When Encapsulating Security Payload (ESP) is used in the tunnel mode, a new IP header is computed and added. Why is this necessary? Thank you.
Why is this necessary?
Actually, it's not necessary; if you don't want to add a new IP header, there's another perfectly good mode you can use ("transport mode").
If your question is "why would anyone use tunnel mode", the largest reason is security gateways.
Suppose that you are in an office that has a small network, and a VPN link to the corporate headquarters. Your PC in the office has been assigned address 10.1.2.3 (which is fine; your office network is isolated from the internet), and you want to talk to a server at headquarters, address 10.4.5.6. Your PC creates an IP packet with a header that lists it as from 10.1.2.3 and to 10.4.5.6. Your gateway has the responsibility of encrypting this packet, and sending the encrypted packet over the internet to the headquarter's gateway (which might have address 220.127.116.11). The destination IP address for this packet must be 18.104.22.168 (otherwise, the headquarter's gateway will never receive it), however it is also important that the decrypting gateway could deduce that the original packet was destined to 10.4.5.6. Just one IP header doesn't really work (because we have two different destination addresses, and for similar reasons, two different source addresses); the way that the IPsec designers decided to address this is to encrypt the original ("inner") IP header along with the rest of the packet, and add another ("outer") IP header (whose job is to get the encrypted packet to the one guy who is willing to decrypt it).
Also, you state that a new IP header is "computed"; in the IPsec implementations I've seen (and written), the outer IP header is mostly preformatted; a few things need to be tweaked (TL, TOS, IPv4 DF, ID fields), but it's cheaper than formatting it from scratch each time.