It would be classy to put all the Istio machinery in a single namespace, such as "istio", rather than the default namespace.  This can be done by specifying e.g.
Kubectl create -f istio.yaml --namespace istio
But this is not critical and may be trickier to get right along with the RBAC stuff.