istio: Istio breaks Pod's securityContext

Bug description I have tried to deploy a StatefulSet with the following securityContext:

imagePullSecrets: []
      initContainers: []
      securityContext:
        fsGroup: 1000

in an Istio enabled namespace. When the Pod is started, I find the following on the Pod:

securityContext:
    fsGroup: 1337
  serviceAccount: default

[ ] Docs [X] Installation [ ] Networking [ ] Performance and Scalability [ ] Extensions and Telemetry [ ] Security [ ] Test and Release [X] User Experience [ ] Developer Infrastructure

Expected behavior I should be able to deploy a StatefulSet with the expected fsGroup.

Steps to reproduce the bug Deploy the following test in an Istio enabled namespace:

apiVersion: v1
kind: Service
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  ports:
  - port: 80
    name: web
  clusterIP: None
  selector:
    app: nginx
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  serviceName: "nginx"
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      securityContext:
        fsGroup: 1000
      volumes:
      - name: configuration
        configMap:
          name: broker-config
      containers:
      - name: nginx
        image: k8s.gcr.io/nginx-slim:0.8
        command: ["sleep"]
        args: ["100000"]
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: configuration
          mountPath: /usr/share/nginx/html/broker.xml
          subPath: broker.xml
        - name: www
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 1Gi
---
apiVersion: v1
data:
  broker.xml: "aaaa"
kind: ConfigMap
metadata:
  name: broker-config

Then exec into the container web-0: kubectl exec -it web-0 – ‘ls -al /usr/share/nginx/html/’

drwxrwxrwx 2 root root 24 Aug 28 10:46 .
drwxr-xr-x 4 root root 30 Jul  1  2016 ..
-rw-r--r-- 1 root 1337  4 Aug 28 10:46 broker.xml

Version (include the output of istioctl version --remote and kubectl version and helm version if you used Helm)

client version: 1.7.0
control plane version: 1.7.0
data plane version: 1.7.0 (3 proxies)

How was Istio installed? Using Istio operator:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
 name: istiooperator
 namespace: istio-system
spec:
  profile: demo
  components:
    ingressGateways:
    - enabled: true
      k8s:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                  - key: app
                    operator: In
                    values:
                    - istio-ingressgateway
                topologyKey: kubernetes.io/hostname
              weight: 100
        service:
          ports:
          - name: tcp-activemq
            port: 61616
            targetPort: 61616
            nodePort: 32000
          - name: http2
            port: 80
            targetPort: 8080
            nodePort: 32001
          - name: https
            port: 443
            targetPort: 8443
          - name: tls
            port: 15443
            targetPort: 15443
      name: istio-ingressgateway
  values:
    sidecarInjectorWebhook:
      rewriteAppHTTPProbe: true 
    gateways:
      istio-ingressgateway:
        type: NodePort

Environment where bug was observed (cloud vendor, OS, etc)