When a SNO cluster is deployed with ZTP with IPSec N-S, it is not possible for packets originating from a workload to get encapsulated on the IPSec tunnel.

4.16    

    100%

    1.  Follow the example in ZTP to configure ipsec: https://github.com/openshift-kni/cnf-features-deploy/blob/master/README.md  
    2.  Create a service and deployment for a workload pod.
    3.  Try to ping an IP on the VPN subnet on the Security Gateway.
    

    It is not possible for packets originating from this pod to get encapsulated on the IPSec tunnel, which is managed on the host.

    It should be possible for packets originating from this pod to get encapsulated on the IPSec tunnel, which is managed on the host.

    Setting Local gateway mode would resolve this problem:

oc get network.operator/cluster -o json
...
{"spec":{"defaultNetwork":{"ovnKubernetesConfig":{"gatewayConfig":{"routingViaHost":true}}}}}