Currently, the operator considers all resources with the maistra.io/owner label set to an SMCP's namespace to be owned by said SMCP. When pruning resources, the operator deletes all resources that have this label and do not at the same time have the app.kubernetes.io/version label set to the current SMCP generation.

Some customers manually create resources with the maistra.io/owner label in member namespaces. Since 2.1, the operator deletes these resources (in 2.0 it only deleted these resources in the SMCP's namespace).

We can't really blame customers for doing this, because, in a way, these resources are part of the mesh specified in the label value (e.g. a manually-created gateway with the label maistra.io/owner=istio-system is indeed part of the istio-system mesh), even if it isn't managed by the operator. And since it isn't managed by the operator, the operator shouldn't delete it during pruning. However, the operator currently does delete the resource.

To fix this, we should make the operator only prune resources that have the app.kubernetes.io/managed-by label set to maistra-istio-operator (in addition to having the maistra.io/owner label). The managed-by label makes it clear that the resource is managed by the operator. If users manually create resources with this label key and value, they shouldn't be surprised when the operator deletes those resources.