{"slug":"expose-a-cloud-service-to-your-tailnet","title":"Expose a cloud service to your tailnet","tags":["tailscale","containers"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Expose a cloud service to your tailnet\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nExposing cloud services to your tailnetis currently [in beta](https://tailscale.com/docs/reference/tailscale-release-stages#beta).\r\n\r\nYou can use the Tailscale Kubernetes Operator to expose any cloud service, such as an RDS database on a cluster network, to your tailnet. If you have a cloud service that is not publicly accessible but is accessible to a Kubernetes cluster on that cloud, you can make it available to your tailnet using an operator deployed in the cluster.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/features/kubernetes-operator/how-to/cloud-services\\#prerequisites)\r\n\r\n- [Set up the Kubernetes Operator](https://tailscale.com/docs/features/kubernetes-operator#setup).\r\n\r\n## [Expose a cloud service using a Kubernetes `ExternalName``Service`](https://tailscale.com/docs/features/kubernetes-operator/how-to/cloud-services\\#expose-a-cloud-service-using-a-kubernetes-externalname-service)\r\n\r\nIf the cloud service that you wish to expose has a DNS name that can be resolved from within the cluster, you can expose it using an [ExternalName Service](https://kubernetes.io/docs/concepts/services-networking/service/#externalname).\r\n\r\nFor example, to expose an RDS database and connect to it from a tailnet client:\r\n\r\n1. Deploy Tailscale Kubernetes Operator to a Kubernetes cluster that is on the same network as the RDS instance.\r\n\r\nFollow the [installation instructions](https://tailscale.com/docs/features/kubernetes-operator#setup) to deploy the operator.\r\n\r\n2. Create an `ExternalName``Service` with `tailscale.com/expose: \"true\"` annotation and `spec.externalName` set to the DNS name of the RDS instance:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```yaml\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\n name: my-rds\r\n annotations:\r\n tailscale.com/expose: \"true\"\r\nspec:\r\n type: ExternalName\r\n externalName: my-rds.eu-central-1.rds.amazonaws.com\r\n```\r\n\r\n3. Retrieve the Tailscale MagicDNS name of the cluster proxy that the operator creates for the `Service` using the [`view-secret kubectl` plugin](https://github.com/elsesiy/kubectl-view-secret):\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\nrds_magic_dns_name=$(kubectl view-secret \\\r\n $(kubectl get secret -n tailscale \\\r\n --selector tailscale.com/parent-resource=my-rds,tailscale.com/parent-resource-ns=default,tailscale.com/parent-resource-type=svc \\\r\n -ojsonpath='{.items[0].metadata.name}') \\\r\n -n tailscale \\\r\n device_fqdn)\r\n```\r\n\r\n4. You can now connect to the RDS instance from a tailnet client using the MagicDNS name of the proxy as the database hostname.\r\n\r\nFor example, for a PostgreSQL database:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\npsql -h ${rds_magic_dns_name} -U postgres\r\n```\r\n\r\n\r\nThe cluster proxies created for `ExternalName``Service`s forward TCP traffic, so you should be able to use them with different backend protocols, such as PostgreSQL.\r\n\r\nThe Tailscale Kubernetes Operator periodically (every 10 minutes) attempts to resolve the IP addresses of the backend cloud service and reconfigures the proxy rules, if needed.\r\n\r\nFor proxies deployed with [firewall in nftables mode](https://tailscale.com/docs/features/firewall-mode), the traffic will only be proxied to the first IP address that the DNS name resolves to.\r\n\r\n`ExternalName``Service`s support the same `tailscale.com` labels and annotations as other `Service`s.\r\n\r\nWe are actively seeking feedback about this feature — [reach out](https://github.com/tailscale/tailscale/issues/new/choose) if you would like it to support additional workflows.\r\n\r\n## [Expose a cloud service or services using `Connector`](https://tailscale.com/docs/features/kubernetes-operator/how-to/cloud-services\\#expose-a-cloud-service-or-services-using-connector)\r\n\r\nIf the cloud service that you intend to expose does not have a DNS name that can be resolved from within a cluster, or you want to expose a whole CIDR range, you can do so using [Connector](https://tailscale.com/docs/features/kubernetes-operator/how-to/connector):\r\n\r\n```yaml\r\napiVersion: tailscale.com/v1alpha1\r\nkind: Connector\r\nmetadata:\r\n name: my-rds-instances\r\nspec:\r\n subnetRouter:\r\n advertiseRoutes:\r\n - \"\"\r\n```\r\n\r\nThe above `Connector` instance configures the operator to deploy an in-cluster [subnet router](https://tailscale.com/docs/features/subnet-routers) that exposes the configured CIDR range to your tailnet.\r\n\r\n## [Customization](https://tailscale.com/docs/features/kubernetes-operator/how-to/cloud-services\\#customization)\r\n\r\n[Customize the operator and resources it manages](https://tailscale.com/docs/features/kubernetes-operator/how-to/customize).\r\n\r\n## [Troubleshooting](https://tailscale.com/docs/features/kubernetes-operator/how-to/cloud-services\\#troubleshooting)\r\n\r\n[Troubleshoot the operator and resources it manages](https://tailscale.com/docs/reference/troubleshooting/containers/kubernetes-operator).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Expose a cloud service to your tailnet

\n

Last validated: Jan 5, 2026

\n

Exposing cloud services to your tailnetis currently in beta.

\n

You can use the Tailscale Kubernetes Operator to expose any cloud service, such as an RDS database on a cluster network, to your tailnet. If you have a cloud service that is not publicly accessible but is accessible to a Kubernetes cluster on that cloud, you can make it available to your tailnet using an operator deployed in the cluster.

\n

Prerequisites

\n\n

Expose a cloud service using a Kubernetes ExternalName``Service

\n

If the cloud service that you wish to expose has a DNS name that can be resolved from within the cluster, you can expose it using an ExternalName Service.

\n

For example, to expose an RDS database and connect to it from a tailnet client:

\n
    \n
  1. Deploy Tailscale Kubernetes Operator to a Kubernetes cluster that is on the same network as the RDS instance.
    2. \n
\n

Follow the installation instructions to deploy the operator.

\n
    \n
  1. Create an ExternalName``Service with tailscale.com/expose: \"true\" annotation and spec.externalName set to the DNS name of the RDS instance:
    2. \n
\n
apiVersion: v1\r\nkind: Service\r\nmetadata:\r\n     name: my-rds\r\n     annotations:\r\n       tailscale.com/expose: \"true\"\r\nspec:\r\n     type: ExternalName\r\n     externalName: my-rds.eu-central-1.rds.amazonaws.com\n
\n
    \n
  1. Retrieve the Tailscale MagicDNS name of the cluster proxy that the operator creates for the Service using the view-secret kubectl plugin:
    2. \n
\n
rds_magic_dns_name=$(kubectl view-secret \\\r\n     $(kubectl get secret -n tailscale   \\\r\n     --selector tailscale.com/parent-resource=my-rds,tailscale.com/parent-resource-ns=default,tailscale.com/parent-resource-type=svc \\\r\n     -ojsonpath='{.items[0].metadata.name}') \\\r\n     -n tailscale \\\r\n     device_fqdn)\n
\n
    \n
  1. You can now connect to the RDS instance from a tailnet client using the MagicDNS name of the proxy as the database hostname.
    2. \n
\n

For example, for a PostgreSQL database:

\n
psql -h ${rds_magic_dns_name} -U postgres\n
\n

The cluster proxies created for ExternalName``Services forward TCP traffic, so you should be able to use them with different backend protocols, such as PostgreSQL.

\n

The Tailscale Kubernetes Operator periodically (every 10 minutes) attempts to resolve the IP addresses of the backend cloud service and reconfigures the proxy rules, if needed.

\n

For proxies deployed with firewall in nftables mode, the traffic will only be proxied to the first IP address that the DNS name resolves to.

\n

ExternalName``Services support the same tailscale.com labels and annotations as other Services.

\n

We are actively seeking feedback about this feature — reach out if you would like it to support additional workflows.

\n

Expose a cloud service or services using Connector

\n

If the cloud service that you intend to expose does not have a DNS name that can be resolved from within a cluster, or you want to expose a whole CIDR range, you can do so using Connector:

\n
apiVersion: tailscale.com/v1alpha1\r\nkind: Connector\r\nmetadata:\r\n  name: my-rds-instances\r\nspec:\r\n  subnetRouter:\r\n    advertiseRoutes:\r\n      - \"<rds-cidr-range>\"\n
\n

The above Connector instance configures the operator to deploy an in-cluster subnet router that exposes the configured CIDR range to your tailnet.

\n

Customization

\n

Customize the operator and resources it manages.

\n

Troubleshooting

\n

Troubleshoot the operator and resources it manages.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}