceLocalOnly: "false",
 				controllerPullSpec:       "wonderfulPullspec",
 			},
@@ -147,8 +148,8 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed, OCM connected mode, custom OCM URL",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:        "true",
-				controllerManaged:        "true",
+				operator.MuoEnabled:      operator.FlagTrue,
+				operator.MuoManaged:      operator.FlagTrue,
 				controllerForceLocalOnly: "false",
 				controllerOcmBaseURL:     "https://example.com",
 				controllerPullSpec:       "wonderfulPullspec",
@@ -167,8 +168,8 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed, pull secret exists, OCM disabled",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:        "true",
-				controllerManaged:        "true",
+				operator.MuoEnabled:      operator.FlagTrue,
+				operator.MuoManaged:      operator.FlagTrue,
 				controllerForceLocalOnly: "true",
 				controllerPullSpec:       "wonderfulPullspec",
 			},
@@ -185,9 +186,9 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed, MUO does not become ready",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "true",
-				controllerManaged:  "true",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.MuoEnabled: operator.FlagTrue,
+				operator.MuoManaged: operator.FlagTrue,
+				controllerPullSpec:  "wonderfulPullspec",
 			},
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
 				expectedConfig := &config.MUODeploymentConfig{
@@ -202,9 +203,9 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed, CreateOrUpdate() fails",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "true",
-				controllerManaged:  "true",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.MuoEnabled: operator.FlagTrue,
+				operator.MuoManaged: operator.FlagTrue,
+				controllerPullSpec:  "wonderfulPullspec",
 			},
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
 				md.EXPECT().CreateOrUpdate(gomock.Any(), cluster, gomock.AssignableToTypeOf(&config.MUODeploymentConfig{})).Return(errors.New("failed ensure"))
@@ -214,9 +215,9 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed=false (removal)",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "true",
-				controllerManaged:  "false",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.MuoEnabled: operator.FlagTrue,
+				operator.MuoManaged: operator.FlagFalse,
+				controllerPullSpec:  "wonderfulPullspec",
 			},
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
 				md.EXPECT().Remove(gomock.Any(), gomock.Any()).Return(nil)
@@ -225,9 +226,9 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed=false (removal), Remove() fails",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "true",
-				controllerManaged:  "false",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.MuoEnabled: operator.FlagTrue,
+				operator.MuoManaged: operator.FlagFalse,
+				controllerPullSpec:  "wonderfulPullspec",
 			},
 			mocks: func(md *mock_deployer.MockDeployer, cluster *arov1alpha1.Cluster) {
 				md.EXPECT().Remove(gomock.Any(), gomock.Any()).Return(errors.New("failed delete"))
@@ -237,9 +238,9 @@ func TestMUOReconciler(t *testing.T) {
 		{
 			name: "managed=blank (no action)",
 			flags: arov1alpha1.OperatorFlags{
-				controllerEnabled:  "true",
-				controllerManaged:  "",
-				controllerPullSpec: "wonderfulPullspec",
+				operator.MuoEnabled: operator.FlagTrue,
+				operator.MuoManaged: "",
+				controllerPullSpec:  "wonderfulPullspec",
 			},
 		},
 	}
diff --git a/pkg/operator/controllers/node/node_controller.go b/pkg/operator/controllers/node/node_controller.go
index 1c0948314eb..d72c164fd0b 100644
--- a/pkg/operator/controllers/node/node_controller.go
+++ b/pkg/operator/controllers/node/node_controller.go
@@ -19,14 +19,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	"github.com/Azure/ARO-RP/pkg/operator/controllers/base"
 	"github.com/Azure/ARO-RP/pkg/util/ready"
 )
 
 const (
 	ControllerName = "Node"
-
-	controllerEnabled = "aro.nodedrainer.enabled"
 )
 
 // Reconciler spots nodes that look like they're stuck upgrading.  When this
@@ -55,7 +54,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.NodeDrainerEnabled) {
 		r.Log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/node/node_controller_test.go b/pkg/operator/controllers/node/node_controller_test.go
index 1b7411f34fa..488545ff159 100644
--- a/pkg/operator/controllers/node/node_controller_test.go
+++ b/pkg/operator/controllers/node/node_controller_test.go
@@ -18,6 +18,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/util/cmp"
 	_ "github.com/Azure/ARO-RP/pkg/util/scheme"
@@ -415,7 +416,7 @@ func TestReconciler(t *testing.T) {
 					Spec: arov1alpha1.ClusterSpec{
 						InfraID: "aro-fake",
 						OperatorFlags: arov1alpha1.OperatorFlags{
-							controllerEnabled: strconv.FormatBool(tt.featureFlag),
+							operator.NodeDrainerEnabled: strconv.FormatBool(tt.featureFlag),
 						},
 					},
 				}
diff --git a/pkg/operator/controllers/pullsecret/pullsecret_controller.go b/pkg/operator/controllers/pullsecret/pullsecret_controller.go
index 3cfc8402113..b90400df1d1 100644
--- a/pkg/operator/controllers/pullsecret/pullsecret_controller.go
+++ b/pkg/operator/controllers/pullsecret/pullsecret_controller.go
@@ -35,9 +35,6 @@ import (
 
 const (
 	ControllerName = "PullSecret"
-
-	controllerEnabled = "aro.pullsecret.enabled"
-	controllerManaged = "aro.pullsecret.managed"
 )
 
 var pullSecretName = types.NamespacedName{Name: "pull-secret", Namespace: "openshift-config"}
@@ -73,7 +70,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.PullSecretEnabled) {
 		r.log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
@@ -87,7 +84,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 
 	// reconcile global pull secret
 	// detects if the global pull secret is broken and fixes it by using backup managed by ARO operator
-	if instance.Spec.OperatorFlags.GetSimpleBoolean(controllerManaged) {
+	if instance.Spec.OperatorFlags.GetSimpleBoolean(operator.PullSecretManaged) {
 		operatorSecret := &corev1.Secret{}
 		err = r.client.Get(ctx, types.NamespacedName{Namespace: operator.Namespace, Name: operator.SecretName}, operatorSecret)
 		if err != nil {
diff --git a/pkg/operator/controllers/pullsecret/pullsecret_controller_test.go b/pkg/operator/controllers/pullsecret/pullsecret_controller_test.go
index f99fd074877..4d02241b837 100644
--- a/pkg/operator/controllers/pullsecret/pullsecret_controller_test.go
+++ b/pkg/operator/controllers/pullsecret/pullsecret_controller_test.go
@@ -30,8 +30,8 @@ func TestPullSecretReconciler(t *testing.T) {
 		Status:     arov1alpha1.ClusterStatus{},
 		Spec: arov1alpha1.ClusterSpec{
 			OperatorFlags: arov1alpha1.OperatorFlags{
-				controllerEnabled: "true",
-				controllerManaged: "true",
+				operator.PullSecretEnabled: operator.FlagTrue,
+				operator.PullSecretManaged: operator.FlagTrue,
 			},
 		},
 	}
@@ -238,8 +238,8 @@ func TestPullSecretReconciler(t *testing.T) {
 				Status:     arov1alpha1.ClusterStatus{},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: "true",
-						controllerManaged: "false",
+						operator.PullSecretEnabled: operator.FlagTrue,
+						operator.PullSecretManaged: operator.FlagFalse,
 					},
 				},
 			},
@@ -271,8 +271,8 @@ func TestPullSecretReconciler(t *testing.T) {
 				Status:     arov1alpha1.ClusterStatus{},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: "true",
-						controllerManaged: "false",
+						operator.PullSecretEnabled: operator.FlagTrue,
+						operator.PullSecretManaged: operator.FlagFalse,
 					},
 				},
 			},
diff --git a/pkg/operator/controllers/rbac/rbac_controller.go b/pkg/operator/controllers/rbac/rbac_controller.go
index d2be5d9d380..36aa98fa82b 100644
--- a/pkg/operator/controllers/rbac/rbac_controller.go
+++ b/pkg/operator/controllers/rbac/rbac_controller.go
@@ -17,14 +17,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/util/dynamichelper"
 )
 
 const (
 	ControllerName = "RBAC"
-
-	controllerEnabled = "aro.rbac.enabled"
 )
 
 type Reconciler struct {
@@ -50,7 +49,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.RbacEnabled) {
 		r.log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/routefix/routefix_controller.go b/pkg/operator/controllers/routefix/routefix_controller.go
index 7e09caeaf99..68e144f9a68 100644
--- a/pkg/operator/controllers/routefix/routefix_controller.go
+++ b/pkg/operator/controllers/routefix/routefix_controller.go
@@ -21,6 +21,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/util/dynamichelper"
 	"github.com/Azure/ARO-RP/pkg/util/version"
@@ -28,8 +29,6 @@ import (
 
 const (
 	ControllerName = "RouteFix"
-
-	controllerEnabled = "aro.routefix.enabled"
 )
 
 // Reconciler is the controller struct
@@ -69,7 +68,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.RouteFixEnabled) {
 		r.log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/storageaccounts/storageaccount_controller.go b/pkg/operator/controllers/storageaccounts/storageaccount_controller.go
index f6ed4ce95ac..7b8c3c82d73 100644
--- a/pkg/operator/controllers/storageaccounts/storageaccount_controller.go
+++ b/pkg/operator/controllers/storageaccounts/storageaccount_controller.go
@@ -18,6 +18,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/storage"
@@ -27,8 +28,6 @@ import (
 
 const (
 	ControllerName = "StorageAccounts"
-
-	controllerEnabled = "aro.storageaccounts.enabled"
 )
 
 // Reconciler is the controller struct
@@ -67,7 +66,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.StorageAccountsEnabled) {
 		r.log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/storageaccounts/storageaccounts_test.go b/pkg/operator/controllers/storageaccounts/storageaccounts_test.go
index cdd73e7fed6..468751f1f1d 100644
--- a/pkg/operator/controllers/storageaccounts/storageaccounts_test.go
+++ b/pkg/operator/controllers/storageaccounts/storageaccounts_test.go
@@ -21,6 +21,7 @@ import (
 
 	"github.com/Azure/ARO-RP/pkg/api"
 	apisubnet "github.com/Azure/ARO-RP/pkg/api/util/subnet"
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	mock_storage "github.com/Azure/ARO-RP/pkg/util/mocks/azureclient/mgmt/storage"
 	mock_subnet "github.com/Azure/ARO-RP/pkg/util/mocks/subnet"
@@ -55,7 +56,7 @@ func getValidClusterInstance(operatorFlag bool) *arov1alpha1.Cluster {
 			Location:               location,
 			StorageSuffix:          storageSuffix,
 			OperatorFlags: arov1alpha1.OperatorFlags{
-				controllerEnabled: strconv.FormatBool(operatorFlag),
+				operator.StorageAccountsEnabled: strconv.FormatBool(operatorFlag),
 			},
 		},
 	}
diff --git a/pkg/operator/controllers/subnets/subnet_controller_test.go b/pkg/operator/controllers/subnets/subnet_controller_test.go
index d22f3a83148..8d68257835a 100644
--- a/pkg/operator/controllers/subnets/subnet_controller_test.go
+++ b/pkg/operator/controllers/subnets/subnet_controller_test.go
@@ -20,6 +20,7 @@ import (
 
 	"github.com/Azure/ARO-RP/pkg/api"
 	apisubnet "github.com/Azure/ARO-RP/pkg/api/util/subnet"
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	mock_subnet "github.com/Azure/ARO-RP/pkg/util/mocks/subnet"
 	_ "github.com/Azure/ARO-RP/pkg/util/scheme"
@@ -54,8 +55,8 @@ func getValidClusterInstance(operatorFlagEnabled bool, operatorFlagNSG bool, ope
 			ClusterResourceGroupID: clusterResourceGroupId,
 			InfraID:                infraId,
 			OperatorFlags: arov1alpha1.OperatorFlags{
-				controllerEnabled:                strconv.FormatBool(operatorFlagEnabled),
-				controllerNSGManaged:             strconv.FormatBool(operatorFlagNSG),
+				operator.AzureSubnetsEnabled:     strconv.FormatBool(operatorFlagEnabled),
+				operator.AzureSubnetsNsgManaged:  strconv.FormatBool(operatorFlagNSG),
 				controllerServiceEndpointManaged: strconv.FormatBool(operatorFlagServiceEndpoint),
 			},
 		},
diff --git a/pkg/operator/controllers/subnets/subnets_controller.go b/pkg/operator/controllers/subnets/subnets_controller.go
index 637faff28b5..32606cffaa0 100644
--- a/pkg/operator/controllers/subnets/subnets_controller.go
+++ b/pkg/operator/controllers/subnets/subnets_controller.go
@@ -20,6 +20,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 	"github.com/Azure/ARO-RP/pkg/util/clusterauthorizer"
@@ -27,11 +28,8 @@ import (
 )
 
 const (
-	ControllerName = "AzureSubnets"
-
-	controllerEnabled                = "aro.azuresubnets.enabled"
-	controllerNSGManaged             = "aro.azuresubnets.nsg.managed"
-	controllerServiceEndpointManaged = "aro.azuresubnets.serviceendpoint.managed"
+	ControllerName                   = "AzureSubnets"
+	controllerServiceEndpointManaged = operator.AzureSubnetsServiceEndpointManaged
 )
 
 // Reconciler is the controller struct
@@ -70,14 +68,14 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.AzureSubnetsEnabled) {
 		r.log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
 
 	r.log.Debug("running")
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerNSGManaged) && !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerServiceEndpointManaged) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.AzureSubnetsNsgManaged) && !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerServiceEndpointManaged) {
 		// controller is disabled
 		return reconcile.Result{}, nil
 	}
@@ -127,7 +125,7 @@ func (r *reconcileManager) reconcileSubnets(ctx context.Context) error {
 	// This potentially calls an update twice for the same loop, but this is the price
 	// to pay for keeping logic split, separate, and simple
 	for _, s := range subnets {
-		if r.instance.Spec.OperatorFlags.GetSimpleBoolean(controllerNSGManaged) {
+		if r.instance.Spec.OperatorFlags.GetSimpleBoolean(operator.AzureSubnetsNsgManaged) {
 			err = r.ensureSubnetNSG(ctx, s)
 			if err != nil {
 				combinedErrors = append(combinedErrors, err.Error())
diff --git a/pkg/operator/controllers/workaround/systemreserved.go b/pkg/operator/controllers/workaround/systemreserved.go
index b3fe4c79a91..08fcecfe2e7 100644
--- a/pkg/operator/controllers/workaround/systemreserved.go
+++ b/pkg/operator/controllers/workaround/systemreserved.go
@@ -16,8 +16,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
-	"github.com/Azure/ARO-RP/pkg/operator/controllers/autosizednodes"
 	"github.com/Azure/ARO-RP/pkg/util/version"
 )
 
@@ -47,7 +47,7 @@ func (sr *systemreserved) Name() string {
 }
 
 func (sr *systemreserved) IsRequired(clusterVersion *version.Version, cluster *arov1alpha1.Cluster) bool {
-	if cluster.Spec.OperatorFlags.GetSimpleBoolean(autosizednodes.ControllerEnabled) {
+	if cluster.Spec.OperatorFlags.GetSimpleBoolean(operator.AutosizedNodesEnabled) {
 		return false
 	}
 	return clusterVersion.Lt(sr.versionFixed)
diff --git a/pkg/operator/controllers/workaround/workaround_controller.go b/pkg/operator/controllers/workaround/workaround_controller.go
index a5f54c4ac6d..67c5255ee74 100644
--- a/pkg/operator/controllers/workaround/workaround_controller.go
+++ b/pkg/operator/controllers/workaround/workaround_controller.go
@@ -14,14 +14,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	"github.com/Azure/ARO-RP/pkg/util/version"
 )
 
 const (
 	ControllerName = "Workaround"
-
-	controllerEnabled = "aro.workaround.enabled"
 )
 
 // Reconciler the point of the workaround controller is to apply
@@ -50,7 +49,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		return reconcile.Result{}, err
 	}
 
-	if !instance.Spec.OperatorFlags.GetSimpleBoolean(controllerEnabled) {
+	if !instance.Spec.OperatorFlags.GetSimpleBoolean(operator.WorkaroundEnabled) {
 		r.log.Debug("controller is disabled")
 		return reconcile.Result{}, nil
 	}
diff --git a/pkg/operator/controllers/workaround/workaround_controller_test.go b/pkg/operator/controllers/workaround/workaround_controller_test.go
index 40945834fce..edbb40a7540 100644
--- a/pkg/operator/controllers/workaround/workaround_controller_test.go
+++ b/pkg/operator/controllers/workaround/workaround_controller_test.go
@@ -17,6 +17,7 @@ import (
 	ctrlfake "sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	utillog "github.com/Azure/ARO-RP/pkg/util/log"
 	mock_workaround "github.com/Azure/ARO-RP/pkg/util/mocks/operator/controllers/workaround"
@@ -86,7 +87,7 @@ func TestWorkaroundReconciler(t *testing.T) {
 				},
 				Spec: arov1alpha1.ClusterSpec{
 					OperatorFlags: arov1alpha1.OperatorFlags{
-						controllerEnabled: "true",
+						operator.WorkaroundEnabled: operator.FlagTrue,
 					},
 				},
 			}
diff --git a/pkg/operator/flags.go b/pkg/operator/flags.go
new file mode 100644
index 00000000000..a0580621212
--- /dev/null
+++ b/pkg/operator/flags.go
@@ -0,0 +1,74 @@
+package operator
+
+// Copyright (c) Microsoft Corporation.
+// Licensed under the Apache License 2.0.
+
+const (
+	AlertWebhookEnabled                = "aro.alertwebhook.enabled"
+	AzureSubnetsEnabled                = "aro.azuresubnets.enabled"
+	AzureSubnetsNsgManaged             = "aro.azuresubnets.nsg.managed"
+	AzureSubnetsServiceEndpointManaged = "aro.azuresubnets.serviceendpoint.managed"
+	BannerEnabled                      = "aro.banner.enabled"
+	CheckerEnabled                     = "aro.checker.enabled"
+	DnsmasqEnabled                     = "aro.dnsmasq.enabled"
+	RestartDnsmasqEnabled              = "aro.restartdnsmasq.enabled"
+	GenevaLoggingEnabled               = "aro.genevalogging.enabled"
+	ImageConfigEnabled                 = "aro.imageconfig.enabled"
+	IngressEnabled                     = "aro.ingress.enabled"
+	MachineEnabled                     = "aro.machine.enabled"
+	MachineSetEnabled                  = "aro.machineset.enabled"
+	MachineHealthCheckEnabled          = "aro.machinehealthcheck.enabled"
+	MachineHealthCheckManaged          = "aro.machinehealthcheck.managed"
+	MonitoringEnabled                  = "aro.monitoring.enabled"
+	NodeDrainerEnabled                 = "aro.nodedrainer.enabled"
+	PullSecretEnabled                  = "aro.pullsecret.enabled"
+	PullSecretManaged                  = "aro.pullsecret.managed"
+	RbacEnabled                        = "aro.rbac.enabled"
+	RouteFixEnabled                    = "aro.routefix.enabled"
+	StorageAccountsEnabled             = "aro.storageaccounts.enabled"
+	WorkaroundEnabled                  = "aro.workaround.enabled"
+	AutosizedNodesEnabled              = "aro.autosizednodes.enabled"
+	MuoEnabled                         = "rh.srep.muo.enabled"
+	MuoManaged                         = "rh.srep.muo.managed"
+	GuardrailsEnabled                  = "aro.guardrails.enabled"
+	GuardrailsDeployManaged            = "aro.guardrails.deploy.managed"
+	CloudProviderConfigEnabled         = "aro.cloudproviderconfig.enabled"
+	FlagTrue                           = "true"
+	FlagFalse                          = "false"
+)
+
+// DefaultOperatorFlags returns flags for new clusters
+// and ones that have not been AdminUpdated.
+func DefaultOperatorFlags() map[string]string {
+	return map[string]string{
+		AlertWebhookEnabled:                FlagTrue,
+		AzureSubnetsEnabled:                FlagTrue,
+		AzureSubnetsNsgManaged:             FlagTrue,
+		AzureSubnetsServiceEndpointManaged: FlagTrue,
+		BannerEnabled:                      FlagFalse,
+		CheckerEnabled:                     FlagTrue,
+		DnsmasqEnabled:                     FlagTrue,
+		RestartDnsmasqEnabled:              FlagFalse,
+		GenevaLoggingEnabled:               FlagTrue,
+		ImageConfigEnabled:                 FlagTrue,
+		IngressEnabled:                     FlagTrue,
+		MachineEnabled:                     FlagTrue,
+		MachineSetEnabled:                  FlagTrue,
+		MachineHealthCheckEnabled:          FlagTrue,
+		MachineHealthCheckManaged:          FlagTrue,
+		MonitoringEnabled:                  FlagTrue,
+		NodeDrainerEnabled:                 FlagTrue,
+		PullSecretEnabled:                  FlagTrue,
+		PullSecretManaged:                  FlagTrue,
+		RbacEnabled:                        FlagTrue,
+		RouteFixEnabled:                    FlagTrue,
+		StorageAccountsEnabled:             FlagTrue,
+		WorkaroundEnabled:                  FlagTrue,
+		AutosizedNodesEnabled:              FlagTrue,
+		MuoEnabled:                         FlagTrue,
+		MuoManaged:                         FlagTrue,
+		GuardrailsEnabled:                  FlagFalse,
+		GuardrailsDeployManaged:            FlagFalse,
+		CloudProviderConfigEnabled:         FlagTrue,
+	}
+}
diff --git a/test/e2e/aro.go b/test/e2e/aro.go
index 7fe8711d3bc..ab9dbe10ee8 100644
--- a/test/e2e/aro.go
+++ b/test/e2e/aro.go
@@ -14,7 +14,7 @@ import (
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"github.com/Azure/ARO-RP/pkg/api"
+	"github.com/Azure/ARO-RP/pkg/operator"
 	"github.com/Azure/ARO-RP/pkg/util/azureclient"
 )
 
@@ -64,7 +64,7 @@ var _ = Describe("ARO Cluster", func() {
 		Expect(co.Spec.GenevaLogging).NotTo(BeNil())
 
 		By("verifying OperatorFlags are set and equivalent to latest defaults")
-		Expect(co.Spec.OperatorFlags).To(BeEquivalentTo(api.DefaultOperatorFlags()))
+		Expect(co.Spec.OperatorFlags).To(BeEquivalentTo(operator.DefaultOperatorFlags()))
 
 		By("verifying InternetChecker exists")
 		Expect(co.Spec.InternetChecker).NotTo(BeNil())
diff --git a/test/e2e/cluster.go b/test/e2e/cluster.go
index 1129972c9ae..a7bc86b66be 100644
--- a/test/e2e/cluster.go
+++ b/test/e2e/cluster.go
@@ -23,6 +23,7 @@ import (
 
 	apisubnet "github.com/Azure/ARO-RP/pkg/api/util/subnet"
 	"github.com/Azure/ARO-RP/pkg/client/services/redhatopenshift/mgmt/2022-09-04/redhatopenshift"
+	"github.com/Azure/ARO-RP/pkg/operator"
 	"github.com/Azure/ARO-RP/pkg/util/ready"
 	"github.com/Azure/ARO-RP/pkg/util/stringutils"
 	"github.com/Azure/ARO-RP/pkg/util/version"
@@ -144,11 +145,11 @@ var _ = Describe("Cluster", Serial, func() {
 			Expect(err).NotTo(HaveOccurred())
 
 			// Poke the ARO storageaccount controller to reconcile
-			cluster.Spec.OperatorFlags["aro.storageaccounts.enabled"] = "false"
+			cluster.Spec.OperatorFlags[operator.StorageAccountsEnabled] = operator.FlagFalse
 			cluster, err = clients.AROClusters.AroV1alpha1().Clusters().Update(ctx, cluster, metav1.UpdateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 
-			cluster.Spec.OperatorFlags["aro.storageaccounts.enabled"] = "true"
+			cluster.Spec.OperatorFlags[operator.StorageAccountsEnabled] = operator.FlagTrue
 			cluster, err = clients.AROClusters.AroV1alpha1().Clusters().Update(ctx, cluster, metav1.UpdateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 
diff --git a/test/e2e/operator.go b/test/e2e/operator.go
index 2528ff61e1a..01ba11292fc 100644
--- a/test/e2e/operator.go
+++ b/test/e2e/operator.go
@@ -29,6 +29,7 @@ import (
 	"k8s.io/client-go/util/retry"
 
 	apisubnet "github.com/Azure/ARO-RP/pkg/api/util/subnet"
+	"github.com/Azure/ARO-RP/pkg/operator"
 	arov1alpha1 "github.com/Azure/ARO-RP/pkg/operator/apis/aro.openshift.io/v1alpha1"
 	cpcController "github.com/Azure/ARO-RP/pkg/operator/controllers/cloudproviderconfig"
 	imageController "github.com/Azure/ARO-RP/pkg/operator/controllers/imageconfig"
@@ -375,7 +376,7 @@ var _ = Describe("ARO Operator - Azure Subnet Reconciler", func() {
 		By("checking if preconfiguredNSG is enabled")
 		co, err := clients.AROClusters.AroV1alpha1().Clusters().Get(ctx, "cluster", metav1.GetOptions{})
 		Expect(err).NotTo(HaveOccurred())
-		if co.Spec.OperatorFlags["aro.azuresubnets.nsg.managed"] == "false" {
+		if co.Spec.OperatorFlags[operator.AzureSubnetsNsgManaged] == operator.FlagFalse {
 			Skip("preconfiguredNSG is enabled, skipping test")
 		}
 		By("preconfiguredNSG is disabled")
@@ -501,7 +502,7 @@ var _ = Describe("ARO Operator - MUO Deployment", func() {
 
 var _ = Describe("ARO Operator - ImageConfig Reconciler", func() {
 	const (
-		imageconfigFlag  = "aro.imageconfig.enabled"
+		imageconfigFlag  = operator.ImageConfigEnabled
 		optionalRegistry = "quay.io"
 		timeout          = 5 * time.Minute
 	)
@@ -660,8 +661,8 @@ var _ = Describe("ARO Operator - dnsmasq", func() {
 
 var _ = Describe("ARO Operator - Guardrails", func() {
 	const (
-		guardrailsEnabledFlag         = "aro.guardrails.enabled"
-		guardrailsDeployManagedFlag   = "aro.guardrails.deploy.managed"
+		guardrailsEnabledFlag         = operator.GuardrailsEnabled
+		guardrailsDeployManagedFlag   = operator.GuardrailsDeployManaged
 		guardrailsNamespace           = "openshift-azure-guardrails"
 		gkControllerManagerDeployment = "gatekeeper-controller-manager"
 		gkAuditDeployment             = "gatekeeper-audit"
@@ -741,7 +742,7 @@ var _ = Describe("ARO Operator - Guardrails", func() {
 
 var _ = Describe("ARO Operator - Cloud Provder Config ConfigMap", func() {
 	const (
-		cpcControllerEnabled = "aro.cloudproviderconfig.enabled"
+		cpcControllerEnabled = operator.CloudProviderConfigEnabled
 	)
 
 	It("must have disableOutboundSNAT set to true", func(ctx context.Context) {