MEC currently creates Image Streams but never remove them - e.g., when the last ServiceMeshExtension resource that references an image stream is removed.

If the ImageStream is in the same namespace as the SME, then adding an OwnerReference should suffice. If not, I'm not sure what the correct solution is. I don't think adding a finalizer and having istiod manage cleanup is the correct approach, as if istiod is deleted (e.g. uninstall), it could cause deletion of namespaces to hang, while waiting for the finalizers to be released.