In MultiTenant mode, the member controller creates RoleBindings in each member namespace. In ClusterWide mode this is not necessary, because istiod already has a ClusterRoleBinding giving it the same privileges.