diff --git a/pkg/rings/encode.go b/pkg/rings/encode.go
index f8cd089..7a083eb 100644
--- a/pkg/rings/encode.go
+++ b/pkg/rings/encode.go
@@ -76,6 +76,22 @@ func RingOneAddress(region RegionID, zone ZoneID, node NodeID) (addr netip.Addr,
 	return addr, err
 }
 
+// RingTwoPrefix represents the services of a cluster
+//
+// Ring 2 subnets are of the form `10.(region_id).0.0/20`,
+// using the address space that would belong to the ring 3
+// region_id 0.
+func RingTwoPrefix(region RegionID) (cidr netip.Prefix, err error) {
+	switch {
+	case !region.Valid():
+		err = ErrOutOfRange(region, "region")
+	default:
+		addr := unsafeRingTwoAddress(region, 0)
+		cidr = netip.PrefixFrom(addr, RingTwoBits)
+	}
+	return cidr, err
+}
+
 // RingThreePrefix returns the subnet corresponding to
 // the pods of a cluster.
 //
@@ -109,6 +125,15 @@ func unsafeRingOneAddress(region RegionID, zone ZoneID, node NodeID) netip.Addr
 	return AddrFrom4(10, r, z<<4+n1, n0)
 }
 
+func unsafeRingTwoAddress(region RegionID, n uint) netip.Addr {
+	r := uint(region)
+
+	n1 := n >> 8
+	n0 := n >> 0
+
+	return AddrFrom4(10, r, n1, n0)
+}
+
 func unsafeRingThreeAddress(region RegionID, n uint) netip.Addr {
 	r := uint(region)
 
diff --git a/pkg/rings/rings.go b/pkg/rings/rings.go
index 99f8a6d..646014d 100644
--- a/pkg/rings/rings.go
+++ b/pkg/rings/rings.go
@@ -23,6 +23,9 @@ const (
 	RingZeroBits = 16
 	// RingOneBits indicates the size of the prefix on the ring 1 (lan) network.
 	RingOneBits = 20
+	// RingTwoBits indicates the size of the prefix on the ring 2 (services) network
+	// of all kubernetes clusters.
+	RingTwoBits = 20
 	// RingThreeBits indicates the size of the prefix on the ring 3 (pods) network
 	// of the kubernetes cluster of a region.
 	RingThreeBits = 12