When upgrading from a v3.6 to v3.7 a new "managed-key" secret is created every time the reconcile runs, causing quay, mirror and config editor to be redeployed every single time.

This happens because the original secret does not contain the "config editor password" and "clair PSK key" stored and as it is used as a base for the deployment these properties are randomly generated every time.