I would try to make your ingress also an egress for the 10.10.10.x network and then generate new ext client configs. Make sure the 10.10.10.x network shows up under allowed networks. Metallb exposes the ip on a random node via layer2. aka you have to be able to arp for it.