diff --git a/build/rbac/rbac.yaml b/build/rbac/rbac.yaml
index 230d0173616a7..3445c459f6daf 100644
--- a/build/rbac/rbac.yaml
+++ b/build/rbac/rbac.yaml
@@ -74,6 +74,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
+    helm.sh/chart: rook-ceph-0.0.1
 rules:
   - apiGroups:
       - policy
@@ -177,6 +183,29 @@ rules:
     resources: [serviceaccounts]
     verbs: [get]
 ---
+<<<<<<< HEAD
+=======
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rook-ceph-agent-mount
+  labels:
+    operator: rook
+    storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - secrets
+    verbs:
+      - get
+---
+>>>>>>> c1e54f5ad (build: create resources with k8s recommended labels)
 # The cluster role for managing all the cluster-specific resources in a namespace
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -185,6 +214,11 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
   - apiGroups:
       - ''
@@ -217,6 +251,11 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
   - apiGroups:
       - ''
@@ -342,6 +381,11 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
   - apiGroups:
       - ''
@@ -398,6 +442,11 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
   - apiGroups: ['']
     resources: [secrets, configmaps]
@@ -463,6 +512,11 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
   # Most resources are represented by a string representation of their name, such as “pods”, just as it appears in the URL for the relevant API endpoint.
   # However, some Kubernetes APIs involve a “subresource”, such as the logs for a pod. [...]
@@ -535,6 +589,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
+    helm.sh/chart: rook-ceph-0.0.1
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -593,6 +653,11 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -609,6 +674,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
+    helm.sh/chart: rook-ceph-0.0.1
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -621,6 +692,31 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
+<<<<<<< HEAD
+=======
+  name: rook-ceph-system-psp-users
+  labels:
+    operator: rook
+    storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
+    helm.sh/chart: rook-ceph-0.0.1
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: rook-ceph-system-psp-user
+subjects:
+  - kind: ServiceAccount
+    name: rook-ceph-system
+    namespace: rook-ceph
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+>>>>>>> c1e54f5ad (build: create resources with k8s recommended labels)
   name: rook-csi-cephfs-plugin-sa-psp
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -892,6 +988,11 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
   - apiGroups:
       - ''
@@ -1019,6 +1120,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
+    helm.sh/chart: rook-ceph-0.0.1
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -1123,6 +1230,11 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -1140,6 +1252,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
+    helm.sh/chart: rook-ceph-0.0.1
 ---
 # Service account for the Ceph Mgr. Must exist and cannot be renamed.
 apiVersion: v1
@@ -1150,6 +1268,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
+    helm.sh/chart: rook-ceph-0.0.1
 ---
 # Service account for the Ceph OSDs. Must exist and cannot be renamed.
 apiVersion: v1
@@ -1160,6 +1284,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
+    helm.sh/chart: rook-ceph-0.0.1
 ---
 # Service account for the purge osd job
 apiVersion: v1
@@ -1177,6 +1307,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/created-by: rook-ceph-operator
+    helm.sh/chart: rook-ceph-0.0.1
 ---
 # Service account for the cephfs csi driver
 apiVersion: v1
diff --git a/cluster/charts/rook-ceph/templates/_helpers.tpl b/cluster/charts/rook-ceph/templates/_helpers.tpl
index 529b4901755eb..0dcb43af26045 100644
--- a/cluster/charts/rook-ceph/templates/_helpers.tpl
+++ b/cluster/charts/rook-ceph/templates/_helpers.tpl
@@ -24,3 +24,14 @@ imagePullSecrets:
 {{ toYaml .Values.imagePullSecrets }}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "rook-ceph.labels" -}}
+app.kubernetes.io/name: rook-ceph
+app.kubernetes.io/component: csi
+app.kubernetes.io/part-of: rook-ceph
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/created-by: rook-ceph-operator
+{{- end -}}
diff --git a/cluster/charts/rook-ceph/templates/clusterrole.yaml b/cluster/charts/rook-ceph/templates/clusterrole.yaml
index a1b37c6c2e695..14d0831fdcce5 100644
--- a/cluster/charts/rook-ceph/templates/clusterrole.yaml
+++ b/cluster/charts/rook-ceph/templates/clusterrole.yaml
@@ -6,6 +6,7 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    {{- include "rook-ceph.labels" . | nindent 4 }}
 rules:
   # Most resources are represented by a string representation of their name, such as “pods”, just as it appears in the URL for the relevant API endpoint.
   # However, some Kubernetes APIs involve a “subresource”, such as the logs for a pod. [...]
@@ -26,6 +27,7 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    {{- include "rook-ceph.labels" . | nindent 4 }}
 rules:
 - apiGroups:
   - ""
@@ -58,6 +60,7 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    {{- include "rook-ceph.labels" . | nindent 4 }}
 rules:
 - apiGroups:
   - ""
@@ -183,6 +186,7 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    {{- include "rook-ceph.labels" . | nindent 4 }}
 rules:
 - apiGroups:
   - ""
@@ -239,6 +243,7 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    {{- include "rook-ceph.labels" . | nindent 4 }}
 rules:
   - apiGroups: [""]
     resources: ["secrets", "configmaps"]
@@ -296,6 +301,28 @@ rules:
   verbs:
   - get
   - list
+<<<<<<< HEAD
+=======
+# Use a default dict to avoid 'can't give argument to non-function' errors from text/template
+{{- if ne ((.Values.agent | default (dict "mountSecurityMode" "")).mountSecurityMode | default "") "Any" }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rook-ceph-agent-mount
+  labels:
+    operator: rook
+    storage-backend: ceph
+    {{- include "rook-ceph.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+{{- end }}
+>>>>>>> c1e54f5ad (build: create resources with k8s recommended labels)
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
@@ -468,7 +495,8 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- include "rook-ceph.labels" . | nindent 4 }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
 rules:
 - apiGroups:
   - policy
diff --git a/cluster/charts/rook-ceph/templates/clusterrolebinding.yaml b/cluster/charts/rook-ceph/templates/clusterrolebinding.yaml
index ec036d70301f0..cd95d906a22ae 100644
--- a/cluster/charts/rook-ceph/templates/clusterrolebinding.yaml
+++ b/cluster/charts/rook-ceph/templates/clusterrolebinding.yaml
@@ -6,6 +6,7 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    {{- include "rook-ceph.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -23,7 +24,8 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- include "rook-ceph.labels" . | nindent 4 }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -123,7 +125,8 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- include "rook-ceph.labels" . | nindent 4 }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -141,7 +144,8 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- include "rook-ceph.labels" . | nindent 4 }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -154,6 +158,27 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
+<<<<<<< HEAD
+=======
+  name: rook-ceph-system-psp-users
+  labels:
+    operator: rook
+    storage-backend: ceph
+    {{- include "rook-ceph.labels" . | nindent 4 }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: rook-ceph-system-psp-user
+subjects:
+- kind: ServiceAccount
+  name: rook-ceph-system
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+>>>>>>> c1e54f5ad (build: create resources with k8s recommended labels)
   name: rook-csi-cephfs-provisioner-sa-psp
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/cluster/charts/rook-ceph/templates/deployment.yaml b/cluster/charts/rook-ceph/templates/deployment.yaml
index 2af242a26bf5e..03e30677600c9 100644
--- a/cluster/charts/rook-ceph/templates/deployment.yaml
+++ b/cluster/charts/rook-ceph/templates/deployment.yaml
@@ -5,7 +5,8 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- include "rook-ceph.labels" . | nindent 4 }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
 spec:
   replicas: 1
   selector:
@@ -15,7 +16,7 @@ spec:
     metadata:
       labels:
         app: rook-ceph-operator
-        chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
 {{- if .Values.annotations }}
       annotations:
 {{ toYaml .Values.annotations | indent 8 }}
diff --git a/cluster/charts/rook-ceph/templates/role.yaml b/cluster/charts/rook-ceph/templates/role.yaml
index c27c11cd5f49a..f268ba5a2040a 100644
--- a/cluster/charts/rook-ceph/templates/role.yaml
+++ b/cluster/charts/rook-ceph/templates/role.yaml
@@ -8,6 +8,7 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    {{- include "rook-ceph.labels" . | nindent 4 }}
 rules:
 - apiGroups:
   - ""
diff --git a/cluster/charts/rook-ceph/templates/rolebinding.yaml b/cluster/charts/rook-ceph/templates/rolebinding.yaml
index aeda4636ad7be..a8a8dd079edbd 100644
--- a/cluster/charts/rook-ceph/templates/rolebinding.yaml
+++ b/cluster/charts/rook-ceph/templates/rolebinding.yaml
@@ -8,6 +8,7 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    {{- include "rook-ceph.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
diff --git a/cluster/charts/rook-ceph/templates/serviceaccount.yaml b/cluster/charts/rook-ceph/templates/serviceaccount.yaml
index f9317cb0a8962..6021a20ce8d45 100644
--- a/cluster/charts/rook-ceph/templates/serviceaccount.yaml
+++ b/cluster/charts/rook-ceph/templates/serviceaccount.yaml
@@ -7,7 +7,8 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- include "rook-ceph.labels" . | nindent 4 }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
 {{ template "imagePullSecrets" . }}
 ---
 # Service account for the Ceph OSDs. Must exist and cannot be renamed.
@@ -19,7 +20,8 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- include "rook-ceph.labels" . | nindent 4 }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
 {{ template "imagePullSecrets" . }}
 ---
 # Service account for the Ceph Mgr. Must exist and cannot be renamed.
@@ -31,7 +33,8 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- include "rook-ceph.labels" . | nindent 4 }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
 {{ template "imagePullSecrets" . }}
 ---
 apiVersion: v1
@@ -42,7 +45,8 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- include "rook-ceph.labels" . | nindent 4 }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
 {{ template "imagePullSecrets" . }}
 ---
 # Service account for the cephfs csi driver
diff --git a/cluster/examples/kubernetes/ceph/common.yaml b/cluster/examples/kubernetes/ceph/common.yaml
index 6eac0f539e1e2..0181915c2f2df 100644
--- a/cluster/examples/kubernetes/ceph/common.yaml
+++ b/cluster/examples/kubernetes/ceph/common.yaml
@@ -41,6 +41,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
   - apiGroups:
       - ""
@@ -70,6 +76,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
     # Most resources are represented by a string representation of their name, such as “pods”, just as it appears in the URL for the relevant API endpoint.
     # However, some Kubernetes APIs involve a “subresource”, such as the logs for a pod. [...]
@@ -91,6 +103,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
   - apiGroups:
       - ""
@@ -137,6 +155,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
   - apiGroups:
       - ""
@@ -262,6 +286,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
   - apiGroups:
       - ""
@@ -303,6 +333,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 rules:
   - apiGroups: [""]
     resources: ["secrets", "configmaps"]
@@ -359,6 +395,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 # imagePullSecrets:
 # - name: my-registry-secret
 
@@ -374,6 +416,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -390,6 +438,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -407,6 +461,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/cluster/examples/kubernetes/ceph/operator-openshift.yaml b/cluster/examples/kubernetes/ceph/operator-openshift.yaml
index 4341195244bdf..beacbdbd1e49c 100644
--- a/cluster/examples/kubernetes/ceph/operator-openshift.yaml
+++ b/cluster/examples/kubernetes/ceph/operator-openshift.yaml
@@ -424,6 +424,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 spec:
   selector:
     matchLabels:
diff --git a/cluster/examples/kubernetes/ceph/operator.yaml b/cluster/examples/kubernetes/ceph/operator.yaml
index 37dbe11c6a4de..09d4d8caf041d 100644
--- a/cluster/examples/kubernetes/ceph/operator.yaml
+++ b/cluster/examples/kubernetes/ceph/operator.yaml
@@ -341,6 +341,12 @@ metadata:
   labels:
     operator: rook
     storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/instance: rook-ceph
+    app.kubernetes.io/component: csi
+    app.kubernetes.io/part-of: rook-ceph
+    app.kubernetes.io/managed-by: rook-ceph-operator
+    app.kubernetes.io/created-by: rook-ceph-operator
 spec:
   selector:
     matchLabels: