For IPsec support on IBM, we need to enable NAT-T. For that, we need:

OVN: https://github.com/ovn-org/ovn/commit/d6dd8e49551141159f040406202f8550c18a1846
OVS: https://github.com/openvswitch/ovs/commit/e8515c8cc082964f7611e6f03300e614b9b8eaca

There's a high likelihood that this will not make it into earlier versions of OVS, but it is upstream in OVS 3.0 now. So when we pull that into OCP, the fix will be there.
Check https://coreos.slack.com/archives/C01G7T6SYSD/p1658413488130169 eventually.

The upstream patch for 2.17 is here, but there's a chance that it may be declined: http://patchwork.ozlabs.org/project/openvswitch/patch/20220722101122.19470-1-ak.karis@gmail.com/

I can't find any openvswitch3.0 downstream RPMs (https://brewweb.engineering.redhat.com/brew/search?match=glob&type=package&terms=openvswitch*) ; I suppose that we do not have them, yet