When I deploy the v2.3 operator and then create an SMCP with version: v2.4, the validating webhook doesn't reject it. The operator actually creates the istiod deployment, but sets the image to docker.io/maistra/pilot:2.4.0, which doesn't exist.

It took me a long time to figure out what was happening (I didn't notice that I created a v2.4 SMCP instead of v2.3).

The webhook should reject SMCPs that specify an invalid version.