A source-range rule trusts node addresses while externalTrafficPolicy Local leaves one zone with no eligible ingress path during a failover rehearsal

The load balancer policy is correct and locality changes which nodes can actually receive traffic. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.