This bug is a tracker for a customer issue with submariner. Initial setup is two MicroShift clusters, both of them running submariner. When adding the second node to submariner a gateway route gets created and submariner will resync ovn rules.
The submariner-operator then removes the cluster subnet rule, breaking cluster local traffic (including the apiserver).

There is an upstream issue here: https://github.com/submariner-io/submariner/issues/3880
There is also an upstream fix here: https://github.com/submariner-io/submariner/pull/3881

    1.
    2.
    3.