Access kubernetes services behind IKEv2 VPN (strongswan) on AKS

Question

I am trying to establish an IKEv2 VPN between one VM(subnet: 20.25.0.0/16) and one AKS cluster(subnet: 10.0.0.0/16 - Azure CNI) using strongswan gateway. I need to access some kubernetes services behind of this AKS cluster. With Azure CNI each pod will be assigned an IP address from the POD subnets specified at cluster creation, this subnet is attached in interface eth0 for each node. Already kubernetes services of the type clusterIP will get an IP from service CIDR range specified at cluster creation, but this IP is only available in the cluster is not attached in any interface of the nodes, like POD subnet.

To run the strongswan on K8S it's necessary to mount the kernel modules(/lib/modules), in addition to enable NET_ADMIN capabilities. So the VPN tunnel is established using any of the networks attached on the host(nodes) interface, so I can't established a VPN using service CIDR range specified at cluster creation, since this IPs is known only within the cluster, through personalized routes and is not attached on any host interface. If I try to configure the VPN established with a subnet with the CIDR range of services informed in the creation of the cluster, I get an error stating that the subnet was not found in any of the interfaces.

To get around this, I realized that I can configure a tunnel informing a subnet with a larger range, as long as there is a subnet attached in my interface that is within the wider informed range. For example, I can configure a VPN informing the subnet 10.0.0.0/16, but my subnet for pods and nodes (attached in eth0) is 10.0.0.0/17 and CIDR range for services is 10.0.128.0/17, in this way all traffic 10.0.0.0/16 is routed through the vpn tunnel. In this way, as a workaround I define my services CIDR as a network subsequent to the network of pods and nodes and configure the VPN using a network that overlaps the two.

All 10.0.0.0/16 traffic from one side of the VPN (VM) is correctly routed to inside tunnel. If I try to access a Pod directly, using any IP from the Pods subnet (10.0.0.0/17), everything works fine. The issue is if I try to access a kubernetes service using a IP from CIDR for services(10.0.128.0/17), the traffic is not routed correctly until the K8S services. I can see the request in tcpdump in AKS, but it doesn't arrive in the service. So my question is, how to make a configuration on the strongswan, in which I can access the services on the aks kubernetes cluster?

Below is the current configuration of the strongswan:

• PEER-1(VM)

conn %default
    authby="secret"
    closeaction="restart"
    dpdaction="restart"
    dpddelay="5"
    dpdtimeout="10"
    esp="aes256-sha1-modp1536"
    ike="aes256-sha1-modp1024"
    ikelifetime="1440m"
    keyexchange="ikev2"
    keyingtries="1"
    keylife="60m"
    mobike="no"

conn PEER-1
    auto=add
    leftid=<LEFT-PHASE-1-IP>
    left=%any
    leftsubnet=20.25.0.0/16
    leftfirewall=yes
    leftauth=psk
    rightid=<RIGHT-PHASE-1-IP>
    right=<RIGHT-PHASE-1-IP>
    rightsubnet=10.0.0.0/16
    rightfirewall=yes
    rightauth=psk

• PEER-2(AKS)

conn %default
    authby="secret"
    closeaction="restart"
    dpdaction="restart"
    dpddelay="5"
    dpdtimeout="10"
    esp="aes256-sha1-modp1536"
    ike="aes256-sha1-modp1024"
    ikelifetime="1440m"
    keyexchange="ikev2"
    keyingtries="1"
    keylife="60m"
    mobike="no"

conn PEER-2
    auto=start
    leftid=<LEFT-PHASE-1-IP>
    left=%any
    leftsubnet=10.0.0.0/16
    leftfirewall=yes
    leftauth=psk
    rightid=<RIGHT-PHASE-1-IP>
    right=<RIGHT-PHASE-1-IP>
    rightsubnet=20.25.0.0/16
    rightfirewall=yes
    rightauth=psk