The MemberRoll controller was changed in MAISTRA-2197 to not send the initial update with just the system namespace. This can be a problem when the user hasn't created an SMMR resource yet, because any listeners registered before the caches sync may never get an update informing them to watch the system namespace. In Maistra 2.1 this actually prevents istiod from starting in some cases, e.g. if the ConfigMap with the CA cert hasn't been created yet.