From f23d379faac15454224ff0908f78f89359b58589 Mon Sep 17 00:00:00 2001
From: Liam White <liamawhite@gmail.com>
Date: Fri, 31 Oct 2025 10:00:25 -0700
Subject: [PATCH 1/2] Instruct helm to keep workload groups around on deletion

---
 kubernetes/customresourcedefinitions.gen.yaml  | 2 ++
 networking/v1/workload_group_alias.gen.go      | 1 +
 networking/v1alpha3/workload_group.pb.go       | 1 +
 networking/v1alpha3/workload_group.proto       | 1 +
 networking/v1beta1/workload_group_alias.gen.go | 1 +
 5 files changed, 6 insertions(+)

diff --git a/kubernetes/customresourcedefinitions.gen.yaml b/kubernetes/customresourcedefinitions.gen.yaml
index 2fa63ba2c0..2601fae45c 100644
--- a/kubernetes/customresourcedefinitions.gen.yaml
+++ b/kubernetes/customresourcedefinitions.gen.yaml
@@ -14171,6 +14171,8 @@ spec:
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     app: istio-pilot
     chart: istio
diff --git a/networking/v1/workload_group_alias.gen.go b/networking/v1/workload_group_alias.gen.go
index ae4f439b64..9772e11fc4 100644
--- a/networking/v1/workload_group_alias.gen.go
+++ b/networking/v1/workload_group_alias.gen.go
@@ -12,6 +12,7 @@ import "istio.io/api/networking/v1alpha3"
 // <!-- crd generation tags
 // +cue-gen:WorkloadGroup:groupName:networking.istio.io
 // +cue-gen:WorkloadGroup:versions:v1,v1beta1,v1alpha3
+// +cue-gen:WorkloadGroup:annotations:helm.sh/resource-policy=keep
 // +cue-gen:WorkloadGroup:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
 // +cue-gen:WorkloadGroup:subresource:status
 // +cue-gen:WorkloadGroup:scope:Namespaced
diff --git a/networking/v1alpha3/workload_group.pb.go b/networking/v1alpha3/workload_group.pb.go
index d1e25ce377..6913e9bbe8 100644
--- a/networking/v1alpha3/workload_group.pb.go
+++ b/networking/v1alpha3/workload_group.pb.go
@@ -98,6 +98,7 @@ const (
 // <!-- crd generation tags
 // +cue-gen:WorkloadGroup:groupName:networking.istio.io
 // +cue-gen:WorkloadGroup:versions:v1,v1beta1,v1alpha3
+// +cue-gen:WorkloadGroup:annotations:helm.sh/resource-policy=keep
 // +cue-gen:WorkloadGroup:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
 // +cue-gen:WorkloadGroup:subresource:status
 // +cue-gen:WorkloadGroup:scope:Namespaced
diff --git a/networking/v1alpha3/workload_group.proto b/networking/v1alpha3/workload_group.proto
index 10b96c9bac..80f6c2fbb8 100644
--- a/networking/v1alpha3/workload_group.proto
+++ b/networking/v1alpha3/workload_group.proto
@@ -82,6 +82,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // <!-- crd generation tags
 // +cue-gen:WorkloadGroup:groupName:networking.istio.io
 // +cue-gen:WorkloadGroup:versions:v1,v1beta1,v1alpha3
+// +cue-gen:WorkloadGroup:annotations:helm.sh/resource-policy=keep
 // +cue-gen:WorkloadGroup:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
 // +cue-gen:WorkloadGroup:subresource:status
 // +cue-gen:WorkloadGroup:scope:Namespaced
diff --git a/networking/v1beta1/workload_group_alias.gen.go b/networking/v1beta1/workload_group_alias.gen.go
index a9aa2b1105..cb9e234b91 100644
--- a/networking/v1beta1/workload_group_alias.gen.go
+++ b/networking/v1beta1/workload_group_alias.gen.go
@@ -12,6 +12,7 @@ import "istio.io/api/networking/v1alpha3"
 // <!-- crd generation tags
 // +cue-gen:WorkloadGroup:groupName:networking.istio.io
 // +cue-gen:WorkloadGroup:versions:v1,v1beta1,v1alpha3
+// +cue-gen:WorkloadGroup:annotations:helm.sh/resource-policy=keep
 // +cue-gen:WorkloadGroup:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
 // +cue-gen:WorkloadGroup:subresource:status
 // +cue-gen:WorkloadGroup:scope:Namespaced

From 93c047638ae4730c161c37b6c36fa91bbf702202 Mon Sep 17 00:00:00 2001
From: Liam White <liamawhite@gmail.com>
Date: Fri, 31 Oct 2025 10:09:07 -0700
Subject: [PATCH 2/2] Add release notes

---
 releasenotes/notes/3314.yaml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 releasenotes/notes/3314.yaml

diff --git a/releasenotes/notes/3314.yaml b/releasenotes/notes/3314.yaml
new file mode 100644
index 0000000000..c5129d1cd5
--- /dev/null
+++ b/releasenotes/notes/3314.yaml
@@ -0,0 +1,6 @@
+apiVersion: release-notes/v2
+kind: bug-fix
+area: installation
+releaseNotes:
+- |
+  **Added** Added missing helm.sh/resource-policy=keep annotation to WorkloadGroup CRD
\ No newline at end of file