fix CRD lifecycle: retain on uninstall (resource-policy keep) + document upgrade adoption

Inject helm.sh/resource-policy: keep into each templated CRD via a
fromYaml/toYaml round-trip so the CRDs (and their custom resources) survive
helm uninstall and installCrds true->false, without touching the canonical
crd/ files. Document the pre-2.8 -> 2.8 adoption path (--take-ownership or
label/annotate) and the installCrds:false out-of-band option in the v2.8.1
release notes, and correct the v2.8.0 uninstall caveat.

Author: pcholakov

charts/restate-operator-helm/templates/crds.yaml

@@ -1,6 +1,9 @@
 {{- if .Values.installCrds }}
 {{- range $path, $_ := .Files.Glob "crd-manifests/*.yaml" }}
+{{- $crd := $.Files.Get $path | fromYaml }}
+{{- $meta := $crd.metadata }}
+{{- $_ := set $meta "annotations" (merge (dict "helm.sh/resource-policy" "keep") (default (dict) $meta.annotations)) }}
 ---
-{{ $.Files.Get $path }}
+{{ $crd | toYaml }}
 {{- end }}
 {{- end }}

release-notes/v2.8.0.md

@@ -29,10 +29,12 @@ ownership:
 installCrds: false
 ```
 
-Caveat: templated CRDs are removed on `helm uninstall`, which cascades to and
-deletes any existing custom resources (RestateClusters, RestateDeployments,
-RestateCloudEnvironments). Set `installCrds: false` if you need CRDs to survive an
-uninstall.
+Caveat (fixed in v2.8.1): in v2.8.0 the templated CRDs were removed on
+`helm uninstall`, which cascaded to and deleted any existing custom resources
+(RestateClusters, RestateDeployments, RestateCloudEnvironments). As of v2.8.1 the
+templated CRDs carry `helm.sh/resource-policy: keep` and are retained on uninstall.
+See the [v2.8.1 release notes](https://github.com/restatedev/restate-operator/blob/release-2.8.1/release-notes/v2.8.1.md)
+for the retain policy and, if upgrading a pre-2.8 install, the CRD adoption steps.
 
 *Related: PR [#161](https://github.com/restatedev/restate-operator/pull/161)*
 

release-notes/v2.8.1.md

@@ -6,10 +6,49 @@ This is a bug fix release, see [v2.8.0 release notes](https://github.com/restate
 
 - **Fix: the release build now works with the Rust 1.95.0 toolchain** — the release Docker base image is bumped from `ghcr.io/restatedev/dev-tools:1.16.1` to `1.17.0`, which bakes the Rust 1.95.0 toolchain and its musl standard library needed by the musl cross-compile.
 
-## Upgrading
+- **Fix: templated CRDs are now retained on uninstall** — with the default `installCrds: true`, the chart's CRDs (`RestateCluster`, `RestateDeployment`, `RestateCloudEnvironment`) now carry the `helm.sh/resource-policy: keep` annotation. They are no longer deleted on `helm uninstall` or when switching to `installCrds: false`, so your custom resources are not cascade-deleted. This corrects the uninstall caveat noted in v2.8.0.
 
-No CRD or functional changes in this release. Upgrade the operator via Helm:
+## Upgrading an existing (<= 2.7) install
+
+CRDs now retain across uninstall, but adopting a pre-2.8 install into the new templated CRDs needs one manual step the first time.
+
+Chart versions <= 2.7 installed the CRDs via Helm's special `crds/` directory, which leaves no Helm ownership metadata on them. On the first upgrade to 2.8 with the default `installCrds: true`, Helm tries to take over those CRDs and aborts with an `invalid ownership metadata` error. Pick one of the following before (or during) the upgrade.
+
+Option A — take ownership during the upgrade (requires Helm >= 3.17):
+
+```bash
+helm upgrade restate-operator restatedev/restate-operator --version 2.8.1 --take-ownership
+```
+
+Option B — label and annotate the CRDs first, then upgrade normally. Replace `<release>` and `<namespace>` with your Helm release name and namespace:
+
+```bash
+for crd in restateclusters.restate.dev restatedeployments.restate.dev restatecloudenvironments.restate.dev; do
+  kubectl label crd "$crd" app.kubernetes.io/managed-by=Helm --overwrite
+  kubectl annotate crd "$crd" \
+    meta.helm.sh/release-name=<release> \
+    meta.helm.sh/release-namespace=<namespace> --overwrite
+done
+
+helm upgrade restate-operator restatedev/restate-operator --version 2.8.1
+```
+
+Once adopted, the CRDs update on every `helm upgrade` and, thanks to the retain policy, survive uninstall.
+
+### Managing CRDs outside the chart
+
+If you manage CRDs out-of-band (GitOps/ArgoCD, or as nuon-byoc vendors them), set `installCrds: false` instead. The chart then never touches the CRDs, so there is nothing to adopt. Apply the CRD manifests published as GitHub release artifacts yourself (`crd/restateclusters.yaml`, `crd/restatedeployments.yaml`, `crd/restatecloudenvironments.yaml`). This is the recommended path for external CRD management.
+
+```yaml
+installCrds: false
+```
+
+## Upgrading (new install or already on 2.8.0)
+
+No CRD schema or functional changes since 2.8.0. Upgrade the operator via Helm:
 
 ```bash
 helm upgrade restate-operator restatedev/restate-operator --version 2.8.1
 ```
+
+With the default `installCrds: true`, the CRDs are applied as part of the upgrade. If you manage CRDs outside this chart, set `installCrds: false` and apply them yourself.