Why does my NLB sometimes refuse connections when ingress-nginx scales down?

Check for a gap between the pod leaving a node and the NLB marking that node unhealthy. With instance targets and Local traffic policy, the NLB can keep sending connections to a node that no longer has a local ingress endpoint. Those connections can be refused.

Compare pod termination times with the target group's health check results and target state changes. A preStop hook that keeps the pod around briefly may give health checks and draining time to catch up. The right delay depends on your health check settings and shutdown behavior, so measure it rather than assuming a fixed number.

Look at the target group deregistration delay too. A shorter delay may help with draining, but it is separate from how quickly health checks detect that a node has lost its local endpoint. Check both timings before changing either one.

Make sure the ingress controller has suitable startup and readiness probes, and that the NLB health checks are configured correctly. The proxy needs to be ready before it gets traffic. Readiness alone may not close the scale-down window though, since the NLB has its own health check timing.

Also plan a move away from ingress-nginx, which is being retired. That won't solve this incident by itself, so the NLB and pod shutdown timing are still worth investigating while the migration is planned.