Allow Helm CRD management to be disabled

[ron1]

It is common for mainstream CRD-based workloads to allow Helm CRD management to be externalized from the main chart. One approach used by Rancher, the Elastic Cloud on Kubernetes Operator, and others externalizes crds into their own chart, for example, charts eck-operator and eck-operator-crds.

Another lighter-weight approach adopted by jetstack/cert-manager and kyverno/kyverno to name a few leverages an "installCRDs" boolean property to allow Helm CRD management to be disabled. This approach at least provides the option to disable CRD management.

The current approach used by this chart that relies on the "/crds" directory to install crds but not update them is problematic, especially for gitops scenarios. Consider adopting one of the other strategies described above.

[sathieu]

I only know a few charts handling this correctly:

• gatekeeper
  • crds directory
  • upgrade with a "hook" (ClusterRole+ClusterRoleBinding+ServiceAccount+Job)
• velero:
  • crds directory
  • upgrade-crds Job
  • cleanup-crds Job

Other methods are partial, and the eck-operator way requires extra manual steps.

[benjaminjb]

I've entered this into the backlog, but would welcome if anyone wants to open a PR for that.