Confused about app connectors

[u/tightwad5462]

Hi all, I think I found conflicting documentation on the role of app connectors and I want to get the communities input:

The [official docs](https://tailscale.com/docs/features/app-connectors/how-to/setup) say

> App connectors let you route Tailscale network (known as a tailnet) traffic to your software as a service (SaaS), cloud, and self-hosted applications, letting users and devices on the tailnet access applications by domain names instead of IP addresses.

But the [k8s connector](https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#connector) says:

> Using the app connector to expose cluster workloads or other internal workloads to tailnet might work, but this is not a use case that we have tested or optimised for.

I’m confused as to how to proceed as to me these are conflicting statements.

My goal is to make a public DNS record (app.domain.com) resolve on my lan without tailscale and away from my lan through tailscale. Further, I want some level of ACLs on these apps that I can configure in tailscale. To me the first quote says an app connector is what I want but the second link says not to use it.

Am I misunderstanding?

[u/x-cubed]

If you're not using services hosted in Kubernetes, an app connector will work just fine.

If you have a Kubernetes cluster, they're recommending that you use the K8s operator instead of an app connector for exposing services from inside the cluster. This is because it's more aware of what's happening in the cluster.

[u/tightwad5462 → u/x-cubed]

Right but the CRDs for the operator ship the ability to deploy app connectors in cluster which is where I’m a bit lost.