feat: Add stable helm chart and gh action to release it. (#1203)

* feat: Add stable helm chart and gh action to release it. Signed-off-by: Oleksandr Andriienko <oandriie@redhat.com> Co-authored-by: Anatolii Bazko <abazko@redhat.com>
2021-12-01 17:25:34 +02:00 · 2021-12-01 17:25:34 +02:00 · 957038515a
parent 53fee907ec
commit 957038515a
33 changed files with 2969 additions and 19 deletions
--- a/.github/workflows/release-helm-charts.yaml
+++ b/.github/workflows/release-helm-charts.yaml
@ -0,0 +1,63 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+name: Release helm charts
+
+on:
+  # manual trigger if required
+  workflow_dispatch:
+    inputs:
+      reason:
+        description: 'Reason to trigger a release helm charts'
+        required: false
+  # trigger on commit to main branch after release
+  push:
+    branches:
+      - main
+    paths:
+      - 'version/version.go'
+
+jobs:
+  build:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Install Helm
+        uses: azure/setup-helm@v1
+        with:
+          version: v3.4.0
+
+      - name: Release
+        run: |
+          helm version
+          cp -rf "${GITHUB_WORKSPACE}"/helmcharts/stable /tmp/charts
+          git checkout gh-pages
+          cp -rf /tmp/charts "${GITHUB_WORKSPACE}"/charts/new
+          helm package ./charts/new
+          mkdir -p charts/stable
+          mv *.tgz charts/stable
+          rm -rf ./charts/new
+
+          # Generate index.yaml with list Helm packages
+          helm repo index --url https://eclipse-che.github.io/che-operator/charts charts
+
+          git config --global user.name "Mykhailo Kuznietsov"
+          git config --global user.email "mkuznets@redhat.com"
+          export GITHUB_TOKEN=${{ secrets.CHE_BOT_GITHUB_TOKEN }}
+
+          git add .
+          git commit -am "Add new chart package." --signoff
+
+          git push origin gh-pages
--- a/23
+++ b/23
@ -792,10 +792,16 @@ update-resources: check-requirements update-resource-images update-roles update-
 		done
 	done

+update-helmcharts: SHELL := /bin/bash
 update-helmcharts: add-license-download check-requirements update-resource-images update-roles
-	HELMCHARTS_TEMPLATES="helmcharts/templates"
-	HELMCHARTS_CRDS="helmcharts/crds"
+	helmFolder=$(HELM_FOLDER)
+	if [ -z "$${helmFolder}" ]; then
+		helmFolder="next"
+	fi
+	HELMCHARTS_TEMPLATES="helmcharts/$${helmFolder}/templates"
+	HELMCHARTS_CRDS="helmcharts/$${helmFolder}/crds"

+	echo "[INFO] Update Helm templates $${HELMCHARTS_TEMPLATES}"
 	cp config/manager/manager.yaml $${HELMCHARTS_TEMPLATES}
 	cp config/rbac/cluster_role.yaml $${HELMCHARTS_TEMPLATES}
 	cp config/rbac/cluster_rolebinding.yaml $${HELMCHARTS_TEMPLATES}
@ -804,6 +810,7 @@ update-helmcharts: add-license-download check-requirements update-resource-image
 	cp config/rbac/role_binding.yaml $${HELMCHARTS_TEMPLATES}
 	cp config/samples/org.eclipse.che_v1_checluster.yaml $${HELMCHARTS_TEMPLATES}

+	echo "[INFO] Update helm CRDs $${HELMCHARTS_CRDS}"
 	cp config/crd/bases/org_v1_che_crd.yaml $${HELMCHARTS_CRDS}
 	cp config/crd/bases/org.eclipse.che_chebackupserverconfigurations_crd.yaml $${HELMCHARTS_CRDS}
 	cp config/crd/bases/org.eclipse.che_checlusterbackups_crd.yaml $${HELMCHARTS_CRDS}
@ -812,12 +819,12 @@ update-helmcharts: add-license-download check-requirements update-resource-image
 	## Set references to values
 	yq -riY ".spec.k8s.ingressDomain  |= \"{{ .Values.k8s.ingressDomain }}\"" $${HELMCHARTS_TEMPLATES}/org.eclipse.che_v1_checluster.yaml

-	yq -riY '.metadata.namespace = "{{ .Release.Namespace }}"' $${HELMCHARTS_TEMPLATES}/manager.yaml
-	yq -riY '.metadata.namespace = "{{ .Release.Namespace }}"' $${HELMCHARTS_TEMPLATES}/service_account.yaml
-	yq -riY '.metadata.namespace = "{{ .Release.Namespace }}"' $${HELMCHARTS_TEMPLATES}/role.yaml
-	yq -riY '.metadata.namespace = "{{ .Release.Namespace }}"' $${HELMCHARTS_TEMPLATES}/role_binding.yaml
-	yq -riY '.metadata.namespace = "{{ .Release.Namespace }}"' $${HELMCHARTS_TEMPLATES}/org.eclipse.che_v1_checluster.yaml
-	yq -riY '.subjects[0].namespace = "{{ .Release.Namespace }}"' $${HELMCHARTS_TEMPLATES}/cluster_rolebinding.yaml
+	yq -riY ".metadata.namespace = \"$(ECLIPSE_CHE_NAMESPACE)\"" $${HELMCHARTS_TEMPLATES}/manager.yaml
+	yq -riY ".metadata.namespace = \"$(ECLIPSE_CHE_NAMESPACE)\"" $${HELMCHARTS_TEMPLATES}/service_account.yaml
+	yq -riY ".metadata.namespace = \"$(ECLIPSE_CHE_NAMESPACE)\"" $${HELMCHARTS_TEMPLATES}/role.yaml
+	yq -riY ".metadata.namespace = \"$(ECLIPSE_CHE_NAMESPACE)\"" $${HELMCHARTS_TEMPLATES}/role_binding.yaml
+	yq -riY ".metadata.namespace = \"$(ECLIPSE_CHE_NAMESPACE)\"" $${HELMCHARTS_TEMPLATES}/org.eclipse.che_v1_checluster.yaml
+	yq -riY ".subjects[0].namespace = \"$(ECLIPSE_CHE_NAMESPACE)\"" $${HELMCHARTS_TEMPLATES}/cluster_rolebinding.yaml

 	$(MAKE) add-license $$(find ./helmcharts -name "*.yaml")
 check-requirements:
--- a/helmcharts/next/Chart.yaml
+++ b/helmcharts/next/Chart.yaml
--- a/helmcharts/next/README.md
+++ b/helmcharts/next/README.md
@ -16,14 +16,11 @@ Helm charts to deploy [Eclipse Che](https://www.eclipse.org/che/)

 ### Installation

-Create a Namespace and install the Helm Charts for Eclipse Che Operator.
+Install the Helm Charts for Eclipse Che Operator.

 ```
-NAMESPACE=eclipse-che
 DOMAIN=<KUBERNETES_CLUSTER_DOMAIN>

-kubectl create namespace $NAMESPACE
-
 # Install charts
-helm install che --set k8s.ingressDomain=$DOMAIN --namespace $NAMESPACE .
+helm install che --set k8s.ingressDomain=$DOMAIN .
 ```
--- a/helmcharts/next/crds/org.eclipse.che_chebackupserverconfigurations_crd.yaml
+++ b/helmcharts/next/crds/org.eclipse.che_chebackupserverconfigurations_crd.yaml
--- a/helmcharts/next/crds/org.eclipse.che_checlusterbackups_crd.yaml
+++ b/helmcharts/next/crds/org.eclipse.che_checlusterbackups_crd.yaml
--- a/helmcharts/next/crds/org.eclipse.che_checlusterrestores_crd.yaml
+++ b/helmcharts/next/crds/org.eclipse.che_checlusterrestores_crd.yaml
--- a/helmcharts/next/crds/org_v1_che_crd.yaml
+++ b/helmcharts/next/crds/org_v1_che_crd.yaml
--- a/helmcharts/next/templates/cluster_role.yaml
+++ b/helmcharts/next/templates/cluster_role.yaml
--- a/helmcharts/next/templates/cluster_rolebinding.yaml
+++ b/helmcharts/next/templates/cluster_rolebinding.yaml
@ -22,7 +22,7 @@ metadata:
 subjects:
  - kind: ServiceAccount
    name: che-operator
-    namespace: '{{ .Release.Namespace }}'
+    namespace: eclipse-che
 roleRef:
  kind: ClusterRole
  name: che-operator
--- a/helmcharts/next/templates/manager.yaml
+++ b/helmcharts/next/templates/manager.yaml
@ -14,7 +14,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: che-operator
-  namespace: '{{ .Release.Namespace }}'
+  namespace: eclipse-che
  labels:
    app: che-operator
    app.kubernetes.io/name: che
--- a/helmcharts/next/templates/namespace.yaml
+++ b/helmcharts/next/templates/namespace.yaml
@ -0,0 +1,16 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: eclipse-che
--- a/helmcharts/next/templates/org.eclipse.che_v1_checluster.yaml
+++ b/helmcharts/next/templates/org.eclipse.che_v1_checluster.yaml
@ -14,7 +14,7 @@ apiVersion: org.eclipse.che/v1
 kind: CheCluster
 metadata:
  name: eclipse-che
-  namespace: '{{ .Release.Namespace }}'
+  namespace: eclipse-che
 spec:
  server:
    cheFlavor: ''
--- a/helmcharts/next/templates/role.yaml
+++ b/helmcharts/next/templates/role.yaml
@ -19,7 +19,7 @@ metadata:
    app.kubernetes.io/part-of: che.eclipse.org
    app.kubernetes.io/name: che
  name: che-operator
-  namespace: '{{ .Release.Namespace }}'
+  namespace: eclipse-che
 rules:
  - apiGroups:
      - extensions
--- a/helmcharts/next/templates/role_binding.yaml
+++ b/helmcharts/next/templates/role_binding.yaml
@ -19,7 +19,7 @@ metadata:
    app.kubernetes.io/instance: che
    app.kubernetes.io/part-of: che.eclipse.org
    app.kubernetes.io/component: che-operator
-  namespace: '{{ .Release.Namespace }}'
+  namespace: eclipse-che
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
--- a/helmcharts/next/templates/service_account.yaml
+++ b/helmcharts/next/templates/service_account.yaml
@ -19,4 +19,4 @@ metadata:
    app.kubernetes.io/instance: che
    app.kubernetes.io/part-of: che.eclipse.org
    app.kubernetes.io/component: che-operator
-  namespace: '{{ .Release.Namespace }}'
+  namespace: eclipse-che
--- a/helmcharts/next/values.yaml
+++ b/helmcharts/next/values.yaml
--- a/helmcharts/stable/Chart.yaml
+++ b/helmcharts/stable/Chart.yaml
@ -0,0 +1,37 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: v1
+description: A Helm chart for deploying Eclipse Che on a Kubernetes
+name: eclipse-che
+version: 7.39.0
+annotations:
+  artifacthub.io/license: EPL-2.0
+  artifacthub.io/links: |
+    - name: repository
+      url: https://github.com/eclipse-che/che-operator
+    - name: web-site
+      url: https://www.eclipse.org/che/
+    - name: docs
+      url: https://www.eclipse.org/che/docs
+    - name: support
+      url: https://github.com/eclipse/che
+  artifacthub.io/provider: Eclipse Foundation
+  artifacthub.io/maintainers: |
+    - name: Anatolii Bazko
+      email: abazko@redhat.com
+    - name: Mykola Morhun
+      email: mmorhun@redhat.com
+    - name: Oleksandr Andriienko
+      email: oandriie@redhat.com
+  artifacthub.io/operator: "true"
+  artifacthub.io/operatorCapabilities: Seamless Upgrades
--- a/helmcharts/stable/README.md
+++ b/helmcharts/stable/README.md
@ -0,0 +1,45 @@
+# Eclipse Che Helm Charts
+
+A collaborative Kubernetes-native development solution that delivers Kubernetes workspaces and in-browser IDE for rapid cloud application development. This operator installs PostgreSQL, Keycloak, Plugin registry, Devfile registry and the Eclipse Che server, as well as configures all these services.
+
+- [Charts](#charts)
+  - [Prerequisites](#prerequisites)
+  - [Installation](#installation)
+
+## Charts
+
+Helm charts to deploy [Eclipse Che](https://www.eclipse.org/che/)
+
+### Prerequisites
+
+* Minimal Kubernetes version is 1.19
+* Minimal Helm version is 3.2.2
+
+### Installation
+
+Install `Eclipse Che Operator` by following instructions in top right button `Install`.
+
+A new pod che-operator is created in `eclipse-che` namespace
+
+```bash
+$ kubectl get pods -n eclipse-che
+eclipse-che   che-operator-554c564476-fl98z                           1/1     Running   0          13s
+```
+
+Use `kubectl edit checluster/eclipse-che -n eclipse-che` to update Eclipse Che configuration.
+See more configuration options in the [Installation guide](https://www.eclipse.org/che/docs/che-7/installation-guide/configuring-the-che-installation/).
+
+The deployment process can be tracked by looking at the Operator logs by using the command:
+
+```bash
+$ kubectl logs che-operator-554c564476-fl98z -n eclipse-che -f
+important: pod name is different on each installation
+```
+
+When all Eclipse Che containers are running, the Eclipse Che URL is printed in the logs:
+
+```bash
+time="2019-08-01T13:31:05Z" level=info msg="Eclipse Che is now available at: http://che-eclipse-che.gcp.my-ide.cloud"
+```
+
+By opening this URL in a web browser, Eclipse Che is ready to use.
--- a/helmcharts/stable/crds/org.eclipse.che_chebackupserverconfigurations_crd.yaml
+++ b/helmcharts/stable/crds/org.eclipse.che_chebackupserverconfigurations_crd.yaml
@ -0,0 +1,162 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: chebackupserverconfigurations.org.eclipse.che
+spec:
+  group: org.eclipse.che
+  names:
+    kind: CheBackupServerConfiguration
+    listKind: CheBackupServerConfigurationList
+    plural: chebackupserverconfigurations
+    singular: chebackupserverconfiguration
+  scope: Namespaced
+  versions:
+    - name: v1
+      schema:
+        openAPIV3Schema:
+          description: The `CheBackupServerConfiguration` custom resource allows defining
+            and managing Eclipse Che Backup Server Configurations
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+                of an object. Servers should convert recognized schemas to the latest
+                internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource
+                this object represents. Servers may infer this from the endpoint the
+                client submits requests to. Cannot be updated. In CamelCase. More
+                info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: CheBackupServerConfigurationSpec defines the desired state
+                of CheBackupServerConfiguration Only one type of backup server is
+                allowed to be configured per CR.
+              properties:
+                awss3:
+                  description: Amazon S3 or compatible alternatives.
+                  properties:
+                    awsAccessKeySecretRef:
+                      description: Reference to secret that contains awsAccessKeyId
+                        and awsSecretAccessKey keys.
+                      type: string
+                    hostname:
+                      description: Server hostname, defaults to 's3.amazonaws.com'.
+                        Might be customized in case of alternative server.
+                      type: string
+                    port:
+                      description: Backup server port. Usually default value is used.
+                        Might be customized in case of alternative server.
+                      type: integer
+                    protocol:
+                      description: Protocol to use when connection to the server.
+                        Might be customized in case of alternative server.
+                      type: string
+                    repositoryPasswordSecretRef:
+                      description: Holds reference to a secret with restic repository
+                        password under 'repo-password' field to encrypt / decrypt
+                        its content.
+                      type: string
+                    repositoryPath:
+                      description: Bucket name and repository, e.g. bucket/repo
+                      type: string
+                  required:
+                    - awsAccessKeySecretRef
+                    - repositoryPasswordSecretRef
+                    - repositoryPath
+                  type: object
+                rest:
+                  description: Rest backup server configuration.
+                  properties:
+                    credentialsSecretRef:
+                      description: Secret that contains username and password fields
+                        to login into restic server. Note, each repository is encrypted
+                        with own password. See ResticRepoPasswordSecretRef field.
+                      type: string
+                    hostname:
+                      description: Backup server host
+                      type: string
+                    port:
+                      description: Backup server port
+                      type: integer
+                    protocol:
+                      description: Protocol to use when connection to the server Defaults
+                        to https.
+                      type: string
+                    repositoryPasswordSecretRef:
+                      description: Holds reference to a secret with restic repository
+                        password under 'repo-password' field to encrypt / decrypt
+                        its content.
+                      type: string
+                    repositoryPath:
+                      description: Restic repository path
+                      type: string
+                  required:
+                    - hostname
+                    - repositoryPasswordSecretRef
+                  type: object
+                sftp:
+                  description: Sftp backup server configuration.
+                  properties:
+                    hostname:
+                      description: Backup server host
+                      type: string
+                    port:
+                      description: Backup server port
+                      type: integer
+                    repositoryPasswordSecretRef:
+                      description: Holds reference to a secret with restic repository
+                        password under 'repo-password' field to encrypt / decrypt
+                        its content.
+                      type: string
+                    repositoryPath:
+                      description: Restic repository path, relative or absolute, e.g.
+                        /srv/repo
+                      type: string
+                    sshKeySecretRef:
+                      description: Private ssh key under 'ssh-privatekey' field for
+                        passwordless login
+                      type: string
+                    username:
+                      description: User login on the remote server
+                      type: string
+                  required:
+                    - hostname
+                    - repositoryPasswordSecretRef
+                    - repositoryPath
+                    - sshKeySecretRef
+                    - username
+                  type: object
+              type: object
+            status:
+              description: CheBackupServerConfigurationStatus defines the observed
+                state of CheBackupServerConfiguration
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
--- a/helmcharts/stable/crds/org.eclipse.che_checlusterbackups_crd.yaml
+++ b/helmcharts/stable/crds/org.eclipse.che_checlusterbackups_crd.yaml
@ -0,0 +1,92 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: checlusterbackups.org.eclipse.che
+spec:
+  group: org.eclipse.che
+  names:
+    kind: CheClusterBackup
+    listKind: CheClusterBackupList
+    plural: checlusterbackups
+    singular: checlusterbackup
+  scope: Namespaced
+  versions:
+    - name: v1
+      schema:
+        openAPIV3Schema:
+          description: The `CheClusterBackup` custom resource allows defining and
+            managing Eclipse Che backup
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+                of an object. Servers should convert recognized schemas to the latest
+                internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource
+                this object represents. Servers may infer this from the endpoint the
+                client submits requests to. Cannot be updated. In CamelCase. More
+                info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: CheClusterBackupSpec defines the desired state of CheClusterBackup
+              properties:
+                backupServerConfigRef:
+                  description: Name of custom resource with a backup server configuration
+                    to use for this backup. Note, UseInternalBackupServer field can
+                    configure internal backup server automatically.
+                  type: string
+                useInternalBackupServer:
+                  description: Automatically setup pod with REST backup server and
+                    use the server in this configuration. Note, this flag takes precedence
+                    and will overwrite existing backup server configuration.
+                  type: boolean
+              type: object
+            status:
+              description: CheClusterBackupStatus defines the observed state of CheClusterBackup
+              properties:
+                cheVersion:
+                  description: Version that was backed up
+                  type: string
+                message:
+                  description: Message explaining the state of the backup or an error
+                    message
+                  type: string
+                snapshotId:
+                  description: Last backup snapshot ID
+                  type: string
+                stage:
+                  description: Describes backup progress
+                  type: string
+                state:
+                  description: 'Backup progress state: InProgress, Failed, Succeeded'
+                  type: string
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
--- a/helmcharts/stable/crds/org.eclipse.che_checlusterrestores_crd.yaml
+++ b/helmcharts/stable/crds/org.eclipse.che_checlusterrestores_crd.yaml
@ -0,0 +1,83 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: checlusterrestores.org.eclipse.che
+spec:
+  group: org.eclipse.che
+  names:
+    kind: CheClusterRestore
+    listKind: CheClusterRestoreList
+    plural: checlusterrestores
+    singular: checlusterrestore
+  scope: Namespaced
+  versions:
+    - name: v1
+      schema:
+        openAPIV3Schema:
+          description: The `CheClusterRestore` custom resource allows defining and
+            managing Eclipse Che restore
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+                of an object. Servers should convert recognized schemas to the latest
+                internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource
+                this object represents. Servers may infer this from the endpoint the
+                client submits requests to. Cannot be updated. In CamelCase. More
+                info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: CheClusterRestoreSpec defines the desired state of CheClusterRestore
+              properties:
+                backupServerConfigRef:
+                  description: Name of custom resource with a backup server configuration
+                    to use for this restore. Can be omitted if only one server configuration
+                    object exists within the namespace.
+                  type: string
+                snapshotId:
+                  description: If omitted, latest snapshot will be used.
+                  type: string
+              type: object
+            status:
+              description: CheClusterRestoreStatus defines the observed state of CheClusterRestore
+              properties:
+                message:
+                  description: Restore result or error message
+                  type: string
+                stage:
+                  description: Describes phase of restore progress
+                  type: string
+                state:
+                  description: 'Restore progress state: InProgress, Failed, Succeeded'
+                  type: string
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
--- a/helmcharts/stable/crds/org_v1_che_crd.yaml
+++ b/helmcharts/stable/crds/org_v1_che_crd.yaml
--- a/helmcharts/stable/templates/cluster_role.yaml
+++ b/helmcharts/stable/templates/cluster_role.yaml
@ -0,0 +1,668 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: che-operator
+  labels:
+    app.kubernetes.io/name: che
+    app.kubernetes.io/instance: che
+    app.kubernetes.io/part-of: che.eclipse.org
+    app.kubernetes.io/component: che-operator
+rules:
+  ### CHE-OPERATOR ROLES ONLY: BEGIN
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+  - apiGroups:
+      - oauth.openshift.io
+    resources:
+      - oauthclients
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - oauths
+    verbs:
+      - get
+      - list
+      - watch
+      - patch
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - infrastructures
+      - proxies
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - user.openshift.io
+    resources:
+      - users
+    verbs:
+      - list
+      - delete
+  - apiGroups:
+      - user.openshift.io
+    resources:
+      - identities
+    verbs:
+      - delete
+  - apiGroups:
+      - console.openshift.io
+    resources:
+      - consolelinks
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - clusterrolebindings
+      - clusterroles
+    verbs:
+      - list
+      - create
+      - watch
+      - update
+      - get
+      - delete
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - roles
+      - rolebindings
+    verbs:
+      - get
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - authorization.openshift.io
+    resources:
+      - roles
+      - rolebindings
+    verbs:
+      - get
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - org.eclipse.che
+    resources:
+      - checlusters
+      - checlusters/status
+      - checlusters/finalizers
+      - checlusters/status
+      - checlusterbackups
+      - checlusterbackups/status
+      - checlusterbackups/finalizers
+      - checlusterrestores
+      - checlusterrestores/status
+      - backupserverconfigurations
+      - backupserverconfigurations/status
+      - chebackupserverconfigurations
+    verbs:
+      - '*'
+  - apiGroups:
+      - project.openshift.io
+    resources:
+      - projectrequests
+    verbs:
+      - create
+      - update
+  - apiGroups:
+      - project.openshift.io
+    resources:
+      - projects
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - watch
+  - apiGroups:
+      - ''
+    resources:
+      - pods/exec
+    verbs:
+      - create
+  - apiGroups:
+      - apps
+    resources:
+      - secrets
+    verbs:
+      - list
+  - apiGroups:
+      - ''
+    resources:
+      - secrets
+    verbs:
+      - list
+      - get
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - delete
+  - apiGroups:
+      - ''
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - create
+      - watch
+      - delete
+  - apiGroups:
+      - apps
+      - extensions
+    resources:
+      - deployments
+      - replicasets
+    verbs:
+      - '*'
+  - apiGroups:
+      - route.openshift.io
+    resources:
+      - routes
+    verbs:
+      - '*'
+  - apiGroups:
+      - route.openshift.io
+    resources:
+      - routes/custom-host
+    verbs:
+      - create
+  - apiGroups:
+      - ''
+    resources:
+      - events
+    verbs:
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - list
+      - get
+      - patch
+      - delete
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses
+    verbs:
+      - '*'
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - list
+      - create
+      - watch
+      - get
+      - delete
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - create
+      - update
+  - apiGroups:
+      - operators.coreos.com
+    resources:
+      - subscriptions
+    verbs:
+      - get
+  - apiGroups:
+      - operators.coreos.com
+    resources:
+      - clusterserviceversions
+    verbs:
+      - list
+      - get
+      - watch
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - cert-manager.io
+    resources:
+      - issuers
+      - certificates
+    verbs:
+      - create
+      - get
+      - list
+      - update
+  - apiGroups:
+    - ''
+    resources:
+    - configmaps
+    - persistentvolumeclaims
+    - pods
+    - secrets
+    - serviceaccounts
+    - services
+    verbs:
+    - '*'
+  - apiGroups:
+    - apps
+    resourceNames:
+    - che-operator
+    resources:
+    - deployments/finalizers
+    verbs:
+    - update
+  - apiGroups:
+    - batch
+    resources:
+    - jobs
+    verbs:
+    - create
+    - delete
+    - get
+    - update
+    - watch
+  - apiGroups:
+    - controller.devfile.io
+    resources:
+    - devworkspaceroutings
+    verbs:
+    - '*'
+  - apiGroups:
+    - controller.devfile.io
+    resources:
+    - devworkspaceroutings/finalizers
+    verbs:
+    - update
+  - apiGroups:
+    - controller.devfile.io
+    resources:
+    - devworkspaceroutings/status
+    verbs:
+    - get
+    - patch
+    - update
+  - apiGroups:
+    - monitoring.coreos.com
+    resources:
+    - servicemonitors
+    verbs:
+    - create
+    - get
+  - nonResourceURLs:
+    - /metrics
+    verbs:
+    - get
+  - apiGroups:
+    - che.eclipse.org
+    resources:
+    - kubernetesimagepullers
+    verbs:
+    - '*'
+  - apiGroups:
+    - config.openshift.io
+    resources:
+    - consoles
+    resourceNames:
+    - cluster
+    verbs:
+    - get
+  ### CHE-OPERATOR ROLES ONLY: END
+  # devworkspace-controller-view-workspaces.ClusterRole.yaml
+  - apiGroups:
+    - workspace.devfile.io
+    resources:
+    - devworkspaces
+    - devworkspacetemplates
+    verbs:
+    - get
+    - list
+    - watch
+  - apiGroups:
+    - controller.devfile.io
+    resources:
+    - devworkspaceroutings
+    - components
+    verbs:
+    - get
+    - list
+    - watch
+  # devworkspace-controller-edit-workspaces.ClusterRole.yaml
+  - apiGroups:
+    - workspace.devfile.io
+    resources:
+    - devworkspaces
+    - devworkspacetemplates
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - patch
+    - update
+  - apiGroups:
+    - controller.devfile.io
+    resources:
+    - devworkspaceroutings
+    - components
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - patch
+    - update
+  # devworkspace-controller-leader-election-role.Role.yaml
+  - apiGroups:
+    - ""
+    resources:
+    - configmaps
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - update
+    - patch
+    - delete
+  - apiGroups:
+    - ""
+    resources:
+    - configmaps/status
+    verbs:
+    - get
+    - update
+    - patch
+  - apiGroups:
+    - ""
+    resources:
+    - events
+    verbs:
+    - create
+    - patch
+  # devworkspace-controller-proxy-role.ClusterRole.yaml
+  - apiGroups:
+    - authentication.k8s.io
+    resources:
+    - tokenreviews
+    verbs:
+    - create
+  - apiGroups:
+    - authorization.k8s.io
+    resources:
+    - subjectaccessreviews
+    verbs:
+    - create
+  # devworkspace-controller-role.ClusterRole.yaml
+  - apiGroups:
+    - ""
+    resourceNames:
+    - workspace-preferences-configmap
+    resources:
+    - configmaps
+    verbs:
+    - create
+    - delete
+    - get
+    - patch
+  - apiGroups:
+    - ""
+    resources:
+    - configmaps
+    - persistentvolumeclaims
+    - pods
+    - secrets
+    - serviceaccounts
+    verbs:
+    - '*'
+  - apiGroups:
+    - ""
+    resources:
+    - events
+    - namespaces
+    verbs:
+    - get
+    - list
+    - watch
+  - apiGroups:
+    - ""
+    resources:
+    - pods/exec
+    verbs:
+    - create
+  - apiGroups:
+    - ""
+    resourceNames:
+    - workspace-credentials-secret
+    resources:
+    - secrets
+    verbs:
+    - create
+    - delete
+    - get
+    - patch
+  - apiGroups:
+    - ""
+    resources:
+    - services
+    verbs:
+    - '*'
+  - apiGroups:
+    - admissionregistration.k8s.io
+    resources:
+    - mutatingwebhookconfigurations
+    - validatingwebhookconfigurations
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resourceNames:
+    - devworkspace-controller
+    resources:
+    - deployments/finalizers
+    verbs:
+    - update
+  - apiGroups:
+    - apps
+    - extensions
+    resources:
+    - deployments
+    verbs:
+    - get
+    - list
+    - watch
+  - apiGroups:
+    - apps
+    - extensions
+    resources:
+    - deployments
+    - replicasets
+    verbs:
+    - '*'
+  - apiGroups:
+    - apps
+    - extensions
+    resources:
+    - replicasets
+    verbs:
+    - get
+    - list
+    - watch
+  - apiGroups:
+    - batch
+    resources:
+    - jobs
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - controller.devfile.io
+    resources:
+    - '*'
+    verbs:
+    - '*'
+  - apiGroups:
+    - controller.devfile.io
+    resources:
+    - devworkspaceroutings
+    verbs:
+    - '*'
+  - apiGroups:
+    - controller.devfile.io
+    resources:
+    - devworkspaceroutings/status
+    verbs:
+    - get
+    - patch
+    - update
+  - apiGroups:
+    - coordination.k8s.io
+    resources:
+    - leases
+    verbs:
+    - create
+    - get
+    - update
+  - apiGroups:
+    - monitoring.coreos.com
+    resources:
+    - servicemonitors
+    verbs:
+    - create
+    - get
+  - apiGroups:
+    - networking.k8s.io
+    resources:
+    - ingresses
+    verbs:
+    - '*'
+  - apiGroups:
+    - oauth.openshift.io
+    resources:
+    - oauthclients
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - rbac.authorization.k8s.io
+    resources:
+    - clusterrolebindings
+    - clusterroles
+    - rolebindings
+    - roles
+    verbs:
+    - create
+    - get
+    - list
+    - update
+    - watch
+  - apiGroups:
+    - route.openshift.io
+    resources:
+    - routes
+    verbs:
+    - '*'
+  - apiGroups:
+    - route.openshift.io
+    resources:
+    - routes/custom-host
+    verbs:
+    - create
+  - apiGroups:
+    - workspace.devfile.io
+    resources:
+    - '*'
+    verbs:
+    - '*'
+  # devworkspace-controller-view-workspaces.ClusterRole.yaml
+  - apiGroups:
+    - workspace.devfile.io
+    resources:
+    - devworkspaces
+    - devworkspacetemplates
+    verbs:
+    - get
+    - list
+    - watch
+  - apiGroups:
+    - controller.devfile.io
+    resources:
+    - devworkspaceroutings
+    - components
+    verbs:
+    - get
+    - list
+    - watch
--- a/helmcharts/stable/templates/cluster_rolebinding.yaml
+++ b/helmcharts/stable/templates/cluster_rolebinding.yaml
@ -0,0 +1,29 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: che-operator
+  labels:
+    app.kubernetes.io/name: che
+    app.kubernetes.io/instance: che
+    app.kubernetes.io/part-of: che.eclipse.org
+    app.kubernetes.io/component: che-operator
+subjects:
+  - kind: ServiceAccount
+    name: che-operator
+    namespace: eclipse-che
+roleRef:
+  kind: ClusterRole
+  name: che-operator
+  apiGroup: rbac.authorization.k8s.io
--- a/helmcharts/stable/templates/manager.yaml
+++ b/helmcharts/stable/templates/manager.yaml
@ -0,0 +1,276 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: che-operator
+  namespace: eclipse-che
+  labels:
+    app: che-operator
+    app.kubernetes.io/name: che
+    app.kubernetes.io/instance: che
+    app.kubernetes.io/component: che-operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: che-operator
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: che-operator
+        app.kubernetes.io/name: che
+        app.kubernetes.io/instance: che
+        app.kubernetes.io/component: che-operator
+    spec:
+      containers:
+        - name: che-operator
+          image: quay.io/eclipse/che-operator:7.39.2
+          command:
+            - /manager
+          args:
+            - --leader-elect
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 60000
+              name: metrics
+          env:
+            - name: WATCH_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: OPERATOR_NAME
+              value: che-operator
+            - name: CHE_VERSION
+              value: 7.39.2
+            - name: RELATED_IMAGE_che_server
+              value: quay.io/eclipse/che-server:7.39.2
+            - name: RELATED_IMAGE_dashboard
+              value: quay.io/eclipse/che-dashboard:7.39.2
+            - name: RELATED_IMAGE_plugin_registry
+              value: quay.io/eclipse/che-plugin-registry:7.39.2
+            - name: RELATED_IMAGE_devfile_registry
+              value: quay.io/eclipse/che-devfile-registry:7.39.2
+            - name: RELATED_IMAGE_che_tls_secrets_creation_job
+              value: quay.io/eclipse/che-tls-secret-creator:alpine-d1ed4ad
+            - name: RELATED_IMAGE_pvc_jobs
+              value: registry.access.redhat.com/ubi8-minimal:8.5-204
+            - name: RELATED_IMAGE_postgres
+              value: quay.io/eclipse/che--centos--postgresql-96-centos7:9.6-b681d78125361519180a6ac05242c296f8906c11eab7e207b5ca9a89b6344392
+            - name: RELATED_IMAGE_postgres_13_3
+              value: quay.io/eclipse/che--centos--postgresql-13-centos7:1-71b24684d64da46f960682cc4216222a7e4ed8b1a31dd5a865b3e71afdea20d2
+            - name: RELATED_IMAGE_keycloak
+              value: quay.io/eclipse/che-keycloak:7.39.2
+            - name: RELATED_IMAGE_che_workspace_plugin_broker_metadata
+              value: quay.io/eclipse/che-plugin-metadata-broker:v3.4.0
+            - name: RELATED_IMAGE_che_workspace_plugin_broker_artifacts
+              value: quay.io/eclipse/che-plugin-artifacts-broker:v3.4.0
+            - name: RELATED_IMAGE_che_server_secure_exposer_jwt_proxy_image
+              value: quay.io/eclipse/che-jwtproxy:0.10.0
+            - name: RELATED_IMAGE_single_host_gateway
+              value: quay.io/eclipse/che--traefik:v2.5.0-eb30f9f09a65cee1fab5ef9c64cb4ec91b800dc3fdd738d62a9d4334f0114683
+            - name: RELATED_IMAGE_single_host_gateway_config_sidecar
+              value: quay.io/che-incubator/configbump:0.1.4
+            - name: RELATED_IMAGE_devworkspace_controller
+              value: quay.io/devfile/devworkspace-controller:v0.9.0
+            - name: RELATED_IMAGE_internal_rest_backup_server
+              value: quay.io/eclipse/che-backup-server-rest:eeacd92
+            - name: RELATED_IMAGE_gateway_authentication_sidecar
+              value: quay.io/openshift/origin-oauth-proxy:4.7
+            - name: RELATED_IMAGE_gateway_authorization_sidecar
+              value: quay.io/openshift/origin-kube-rbac-proxy:4.7
+            - name: RELATED_IMAGE_gateway_header_sidecar
+              value: quay.io/che-incubator/header-rewrite-proxy:latest
+            - name: CHE_FLAVOR
+              value: che
+            - name: CONSOLE_LINK_NAME
+              value: che
+            - name: CONSOLE_LINK_DISPLAY_NAME
+              value: Eclipse Che
+            - name: CONSOLE_LINK_SECTION
+              value: Red Hat Applications
+            - name: CONSOLE_LINK_IMAGE
+              value: /dashboard/assets/branding/loader.svg
+            - name: CHE_IDENTITY_SECRET
+              value: che-identity-secret
+            - name: CHE_IDENTITY_POSTGRES_SECRET
+              value: che-identity-postgres-secret
+            - name: CHE_POSTGRES_SECRET
+              value: che-postgres-secret
+            - name: CHE_SERVER_TRUST_STORE_CONFIGMAP_NAME
+              value: ca-certs
+            - name: MAX_CONCURRENT_RECONCILES
+              value: '1'
+            - name: ALLOW_DEVWORKSPACE_ENGINE
+              value: 'true'
+            - name: ADD_COMPONENT_READINESS_INIT_CONTAINERS
+              value: 'false'
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUNDCMNSTEZJTHFTGKZJWMI4WKNDBHBRDIZJYGY4DCMZYGBRWKMRUGYZDMNZUGU4TOYJUHBRDQMLDGEZTCY3CMJTDANJVMRSDKZBQMMZQ____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:4bce2e39fee6b9e4a8b4e8681380ce2462674597a48b81c131cbbf055dd5d0c3
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUN3DMY3GMMBQMQZWMMTEMFTDANBWG42TMMJYMM2DAODFGA4GMMBRHFTDENLCHEYWKYZQHBSDENZZGA4TIZTEMRRDAMLGGU2TSNJQGJRA____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:7cf6f00d3f2daf04675618c408e08f019f25b91ec08d279094fddb01f559502b
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUMTFGJRDGNLGMIZTGYZXHA3TGOBTGY4DIMRXMIYGEMJUME2DMNJZMI3GEMBTGEYTGZBYHA3TINZSMM2DINLBMU3DCNLEHE3TMMLEGM4Q____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:2e2b35fb33c78738368427b0b14a4659b6b03113d887472c445ae615d9761d39
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUYLFGUYTENDFGMYTSODBMM3DSNZXMNQTSNZTMFQWMNBYHA2WCMJUMU4DAMDEGY2DOYZZGZQTEM3EGE2WCMTCGZRGCYTCMU4GMZLGGJQQ____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:ae5124e3198ac6977ca973aaf4885a14e800d647c96a23d15a2b6babbe8fef2a
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUMTFGQ4WMYLGMI4WCYJWGUYTSZTDGYZTAMJZME3TEYJUGUZDMMRSGJRDMOJQGVSWIMBRMRRTIOBUMMZWKOLGGUYTGMLBMUYDAYRVGQ3A____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:2e49fafb9aa6519fc63019a72a4526222b6905ed01dc484c3e9f5131ae00b546
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUMRXGY3TMNLDMYZWKNTGGU2GCZJTMJSDOMBTGI2TCMZSMVTDAYRXHEYDCOJXHE4GCZTDGA4DCYZVMZTDMNZVGA3TMNZZHE2WIZRQMMZQ____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:276765cf3e6f54ae3bd70325132ef0b79019798afc081c5ff6750767995df0c3
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUZBVGY2WEOJYMYYTCMDFMZSTIMRUGZTGKMLGGI2WKZJWGJSDONDEG4YGMNDGHE4TSZJUGY3TSZJYMY3TAOBVMYYTQYRRG4YTCZRXGZSA____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:d565b98f110efe4246fe1f25ee62d74d70f4f999e4679e8f7085f18b1711f76d
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUOBUHFRTKODFHBQTGNZRMEZGEZRZMVSDONRQGBRWEZRYMM4DINRTMJRGMNLGMZRDINBSG5RWEMLGGJRWINDGGNSDGMRXGQ3TMNRQMU3A____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:849c58e8a371a2bf9ed7600cbf8c8463bbf5ffb4427cb1f2cd4f3d32747660e6
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUNJVG4YDGYLFGVTGCZLCMVSGKZJVGZTGIY3FGM4DOOLGMEZDEOBRMNRTENRQGQ4DQZBYME2DQODGMY3TOZLEGNSDIMDGG43TQZDEMY3Q____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:55703ae5faebedee56fdce3879fa2281cc260488d8a488ff77ed3d40f778ddf7
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUZDGMMZTSYLBMQ4TMZRUGU4GGNZZGZSTOMTBGJSDAYRWGI4GMZDGMQ4DCNZWMU2TMOLEGQ4TCYLDGMZTOMBSGI4TSZLEHBSTQYZXGFRQ____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:dfc39aad96f458c796e72a2d0b628fdfd8176e569d491ac33702299ed8e8c71c
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUOJXGRSGIMDBGVQWEN3FGA3TKZBXMQZTINDBMYZGKODFGJQTEZRYGBQTANRZMU4GCNLBGRRTSZTGMMZGCNJXMU2DEMLCGYZGCYJRG5QQ____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:974dd0a5ab7e075d7d344af2e8e2a2f80a069e8a5a4c9ffc2a57e421b62aa17a
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUOBSHE3WMYRRG4ZTEZBYG5SDKNTBGBQWCNDDGY4TCMBVMU3WEY3GGRRDKMBQMU2DAYTCGE3DINBWMQ3DEOBWMMYDOYRYHA2GKYRXGNSA____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:8297fb1732d87d56a0aa4c69105e7bcf4b500e40bb16446d6286c07b884eb73d
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUMBZGVRTENBQGU2TAMZTMUZDCOLEGVQTSZRWMZSTSOBTGVRDOOLDGVSDGNBRGZTDAZDGMJRDEMRYMQZDSNJXGEZWKOBRMQZDOYZWGYYQ____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:095c24055033e219d5a9f6fe9835b79c5d3416f0dfbb228d295713e81d27c661
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUNJWMU3TSNRQHA2TOOBYGZQTANLGMM2DKOLFMQ3GKNZTMEYGCMZYGZTDCNBVMEZDINZUMMZDEODDGJRDOY3DMI4TOYJRMQYTQYRUMRTA____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:56e7960857886a05fc459ed6e73a0a386f145a2474c228c2b7ccb97a1d18b4df
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUZDCHA3GGOJSGQYTQYRZMY2DAYRSGY2TIYRYMZRTINZTGA3TGNJWHFSTAZDDHBQTAMLEG5QWIYZTGFRTSOJSGVSTKNBWHFSDEYRRGE2A____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:db86c92418b9f40b2654b8fc473073569e0dc8a01d7adc31c9925e5469d2b114
+            - name: RELATED_IMAGE_mta_vscode_extension_plugin_registry_image_IBZWQYJSGU3DUOBQGY3TMNJRG4YDQMBSGQYTSODGGUYDKMZSMEYGGNBSGNRDSMJQME4TENDDGFSGIMLFMU2WMMBTGJQTIZDCMIYDKMJYMI4TEMBVHA2A____
+              value: quay.io/windupeng/mta-vscode-extension@sha256:8067651708024198f50532a0c423b910a924c1dd1ee5f032a4dbb0518b920584
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUNJQGJQWEY3GGY2TSOLGMRQWIYLCMVTDEOBZMRRWCZDDGVRTGMTDME3DEMTGMEYDEYRXGNQTOMTCGEYTGY3BGFSTKZJVMIYTOOJTG42Q____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:502abcf6599fdadabef289dcadc5c32ca622fa02b73a72b113ca1e5e5b179375
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUZRTHE4GKM3GMZSDKMRQGBRTKNTCMY2TMYJWMY3WMOLFHBSGENDBMEZWMNRTHFQTMMJSGU4DKMDGGE3DSNBRGQ2TEOBSGYYGIY3FHBQQ____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:f398e3ffd5200c56bf56a6f7f9e8db4aa3f639a6125850f169414528260dce8a
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUZJTG42GKYZTGY3TINBXMFTGKYJZMIYTEZRVME4GMNRWHEYGCNTGHE4TGNJSGY2DAODBGM3TGMLGGUZDEYJVGNSTKZBQMJTGGMRYG5TA____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:e374ec367447afea9b12f5a8f6690a6f993526408a3731f522a53e5d0bfc287f
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUMTDMI2GMNZQMVSGEY3EMFRDGYRSG44WIYLFGUZWENTBG42TGZBWGNTGKZJQGNRGGYLFGNSDEYJTHA2WKMRUMYZDKZJWHE2WGMBTMRTA____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:2cb4f70edbcdab3b279dae53b6a753d63fee03bcae3d2a385e24f25e695c03df
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUNDGMRRDANBQGI3GGYTFMRSGEZTFGUZTCOBUMFTGGZBWMZRTKY3CGYYTGMTBGIZGEZJVHAYTAYRRGNSDGODBGEZDKYLGMQYDQMZSGIYQ____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:4fdb04026cbeddbfe53184afcd6fc5cb6132a22be5810b13d38a125afd083221
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUNBZGFRTMMTBGNQWGNZXGVSDKNBSGZSDOMTBGU4WCYZRHBRGIZBVGBTDKZRVMQ3DCZBQG5TGEZTCGM2GKMDDMQ3WMZLEGNSDIZDBGIYQ____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:491c62a3ac775d5426d72a59ac18bdd50f5f5d61d07fbfb34e0cd7fed3d4da21
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUNJZG5QTGMDDHFRTGZTDG5SGEYTGMI4WKMBYMIYWEYRSGE3TSZBYMVRDANRSMFSDCNBYGQ4DAZTGGMZDIOBZMI2GMMBRMVRTMNZVMY2A____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:597a30c9c3fc7dbbfb9e08b1bb2179d8eb062ad148480ff32489b4f01ec675f4
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUNTEGBRTINBQME3WIYZWGQ4DQMJWMZRWINBYHA2WEOLDMM4DKZRQMVRDAZRTHEYTMNJZMJRDSZTDHBQTSMJSGMYDONLCMVQTONJRGY2Q____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:6d0c440a7dc648816fcd4885b9cc85f0eb0f391659bb9fc8a9123075bea75165
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUMTCME4GMZTGMU3GMMTEGY2GMOBSHA4TMMZWG5QTGNDGMRRDMNJXGY3TEOJYGQ2TIODDG44TANDGHEYDMMJXHBSTQZJQHAZDSNBSG43Q____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:2ba8fffe6f2d64f82896367a34fdb657672984548c7904f906178e8e08294277
+            - name: RELATED_IMAGE_che_plugin_sidecar_plugin_registry_image_IBZWQYJSGU3DUYTCGQYDIZTGMFQTCMRVGY2WEZLCGEZGENDDMQ4DCNRQMNTGCM3GMYZWKZRTMJSTIMRQGQZTAYJWGU3DEZRRMZSTIOBWGM4WGYTGGFTA____
+              value: quay.io/eclipse/che-plugin-sidecar@sha256:bb404ffaa12565beb12b4cd8160cfa3ff3ef3be420430a6562f1fe48639cbf1f
+            - name: RELATED_IMAGE_che_theia_plugin_registry_image_IBZWQYJSGU3DUM3BGFSWGNTBMFTDAZTCGMYWGNJZMJRTANRYG43TEYRZMY2DEMBWMZTGGZBXG5SDQMJYHFQTGZBRME2TQY3FGAYTSZLFGFQWCYZVMRSQ____
+              value: quay.io/eclipse/che-theia@sha256:3a1ec6aaf0fb31c59bc068772b9f4206ffcd77d8189a3d1a58ce019ee1aac5de
+            - name: RELATED_IMAGE_che_machine_exec_plugin_registry_image_IBZWQYJSGU3DUNTGMZSGMNLGMU2DQZBXMEZTANTBGAYGINRRGM2TSNJSMFTDSN3EMM3WMZJWMNTDQZRYMQYGEZBXME4GCNBQMRTGGMJVMNRTONZSG4YQ____
+              value: quay.io/eclipse/che-machine-exec@sha256:6ffdf5fe48d7a306a00d6135952af97dc7fe6cf8f8d0bd7a8a40dfc15cc77271
+            - name: RELATED_IMAGE_che_theia_endpoint_runtime_binary_plugin_registry_image_IBZWQYJSGU3DUNRWMVTDEM3EGVTGMMZXGE4WGNZSGMYDOYRRGNTDOZBRGVTDAZBQGFSGEZJZMRRWIZRYMRRGKNLDHE4TKODEGYYWCZTDGNQWEMRSMFSQ____
+              value: quay.io/eclipse/che-theia-endpoint-runtime-binary@sha256:66ef23d5ff3719c72307b13f7d15f0d01dbe9dcdf8dbe5c9958d61afc3ab22ae
+            - name: RELATED_IMAGE_che_editor_jupyter_plugin_registry_image_IBZWQYJSGU3DUOBTGQZTSYLFHFSWIY3BMEZWCOJXGUZTMNZUGIZTCNLBG44TCMTGHEZWKNBZHFTDIOJYGQ3WIYJQHE2GGNBYGAYDGMLFMFSTIYTBGQ3Q____
+              value: index.docker.io/ksmster/che-editor-jupyter@sha256:83439ae9edcaa3a97536742315a7912f93e499f49847da094c480031eae4ba47
+            - name: RELATED_IMAGE_dirigible_openshift_plugin_registry_image_IBZWQYJSGU3DUMZTGY2TMMZVMQYWKMBUGAZTMOJXMRSWCMBWG42GEYTCMRRTONBZMM2GEZJSMRRDEOJYGE4GCOJTMI4GKMLFGUZWGM3DGUYTINBRGEZQ____
+              value: index.docker.io/dirigiblelabs/dirigible-openshift@sha256:3365635d1e0403697dea0674bbbdc749c4be2db29818a93b8e1e53c3c5144113
+            - name: RELATED_IMAGE_che_idea_plugin_registry_image_IBZWQYJSGU3DUYRQGI3DMM3CGJQWKYJVGIYWEY3CMNQWMZDCMVRTOZLCMEZDOYRWMQ4DANDFGM4DQNLEMM2TIYTCG5SDKYZXG4YWKZBXG5SDIYJZG5TA____
+              value: quay.io/che-incubator/che-idea@sha256:b02663b2aea521bcbcafdbec7eba27b6d804e3885dc54bb7d5c771ed77d4a97f
+            - name: RELATED_IMAGE_che_pycharm_plugin_registry_image_IBZWQYJSGU3DUOJUGI4DGMBUMJQWIZJXGVSTMYRWHEYGENDGGQ4DANLFGE2TONZYMQ2WKZRXMMZGGZLDGMYTSMJQMUZWEZBXGRRTENZTMMYTEYRWGJTA____
+              value: quay.io/che-incubator/che-pycharm@sha256:9428304bade75e6b690b4f4805e15778d5ef7c2cec31910e3bd74c273c12b62f
+            - name: RELATED_IMAGE_eclipse_broadway_plugin_registry_image_IBZWQYJSGU3DUNJXMM4DEY3EHAYDMYJVGZTDMOLBME4DMNRTMY3DQNBQGVSDANZXHBRDMMRYMEZDSYJWGRTGEMJWHA4DCYRRGFRWKOLGGQ4DIZDEME3Q____
+              value: index.docker.io/wsskeleton/eclipse-broadway@sha256:57c82cd806a56f69aa8663f68405d0778b628a29a64fb16881b11ce9f484dda7
+            - name: RELATED_IMAGE_code_server_plugin_registry_image_IBZWQYJSGU3DUZLGGA3TEOBRGAYDIOJQHFRGEMTDGIZDQNBSGJSGMMTFHE4WCNLCME2WKNBVGBTGGZJXGU2DMYRYMZQTCOBWHA2TEZRSGNRGMNRXGUYQ____
+              value: index.docker.io/codercom/code-server@sha256:ef07281004909bb2c228422df2e99a5ba5e450fce7546b8fa186852f23bf6751
+            - name: RELATED_IMAGE_che_buildah_base_plugin_registry_image_IBZWQYJSGU3DUNBRG4ZDAM3EHA3DEOLFMRSDSMTGGE4DOYLGMQZWKYTCGNSDQZDDGI4DGMZYMQZTIOBQHFSWENZVMZTGGMTFGA4GCNBQGBTDQZBVGZRA____
+              value: quay.io/eclipse/che-buildah-base@sha256:417203d8629edd92f187afd3ebb3d8dc28338d34809eb75ffc2e08a400f8d56b
+            - name: RELATED_IMAGE_che_sidecar_workspace_data_sync_plugin_registry_image_IBZWQYJSGU3DUOBYMQYDCMRVHAZTOZBVME2TOY3CGI2GEYRTMVSDQMLFGZQTQZRUGEYTSYJVGA2DGYRXHEZDMYTEGJRGIMBRG4YTAOBVGRRTINDGGEYA____
+              value: quay.io/eclipse/che-sidecar-workspace-data-sync@sha256:88d0125837d5a57cb24bb3ed81e6a8f4119a5043b7926bd2bd01710854c44f10
+            - name: RELATED_IMAGE_che_buildkit_base_plugin_registry_image_IBZWQYJSGU3DUZLGMZQTSODEMQZGGZLEGMYGENJSGBRDENLBMZTGMMLBHA4DAZBRGIYWGZRWMIZWMODBMI2DEYJVGE2DSZLBMRQTINTCME3TSM3DMU4Q____
+              value: quay.io/eclipse/che-buildkit-base@sha256:effa98dd2ced30b520b25afff1a880d121cf6b3f8ab42a5149eada46ba793ce9
+            - name: RELATED_IMAGE_che__centos__mongodb_36_centos7_devfile_registry_image_NRQXIZLTOQWWCOJRGVSGEN3CMVRWCOBXGE4TQZTDMQ3TQNRQGA4DMOJYHFTGKODBGMZDOYJRME2GMNRVGA4DAMRVMI3DIYLCGI4GMY3DG42DEM3CGI______
+              value: quay.io/eclipse/che--centos--mongodb-36-centos7@sha256:a915db7beca87198fcd7860086989fe8a327a1a4f6508025b64ab28fcc7423b2
+            - name: RELATED_IMAGE_che__centos__mongodb_36_centos7_devfile_registry_image_NRQXIZLTOQWWMZTEMYZDIMZRMJRGGNTEHFQTSZBSMEYDGZJZGVRGEYTFHBQWIYRUHFQWEOLFMFRTGMBRMYZDMODBGM2TAMZYMM4DIMRYHAZDKOLDGE______
+              value: quay.io/eclipse/che--centos--mongodb-36-centos7@sha256:ffdf2431bbc6d9a9d2a03e95bbbe8adb49ab9eac301f268a35038c84288259c1
+            - name: RELATED_IMAGE_che__centos__mysql_57_centos7_devfile_registry_image_NRQXIZLTOQWWKMBYMVSTIZBUGNRDOMZVGY3DANZWHA2WENRZMJSGKNRTGM2WKMRXMNTDEMDDGAZDAZRTGQ2WENTDGZRTKOJUGAYDCOBTHA4DENZWGQ______
+              value: quay.io/eclipse/che--centos--mysql-57-centos7@sha256:e08ee4d43b7356607685b69bde6335e27cf20c020f345b6c6c59400183882764
+            - name: RELATED_IMAGE_che_cpp_rhel7_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-cpp-rhel7@sha256:aaf8cb7ff6d0559867fd14c59ddb87e7e642ab2dcb99807f407e95f2c45e1f84
+            - name: RELATED_IMAGE_che_dotnet_2_2_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-dotnet-2.2@sha256:4463170271629f235ddcd53fddfe8ce19ac70d918fd008613b6983b4e5782139
+            - name: RELATED_IMAGE_che_dotnet_3_1_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-dotnet-3.1@sha256:58ac9fd8aeff6a1d0ceb8d6b4eb64d439cb55b0a8b42fbbd2ebb8e876cff140c
+            - name: RELATED_IMAGE_che_golang_1_17_devfile_registry_image_GE2DGZRSG42A____
+              value: quay.io/eclipse/che-golang-1.17@sha256:4386b101e197768ce569dddb53e96e647e9cc5184eb28ede61e8f782f5516004
+            - name: RELATED_IMAGE_che_java11_gradle_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-java11-gradle@sha256:2a3079baf4556b3a81d54def3d293ecd54109130155b36a968ccdfe0e4ebb4cf
+            - name: RELATED_IMAGE_che_java11_maven_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-java11-maven@sha256:cc9e3cb0b00357ed118c130ce9f8e8e4724c718f8e2a1bd294f81696116d7b32
+            - name: RELATED_IMAGE_che_java8_maven_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-java8-maven@sha256:efff1c6b997cc14099173b3a7e94e700afcde3b246822888955f9e637aefcbdb
+            - name: RELATED_IMAGE_che_nodejs10_community_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-nodejs10-community@sha256:6ce1df02636cb02b4c07947a99cb75538b7a04a7a578d3941878d46f496c57c4
+            - name: RELATED_IMAGE_che_nodejs10_ubi_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-nodejs10-ubi@sha256:87cb1ba4929c367eac010ab2b65ee04a67b0b0ecd0070b204204a7ed27308953
+            - name: RELATED_IMAGE_che_nodejs12_community_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-nodejs12-community@sha256:66fd9710610641572b99479cfc13282b60c55a0cbe87042cfc7ea536a3ea4122
+            - name: RELATED_IMAGE_che_nodejs8_centos_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-nodejs8-centos@sha256:b796be7ea39f9b7a1a43fad69a6093fe4d30fde0dbc4aa2b5fb4d44e9e0b3cbb
+            - name: RELATED_IMAGE_che_php_7_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-php-7@sha256:9e75e4202a53defd59a3901a569cfcee7269dbe31a9a6866e8c6d98aaa799b17
+            - name: RELATED_IMAGE_che_python_3_8_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-python-3.8@sha256:d6e3bc3336514080d706cc399b479bc278cfdfe2aa8e254df108b194c04980eb
+            - name: RELATED_IMAGE_che_quarkus_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-quarkus@sha256:5a08ef7ecd394c78b1002be3ece6afb1fd084f28b0d48319443e01e805057928
+            - name: RELATED_IMAGE_che_rust_1_39_devfile_registry_image_MNSTANJSGZTA____
+              value: quay.io/eclipse/che-rust-1.39@sha256:4b9f381ca0cb1f6efe1f56572a2698aa4e9b62e7c0f92da9b60bcf0c5e85733d
+            - name: RELATED_IMAGE_ubi8_minimal_devfile_registry_image_HAXDG___
+              value: registry.access.redhat.com/ubi8-minimal@sha256:2f6b88c037c0503da7704bccd3fc73cb76324101af39ad28f16460e7bce98324
+            - name: RELATED_IMAGE_ubi_minimal_devfile_registry_image_
+              value: registry.access.redhat.com/ubi8/ubi-minimal@sha256:16da4d4c5cb289433305050a06834b7328769f8a5257ad5b4a5006465a0379ff
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 6789
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            failureThreshold: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 6789
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            failureThreshold: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          securityContext:
+            privileged: false
+            readOnlyRootFilesystem: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            limits:
+              cpu: 500m
+              memory: 5Gi
+            requests:
+              cpu: 100m
+              memory: 64Mi
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      restartPolicy: Always
+      serviceAccountName: che-operator
+      terminationGracePeriodSeconds: 20
--- a/helmcharts/stable/templates/namespace.yaml
+++ b/helmcharts/stable/templates/namespace.yaml
@ -0,0 +1,16 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: eclipse-che
--- a/helmcharts/stable/templates/org.eclipse.che_v1_checluster.yaml
+++ b/helmcharts/stable/templates/org.eclipse.che_v1_checluster.yaml
@ -0,0 +1,68 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: org.eclipse.che/v1
+kind: CheCluster
+metadata:
+  name: eclipse-che
+  namespace: eclipse-che
+spec:
+  server:
+    cheFlavor: ''
+    cheClusterRoles: ''
+    cheWorkspaceClusterRole: ''
+    serverTrustStoreConfigMapName: ''
+    gitSelfSignedCert: false
+    tlsSupport: true
+    proxyURL: ''
+    proxyPort: ''
+    proxyUser: ''
+    proxyPassword: ''
+    nonProxyHosts: ''
+    workspaceNamespaceDefault: "<username>-che"
+    allowUserDefinedWorkspaceNamespaces: false
+    serverExposureStrategy: ''
+  database:
+    externalDb: false
+    chePostgresHostName: ''
+    chePostgresPort: ''
+    chePostgresUser: ''
+    chePostgresPassword: ''
+    chePostgresDb: ''
+  storage:
+    pvcStrategy: 'common'
+    pvcClaimSize: '10Gi'
+    preCreateSubPaths: true
+    postgresPVCStorageClassName: ''
+    workspacePVCStorageClassName: ''
+  auth:
+    initialOpenShiftOAuthUser: true
+    externalIdentityProvider: false
+    identityProviderURL: ''
+    identityProviderAdminUserName: ''
+    identityProviderPassword: ''
+    identityProviderRealm: ''
+    identityProviderClientId: ''
+    oAuthClientName: ''
+    oAuthSecret: ''
+  k8s:
+    ingressDomain: '{{ .Values.k8s.ingressDomain }}'
+    ingressClass: ''
+    ingressStrategy: ''
+    tlsSecretName: 'che-tls'
+    securityContextFsGroup: ''
+    securityContextRunAsUser: ''
+    singleHostExposureType: ''
+  metrics:
+    enable: true
+  devWorkspace:
+    enable: false
--- a/helmcharts/stable/templates/role.yaml
+++ b/helmcharts/stable/templates/role.yaml
@ -0,0 +1,193 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/component: che-operator
+    app.kubernetes.io/instance: che
+    app.kubernetes.io/part-of: che.eclipse.org
+    app.kubernetes.io/name: che
+  name: che-operator
+  namespace: eclipse-che
+rules:
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses
+    verbs:
+      - '*'
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - '*'
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs:
+      - '*'
+  - apiGroups:
+      - route.openshift.io
+    resources:
+      - routes
+      - routes/custom-host
+    verbs:
+      - '*'
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - roles
+      - rolebindings
+    verbs:
+      - '*'
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - clusterroles
+      - clusterrolebindings
+    verbs:
+      - '*'
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - serviceaccounts
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+      - pods/exec
+      - pods/log
+    verbs:
+      - '*'
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+      - extensions
+    resources:
+      - deployments
+      - replicasets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - org.eclipse.che
+    resources:
+      - checlusters
+      - checlusters/status
+      - checlusters/finalizers
+      - checlusterbackups
+      - checlusterbackups/status
+      - checlusterbackups/finalizers
+      - checlusterrestores
+      - checlusterrestores/status
+      - backupserverconfigurations
+      - backupserverconfigurations/status
+      - chebackupserverconfigurations
+    verbs:
+      - '*'
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operators.coreos.com
+    resources:
+      - subscriptions
+      - clusterserviceversions
+      - operatorgroups
+    verbs:
+      - '*'
+  - apiGroups:
+      - packages.operators.coreos.com
+    resources:
+      - packagemanifests
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps/status
+    verbs:
+      - get
+      - update
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - che-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - controller.devfile.io
+    resources:
+      - devworkspaceroutings
+    verbs:
+      - '*'
+  - apiGroups:
+      - controller.devfile.io
+    resources:
+      - devworkspaceroutings/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - controller.devfile.io
+    resources:
+      - devworkspaceroutings/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - oauth.openshift.io
+    resources:
+      - oauthclients
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - get
+      - list
+      - patch
+      - update
+      - watch
--- a/helmcharts/stable/templates/role_binding.yaml
+++ b/helmcharts/stable/templates/role_binding.yaml
@ -0,0 +1,29 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: che-operator
+  labels:
+    app.kubernetes.io/name: che
+    app.kubernetes.io/instance: che
+    app.kubernetes.io/part-of: che.eclipse.org
+    app.kubernetes.io/component: che-operator
+  namespace: eclipse-che
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: che-operator
+subjects:
+  - kind: ServiceAccount
+    name: che-operator
--- a/helmcharts/stable/templates/service_account.yaml
+++ b/helmcharts/stable/templates/service_account.yaml
@ -0,0 +1,22 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: che-operator
+  labels:
+    app.kubernetes.io/name: che
+    app.kubernetes.io/instance: che
+    app.kubernetes.io/part-of: che.eclipse.org
+    app.kubernetes.io/component: che-operator
+  namespace: eclipse-che
--- a/helmcharts/stable/values.yaml
+++ b/helmcharts/stable/values.yaml
@ -0,0 +1,14 @@
+#
+# Copyright (c) 2019-2021 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+k8s:
+  ingressDomain: "192.168.99.101.nip.io"
--- a/make-release.sh
+++ b/make-release.sh
@ -210,6 +210,12 @@ updateVersionFile() {
  git commit -m "ci: Update VERSION to $RELEASE" --signoff
 }

+releaseHelmPackage() {
+  echo "[INFO] releaseHelmPackage :: release Helm package"
+  yq -rYi ".version=\"${RELEASE}\"" "$RELEASE_DIR/helmcharts/stable/Chart.yaml"
+  make update-helmcharts HELM_FOLDER="stable"
+}
+
 releaseOlmFiles() {
  echo "[INFO] releaseOlmFiles :: Release OLM files"
  echo "[INFO] releaseOlmFiles :: Launch 'olm/release-olm-files.sh' script"
@ -305,6 +311,7 @@ run() {
  checkoutToReleaseBranch
  updateVersionFile
  releaseOperatorCode
+  releaseHelmPackage
  if [[ $RELEASE_OLM_FILES == "true" ]]; then
    releaseOlmFiles
  fi