--- title: What makes the ngrok Kubernetes Operator different? description: The ngrok Kubernetes Operator differentiates itself from standard Ingress Controllers by working behind NAT, requiring no public IP or load balancer since it... canonical: https://daily.dev/posts/what-makes-the-ngrok-kubernetes-operator-different--diycy7udt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What makes the ngrok Kubernetes Operator different? | daily.dev og:description: The ngrok Kubernetes Operator differentiates itself from standard Ingress Controllers by working behind NAT, requiring no public IP or load balancer since it... og:url: https://daily.dev/posts/what-makes-the-ngrok-kubernetes-operator-different--diycy7udt og:image: https://api.daily.dev/og/posts/DIycY7uDT.png og:image:alt: What makes the ngrok Kubernetes Operator different? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What makes the ngrok Kubernetes Operator different? **[ngrok Blog](https://daily.dev/sources/ngrok)** · 5 min read · 0 upvotes · 0 comments ## Summary The ngrok Kubernetes Operator differentiates itself from standard Ingress Controllers by working behind NAT, requiring no public IP or load balancer since it establishes an outbound connection to ngrok's global network. It reduces operational overhead by eliminating the need for cert-manager (certificates are auto-provisioned) and optionally ExternalDNS. The operator supports running identical configurations locally (via k3s, k3d, kind) and in production, offers off-the-shelf modules for OAuth, OIDC, SAML, IP restrictions, header manipulation, webhook verification, and circuit breakers, and extends beyond HTTP(S) Ingress to support TCP/TLS traffic via custom resources. ngrok also mentions it is building a Gateway API-based Gateway Controller with native TCP/TLS route support. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the ngrok Kubernetes Operator provide ingress without a public IP address? It works behind NAT by having the operator make an outbound connection from the cluster to ngrok's global network, rather than requiring a public IP attached to a load balancer or edge router. This lets traffic reach any Kubernetes cluster, including ones in a public cloud, a private data center, or even running on a laptop. _Developers debating ingress approaches for restricted networks compare options like this on daily.dev._ ### Can I avoid using cert-manager and ExternalDNS when setting up Kubernetes ingress? Yes, with the ngrok Kubernetes Operator, TLS certificates are automatically provisioned and managed by ngrok, removing the need to install and manage cert-manager. ExternalDNS is only needed if you use your own custom subdomain and want CNAME records automatically created; ngrok subdomains or manual DNS management skip that requirement too. _Teams simplifying their ingress stack often weigh tradeoffs like these on daily.dev._ ### What Kubernetes custom resource does ngrok use to configure ingress modules like OAuth or IP restrictions? The NgrokModuleSet custom resource lets users build reusable, composable configuration for controlling ingress traffic, supporting modules such as OAuth, OIDC, SAML, IP restrictions, header addition and removal, webhook verification, and circuit breakers for DDoS protection. _Engineers configuring secure ingress modules track platform capabilities like these on daily.dev._ ## Similar posts on daily.dev - [The Gateway API shift: how Kubernetes networking actually works at scale](https://daily.dev/posts/the-gateway-api-shift-how-kubernetes-networking-actually-works-at-scale-t04kkbq5r) · Giant Swarm · 16 upvotes · 1 comments --- Tags: [#devtools](https://daily.dev/tags/devtools), [#kubernetes](https://daily.dev/tags/kubernetes), [#networking](https://daily.dev/tags/networking) [View this post on daily.dev](https://daily.dev/posts/what-makes-the-ngrok-kubernetes-operator-different--diycy7udt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What makes the ngrok Kubernetes Operator different?","url":"https://daily.dev/posts/what-makes-the-ngrok-kubernetes-operator-different--diycy7udt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-makes-the-ngrok-kubernetes-operator-different--diycy7udt"},"datePublished":"2026-08-23T07:21:27.683Z","dateModified":"2026-08-23T07:26:15.822Z","description":"The ngrok Kubernetes Operator differentiates itself from standard Ingress Controllers by working behind NAT, requiring no public IP or load balancer since it...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/50c4675a9d74ad2707aa1c4de5dec1a1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/50c4675a9d74ad2707aa1c4de5dec1a1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-makes-the-ngrok-kubernetes-operator-different--diycy7udt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools,kubernetes,networking","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"What makes the ngrok Kubernetes Operator different?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-makes-the-ngrok-kubernetes-operator-different--diycy7udt#faq","mainEntity":[{"@type":"Question","name":"How does the ngrok Kubernetes Operator provide ingress without a public IP address?","acceptedAnswer":{"@type":"Answer","text":"It works behind NAT by having the operator make an outbound connection from the cluster to ngrok's global network, rather than requiring a public IP attached to a load balancer or edge router. This lets traffic reach any Kubernetes cluster, including ones in a public cloud, a private data center, or even running on a laptop. Developers debating ingress approaches for restricted networks compare options like this on daily.dev."}},{"@type":"Question","name":"Can I avoid using cert-manager and ExternalDNS when setting up Kubernetes ingress?","acceptedAnswer":{"@type":"Answer","text":"Yes, with the ngrok Kubernetes Operator, TLS certificates are automatically provisioned and managed by ngrok, removing the need to install and manage cert-manager. ExternalDNS is only needed if you use your own custom subdomain and want CNAME records automatically created; ngrok subdomains or manual DNS management skip that requirement too. Teams simplifying their ingress stack often weigh tradeoffs like these on daily.dev."}},{"@type":"Question","name":"What Kubernetes custom resource does ngrok use to configure ingress modules like OAuth or IP restrictions?","acceptedAnswer":{"@type":"Answer","text":"The NgrokModuleSet custom resource lets users build reusable, composable configuration for controlling ingress traffic, supporting modules such as OAuth, OIDC, SAML, IP restrictions, header addition and removal, webhook verification, and circuit breakers for DDoS protection. Engineers configuring secure ingress modules track platform capabilities like these on daily.dev."}}]} ```