The NLB forwards to the Service's NodePort and healthchecks it on the
node; the cloud controller does not open that port in the security
group. shorashim-external had no rule for 30923 for 26 days, so
185.19.29.180 refused connections while the pod was Ready. Rule added
by the kohen 2026-10-04; the command now sits beside the manifest.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>