diff --git a/charts/k8up/Chart.yaml b/charts/k8up/Chart.yaml
index ec3755f36..fd28ef38b 100644
--- a/charts/k8up/Chart.yaml
+++ b/charts/k8up/Chart.yaml
@@ -6,9 +6,9 @@ keywords:
   - backup
   - operator
   - restic
-version: 2.0.5
+version: 3.0.0
 sources:
   - https://github.com/k8up-io/k8up
 maintainers:
-  - name: APPUiO Team
+  - name: K8up Authors
     email: info@appuio.ch
diff --git a/charts/k8up/README.gotmpl.md b/charts/k8up/README.gotmpl.md
index df76c3491..c77e5d361 100644
--- a/charts/k8up/README.gotmpl.md
+++ b/charts/k8up/README.gotmpl.md
@@ -39,3 +39,21 @@ Document your changes in values.yaml and let `make docs:helm` generate this sect
 * Note: `image.tag` changed from `v1.x` to `v2.x`. Please see the [full changelog](https://github.com/k8up-io/k8up/releases/tag/v2.0.0).
 * `metrics.prometheusRule.legacyRules` has been removed (no support for OpenShift 3.11 anymore).
 * Note: `k8up.backupImage.repository` changed from `quay.io/vshn/wrestic` to `ghcr.io/k8up-io/k8up` (`wrestic` is not needed anymore in K8up v2).
+
+## Upgrading from Charts 2.x to 3.x
+
+Due to the migration of the chart from [APPUiO](https://github.com/appuio/charts/tree/master/appuio/k8up) to this repo, we decided to make a breaking change for the chart.
+Only chart archives from version 3.x can be downloaded from the https://k8up-io.github.io/k8up index.
+No 2.x chart releases will be migrated from the APPUiO Helm repo.
+
+Some RBAC roles and role bindings have change the name.
+In most cases this shouldn't be an issue and Helm should be able to cleanup the old resources without impact on the RBAC permissions.
+
+* New parameter: `podAnnotations`, default `{}`.
+* New parameter: `service.annotations`, default `{}`.
+* Note: Renamed ClusterRole `${release-name}-manager-role` to `${release-name}-manager`.
+* Note: Spec of ClusterRole `${release-name}-leader-election-role` moved to `${release-name}-manager`.
+* Note: Renamed ClusterRoleBinding `${release-name}-manager-rolebinding` to `${release-name}`.
+* Note: ClusterRoleBinding `${release-name}-leader-election-rolebinding` removed (not needed anymore).
+* Note: Renamed ClusterRole `${release-name}-k8up-view` to `${release-name}-view`.
+* Note: Renamed ClusterRole `${release-name}-k8up-edit` to `${release-name}-edit`.
diff --git a/charts/k8up/README.md b/charts/k8up/README.md
index 841604115..78633899d 100644
--- a/charts/k8up/README.md
+++ b/charts/k8up/README.md
@@ -1,6 +1,6 @@
 # k8up
 
-![Version: 2.0.5](https://img.shields.io/badge/Version-2.0.5-informational?style=flat-square)
+![Version: 3.0.0](https://img.shields.io/badge/Version-3.0.0-informational?style=flat-square)
 
 Kubernetes and OpenShift Backup Operator based on restic
 
@@ -13,7 +13,7 @@ helm repo add k8up-io https://k8up-io.github.io/k8up
 helm install k8up k8up-io/k8up
 ```
 ```bash
-kubectl apply -f https://github.com/k8up-io/k8up/releases/download/k8up-2.0.5/k8up-crd.yaml
+kubectl apply -f https://github.com/k8up-io/k8up/releases/download/k8up-3.0.0/k8up-crd.yaml
 ```
 
 <!---
@@ -63,6 +63,7 @@ Document your changes in values.yaml and let `make docs:helm` generate this sect
 | metrics.prometheusRule.enabled | bool | `false` | Whether to enable PrometheusRule manifest for [Prometheus Operator][prometheus-operator] |
 | metrics.prometheusRule.jobFailedRulesFor | list | `["archive","backup","check","prune","restore"]` | Create default rules for the given job types. Valid values are "archive", "backup", "check", "prune", and "restore". |
 | metrics.prometheusRule.namespace | string | `""` | If the object should be installed in a different namespace than operator |
+| metrics.service.annotations | object | `{}` | Annotations to add to the service |
 | metrics.service.nodePort | int | `0` | Service node port of the metrics endpoint, requires `metrics.service.type=NodePort` |
 | metrics.service.port | int | `8080` |  |
 | metrics.service.type | string | `"ClusterIP"` |  |
@@ -71,13 +72,14 @@ Document your changes in values.yaml and let `make docs:helm` generate this sect
 | metrics.serviceMonitor.namespace | string | `""` | If the object should be installed in a different namespace than operator |
 | metrics.serviceMonitor.scrapeInterval | string | `"60s"` | Scrape interval to collect metrics |
 | nodeSelector | object | `{}` |  |
-| podSecurityContext | object | `{}` |  |
+| podAnnotations | object | `{}` | Annotations to add to the Pod spec. |
+| podSecurityContext | object | `{}` | Security context to add to the Pod spec. |
 | rbac.create | bool | `true` | Create cluster roles and rolebinding. May need elevated permissions to create cluster roles and -bindings. |
 | replicaCount | int | `1` | How many operator pods should run. Note: Operator features leader election for K8s 1.16 and later, so that only 1 pod is reconciling/scheduling jobs. Follower pods reduce interruption time as they're on hot standby when leader is unresponsive. |
 | resources.limits.memory | string | `"256Mi"` | Memory limit of K8up operator. See [supported units][resource-units]. |
 | resources.requests.cpu | string | `"20m"` | CPU request of K8up operator. See [supported units][resource-units]. |
 | resources.requests.memory | string | `"128Mi"` | Memory request of K8up operator. See [supported units][resource-units]. |
-| securityContext | object | `{}` |  |
+| securityContext | object | `{}` | Container security context |
 | serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
 | serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
 | tolerations | list | `[]` |  |
@@ -99,6 +101,24 @@ Document your changes in values.yaml and let `make docs:helm` generate this sect
 * `metrics.prometheusRule.legacyRules` has been removed (no support for OpenShift 3.11 anymore).
 * Note: `k8up.backupImage.repository` changed from `quay.io/vshn/wrestic` to `ghcr.io/k8up-io/k8up` (`wrestic` is not needed anymore in K8up v2).
 
+## Upgrading from Charts 2.x to 3.x
+
+Due to the migration of the chart from [APPUiO](https://github.com/appuio/charts/tree/master/appuio/k8up) to this repo, we decided to make a breaking change for the chart.
+Only chart archives from version 3.x can be downloaded from the https://k8up-io.github.io/k8up index.
+No 2.x chart releases will be migrated from the APPUiO Helm repo.
+
+Some RBAC roles and role bindings have change the name.
+In most cases this shouldn't be an issue and Helm should be able to cleanup the old resources without impact on the RBAC permissions.
+
+* New parameter: `podAnnotations`, default `{}`.
+* New parameter: `service.annotations`, default `{}`.
+* Note: Renamed ClusterRole `${release-name}-manager-role` to `${release-name}-manager`.
+* Note: Spec of ClusterRole `${release-name}-leader-election-role` moved to `${release-name}-manager`.
+* Note: Renamed ClusterRoleBinding `${release-name}-manager-rolebinding` to `${release-name}`.
+* Note: ClusterRoleBinding `${release-name}-leader-election-rolebinding` removed (not needed anymore).
+* Note: Renamed ClusterRole `${release-name}-k8up-view` to `${release-name}-view`.
+* Note: Renamed ClusterRole `${release-name}-k8up-edit` to `${release-name}-edit`.
+
 ## Source Code
 
 * <https://github.com/k8up-io/k8up>
diff --git a/charts/k8up/templates/deployment.yaml b/charts/k8up/templates/deployment.yaml
index 73dd022da..c4ad1ef7f 100644
--- a/charts/k8up/templates/deployment.yaml
+++ b/charts/k8up/templates/deployment.yaml
@@ -11,6 +11,10 @@ spec:
       {{- include "k8up.selectorLabels" . | nindent 6 }}
   template:
     metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       labels:
         {{- include "k8up.selectorLabels" . | nindent 8 }}
     spec:
diff --git a/charts/k8up/templates/service.yaml b/charts/k8up/templates/service.yaml
index 476d930b5..4f44cd021 100644
--- a/charts/k8up/templates/service.yaml
+++ b/charts/k8up/templates/service.yaml
@@ -3,7 +3,11 @@ kind: Service
 metadata:
   name: {{ include "k8up.fullname" . }}-metrics
   labels:
-{{ include "k8up.labels" . | indent 4 }}
+    {{- include "k8up.labels" . | nindent 4 }}
+  {{- with .Values.metrics.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   type: {{ .Values.metrics.service.type }}
   ports:
diff --git a/charts/k8up/values.yaml b/charts/k8up/values.yaml
index 616222ca3..be38ea2a0 100644
--- a/charts/k8up/values.yaml
+++ b/charts/k8up/values.yaml
@@ -65,7 +65,11 @@ k8up:
       # -- Global Memory resource limit applied to jobs. See [supported units][resource-units].
       memory: ""
 
+# -- Annotations to add to the Pod spec.
+podAnnotations: {}
+# -- Security context to add to the Pod spec.
 podSecurityContext: {}
+# -- Container security context
 securityContext: {}
 
 nodeSelector: {}
@@ -80,6 +84,9 @@ metrics:
     type: ClusterIP
     # -- Service node port of the metrics endpoint, requires `metrics.service.type=NodePort`
     nodePort: 0
+    # -- Annotations to add to the service
+    annotations: {}
+
   serviceMonitor:
     # -- Whether to enable ServiceMonitor manifests for
     # [Prometheus Operator][prometheus-operator]