Simple example to reproduce the issue while changing namespace labels configured in a Prometheus CRD as namespaceSelector

prometheus-operator-namespace-issue.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    example.com.app: app-1
    monitoring: "true"
  name: monitoring-app-1
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    example.com.app: app-1
    example.com.component: prometheus
  name: prometheus
  namespace: monitoring-app-1
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    example.com.app: app-1
    example.com.component: prometheus
  name: prometheus-app-1-scrape
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin # Ye... I know, this should not be here. Testing only
subjects:
- kind: ServiceAccount
  name: prometheus
  namespace: monitoring-app-1
---
apiVersion: monitoring.coreos.com/v1
kind: Prometheus
metadata:
  labels:
    example.com.app: app-1
    example.com.component: prometheus
  name: app-1
  namespace: monitoring-app-1
spec:
  podMetadata:
    labels:
      example.com.app: app-1
      example.com.component: prometheus
  serviceMonitorNamespaceSelector:
    matchLabels:
      monitoring: "true"
  serviceMonitorSelector:
    matchLabels:
      example.com.app: app-1
  serviceAccountName: prometheus
---
apiVersion: v1
kind: Service
metadata:
  labels:
    example.com.app: app-1
    example.com.component: prometheus
  name: prometheus
  namespace: monitoring-app-1
spec:
  ports:
  - name: web
    port: 9090
    targetPort: web
  selector:
    example.com.app: app-1
    example.com.component: prometheus
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  labels:
    example.com.app: app-1
  name: prometheus
  namespace: monitoring-app-1
spec:
  endpoints:
  - interval: 10s
    port: web
  selector:
    matchLabels:
      example.com.app: app-1
      example.com.component: prometheus