Migration of IP Multimedia Subsystem(IMS) for VoLTE in Kubernetes .(The pods of P-CSCF cannot be scheduled to the multiple worker nodes)

The pods of P-CSCF cannot be scheduled to the multiple worker nodes, because the INVITE towards UE-B from Terminating P-CSCF will leave directly from Pod. Since P-CSCF running in pod has contact of UE-B, the packet will go directly from worker node on which Pod is running (Pod IP gets SNAT to worker IP and not to ESP-server IP i.e load balancer).
The associations of IPsec will not be created at this worker node from where the INVITE to UE-B is going, hence, the unencrypted packet will go to UE-B which it will reject. Moreover, INVITE towards B will go through the port 40960 (port-s) for which there is no connection tracking at P-CSCF services, so there is no point in sending the INVITE to the P_CSCF external IP address. The Egress gateway also does not seem to be a good solution, since we do not have an SIP proxy Egress gateway.
May you have any suggestion with respect to this. Even if we were to replicate the IPsec associations on all VM(worker node) somehow (we have no idea how), The response of INVITE will come to the port 5060 which is not opened at the worker node (only Node port between the range of 30000 - 33000 will be opened). which again fails.