Not sure what the best practice here is, or even how much is expected by this issue.

At least if a new image is available for UPS (and oauth-proxy and postgresql?), then deployments should get updated I guess.

Maybe having the version of the operator listed somewhere in the status of the CR could allow each re-deploy of the operator to check if it needs to re-check everything?