# Deploy exit nodes and subnet routers on Kubernetes

Last validated Jun 5, 2026

The Tailscale Kubernetes Operator installation includes a Connector [Custom Resource Definition][xt-k8s-custom-resources]. You can use the Connector to configure the operator to deploy a device that acts as an [exit node][kb-exit-nodes], a subnet router, or both.

For example, you can deploy a Connector that acts as a subnet router and exposes cluster Service CIDRs or cloud service CIDRs that are available from the cluster but not publicly accessible.

## Prerequisites

Complete the following before deploying a Connector:

* [Install][kb-operator-setup] the Tailscale Kubernetes Operator.

## Deploy an exit node or subnet router

To create a Connector that exposes the `10.40.0.0/14` CIDR to your tailnet:

1. (Optional) Set the [tag][kb-tags] of the Connector node to be [automatically approved][kb-acls-autoapprovers]. By default, the device is tagged with `tag:k8s`. You can set custom tags using `.connector.spec.tags`. If you set a custom tag, ensure the operator is an [owner][kb-acls-tag-owners] of this tag.

2. Create a Connector custom resource:

   ```yaml
   apiVersion: tailscale.com/v1alpha1
   kind: Connector
   metadata:
     name: ts-pod-cidrs
   spec:
     replicas: 1
     hostnamePrefix: ts-pod-cidrs
     subnetRouter:
       advertiseRoutes:
         - "10.40.0.0/14"
   ```

3. Verify resource creation:

   ```shell
   kubectl get connector ts-pod-cidrs
   NAME           SUBNETROUTES                ISEXITNODE   STATUS
   ts-pod-cidrs   10.40.0.0/14          false        ConnectorCreated
   ```

4. (Optional) If you did not configure automatic approval, open [Machines](https://login.tailscale.com/admin/machines) and manually approve the newly created `ts-pod-cidrs` device to advertise the `10.40.0.0/14` route.

5. (Optional) Linux clients needing to access resources in the subnet must [accept the advertised route][kb-subnets-use-routes].

## Customization

For details on customizing the operator and the resources it manages, refer to [Kubernetes Operator customization][kb-operator-customization]. You can find all available Connector configuration options [on GitHub][xt-gh-tailscale-k8s-connector].

## Troubleshooting

For troubleshooting information, refer to [Troubleshooting the Tailscale Kubernetes Operator][kb-operator-troubleshooting].

[kb-acls-autoapprovers]: /docs/reference/syntax/policy-file#auto-approvers

[kb-acls-tag-owners]: /docs/reference/syntax/policy-file#tag-owners

[kb-exit-nodes]: /docs/features/exit-nodes

[kb-operator-customization]: /docs/kubernetes-operator/concepts/proxyclass

[kb-operator-setup]: /docs/kubernetes-operator/install-operator

[kb-operator-troubleshooting]: /docs/kubernetes-operator/reference/troubleshooting

[kb-subnets-use-routes]: /docs/features/subnet-routers#use-your-subnet-routes-from-other-devices

[kb-tags]: /docs/features/tags

[xt-gh-tailscale-k8s-connector]: https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#connector

[xt-k8s-custom-resources]: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources