{"slug":"deploy-exit-nodes-and-subnet-routers-on-kubernetes","title":"Deploy exit nodes and subnet routers on Kubernetes","tags":["tailscale","routing","exit-nodes","containers"],"agent_summary":"Last validated: Dec 4, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Deploy exit nodes and subnet routers on Kubernetes\r\n\r\nLast validated: Dec 4, 2025\r\n\r\nDeploying exit nodes and subnet routers on Kubernetesis currently [in beta](https://tailscale.com/docs/reference/tailscale-release-stages#beta).\r\n\r\nTailscale Kubernetes Operator installation includes a `Connector` [Custom Resource Definition](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources).\r\n\r\nYou can use the `Connector` to configure the operator to deploy a Tailscale device that acts as a Tailscale [subnet router](https://tailscale.com/docs/features/subnet-routers), [exit-node](https://tailscale.com/docs/features/exit-nodes), or both.\r\n\r\nFor example, you can deploy a `Connector` that acts as a subnet router and exposes to your tailnet cluster `Service` CIDRs or some cloud service CIDRs that are available from the cluster, but not publicly accessible.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/features/kubernetes-operator/how-to/connector\\#prerequisites)\r\n\r\n- [Set up the Kubernetes Operator](https://tailscale.com/docs/features/kubernetes-operator#setup).\r\n\r\n## [Deploy an exit node or subnet router](https://tailscale.com/docs/features/kubernetes-operator/how-to/connector\\#deploy-an-exit-node-or-subnet-router)\r\n\r\nTo create a `Connector` that exposes `10.40.0.0/14` CIDR to your tailnet:\r\n\r\n1. (Optional) Set the [tag](https://tailscale.com/docs/features/tags) of the `Connector` node to be [auto-approved](https://tailscale.com/docs/reference/syntax/policy-file#autoapprovers). By default, the device will be tagged with `tag:k8s`. You can set one or more custom tags using `.connector.spec.tags` in step 2. If you set a custom tag, you must also ensure that the operator is an [owner](https://tailscale.com/docs/reference/syntax/policy-file#tag-owners) of this tag.\r\n\r\n2. Create a `Connector` Custom Resource:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```yaml\r\napiVersion: tailscale.com/v1alpha1\r\nkind: Connector\r\nmetadata:\r\n     name: ts-pod-cidrs\r\nspec:\r\n     replicas: 1\r\n     hostnamePrefix: ts-pod-cidrs\r\n     subnetRouter:\r\n       advertiseRoutes:\r\n      - \"10.40.0.0/14\"\r\n```\r\n\r\n3. Wait for the `Connector` resources to get created:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\nkubectl get connector ts-pod-cidrs\r\n```\r\n\r\n\r\n\r\nFor example, this command will return information similar to the following:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\nNAME   SUBNETROUTES                  ISEXITNODE   STATUS\r\nts-pod-cidrs   10.40.0.0/14         false        ConnectorCreated\r\n```\r\n\r\n4. (Optional) If you did not configure the route to be auto-approved in step 1, open the [Machines](https://login.tailscale.com/admin/machines) page of the admin console and manually approve the newly created `ts-pod-cidrs` device to advertise the `10.40.0.0/14` route.\r\n\r\n5. (Optional and for Linux clients only) Ensure that clients that need to access resources in the subnet have [accepted the advertised route](https://tailscale.com/docs/features/subnet-routers#use-your-subnet-routes-from-other-devices).\r\n\r\n\r\n## [Customization](https://tailscale.com/docs/features/kubernetes-operator/how-to/connector\\#customization)\r\n\r\n[Customize the operator and resources it manages](https://tailscale.com/docs/features/kubernetes-operator/how-to/customize). You can find [all available `Connector` configuration options on GitHub](https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#connector).\r\n\r\n## [Troubleshooting](https://tailscale.com/docs/features/kubernetes-operator/how-to/connector\\#troubleshooting)\r\n\r\n[Troubleshoot the operator and resources it manages](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Deploy exit nodes and subnet routers on Kubernetes</h1>\n<p>Last validated: Dec 4, 2025</p>\n<p>Deploying exit nodes and subnet routers on Kubernetesis currently <a href=\"https://tailscale.com/docs/reference/tailscale-release-stages#beta\">in beta</a>.</p>\n<p>Tailscale Kubernetes Operator installation includes a <code>Connector</code> <a href=\"https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources\">Custom Resource Definition</a>.</p>\n<p>You can use the <code>Connector</code> to configure the operator to deploy a Tailscale device that acts as a Tailscale <a href=\"https://tailscale.com/docs/features/subnet-routers\">subnet router</a>, <a href=\"https://tailscale.com/docs/features/exit-nodes\">exit-node</a>, or both.</p>\n<p>For example, you can deploy a <code>Connector</code> that acts as a subnet router and exposes to your tailnet cluster <code>Service</code> CIDRs or some cloud service CIDRs that are available from the cluster, but not publicly accessible.</p>\n<h2><a href=\"https://tailscale.com/docs/features/kubernetes-operator/how-to/connector#prerequisites\">Prerequisites</a></h2>\n<ul>\n<li><a href=\"https://tailscale.com/docs/features/kubernetes-operator#setup\">Set up the Kubernetes Operator</a>.</li>\n</ul>\n<h2><a href=\"https://tailscale.com/docs/features/kubernetes-operator/how-to/connector#deploy-an-exit-node-or-subnet-router\">Deploy an exit node or subnet router</a></h2>\n<p>To create a <code>Connector</code> that exposes <code>10.40.0.0/14</code> CIDR to your tailnet:</p>\n<ol>\n<li>\n<p>(Optional) Set the <a href=\"https://tailscale.com/docs/features/tags\">tag</a> of the <code>Connector</code> node to be <a href=\"https://tailscale.com/docs/reference/syntax/policy-file#autoapprovers\">auto-approved</a>. By default, the device will be tagged with <code>tag:k8s</code>. You can set one or more custom tags using <code>.connector.spec.tags</code> in step 2. If you set a custom tag, you must also ensure that the operator is an <a href=\"https://tailscale.com/docs/reference/syntax/policy-file#tag-owners\">owner</a> of this tag.</p>\n</li>\n<li>\n<p>Create a <code>Connector</code> Custom Resource:</p>\n</li>\n</ol>\n<pre><code class=\"language-yaml\">apiVersion: tailscale.com/v1alpha1\r\nkind: Connector\r\nmetadata:\r\n     name: ts-pod-cidrs\r\nspec:\r\n     replicas: 1\r\n     hostnamePrefix: ts-pod-cidrs\r\n     subnetRouter:\r\n       advertiseRoutes:\r\n      - \"10.40.0.0/14\"\n</code></pre>\n<ol start=\"3\">\n<li>Wait for the <code>Connector</code> resources to get created:</li>\n</ol>\n<pre><code class=\"language-shell\">kubectl get connector ts-pod-cidrs\n</code></pre>\n<p>For example, this command will return information similar to the following:</p>\n<pre><code class=\"language-shell\">NAME   SUBNETROUTES                  ISEXITNODE   STATUS\r\nts-pod-cidrs   10.40.0.0/14         false        ConnectorCreated\n</code></pre>\n<ol start=\"4\">\n<li>\n<p>(Optional) If you did not configure the route to be auto-approved in step 1, open the <a href=\"https://login.tailscale.com/admin/machines\">Machines</a> page of the admin console and manually approve the newly created <code>ts-pod-cidrs</code> device to advertise the <code>10.40.0.0/14</code> route.</p>\n</li>\n<li>\n<p>(Optional and for Linux clients only) Ensure that clients that need to access resources in the subnet have <a href=\"https://tailscale.com/docs/features/subnet-routers#use-your-subnet-routes-from-other-devices\">accepted the advertised route</a>.</p>\n</li>\n</ol>\n<h2><a href=\"https://tailscale.com/docs/features/kubernetes-operator/how-to/connector#customization\">Customization</a></h2>\n<p><a href=\"https://tailscale.com/docs/features/kubernetes-operator/how-to/customize\">Customize the operator and resources it manages</a>. You can find <a href=\"https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#connector\">all available <code>Connector</code> configuration options on GitHub</a>.</p>\n<h2><a href=\"https://tailscale.com/docs/features/kubernetes-operator/how-to/connector#troubleshooting\">Troubleshooting</a></h2>\n<p><a href=\"https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator\">Troubleshoot the operator and resources it manages</a>.</p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}