--- title: Add secure ingress to the Kubernetes API | daily.dev description: A step-by-step guide shows how to use ngrok's Kubernetes Operator to securely expose a cluster's Kubernetes API for remote access without VPNs or VPC... canonical: https://daily.dev/posts/add-secure-ingress-to-the-kubernetes-api-6toiow3af twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Add secure ingress to the Kubernetes API | daily.dev og:description: A step-by-step guide shows how to use ngrok's Kubernetes Operator to securely expose a cluster's Kubernetes API for remote access without VPNs or VPC... og:url: https://daily.dev/posts/add-secure-ingress-to-the-kubernetes-api-6toiow3af og:image: https://api.daily.dev/og/posts/6tOIow3af.png og:image:alt: Add secure ingress to the Kubernetes API og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Add secure ingress to the Kubernetes API **[ngrok Blog](https://daily.dev/sources/ngrok)** · 7 min read · 0 upvotes · 0 comments ## Summary A step-by-step guide shows how to use ngrok's Kubernetes Operator to securely expose a cluster's Kubernetes API for remote access without VPNs or VPC tunneling. It covers setting up token-based RBAC with a service account and ClusterRoleBinding, installing the ngrok Operator via Helm, applying an AgentEndpoint CRD to expose the API, reconfiguring kubectl to connect through the ngrok domain, inspecting API traffic with ngrok's Traffic Inspector, and restricting access by IP using ngrok's Traffic Policy engine. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I access my Kubernetes API remotely without setting up a VPN or VPC tunnel? You can use ngrok's Kubernetes Operator to add ingress directly to the Kubernetes API with a single AgentEndpoint custom resource. Set up token-based RBAC with a service account and ClusterRoleBinding, install the operator via Helm, apply the CRD pointing to your reserved ngrok domain, and reconfigure kubectl's server property to use that domain and token instead of a certificate authority. _daily.dev surfaces practical walkthroughs like this for engineers securing remote cluster access._ ### Why can't I access my Kubernetes cluster's API from outside the cluster by default? The default RBAC configuration in most Kubernetes clusters assigns external requests the system:anonymous role, which lacks permission to view or list cluster state. To allow remote access, you need to bootstrap proper authentication and authorization, typically by creating a service account bound to a ClusterRole such as admin, edit, or view via a ClusterRoleBinding. _Engineers configuring cluster access controls can find setup guides like this on daily.dev._ ### How do I restrict access to my exposed Kubernetes API to specific IP addresses using ngrok? Add a trafficPolicy entry to the AgentEndpoint YAML configuration using ngrok's Traffic Policy engine, specifying the restrict-ips action with the allowed IPs or CIDR ranges in IPv4 or IPv6. Requests from any other IP are rejected before reaching the cluster. Reapply the updated CRD with kubectl apply -f to enforce the new restriction. _Teams locking down cluster ingress can track practical security configs like this via daily.dev._ --- Tags: [#devtools](https://daily.dev/tags/devtools), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/add-secure-ingress-to-the-kubernetes-api-6toiow3af) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Add secure ingress to the Kubernetes API","url":"https://daily.dev/posts/add-secure-ingress-to-the-kubernetes-api-6toiow3af","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/add-secure-ingress-to-the-kubernetes-api-6toiow3af"},"datePublished":"2026-08-23T07:21:13.728Z","dateModified":"2026-08-23T07:26:58.151Z","description":"A step-by-step guide shows how to use ngrok's Kubernetes Operator to securely expose a cluster's Kubernetes API for remote access without VPNs or VPC...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c22ea49f52389d3c9a6f535c57544ecf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c22ea49f52389d3c9a6f535c57544ecf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/add-secure-ingress-to-the-kubernetes-api-6toiow3af","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools,kubernetes","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Add secure ingress to the Kubernetes API"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/add-secure-ingress-to-the-kubernetes-api-6toiow3af#faq","mainEntity":[{"@type":"Question","name":"How can I access my Kubernetes API remotely without setting up a VPN or VPC tunnel?","acceptedAnswer":{"@type":"Answer","text":"You can use ngrok's Kubernetes Operator to add ingress directly to the Kubernetes API with a single AgentEndpoint custom resource. Set up token-based RBAC with a service account and ClusterRoleBinding, install the operator via Helm, apply the CRD pointing to your reserved ngrok domain, and reconfigure kubectl's server property to use that domain and token instead of a certificate authority. daily.dev surfaces practical walkthroughs like this for engineers securing remote cluster access."}},{"@type":"Question","name":"Why can't I access my Kubernetes cluster's API from outside the cluster by default?","acceptedAnswer":{"@type":"Answer","text":"The default RBAC configuration in most Kubernetes clusters assigns external requests the system:anonymous role, which lacks permission to view or list cluster state. To allow remote access, you need to bootstrap proper authentication and authorization, typically by creating a service account bound to a ClusterRole such as admin, edit, or view via a ClusterRoleBinding. Engineers configuring cluster access controls can find setup guides like this on daily.dev."}},{"@type":"Question","name":"How do I restrict access to my exposed Kubernetes API to specific IP addresses using ngrok?","acceptedAnswer":{"@type":"Answer","text":"Add a trafficPolicy entry to the AgentEndpoint YAML configuration using ngrok's Traffic Policy engine, specifying the restrict-ips action with the allowed IPs or CIDR ranges in IPv4 or IPv6. Requests from any other IP are rejected before reaching the cluster. Reapply the updated CRD with kubectl apply -f to enforce the new restriction. Teams locking down cluster ingress can track practical security configs like this via daily.dev."}}]} ```