Can Tailscale NAT rules be invisible to nft list ruleset?

Yes. If Tailscale is using the iptables-legacy backend, its rules won't show up in nft list ruleset. Try iptables-legacy -t nat -L -n -v to inspect the legacy NAT table, including rule counters.

Check which backend each component is using rather than assuming they all use the same one. A host can have legacy iptables rules alongside nftables rules, so a clean-looking view in one doesn't rule out translation in the other.

That split gets especially confusing on Kubernetes nodes. Tailscale might use legacy iptables while kube-proxy or the CNI uses the nft backend, leaving relevant rules in both places.

Some setups pin components to one backend with update-alternatives to make inspection less surprising. Check what each component supports and how it selects its backend before changing anything, though. Switching the default doesn't explain existing rules by itself.

The hidden NAT rules are worth checking, but they don't prove they're behind a TLS rejection. Look at the etcd error and the addresses involved as well. A visible translation gives you something concrete to investigate alongside the certificate and connection details.