my understanding from the docs was that Pulumi somehow tries to ensure consistency between resources managed by Pulumi and what it has tracked in it's state, but this doesn't seem to be the case? I can see that the failing resource has a

managed-by: pulumi

label, yet Pulumi didn't clean it up when there should be no resources deployed on the cluster anymore by Pulumi