When creating a ServiceMeshMemberRoll resource, a consequential NetworkAttachmentDefinition is created, but with an empty .spec.config

servicemeshoperator.v2.6.4
OCP 4.18.0-rc.4

100 %

1.
On a cluster with OSSM (istio) installed - apply a ServiceMeshMemberRoll resource:
apiVersion: maistra.io/v1
kind: ServiceMeshMemberRoll
metadata:
  name: default
  namespace: istio-system
spec:
  members:
  - non-udn-ns

(Make sure to put the name of a namespace that exists in your cluster `spec.members`).

A NAD is created with an spty `spec.config`:
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  creationTimestamp: "2025-02-04T14:02:33Z"
  generation: 1
  labels:
    maistra.io/member-of: istio-system
  name: v2-3-istio-cni
  namespace: non-udn-ns
  resourceVersion: "39144968"
  uid: a8e20a61-ed22-468a-940e-8a5851519408
spec:
  config: ""

Valid output resource that can be consumed by workloads.

1.
When attempting to reference this NAD in a VM spec (for the VM default network), the VM fails to start, reporting
virtualmachine-controller    Error creating pod: admission webhook "ipam-claims.k8s.cni.cncf.io" denied the request: failed to extract CNI configuration from NAD: unexpected end of JSON input

2.
To QE: The fix to this bug can be verified by running the automated test_service_mesh_traffic_management