The operator first deploys Prometheus, but if security is enabled, the pod can't start due to the istio.default secret being missing. The secret is created by Citadel, which is only deployed later.

Note that Prometheus isn't stuck forever and eventually starts properly. Due to MAISTRA-446, after about a minute of waiting for Prometheus to become ready, the operator deploys Citadel, which then allows Prometheus to run.

Since Prometheus depends on Citadel, Citadel should be deployed first.