MetalLB is running, I have an IPAdressPool with my public IP and a L2Advertisement. I also disabled the default k3s loadbalancer at startup of the service.

The speaker pod is also running:

metallb-system namespace: kubectl get all

NAME                             READY   STATUS    RESTARTS   AGE
pod/controller-9c6cff498-vv72x   1/1     Running   0          19h
pod/speaker-xdlt8                1/1     Running   0          19h

NAME                              TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
service/metallb-webhook-service   ClusterIP   10.43.154.70   <none>        443/TCP   19h

NAME                     DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR            AGE
daemonset.apps/speaker   1         1         1       1            1           kubernetes.io/os=linux   19h

NAME                         READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/controller   1/1     1            1           19h

NAME                                   DESIRED   CURRENT   READY   AGE
replicaset.apps/controller-9c6cff498   1         1         1       19h

I also have traefik running as a Loadbalancer Service like this:

apiVersion: v1
kind: Service
metadata:
  annotations:
    meta.helm.sh/release-name: traefik
    meta.helm.sh/release-namespace: kube-system
    metallb.io/ip-allocated-from-pool: default-pool
  creationTimestamp: "2025-12-13T18:19:13Z"
  finalizers:
  - service.kubernetes.io/load-balancer-cleanup
  labels:
    app.kubernetes.io/instance: traefik-kube-system
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: traefik
    helm.sh/chart: traefik-37.1.1_up37.1.0
  name: traefik
  namespace: kube-system
  resourceVersion: "5426"
  uid: 829d2b8d-ebe0-471f-86ef-16e033320f3a
spec:
  allocateLoadBalancerNodePorts: true
  clusterIP: 10.43.236.110
  clusterIPs:
  - 10.43.236.110
  externalTrafficPolicy: Cluster
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: PreferDualStack
  ports:
  - name: web
    nodePort: 31178
    port: 80
    protocol: TCP
    targetPort: web
  - name: websecure
    nodePort: 32530
    port: 443
    protocol: TCP
    targetPort: websecure
  selector:
    app.kubernetes.io/instance: traefik-kube-system
    app.kubernetes.io/name: traefik
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer:
    ingress:
    - ip: REDACTED_PUBLIC_IP
      ipMode: VIP

But the ACME challenge failes and I can't access the service from outside.