[zaat]

What you describe is not NAT, the containers network segment is a separate network segment which is not accessible from outside the cluster, not directly and not through address translation. The ingress and service addresses are externally reachable addresses that expose services. NAT is not required for the setup.

[raesene9]

If traffic flows from the pod network to an external network NAT is involved, as the Pod network is not routable.