If istioCNI and metricsServer are both enabled, they will attempt to create the same secret which will cause a conflict. Add logic to metricsServer's imagePullSecrets template to disable it creating if istioCNI is enabled.