See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.

#### Other migrations

If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.

The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:

	var containerID string
	for _, cgroup := range cgroups {
		candidatePodUID, candidateContainerID, ok := getPodUIDAndContainerIDFromCGroupPath(cgroup.GroupPath)
		switch {
		case !ok:
			// Cgroup did not contain a container ID.
			continue
		case containerID == "":
			// This is the first container ID found so far.
			podUID = candidatePodUID
			containerID = candidateContainerID
		case containerID != candidateContainerID:

  // minimum desired number of healthy pods
  optional int32 desiredHealthy = 5;

  // total number of pods counted by this disruption budget
  optional int32 expectedPods = 6;

  // Conditions contain conditions for PDB. The disruption controller sets the
  // DisruptionAllowed condition. The following are known values for the reason field
  // (additional reasons could be added in the future):

  // specify a namespace (which happens either because the resource
  // is not namespaced or the request targets all namespaces).
  // If this field is omitted or false then the `namespaces` field
  // must contain a non-empty list.
  // +optional
  optional bool clusterScope = 4;

  // `namespaces` is a list of target namespaces that restricts
  // matches.  A request that specifies a target namespace matches

  // specify a namespace (which happens either because the resource
  // is not namespaced or the request targets all namespaces).
  // If this field is omitted or false then the `namespaces` field
  // must contain a non-empty list.
  // +optional
  optional bool clusterScope = 4;

  // `namespaces` is a list of target namespaces that restricts
  // matches.  A request that specifies a target namespace matches

// release notes for more information.
// ControllerRevision implements an immutable snapshot of state data. Clients
// are responsible for serializing and deserializing the objects that contain
// their internal state.
// Once a ControllerRevision has been successfully created, it can not be updated.
// The API Server will fail validation of all requests that attempt to mutate