Multus CNI when using namespaceIsolation prevents pods from accessing NetworkAttachmentDefinitions outside of the namespace of a pod where that net-attach-def is referenced (via annotation).
The proposed fix to to allow pods to reference the default namespace from any given namespace. Therefore, if you had a configuration named "macvlan-conf" and had stored it in the default namespace, you could reference it from an annotation (from either within or outside of the default namespace) as "default/macvlan-conf".
The current provides to be painful for users at time. One current such case is that when integrating with Istio (in a non-chained-cni-plugin-mode) users must create NetworkAttachmentDefinition in every namespace which uses Istio.
This may also prove useful in other scenarios where you have commonly used net-attach-def that may be inconvenient to create in a number of different namespaces.
Tested and verified in 4.4.0-0.nightly-2020-05-18-115348
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.