I’m wondering how the backup command would know to use tls vs non-tls on port 32399. Maybe try explicitly specifying the protocol - like : couchbases://<worker_node_ip>:32399 see cbbackupmgr backup | Couchbase Docs. Also see the options releated to ssl - cbbackupmgr backup | Couchbase Docs
You may also need to specify network=external when working with kubernetes. cbbackupmgr backup | Couchbase Docs
You could also try connecting with SDK Doctor as it has detailed diagnostics.