Secondary networks connected to the physical underlay for Openshift Virt VMs using OVN-Kubernetes fails with error:

  Warning  FailedCreatePodSandBox  109s (x3 over 5m53s)  kubelet  (combined from similar events): Failed to create pod sandbox: rpc error: code = Unknown desc = failed to create pod network sandbox k8s_virt-launcher-rhel9-localnet-br1-test-57dk4_chrisj_30813ddf-ccb7-4a52-b1ed-d89237594eeb_0(b340e08baa6544bd8ec7bcbe04c7f5b4653b44ea766110d153a11d46565760c2): error adding pod chrisj_virt-launcher-rhel9-localnet-br1-test-57dk4 to CNI network "multus-cni-network": plugin type="multus-shim" name="multus-cni-network" failed (add): CmdAdd (shim): CNI request failed with status 400: '&{ContainerID:b340e08baa6544bd8ec7bcbe04c7f5b4653b44ea766110d153a11d46565760c2 Netns:/var/run/netns/6ad779e4-eb37-46dd-96c2-ab2f054a1fd8 IfName:eth0 Args:IgnoreUnknown=1;K8S_POD_NAMESPACE=chrisj;K8S_POD_NAME=virt-launcher-rhel9-localnet-br1-test-57dk4;K8S_POD_INFRA_CONTAINER_ID=b340e08baa6544bd8ec7bcbe04c7f5b4653b44ea766110d153a11d46565760c2;K8S_POD_UID=30813ddf-ccb7-4a52-b1ed-d89237594eeb Path: StdinData:[123 34 98 105 110 68 105 114 34 58 34 47 118 97 114 47 108 105 98 47 99 110 105 47 98 105 110 34 44 34 99 104 114 111 111 116 68 105 114 34 58 34 47 104 111 115 116 114 111 111 116 34 44 34 99 108 117 115 116 101 114 78 101 116 119 111 114 107 34 58 34 47 104 111 115 116 47 114 117 110 47 109 117 108 116 117 115 47 99 110 105 47 110 101 116 46 100 47 49 48 45 111 118 110 45 107 117 98 101 114 110 101 116 101 115 46 99 111 110 102 34 44 34 99 110 105 67 111 110 102 105 103 68 105 114 34 58 34 47 104 111 115 116 47 101 116 99 47 99 110 105 47 110 101 116 46 100 34 44 34 99 110 105 86 101 114 115 105 111 110 34 58 34 48 46 51 46 49 34 44 34 100 97 101 109 111 110 83 111 99 107 101 116 68 105 114 34 58 34 47 114 117 110 47 109 117 108 116 117 115 47 115 111 99 107 101 116 34 44 34 103 108 111 98 97 108 78 97 109 101 115 112 97 99 101 115 34 58 34 100 101 102 97 117 108 116 44 111 112 101 110 115 104 105 102 116 45 109 117 108 116 117 115 44 111 112 101 110 115 104 105 102 116 45 115 114 105 111 118 45 110 101 116 119 111 114 107 45 111 112 101 114 97 116 111 114 34 44 34 108 111 103 76 101 118 101 108 34 58 34 118 101 114 98 111 115 101 34 44 34 108 111 103 84 111 83 116 100 101 114 114 34 58 116 114 117 101 44 34 109 117 108 116 117 115 65 117 116 111 99 111 110 102 105 103 68 105 114 34 58 34 47 104 111 115 116 47 114 117 110 47 109 117 108 116 117 115 47 99 110 105 47 110 101 116 46 100 34 44 34 109 117 108 116 117 115 67 111 110 102 105 103 70 105 108 101 34 58 34 97 117 116 111 34 44 34 110 97 109 101 34 58 34 109 117 108 116 117 115 45 99 110 105 45 110 101 116 119 111 114 107 34 44 34 110 97 109 101 115 112 97 99 101 73 115 111 108 97 116 105 111 110 34 58 116 114 117 101 44 34 112 101 114 78 111 100 101 67 101 114 116 105 102 105 99 97 116 101 34 58 123 34 98 111 111 116 115 116 114 97 112 75 117 98 101 99 111 110 102 105 103 34 58 34 47 118 97 114 47 108 105 98 47 107 117 98 101 108 101 116 47 107 117 98 101 99 111 110 102 105 103 34 44 34 99 101 114 116 68 105 114 34 58 34 47 101 116 99 47 99 110 105 47 109 117 108 116 117 115 47 99 101 114 116 115 34 44 34 99 101 114 116 68 117 114 97 116 105 111 110 34 58 34 50 52 104 34 44 34 101 110 97 98 108 101 100 34 58 116 114 117 101 125 44 34 115 111 99 107 101 116 68 105 114 34 58 34 47 104 111 115 116 47 114 117 110 47 109 117 108 116 117 115 47 115 111 99 107 101 116 34 44 34 116 121 112 101 34 58 34 109 117 108 116 117 115 45 115 104 105 109 34 125]} ContainerID:"b340e08baa6544bd8ec7bcbe04c7f5b4653b44ea766110d153a11d46565760c2" Netns:"/var/run/netns/6ad779e4-eb37-46dd-96c2-ab2f054a1fd8" IfName:"eth0" Args:"IgnoreUnknown=1;K8S_POD_NAMESPACE=chrisj;K8S_POD_NAME=virt-launcher-rhel9-localnet-br1-test-57dk4;K8S_POD_INFRA_CONTAINER_ID=b340e08baa6544bd8ec7bcbe04c7f5b4653b44ea766110d153a11d46565760c2;K8S_POD_UID=30813ddf-ccb7-4a52-b1ed-d89237594eeb" Path:"" ERRORED: error configuring pod [chrisj/virt-launcher-rhel9-localnet-br1-test-57dk4] networking: [chrisj/virt-launcher-rhel9-localnet-br1-test-57dk4/30813ddf-ccb7-4a52-b1ed-d89237594eeb:bridge1]: error adding container to network "bridge1": CNI request failed with status 400: '[chrisj/virt-launcher-rhel9-localnet-br1-test-57dk4 b340e08baa6544bd8ec7bcbe04c7f5b4653b44ea766110d153a11d46565760c2 network bridge1 NAD chrisj/vlan-1105-br1] [chrisj/virt-launcher-rhel9-localnet-br1-test-57dk4 b340e08baa6544bd8ec7bcbe04c7f5b4653b44ea766110d153a11d46565760c2 network bridge1 NAD chrisj/vlan-1105-br1] failed to get pod annotation: timed out waiting for annotations: context deadline exceeded


The following yaml has been used to create NNCP and NAD:
---
apiVersion: nmstate.io/v1
kind: NodeNetworkConfigurationPolicy
metadata:
  name: bridge-br1
spec:
  nodeSelector:
    node-role.kubernetes.io/worker: ""
  desiredState:
    ovn:
      bridge-mappings:
        - localnet: bridge1
          bridge: ovs-br1
          state: present
    interfaces:
      - name: ovs-br1
        description: |-
          A dedicated OVS bridge with ens4f1 as a port
          allowing all VLANs and untagged traffic
        type: ovs-bridge
        state: up
        bridge:
          options:
            stp: true
          port:
            - name: ens4f1
---
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  annotations:
    description: Lab Network 172.20.133.0/24 VLAN1105 OVN Bridge
  name: vlan-1105-br1
  namespace: chrisj
spec:
  config: |-
    {
      "cniVersion": "0.3.1",
      "name": "bridge1",
      "type": "ovn-k8s-cni-overlay",
      "topology": "localnet",
      "netAttachDefName": "chrisj/vlan-1105-br1",
      "vlanID": 1105,
      "ipam": {
        "type": "whereabouts",
        "range": "172.20.133.0/24",
        "exclude": [ "172.20.133.1/32", "172.20.133.2/32", "172.20.133.3/32", "172.20.133.4/32" ]
        }
    }


here is my bridge mapping from the ovn perspective:
other_config        : {ct-no-masked-label="true", datapath-type=system, fdb-timestamp="true", iface-types="bareudp,erspan,geneve,gre,gtpu,internal,ip6erspan,ip6gre,lisp,patch,stt,system,tap,vxlan", is-interconn="true", is-remote="false", ls-dpg-column="true", mac-binding-timestamp="true", ovn-bridge-mappings="bridge1:ovs-br1,localnet:ovs-br1,localnet-1105:ovs-br1,localnet1:br-ex,physnet:br-ex", ovn-chassis-mac-mappings="", ovn-cms-options="", ovn-ct-lb-related="true", ovn-enable-lflow-cache="true", ovn-limit-lflow-cache="", ovn-memlimit-lflow-cache-kb="1048576", ovn-monitor-all="true", ovn-trim-limit-lflow-cache="", ovn-trim-timeout-ms="", ovn-trim-wmark-perc-lflow-cache="", port-up-notif="true"}

looking at the ovnkube-node for the worker that VM is being created on I don't see anything suspicious:
2024-04-02T19:42:36.819Z|00049|binding|INFO|Claiming lport chrisj_virt-launcher-rhel9-localnet-br1-test-57dk4 for this chassis.
2024-04-02T19:42:36.819Z|00050|binding|INFO|chrisj_virt-launcher-rhel9-localnet-br1-test-57dk4: Claiming 0a:58:0a:81:02:12 10.129.2.18
2024-04-02T19:42:36.867Z|00051|binding|INFO|Setting lport chrisj_virt-launcher-rhel9-localnet-br1-test-57dk4 up in Southbound
2024-04-02T19:42:36.868Z|00052|binding|INFO|Setting lport chrisj_virt-launcher-rhel9-localnet-br1-test-57dk4 ovn-installed in OVS
2024-04-02T19:43:06.820Z|00053|memory_trim|INFO|Detected inactivity (last active 30001 ms ago): trimming memory
2024-04-02T19:44:37.240Z|00054|binding|INFO|Releasing lport chrisj_virt-launcher-rhel9-localnet-br1-test-57dk4 from this chassis (sb_readonly=0)
2024-04-02T19:44:37.240Z|00055|binding|INFO|Setting lport chrisj_virt-launcher-rhel9-localnet-br1-test-57dk4 down in Southbound
2024-04-02T19:44:38.225Z|00056|binding|INFO|Claiming lport chrisj_virt-launcher-rhel9-localnet-br1-test-57dk4 for this chassis.
2024-04-02T19:44:38.225Z|00057|binding|INFO|chrisj_virt-launcher-rhel9-localnet-br1-test-57dk4: Claiming 0a:58:0a:81:02:12 10.129.2.18
2024-04-02T19:44:38.272Z|00058|binding|INFO|Setting lport chrisj_virt-launcher-rhel9-localnet-br1-test-57dk4 up in Southbound
2024-04-02T19:44:38.272Z|00059|binding|INFO|Setting lport chrisj_virt-launcher-rhel9-localnet-br1-test-57dk4 ovn-installed in OVS

Not sure what other troubleshooting steps could be applied to get me closer to the resolution

    4.15.3

    every time

    1. Create a new ovs bridge with bridge mappings
    2. Create localnet NAD that for the bridge
    3. Try create a VM with the new NAD attached
    

    error

    success

    I have also tried this for the existing br-ex but failed with the same/similar error. Here is the config used for br-ex: 
---
apiVersion: nmstate.io/v1
kind: NodeNetworkConfigurationPolicy
metadata:
  name: localnet
spec:
  nodeSelector:
    node-role.kubernetes.io/worker: ""
  desiredState:
    ovn:
      bridge-mappings:
        - localnet: localnet1
          bridge: br-ex
          state: present 
---
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  annotations:
    description: Lab Network 172.20.133.0/24 VLAN1105 OVN Bridge
  name: vlan-1105-localnet
  namespace: default
spec:
  config: |-
    {
      "cniVersion": "0.3.1", 
      "name": "localnet1",
      "type": "ovn-k8s-cni-overlay", 
      "topology": "localnet", 
      "netAttachDefName": "default/vlan-1105-localnet1",
      "vlan": 1105
    }

I don't have a customer case yet. This is a prep work for customer POC.