UPS operator should check if the version of existing UPS is the expected one. If it is below, update the deployment for UPS. Same goes on with the other managed components like Oauth proxy and Postgres

That's what I meant to say, at least with the image part, but now when I read what I actually said it's clearly not that. So yeah, what you're saying is better than what I said