$ make istio-init.yaml
$ kubectl apply -f install/kubernetes/istio-init.yaml

$ kubectl get crd
No resources found.

$ kubectl get job
NAME                            DESIRED   SUCCESSFUL   AGE
istio-init-crd-10               1         0            4s
istio-init-crd-11               1         0            4s
istio-init-crd-certmanager-10   1         0            4s

$ kubectl describe job istio-init-crd-10
Name:           istio-init-crd-10
Namespace:      default
Selector:       controller-uid=d861524b-163b-11e9-9304-025000000001
Labels:         controller-uid=d861524b-163b-11e9-9304-025000000001
                job-name=istio-init-crd-10
Annotations:    kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"batch/v1","kind":"Job","metadata":{"annotations":{},"name":"istio-init-crd-10","namespace":"default"},"spec":{"template":{"spec":{"conta...
Parallelism:    1
Completions:    1
Pods Statuses:  0 Running / 0 Succeeded / 0 Failed
Pod Template:
  Labels:           controller-uid=d861524b-163b-11e9-9304-025000000001
                    job-name=istio-init-crd-10
  Service Account:  istio-init-service-account
  Containers:
   istio-init-crd-10:
    Image:      istio/kubectl:aa34fc7319ab312a1f11306aa5cdfe64b7528b87
    Port:       <none>
    Host Port:  <none>
    Command:
      kubectl
      apply
      -f
      /etc/istio/crd-10/crd-10.yaml
    Environment:  <none>
    Mounts:
      /etc/istio/crd-10 from crd-10 (ro)
  Volumes:
   crd-10:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      istio-crd-10
    Optional:  false
Events:
  Type     Reason        Age                From            Message
  ----     ------        ----               ----            -------
  Warning  FailedCreate  14s (x2 over 24s)  job-controller  Error creating: pods "istio-init-crd-10-" is forbidden: error looking up service account default/istio-init-service-account: serviceaccount "istio-init-service-account" not found