fix: since policy now logs what it would have done, it makes sense to…

… do them after the endpoint filtering, so that the logs does not contain things that get filtered out anyway

plan/plan.go

@@ -245,10 +245,6 @@ func (p *Plan) Calculate() *Plan {
 		}
 	}
 
-	for _, pol := range p.Policies {
-		changes = pol.Apply(changes)
-	}
-
 	// filter out updates this external dns does not have ownership claim over
 	if p.OwnerID != "" {
 		changes.Delete = endpoint.FilterEndpointsByOwnerID(p.OwnerID, changes.Delete)
@@ -257,6 +253,10 @@ func (p *Plan) Calculate() *Plan {
 		changes.UpdateNew = endpoint.FilterEndpointsByOwnerID(p.OwnerID, changes.UpdateNew)
 	}
 
+	for _, pol := range p.Policies {
+		changes = pol.Apply(changes)
+	}
+
 	plan := &Plan{
 		Current:        p.Current,
 		Desired:        p.Desired,