diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index b4c16492..00000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,282 +0,0 @@
-version: 2.1
-
-orbs:
-  helm: banzaicloud/helm@0.0.8
-  docker: circleci/docker@1.5.0
-
-executors:
-  helm311:
-    docker:
-      - image: ghcr.io/banzaicloud/helm:0.0.7
-
-jobs:
-  build:
-    resource_class: large
-    docker:
-      - image: cimg/go:1.17
-        environment:
-          GOFLAGS: -mod=readonly
-
-    steps:
-      - checkout
-      - run:
-          name: Check
-          environment:
-            LINTER_FLAGS: --timeout=2m
-          command: |
-            make check-circle
-
-  e2e-test:
-    machine:
-      image: ubuntu-1604:201903-01
-      docker_layer_caching: true
-    environment:
-      GO_VERSION: '1.17'
-      K8S_VERSION: 'v1.20.0'
-      #VAULT_VERSION: '1.0.0'
-      KUBECONFIG: '/home/circleci/.kube/config'
-      MINIKUBE_VERSION: 'v1.16.0'
-      MINIKUBE_WANTUPDATENOTIFICATION: 'false'
-      MINIKUBE_WANTREPORTERRORPROMPT: 'false'
-      MINIKUBE_HOME: '/home/circleci'
-      CHANGE_MINIKUBE_NONE_USER: 'true'
-      HELM_VERSION: 'v3.5.0'
-#      GOPATH: '/home/circleci/go'
-    steps:
-      - run:
-          name: Setup minikube
-          command: |
-            curl -Lo minikube https://github.com/kubernetes/minikube/releases/download/${MINIKUBE_VERSION}/minikube-linux-amd64 \
-            && chmod +x minikube \
-            && sudo mv minikube /usr/local/bin/
-
-      - run:
-          name: Start minikube
-          background: true
-          command: |
-            sudo -E minikube start --vm-driver=none --cpus 2 --memory 4096 --kubernetes-version=${K8S_VERSION}
-
-      - run:
-          name: Setup kubectl
-          command: |
-            curl -Lo kubectl https://storage.googleapis.com/kubernetes-release/release/${K8S_VERSION}/bin/linux/amd64/kubectl \
-            && chmod +x kubectl \
-            && sudo mv kubectl /usr/local/bin/
-
-            mkdir -p ${HOME}/.kube
-            touch ${HOME}/.kube/config
-
-      - checkout
-#      - run:
-#          name: Create go directory
-#          command: |
-#            sudo mkdir /go
-#            sudo chmod 777 /go
-#
-#      - run:
-#          name: Setup golang
-#          command: |
-#            sudo rm -rf /usr/local/go
-#            curl \
-#              -Lo go.linux-amd64.tar.gz \
-#              "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz" \
-#            && sudo tar -C /usr/local -xzf go.linux-amd64.tar.gz
-#            echo 'export PATH="$GOPATH/bin:$PATH"' >> "${BASH_ENV}"
-#            rm go.linux-amd64.tar.gz
-
-      - run:
-          name: Build docker image
-          command: |
-            app_version="$(awk '/appVersion:/{print $2}' charts/thanos-operator/Chart.yaml)"
-            docker build -t banzaicloud/thanos-operator:${app_version} .
-
-      - run:
-          name: Wait for minikube
-          command: |
-            timeout 180s bash \<<EOT
-              set -o pipefail
-              function is_ready()
-              {
-                kubectl get nodes -o json \
-                  | jq '.items[].status.conditions[] | select(.type=="Ready" and .status=="True")'
-              }
-
-              until is_ready
-              do
-                sleep 1
-              done
-            EOT
-
-      - run:
-          name: Setup helm
-          command: |
-            curl -L "https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3" \
-              | bash -s -- -v "${HELM_VERSION}"
-            helm repo add banzaicloud-stable https://kubernetes-charts.banzaicloud.com/
-
-      - run:
-          name: Create monitoring namespace
-          command: |
-            kubectl create namespace monitoring
-
-      - run:
-          name: Start Minio
-          command: |
-            kubectl create -f hack/minio.yaml
-            kubectl wait --namespace monitoring --for=condition=available deployment/minio-deployment --timeout=120s
-            minio="$(kubectl get pod --namespace monitoring -l app=minio -o 'jsonpath={.items[0].metadata.name}')"
-            kubectl wait --namespace monitoring--for=condition=Ready pod "${minio}" --timeout=120s
-
-      - run:
-          name: Install thanos operator
-          command: |
-            helm install --namespace monitoring charts/thanos-operator
-#
-#      - run:
-#          name: Setup minio cli
-#          command: |
-#            kubectl create -f hack/minio-mc.yaml
-#            kubectl wait --namespace logging --for=condition=available deployment/minio-mc-deployment --timeout=120s
-#            mc_pod="$(kubectl get pod --namespace logging -l app=minio-mc -o 'jsonpath={.items[0].metadata.name}')"
-#            kubectl wait --namespace logging --for=condition=Ready pod "${mc_pod}" --timeout=120s
-#            kubectl exec --namespace logging "${mc_pod}" -- \
-#              mc config host add minio \
-#                'http://minio-service.logging.svc.cluster.local:9000' \
-#                'minio_access_key' \
-#                'minio_secret_key'
-#
-#      - run:
-#          name: Test
-#          command: |
-#            hack/test.sh
-#
-#  docker-release:
-#    executor:
-#      name: docker/machine
-#      dlc: true
-#    parameters:
-#      tag:
-#        default: $CIRCLE_SHA1
-#        description: 'Image tag'
-#        type: string
-#      extra_build_args:
-#        default: ''
-#        description: >
-#          Extra flags to pass to docker build. For examples, see https://docs.docker.com/engine/reference/commandline/build
-#        type: string
-#      image:
-#        description: Name of image to build
-#        type: string
-#      registry:
-#        default: docker.io
-#        description:
-#          Name of registry to use, defaults to docker.io
-#        type: string
-#    steps:
-#      - checkout
-#      - docker/check
-#      - docker/build:
-#          extra_build_args: <<parameters.extra_build_args>>
-#          registry: <<parameters.registry>>
-#          image: <<parameters.image>>
-#          tag: $CIRCLE_SHA1
-#      - run:
-#          name: Tag release
-#          command: |
-#            docker tag <<parameters.image>>:$CIRCLE_SHA1 <<parameters.registry>>/<<parameters.image>>:<<parameters.tag>>
-#      - docker/push:
-#          registry: <<parameters.registry>>
-#          image: <<parameters.image>>
-#          tag: <<parameters.tag>>
-#      - run:
-#          name: Check version
-#          command: |
-#            if ! echo "${CIRCLE_TAG}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
-#              echo 'Unstable version. Skipping further steps.'
-#              circleci step halt
-#            fi
-#      - run:
-#          name: Tag latest
-#          command: |
-#            docker tag <<parameters.image>>:$CIRCLE_SHA1 <<parameters.registry>>/<<parameters.image>>:latest
-#      - docker/push:
-#          registry: <<parameters.registry>>
-#          image: <<parameters.image>>
-#          tag: latest
-
-workflows:
-  version: 2
-  build:
-    jobs:
-      - build:
-          filters:
-            tags:
-              only: /.*/
-            branches:
-              only: /.*/
-      - docker/publish:
-          name: Publish latest docker image from master
-          executor:
-            name: docker/machine
-            dlc: true
-          context: dockerhub
-          deploy: true
-          image: banzaicloud/thanos-operator
-          tag: master
-          requires:
-            - build
-          filters:
-            branches:
-              only: master
-            tags:
-              ignore: /.*/
-      - docker/publish:
-          name: Publish stable docker image
-          executor:
-            name: docker/machine
-            dlc: true
-          context: dockerhub
-          deploy: true
-          image: banzaicloud/thanos-operator
-          tag: latest,$CIRCLE_TAG
-          requires:
-            - build
-          filters:
-            tags:
-              only: /^[0-9]+\.[0-9]+\.[0-9]+$/
-            branches:
-              ignore: /.*/
-      - docker/publish:
-          name: Publish unstable docker image
-          executor:
-            name: docker/machine
-            dlc: true
-          context: dockerhub
-          deploy: true
-          image: banzaicloud/thanos-operator
-          tag: $CIRCLE_TAG
-          requires:
-            - build
-          filters:
-            tags:
-              only: /^[0-9]+\.[0-9]+\.[0-9]+-(?:dev|rc)\.[0-9]+$/
-            branches:
-              ignore: /.*/
-  helm-chart:
-    jobs:
-      - helm/lint-chart:
-          name: 'Helm lint'
-          executor: helm311
-          filters:
-            tags:
-              ignore: /.*/
-
-      - helm/publish-chart:
-          name: 'Publish chart'
-          executor: helm311
-          context: helm
-          filters:
-            branches:
-              ignore: /.*/
-            tags:
-              only: /chart\/.*\/\d+.\d+.\d+.*/
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 00000000..21b5cb91
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+
+env:
+  GOFLAGS: '-mod=readonly'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.17
+
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Run checks
+        env:
+          LINTER_FLAGS: '--timeout=2m'
+        run: make check-circle
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 5cf2c9e2..052aa01a 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -31,12 +31,18 @@ jobs:
             ${{ runner.os }}-buildx-
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.CR_PAT }}
 
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
       - name: Determine tag or commit
         uses: haya14busa/action-cond@v1
         id: refortag
@@ -50,13 +56,15 @@ jobs:
         env:
           TAG_OR_BRANCH: ${{ steps.refortag.outputs.value }}
       - name: Build thanos-operator
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
-          tags: ghcr.io/banzaicloud/thanos-operator:${{ steps.imagetag.outputs.value }}
           file: Dockerfile
           platforms: ${{ env.PLATFORMS }}
           push: true
           cache-from: type=local,src=/tmp/.buildx-cache
           cache-to: type=local,dest=/tmp/.buildx-cache
+          tags: |
+            ghcr.io/banzaicloud/thanos-operator:${{ steps.imagetag.outputs.value }}
+            banzaicloud/thanos-operator:${{ steps.imagetag.outputs.value }}
 
 
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
new file mode 100644
index 00000000..8e377cfa
--- /dev/null
+++ b/.github/workflows/helm.yml
@@ -0,0 +1,102 @@
+name: Helm chart
+
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - "chart/**/[0-9]+.[0-9]+.[0-9]+"
+      - "chart/**/[0-9]+.[0-9]+.[0-9]+-dev.[0-9]+"
+  pull_request:
+
+env:
+  HELM_CHART_NAME: thanos-operator
+  HELM_CHART_PATH: "${{ github.workspace }}/charts/thanos-operator"
+  HELM_PLUGIN_CHARTMUSEUM_PUSH_VERSION: 0.9.0
+  HELM_PUSH_REPOSITORY_NAME: banzaicloud-stable
+  HELM_VERSION: 3.6.0
+
+jobs:
+  helm:
+    name: Helm
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - uses: azure/setup-helm@v1
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Add Helm repositories
+        run: |
+          helm repo add banzaicloud-stable "https://kubernetes-charts.banzaicloud.com"
+          helm repo add incubator "https://charts.helm.sh/incubator"
+          helm repo add stable "https://charts.helm.sh/stable"
+
+      - name: Update Helm repositories
+        run: helm repo update
+
+      - name: Lint Helm chart
+        run: helm lint "${{ env.HELM_CHART_PATH }}"
+
+      - name: Update Helm chart dependencies
+        run: helm dependency update  "${{ env.HELM_CHART_PATH }}"
+
+      - name: Package Helm chart
+        id: package-chart
+        run: |
+          HELM_PACKAGE_OUTPUT=$(helm package "${{ env.HELM_CHART_PATH }}") || exit 1
+          HELM_PACKAGE_PATH="${HELM_PACKAGE_OUTPUT##"Successfully packaged chart and saved it to: "}"
+
+          echo "HELM_PACKAGE_PATH=${HELM_PACKAGE_PATH}"
+          echo ::set-output name=helm_package_path::${HELM_PACKAGE_PATH}
+
+      - name: Set Git refname
+        id: set-git-refname
+        run: |
+          GIT_REFNAME="$(echo "${{ github.ref }}" | sed -r 's@refs/(heads|pull|tags)/@@g')"
+
+          echo "GIT_REFNAME=${GIT_REFNAME}"
+          echo ::set-output name=git_refname::${GIT_REFNAME}
+
+      - name: Set Helm push enabled
+        id: set-helm-push-enabled
+        run: |
+          HELM_PUSH_ENABLED=""
+          if [ "${{ github.event_name }}" == "push" ] && echo "${{ steps.set-git-refname.outputs.git_refname }}" | grep -E -q "^chart/${{ env.HELM_CHART_NAME }}/[0-9]+.[0-9]+.[0-9]+**"; then
+            HELM_PUSH_ENABLED=1
+          else
+            printf >&2 "Unstable chart (%s) from %s event, chart will not be pushed" "${{ steps.set-git-refname.outputs.git_refname }}" "${{ github.event_name }}"
+          fi
+
+          echo "HELM_PUSH_ENABLED=${HELM_PUSH_ENABLED}"
+          echo ::set-output name=helm_push_enabled::${HELM_PUSH_ENABLED}
+
+      - if: ${{ steps.set-helm-push-enabled.outputs.helm_push_enabled == 1 }}
+        name: Check Helm chart version in repository
+        run: |
+          EXPECTED_CHART_VERSION="$(echo "${{ steps.set-git-refname.outputs.git_refname }}" | awk -F '/' '{print $NF}')" || exit 1
+          ACTUAL_CHART_VERSION="$(awk '/version: [0-9]+\.[0-9]+\.[0-9]+/ {print $2}' "${{ env.HELM_CHART_PATH }}/Chart.yaml")" || exit 1
+
+          if [ "${EXPECTED_CHART_VERSION}" != "${ACTUAL_CHART_VERSION}" ]; then
+            printf >&2 "chart version mismatches, name: %s, expected version (from tag): %s, actual version (from chart): %s" "${{ env.HELM_CHART_NAME }}" "${EXPECTED_CHART_VERSION}" "${ACTUAL_CHART_VERSION}"
+            exit 1
+          fi
+
+          if helm search repo "${{ env.HELM_PUSH_REPOSITORY_NAME }}/${{ env.HELM_CHART_NAME }}" --version "${ACTUAL_CHART_VERSION}" --output json | jq --exit-status 'length > 0'; then
+              printf >&2 "chart version already exists in the repository, repository: %s, name: %s, version: %s" "${{ env.HELM_PUSH_REPOSITORY_NAME }}" "${{ env.HELM_CHART_NAME }}" "${ACTUAL_CHART_VERSION}"
+              exit 1
+          fi
+
+      - if: ${{ steps.set-helm-push-enabled.outputs.helm_push_enabled == 1 }}
+        name: Install Helm ChartMuseum push plugin
+        run: helm plugin install "https://github.com/chartmuseum/helm-push.git" --version "${{ env.HELM_PLUGIN_CHARTMUSEUM_PUSH_VERSION }}"
+
+      - if: ${{ steps.set-helm-push-enabled.outputs.helm_push_enabled == 1 }}
+        name: Push Helm chart
+        env:
+          HELM_REPO_PASSWORD: ${{ secrets.HELM_REPO_PASSWORD }}
+          HELM_REPO_USERNAME: ${{ secrets.HELM_REPO_USERNAME }}
+        run: helm push "${{ steps.package-chart.outputs.helm_package_path }}" "${{ env.HELM_PUSH_REPOSITORY_NAME }}"