Multus CNI when using namespaceIsolation prevents pods from accessing NetworkAttachmentDefinitions outside of the namespace of a pod where that net-attach-def is referenced (via annotation). The proposed fix to to allow pods to reference the default namespace from any given namespace. Therefore, if you had a configuration named "macvlan-conf" and had stored it in the default namespace, you could reference it from an annotation (from either within or outside of the default namespace) as "default/macvlan-conf". The current provides to be painful for users at time. One current such case is that when integrating with Istio (in a non-chained-cni-plugin-mode) users must create NetworkAttachmentDefinition in every namespace which uses Istio. This may also prove useful in other scenarios where you have commonly used net-attach-def that may be inconvenient to create in a number of different namespaces.
Tested and verified in 4.4.0-0.nightly-2020-05-18-115348
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:2180