Errors like "error adding container to network "v1-1-istio-cni": delegateAdd: error invoking confAdd - "v1-1-istio-cni": error in getting result from AddNetwork: exit status 4" are reported during pod creation.

Node journal shows istio-cni errors stating "Another app is currently holding the xtables lock" error.

Possible race with other OpenShift components which operates with iptables? Cluster where this issue was reported has quite long iptables-save time at SDN metrics.