When you configure the SMCP to deploy the istio-ingressgateway to a member namespace, the istio-ingressgateway-sds rolebinding is deleted from the member namespace.

When the gateway is deployed in istio-system, the istio-ingressgateway-sds rolebinding should not be in any member namespaces, but it is (see MAISTRA-2666). Then, when the gateway is moved to the member namespace, the rolebinding gets deleted. If you then modify the SMCP and trigger another full reconcile, the rolebinding in the member namespace gets created.

In contrast, the handling of the istio-ingressgateway-sds role is correct – when the gateway is in istio-system, there's no role in the member namespace. When the gateway is moved to the member namespace, the role is created.