This is what needs to be done:

• add istio_cni.enabled config option to ServiceMeshControlPlane
• when enabled, the operator must deploy the istio-cni daemonset and related resources
• when enabled, the operator must add the k8s.v1.cni.cncf.io/networks: istio-cni annotation to the sidecar injector configmap and remove the init container from the same configmap
• in every member namespace, the operator must create a NetworkAttachmentDefinition resource so that Multus CNI invokes the Istio CNI plugin for pods in that namespace.
• the operator should remove these changes when the namespace is removed from the mesh or istio_cni.enabled is set to false.