Connect a SubImage Outpost (private API access)

What this does

Deploys a lightweight container in the customer's private network that establishes an outbound Tailscale tunnel back to SubImage and proxies sync traffic to an internal HTTPS endpoint. SubImage modules that support outpost connectivity then route through this tunnel instead of the public internet.

When to use

✅ The target API is not reachable from the public internet (private Kubernetes clusters, on-prem services, VPN-only IT tools). ✅ User wants to scan an internal Jamf, BigFix, Kandji, SnipeIT, CrowdStrike, LastPass, or Semgrep instance. ✅ User wants the deployment committed in their Helm/Terraform repo.

❌ The cluster's API endpoint is public: no outpost needed; configure the EKS/GKE module directly. ❌ The user only needs in-cluster RBAC for an already-reachable EKS cluster: that is the EKS RBAC step (Access Entries or aws-auth), covered in Step 5, not an outpost.

Outpost-eligible modules: bigfix, crowdstrike, jamf, kandji, kubernetes (private API endpoint, EKS or self-managed), lastpass, semgrep, snipeit.

Step 1: Get the outpost registration key (self-serve)