if data.IsControlPlaneNode() {
		// Update the InitConfiguration used for RunPullImagesCheck with ImagePullPolicy and ImagePullSerial
		// that come from UpgradeNodeConfiguration.
		initConfig := data.InitCfg()
		initConfig.NodeRegistration.ImagePullPolicy = data.Cfg().Node.ImagePullPolicy
		initConfig.NodeRegistration.ImagePullSerial = data.Cfg().Node.ImagePullSerial

		if !data.DryRun() {

      imagePullSecrets:
      - name: myregistrykey
      containers:
      - name: istio-proxy
        image: auto
        imagePullPolicy: Always
        securityContext: # to allow core dumps
          readOnlyRootFilesystem: false
      - name: app
        image: testing.hub/app:latest
        imagePullPolicy: Always
        args:
          - --metrics=15014
          - --cluster=cluster-0
          - --grpc=7070

      imagePullSecrets:
      - name: myregistrykey
      containers:
      - name: istio-proxy
        image: auto
        imagePullPolicy: Always
        securityContext: # to allow core dumps
          readOnlyRootFilesystem: false
      - name: app
        image: testing.hub/app:latest
        imagePullPolicy: Always
        args:
          - --metrics=15014
          - --cluster=cluster-0
          - --grpc=7070

        version: v1
    spec:
      containers:
      - name: helloworld
        image: docker.io/istio/examples-helloworld-v1:1.0
        resources:
          requests:
            cpu: "100m"
        imagePullPolicy: IfNotPresent #Always
        ports:
        - containerPort: 5000
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: helloworld-v2
  labels:
    app: helloworld
    version: v2
spec:

      imagePullSecrets:
      - name: myregistrykey
      containers:
      - name: istio-proxy
        image: auto
        imagePullPolicy: Always
        securityContext: # to allow core dumps
          readOnlyRootFilesystem: false
      - name: app
        image: testing.hub/app:latest
        imagePullPolicy: Always
        args:
          - --metrics=15014
          - --cluster=cluster-0
          - --grpc=7070

        version: v1
    spec:
      containers:
      - name: helloworld
        image: docker.io/istio/examples-helloworld-v1:1.0
        resources:
          requests:
            cpu: "100m"
        imagePullPolicy: IfNotPresent #Always
        ports:
        - containerPort: 5000
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: helloworld-v2
  labels:
    app: helloworld
    version: v2
spec:

	}
}

// SetDefaults_NodeRegistration sets the defaults for the NodeRegistrationOptions object
func SetDefaults_NodeRegistration(obj *NodeRegistrationOptions) {
	if len(obj.ImagePullPolicy) == 0 {
		obj.ImagePullPolicy = DefaultImagePullPolicy
	}
	if obj.ImagePullSerial == nil {
		obj.ImagePullSerial = ptr.To(true)
	}
}

      imagePullSecrets:
      - name: myregistrykey
      containers:
      - name: istio-proxy
        image: auto
        imagePullPolicy: Always
        securityContext: # to allow core dumps
          readOnlyRootFilesystem: false
      - name: app
        image: testing.hub/app:latest
        imagePullPolicy: Always
        args:
          - --metrics=15014
          - --cluster=cluster-0
          - --xds-grpc-server=7070

	}

	var allErrs []error
	pods.VisitContainersWithPath(&pod.Spec, field.NewPath("spec"), func(c *api.Container, p *field.Path) bool {
		if c.ImagePullPolicy != api.PullAlways {
			allErrs = append(allErrs, admission.NewForbidden(attributes,
				field.NotSupported(p.Child("imagePullPolicy"), c.ImagePullPolicy, []string{string(api.PullAlways)}),
			))
		}
		return true
	})
	if len(allErrs) > 0 {
		return utilerrors.NewAggregate(allErrs)

	obj.Node.EtcdUpgrade = ptr.To(true)
	obj.Node.CertificateRenewal = ptr.To(false)
	obj.Node.ImagePullPolicy = corev1.PullIfNotPresent
	obj.Node.ImagePullSerial = ptr.To(true)

	obj.Apply.EtcdUpgrade = ptr.To(true)
	obj.Apply.CertificateRenewal = ptr.To(false)
	obj.Apply.ImagePullPolicy = corev1.PullIfNotPresent
	obj.Apply.ImagePullSerial = ptr.To(true)

	kubeadm.SetDefaultTimeouts(&obj.Timeouts)