From cf6cf8ec00d1309b00ac55ce1cf34e571e3c05c6 Mon Sep 17 00:00:00 2001
From: Periyasamy Palanisamy <pepalani@redhat.com>
Date: Mon, 22 Jun 2026 10:16:05 +0200
Subject: [PATCH 1/2] Configure ovnkube-node for IPsec Child SA metric

Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
---
 bindata/network/ovn-kubernetes/common/008-script-lib.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/bindata/network/ovn-kubernetes/common/008-script-lib.yaml b/bindata/network/ovn-kubernetes/common/008-script-lib.yaml
index b244e6b3f8..ee60bc9429 100644
--- a/bindata/network/ovn-kubernetes/common/008-script-lib.yaml
+++ b/bindata/network/ovn-kubernetes/common/008-script-lib.yaml
@@ -688,6 +688,11 @@ data:
         enable_interconnect_flag="--enable-interconnect"
       fi
 
+      ipsec_enable_flag=
+      {{ if .OVNIPsecEnable }}
+      ipsec_enable_flag="--enable-ipsec"
+      {{ end }}
+
       exec /usr/bin/ovnkube \
         ${init_ovnkube_controller} \
         --init-node "${K8S_NODE}" \
@@ -714,6 +719,7 @@ data:
         --acl-logging-rate-limit "{{.OVNPolicyAuditRateLimit}}" \
         ${gw_interface_flag} \
         ${ip_forwarding_flag} \
+        ${ipsec_enable_flag} \
         ${ovn_advertised_udn_isolation_mode_flag} \
         ${openflow_probe_flag} \
         ${allow_icmp_network_policy_flag} \

From e56f3b894955847de9e69f3468853a04634f0bce Mon Sep 17 00:00:00 2001
From: Periyasamy Palanisamy <pepalani@redhat.com>
Date: Mon, 22 Jun 2026 13:36:32 +0200
Subject: [PATCH 2/2] Remove host mount for ipsec binaries

Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
---
 .../network/ovn-kubernetes/common/ipsec-host.yaml    | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/bindata/network/ovn-kubernetes/common/ipsec-host.yaml b/bindata/network/ovn-kubernetes/common/ipsec-host.yaml
index 3a3e549c61..014dce1fe9 100644
--- a/bindata/network/ovn-kubernetes/common/ipsec-host.yaml
+++ b/bindata/network/ovn-kubernetes/common/ipsec-host.yaml
@@ -338,10 +338,6 @@ spec:
           name: host-var-lib
         - mountPath: /etc
           name: host-etc
-        - mountPath: /usr/sbin
-          name: usr-sbin
-        - mountPath: /usr/libexec
-          name: usr-libexec
         resources:
           requests:
             cpu: 10m
@@ -537,14 +533,6 @@ spec:
           path: /etc
           type: Directory
         name: host-etc
-      - hostPath:
-          path: /usr/sbin
-          type: Directory
-        name: usr-sbin
-      - hostPath:
-          path: /usr/libexec
-          type: Directory
-        name: usr-libexec
       tolerations:
       - operator: "Exists"
 {{end}}