diff --git a/pkg/rings/rings.go b/pkg/rings/rings.go
index f75def5..73a819f 100644
--- a/pkg/rings/rings.go
+++ b/pkg/rings/rings.go
@@ -23,6 +23,9 @@ const (
 	RingZeroBits = 16
 	// RingOneBits indicates the size of the prefix on the ring 1 (lan) network.
 	RingOneBits = 20
+	// RingThreeBits indicates the size of the prefix on the ring 3 (pods) network
+	// of the kubernetes cluster of a region.
+	RingThreeBits = 12
 )
 
 // RegionID is the identifier of a region, valid between 1 and [RegionMax].
diff --git a/pkg/rings/three.go b/pkg/rings/three.go
new file mode 100644
index 0000000..20c7c1b
--- /dev/null
+++ b/pkg/rings/three.go
@@ -0,0 +1,18 @@
+package rings
+
+import "net/netip"
+
+// RingThreePrefix returns the subnet corresponding to
+// the pods of a cluster.
+//
+// Ring 3 is a `10.(region_id << 4).0.0/12` network
+func RingThreePrefix(region RegionID) (subnet netip.Prefix, err error) {
+	switch {
+	case !region.Valid():
+		err = ErrOutOfRange(region, "region")
+	default:
+		addr := AddrFrom4(10, uint(region)<<4, 0, 0)
+		subnet = netip.PrefixFrom(addr, RingThreeBits)
+	}
+	return subnet, err
+}