apiVersion: release-notes/v2
kind: feature
area: installation
issue:
  - 43204
releaseNotes:
- |
  **Fixed** templated CRD installation in the `base` chart by default. Previously this only worked under certain conditions,
  and when certain install flags were used, could result in CRDs that could only be upgraded via manual `kubectl` intervention.
  **Deprecated** `Values.base.enableCRDTemplates`. This option now defaults to `true` and will be removed
  in a future release. Until then, the legacy behavior can be enabled by setting this to `false`
upgradeNotes:
- title: Istio CRDs are templated by default and can be installed and upgraded via `helm install istio-base`
  content: |
    This changes how CRDs are upgraded.
    Previously, we recommended and documented:

    - Install: `helm install istio-base`
    - Upgrade: `kubectl apply -f manifests/charts/base/files/crd-all.gen.yaml` or similar.
    - Uninstall: `kubectl get crd -oname | grep --color=never 'istio.io' | xargs kubectl delete`

    This change allows:

    - Install: `helm install istio-base`
    - Upgrade: `helm upgrade istio-base`
    - Uninstall: `kubectl get crd -oname | grep --color=never 'istio.io' | xargs kubectl delete`

    Previously this only worked under certain conditions, and when certain install flags were used,
    could result in non-Helm-upgradable CRDs being generated that required manual intervention to fix.

    As a necessary consequence of this, the labels on the CRDs are changed to be consistent with other Helm-installed resources.

    If you previously installed or upgraded CRDs with `kubectl apply` and not Helm, you can continue to do so.

    If you previously installed CRDs with `helm install istio-base` OR `kubectl apply`, you can begin safely upgrading Istio CRDs
    with `helm upgrade istio-base` from this and all subsequent releases
    after running the below kubectl commands as a one-time migration:

      - `kubectl label $(kubectl get crds -l chart=istio -o name && kubectl get crds -l app.kubernetes.io/part-of=istio -o name) "app.kubernetes.io/managed-by=Helm"`
      - `kubectl annotate $(kubectl get crds -l chart=istio -o name && kubectl get crds -l app.kubernetes.io/part-of=istio -o name) "meta.helm.sh/release-name=istio-base"` (replace with actual `istio-base` Helm releasename)
      - `kubectl annotate $(kubectl get crds -l chart=istio -o name && kubectl get crds -l app.kubernetes.io/part-of=istio -o name) "meta.helm.sh/release-namespace=istio-system"` (replace with actual istio namespace)

    If desired, the legacy non-Helm-upgradable CRDs and labels can be generated by setting `Values.base.enableCRDTemplates=false`
    during `helm install base`, but this option will be removed in a future release.
