#### Other migrations

If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.

The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:

```console
KINDS=(service deployment)
RELEASE=istio-ingressgateway

  //
  // Required.
  optional string expression = 2;
}

// MatchResources decides whether to run the admission control policy on an object based
// on whether it meets the match criteria.
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
// +structType=atomic
message MatchResources {
  // NamespaceSelector decides whether to run the admission control policy on an object based

  optional RunAsUserStrategyOptions runAsUser = 11;

  // RunAsGroup is the strategy that will dictate the allowable RunAsGroup values that may be set.
  // If this field is omitted, the pod's RunAsGroup can take any value. This field requires the
  // RunAsGroup feature gate to be enabled.
  // +optional
  optional RunAsGroupStrategyOptions runAsGroup = 22;

  // `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen
  // FlowSchema is among those with the numerically lowest (which we take to be logically highest)
  // MatchingPrecedence.  Each MatchingPrecedence value must be ranged in [1,10000].
  // Note that if the precedence is not specified, it will be set to 1000 as default.
  // +optional

  // `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen
  // FlowSchema is among those with the numerically lowest (which we take to be logically highest)
  // MatchingPrecedence.  Each MatchingPrecedence value must be ranged in [1,10000].
  // Note that if the precedence is not specified, it will be set to 1000 as default.
  // +optional