When user deploy new application with istio, istio injector(manual and automatic) will inject two containers: istio-proxy and istio-proxy_init. If customer configure those two images to be pulled from private registry, then the image pull will be failed as there is no imagePullSecrets, seems we need to add imagePullSecrets to inject containers.

What do you think @linsun @rshriram @ayj