If I added IPs on the node for the services IP range, then bounced the pods/services, would that then create the required routes to stop it routing out via default route? I mean, technically a services IP is attached to a networking rule somewhere...