diff --git a/kubernetes/customresourcedefinitions.gen.yaml b/kubernetes/customresourcedefinitions.gen.yaml
index d76ca2be83..6aaea59596 100644
--- a/kubernetes/customresourcedefinitions.gen.yaml
+++ b/kubernetes/customresourcedefinitions.gen.yaml
@@ -13958,6 +13958,8 @@ spec:
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     app: istio-pilot
     chart: istio
diff --git a/networking/v1/workload_group_alias.gen.go b/networking/v1/workload_group_alias.gen.go
index ae4f439b64..9772e11fc4 100644
--- a/networking/v1/workload_group_alias.gen.go
+++ b/networking/v1/workload_group_alias.gen.go
@@ -12,6 +12,7 @@ import "istio.io/api/networking/v1alpha3"
 // <!-- crd generation tags
 // +cue-gen:WorkloadGroup:groupName:networking.istio.io
 // +cue-gen:WorkloadGroup:versions:v1,v1beta1,v1alpha3
+// +cue-gen:WorkloadGroup:annotations:helm.sh/resource-policy=keep
 // +cue-gen:WorkloadGroup:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
 // +cue-gen:WorkloadGroup:subresource:status
 // +cue-gen:WorkloadGroup:scope:Namespaced
diff --git a/networking/v1alpha3/workload_group.pb.go b/networking/v1alpha3/workload_group.pb.go
index 91d9451854..4696f0f5b9 100644
--- a/networking/v1alpha3/workload_group.pb.go
+++ b/networking/v1alpha3/workload_group.pb.go
@@ -98,6 +98,7 @@ const (
 // <!-- crd generation tags
 // +cue-gen:WorkloadGroup:groupName:networking.istio.io
 // +cue-gen:WorkloadGroup:versions:v1,v1beta1,v1alpha3
+// +cue-gen:WorkloadGroup:annotations:helm.sh/resource-policy=keep
 // +cue-gen:WorkloadGroup:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
 // +cue-gen:WorkloadGroup:subresource:status
 // +cue-gen:WorkloadGroup:scope:Namespaced
diff --git a/networking/v1alpha3/workload_group.proto b/networking/v1alpha3/workload_group.proto
index 10b96c9bac..80f6c2fbb8 100644
--- a/networking/v1alpha3/workload_group.proto
+++ b/networking/v1alpha3/workload_group.proto
@@ -82,6 +82,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // <!-- crd generation tags
 // +cue-gen:WorkloadGroup:groupName:networking.istio.io
 // +cue-gen:WorkloadGroup:versions:v1,v1beta1,v1alpha3
+// +cue-gen:WorkloadGroup:annotations:helm.sh/resource-policy=keep
 // +cue-gen:WorkloadGroup:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
 // +cue-gen:WorkloadGroup:subresource:status
 // +cue-gen:WorkloadGroup:scope:Namespaced
diff --git a/networking/v1beta1/workload_group_alias.gen.go b/networking/v1beta1/workload_group_alias.gen.go
index a9aa2b1105..cb9e234b91 100644
--- a/networking/v1beta1/workload_group_alias.gen.go
+++ b/networking/v1beta1/workload_group_alias.gen.go
@@ -12,6 +12,7 @@ import "istio.io/api/networking/v1alpha3"
 // <!-- crd generation tags
 // +cue-gen:WorkloadGroup:groupName:networking.istio.io
 // +cue-gen:WorkloadGroup:versions:v1,v1beta1,v1alpha3
+// +cue-gen:WorkloadGroup:annotations:helm.sh/resource-policy=keep
 // +cue-gen:WorkloadGroup:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
 // +cue-gen:WorkloadGroup:subresource:status
 // +cue-gen:WorkloadGroup:scope:Namespaced
diff --git a/releasenotes/notes/3314.yaml b/releasenotes/notes/3314.yaml
new file mode 100644
index 0000000000..c5129d1cd5
--- /dev/null
+++ b/releasenotes/notes/3314.yaml
@@ -0,0 +1,6 @@
+apiVersion: release-notes/v2
+kind: bug-fix
+area: installation
+releaseNotes:
+- |
+  **Added** Added missing helm.sh/resource-policy=keep annotation to WorkloadGroup CRD
\ No newline at end of file