The operator currently deploys the istio-node DaemonSet (the one that installs istio CNI binaries on every node) as one of the last components. It should deploy it among the first, as otherwise a node may run out of resources for it (while other nodes may still have enough resources for other regular pods).