diff --git a/app/graphql/types/app_config/kas_type.rb b/app/graphql/types/app_config/kas_type.rb
index 506e4a5dd6f050d731ce79b52c87db8228853edd..7885198c0ea4e9218adada43d176503bc35b8c21 100644
--- a/app/graphql/types/app_config/kas_type.rb
+++ b/app/graphql/types/app_config/kas_type.rb
@@ -9,8 +9,12 @@ class KasType < ::Types::BaseObject
 
       field :enabled, GraphQL::Types::Boolean, null: false,
         description: 'Indicates whether the Kubernetes agent server is enabled.'
+      field :external_k8s_proxy_url, GraphQL::Types::String, null: true,
+        description: 'URL used by the Kubernetes tooling to communicate with the KAS Kubernetes API proxy.'
+      # rubocop:disable GraphQL/ExtractType -- we want to keep this way for backwards compatibility
       field :external_url, GraphQL::Types::String, null: true,
         description: 'URL used by the agents to communicate with the server.'
+      # rubocop:enable GraphQL/ExtractType
       field :version, GraphQL::Types::String, null: true,
         description: 'KAS version.'
     end
diff --git a/app/models/app_config/kas_metadata.rb b/app/models/app_config/kas_metadata.rb
index 0867cbd271a11e80e1a4c1bc03b7ca10d09d0543..917eefaaf9b9ffd655b2c0f2c0d55c576369fbe2 100644
--- a/app/models/app_config/kas_metadata.rb
+++ b/app/models/app_config/kas_metadata.rb
@@ -2,7 +2,7 @@
 
 module AppConfig
   class KasMetadata
-    attr_reader :enabled, :version, :external_url
+    attr_reader :enabled, :version, :external_url, :external_k8s_proxy_url
 
     def self.declarative_policy_class
       "AppConfig::InstanceMetadataPolicy"
@@ -12,6 +12,7 @@ def initialize
       @enabled = Gitlab::Kas.enabled?
       @version = Gitlab::Kas.version if @enabled
       @external_url = Gitlab::Kas.external_url if @enabled
+      @external_k8s_proxy_url = Gitlab::Kas.tunnel_url if @enabled
     end
   end
 end
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 7a5f1461bcc32d9e4b6d7d5c248a687a7a9e8731..4ca48468e10423b35202b43456e9e84907ce944d 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -26575,6 +26575,7 @@ Represents the Geo replication and verification state of a job_artifact.
 | Name | Type | Description |
 | ---- | ---- | ----------- |
 | <a id="kasenabled"></a>`enabled` | [`Boolean!`](#boolean) | Indicates whether the Kubernetes agent server is enabled. |
+| <a id="kasexternalk8sproxyurl"></a>`externalK8sProxyUrl` | [`String`](#string) | URL used by the Kubernetes tooling to communicate with the KAS Kubernetes API proxy. |
 | <a id="kasexternalurl"></a>`externalUrl` | [`String`](#string) | URL used by the agents to communicate with the server. |
 | <a id="kasversion"></a>`version` | [`String`](#string) | KAS version. |
 
diff --git a/doc/api/metadata.md b/doc/api/metadata.md
index 765ad2cc4e12a0eacd3c6e9a6e938d081d5f39c9..6dfe6b7ab8805ee1ffd0baa32f0c30e4a0332062 100644
--- a/doc/api/metadata.md
+++ b/doc/api/metadata.md
@@ -12,6 +12,7 @@ DETAILS:
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/357032) in GitLab 15.2.
 > - `enterprise` [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/103969) in GitLab 15.6.
+> - `kas.externalK8sProxyUrl` [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/172373) in GitLab 17.6.
 
 Retrieve metadata information for this GitLab instance.
 
@@ -21,15 +22,16 @@ GET /metadata
 
 Response body attributes:
 
-| Attribute         | Type           | Description                                                                              |
-|:------------------|:---------------|:-----------------------------------------------------------------------------------------|
-| `version`         | string         | Version of the GitLab instance.                                                          |
-| `revision`        | string         | Revision of the GitLab instance.                                                         |
-| `kas`             | object         | Metadata about the GitLab agent server for Kubernetes (KAS).                             |
-| `kas.enabled`     | boolean        | Indicates whether KAS is enabled.                                                        |
-| `kas.externalUrl` | string or null | URL used by the agents to communicate with KAS. It's `null` if `kas.enabled` is `false`. |
-| `kas.version`     | string or null | Version of KAS. It's `null` if `kas.enabled` is `false`.                                 |
-| `enterprise`      | boolean        | Indicates whether GitLab instance is Enterprise Edition.                                 |
+| Attribute                 | Type           | Description                                                                                                                   |
+|:--------------------------|:---------------|:------------------------------------------------------------------------------------------------------------------------------|
+| `version`                 | string         | Version of the GitLab instance.                                                                                               |
+| `revision`                | string         | Revision of the GitLab instance.                                                                                              |
+| `kas`                     | object         | Metadata about the GitLab agent server for Kubernetes (KAS).                                                                  |
+| `kas.enabled`             | boolean        | Indicates whether KAS is enabled.                                                                                             |
+| `kas.externalUrl`         | string or null | URL used by the agents to communicate with KAS. It's `null` if `kas.enabled` is `false`.                                      |
+| `kas.externalK8sProxyUrl` | string or null | URL used by the Kubernetes tooling to communicate with the KAS Kubernetes API proxy. It's `null` if `kas.enabled` is `false`. |
+| `kas.version`             | string or null | Version of KAS. It's `null` if `kas.enabled` is `false`.                                                                      |
+| `enterprise`              | boolean        | Indicates whether GitLab instance is Enterprise Edition.                                                                      |
 
 Example request:
 
@@ -46,6 +48,7 @@ Example response:
   "kas": {
     "enabled": true,
     "externalUrl": "grpc://gitlab.example.com:8150",
+    "externalK8sProxyUrl": "https://gitlab.example.com:8150/k8s-proxy",
     "version": "15.0.0"
   },
   "enterprise": true
diff --git a/lib/api/entities/metadata.rb b/lib/api/entities/metadata.rb
index 7dfcad2ccabd3c9b936c9707050035d72a89835e..b396d3a2fc209ea222cab1dc8b74c62f719ee071 100644
--- a/lib/api/entities/metadata.rb
+++ b/lib/api/entities/metadata.rb
@@ -8,6 +8,7 @@ class Metadata < Grape::Entity
       expose :kas do
         expose :enabled, documentation: { type: 'boolean' }
         expose :externalUrl, documentation: { type: 'string', example: 'grpc://gitlab.example.com:8150' }
+        expose :externalK8sProxyUrl, documentation: { type: 'string', example: 'https://gitlab.example.com:8150/k8s-proxy' }
         expose :version, documentation: { type: 'string', example: '15.0.0' }
       end
       expose :enterprise, documentation: { type: 'boolean' }
diff --git a/lib/api/metadata.rb b/lib/api/metadata.rb
index d446f81f2cb6adbbe70f84703d39490fffaa4776..95cf3777300bfddf31e50a64aa79198291ad352a 100644
--- a/lib/api/metadata.rb
+++ b/lib/api/metadata.rb
@@ -21,6 +21,7 @@ class Metadata < ::API::Base
           kas {
             enabled
             externalUrl
+            externalK8sProxyUrl
             version
           }
           enterprise
diff --git a/spec/models/app_config/kas_metadata_spec.rb b/spec/models/app_config/kas_metadata_spec.rb
index df1127d5f73bbf4e4dfa008bb1e552b6f6fb7617..3c8a490bdecf2d393f0ef7daea329fcfc0222f5e 100644
--- a/spec/models/app_config/kas_metadata_spec.rb
+++ b/spec/models/app_config/kas_metadata_spec.rb
@@ -14,7 +14,8 @@
       expect(described_class.new).to have_attributes(
         enabled: Gitlab::Kas.enabled?,
         version: Gitlab::Kas.version,
-        external_url: Gitlab::Kas.external_url
+        external_url: Gitlab::Kas.external_url,
+        external_k8s_proxy_url: Gitlab::Kas.tunnel_url
       )
     end
   end
@@ -26,7 +27,8 @@
       expect(described_class.new).to have_attributes(
         enabled: Gitlab::Kas.enabled?,
         version: nil,
-        external_url: nil
+        external_url: nil,
+        external_k8s_proxy_url: nil
       )
     end
   end
diff --git a/spec/requests/api/graphql/metadata_query_spec.rb b/spec/requests/api/graphql/metadata_query_spec.rb
index de54fbe75e7d0ded48f6060688b8dd346d0271e3..d19fe9da797f64b19fd6bb2e0ac70c77759d6a1a 100644
--- a/spec/requests/api/graphql/metadata_query_spec.rb
+++ b/spec/requests/api/graphql/metadata_query_spec.rb
@@ -18,7 +18,8 @@
           'kas' => {
             'enabled' => Gitlab::Kas.enabled?,
             'version' => expected_kas_version,
-            'externalUrl' => expected_kas_external_url
+            'externalUrl' => expected_kas_external_url,
+            'externalK8sProxyUrl' => expected_kas_external_k8s_proxy_url
           },
           'enterprise' => Gitlab.ee?
         }
@@ -28,6 +29,7 @@
     context 'kas is enabled' do
       let(:expected_kas_version) { Gitlab::Kas.version }
       let(:expected_kas_external_url) { Gitlab::Kas.external_url }
+      let(:expected_kas_external_k8s_proxy_url) { Gitlab::Kas.tunnel_url }
 
       before do
         allow(Gitlab::Kas).to receive(:enabled?).and_return(true)
@@ -43,6 +45,7 @@
     context 'kas is disabled' do
       let(:expected_kas_version) { nil }
       let(:expected_kas_external_url) { nil }
+      let(:expected_kas_external_k8s_proxy_url) { nil }
 
       before do
         allow(Gitlab::Kas).to receive(:enabled?).and_return(false)