Summary:
Kubevirt does not respect externally injected values in k8s.v1.cni.cncf.io/network annotation.
In this case Istio webhook injected an istio-cni annotation which after reconciliation is no longer visible in the pod.

Note that the consequences do not seem to be blockers, however it it confusing to users and engineers to debug.

The overriding code is:
https://github.com/kubevirt/kubevirt/blob/56521f85f7ef7d2fa3ddc314702fe4015310d71c/pkg/network/pod/annotations/generator.go#L113

Called from:

https://github.com/kubevirt/kubevirt/blob/7aaf6681eeca8801afd06d96a7bf0dde4dde7e2a/pkg/virt-controller/watch/vmi/lifecycle.go#L175

Steps to reproduce:

• Deploy the cluster with istio and passt
• Create a VM with passt nw binding
• Monitor the `k8s.v1.cni.cncf.io/networks` annotation of the VMI.

Result:

The annotation changes from

k8s.v1.cni.cncf.io/networks: '[\{"name":"netbindingpasst","namespace":"kubevirt-test-default1","cni-args":{"logicNetworkName":"default"}}, {"name": "istio-cni", "namespace": "default"}]'

to

k8s.v1.cni.cncf.io/networks: '{"name":"netbindingpasst","namespace":"kubevirt-test-default1","cni-args":{"logicNetworkName":"default"}}'