What's the feature?

We need to make ovs-monitor-ipsec script as a systemd service on the host. This would help to get the service started so early at the time node reboots which would get IPsec connections established (if configured) with peers.
ovs-monitor-ipsec can run as a systemd service today, but it is not configurable, e.g. it's not possible to pass --no-restart-ike-daemon or run with a non-root ipsec.conf, both of which are required to run this daemon in OCP. So, ability to pass these options to a system-managed daemon should be added.

Why is it needed?

Running as a systemd sevice on the host would allow to get rid of pod workloads packet drop issue which happens for intermediate period during node reboot at the time of OCP upgrade. This also helps in stabilizing IPsec CI lanes and make those as mandatory jobs.

Who will benefit? 

OCP