Istio CRDs in Big Bang

The Istio CRDs package installs the cluster-scoped resources required by Istiod and the remaining Istio packages. Big Bang deploys release istio-crds to istio-system; Istiod depends on that release.

Configuration

With packageConfiguration.version: v1, configure this package under packages.istioCRDs. The legacy istioCRDs entry remains supported. See Package Management for the configuration contract and precedence rules.

Big Bang passes upstream base-chart configuration through packages.istioCRDs.values.upstream. Use the bundled chart’s versioned values for the supported upstream surface rather than copying nested settings here.

CRD lifecycle

The wrapper enables upstream.base.enableCRDTemplates so Istio CRDs are managed as Helm resources and can be upgraded. CRDs are cluster-scoped compatibility interfaces: coordinate Istio CRD upgrades with the matching Istiod, Istio CNI, and Istio Gateway releases, and validate upgrades in a disposable environment before production use.

Do not manually remove Istio CRDs as part of a routine package change. Removing them can make existing Istio custom resources unreadable to the Kubernetes API. For upstream installation and upgrade constraints, see Istio’s Helm installation guidance and release notes.

Big Bang integration

The umbrella owns source selection, namespace creation, image-pull secret injection, post-renderers, and release ordering. The package owns the thin wrapper around Istio’s upstream base chart. Big Bang creates istio-system without mesh enrollment; Istiod consumes the CRDs after this release is ready.

Policy packages can add release dependencies. Check rendered umbrella output when changing policy or ordering configuration; a package chart lint alone does not prove a cluster CRD install or upgrade is safe.