inlets-operator
inlets-operator is a Kubernetes controller that automatically provisions public cloud VMs and creates encrypted tunnels to expose local LoadBalancer services to the internet, eliminating the need for manual port-forwarding or firewall configuration. It works with any local Kubernetes cluster (laptop, on-premises, Raspberry Pi) and integrates with managed cloud providers like DigitalOcean, AWS, and Hetzner.
Key facts
Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.
| Field | Value |
|---|---|
| Repository | inlets/inlets-operator |
| Owner | inlets |
| Primary language | Go |
| License | MIT — OSI-approved |
| Stars | 1.4k |
| Forks | 98 |
| Open issues | 7 |
| Latest release | 0.17.20 (2026-02-25) |
| Last updated | 2026-04-08 |
| Source | https://github.com/inlets/inlets-operator |
What inlets-operator is
Written in Go, the operator detects Kubernetes LoadBalancer service annotations, provisions VM exit-servers via cloud provider APIs (using the shared cloud-provision library), and runs an inlets client-server tunnel pair with optional proxy-protocol support for IP preservation. It exposes a custom Tunnel CRD for advanced scenarios including IPVS networking and pre-shared authentication tokens.
Get the inlets-operator source
Clone the repository and explore it locally.
git clone https://github.com/inlets/inlets-operator.gitcd inlets-operator# follow the project's README for install & configurationNeed it deployed, integrated, or customized instead? DEV.co ships production installs.
Best use cases
Implementation considerations
- Cloud provider credentials must be stored as Kubernetes secrets; plan for credential rotation and audit logging, especially in shared clusters.
- VM provisioning introduces startup latency (typically seconds); services will show <pending> briefly before the exit-server is ready and the operator updates the LoadBalancer IP.
- Proxy-protocol configuration is immutable after provisioning; changing it requires service deletion and recreation, causing tunnel downtime.
- Network egress from your local cluster to the cloud exit-server must be allowed; firewall rules should permit outbound HTTPS or tunnel protocol traffic.
- Cost monitoring is essential; accidentally creating many LoadBalancer services will spawn multiple VMs. Use the `operator.inlets.dev/manage=0` annotation to exclude services from auto-provisioning.
When to avoid it — and what to weigh
- You require a fully managed, zero-cloud-cost solution — inlets-operator provisions real cloud VMs; you will incur cloud provider charges. If your budget requires zero external infrastructure costs, pure local tunneling solutions (Cloudflare Tunnel, ngrok) may be more appropriate.
- You need guaranteed high-availability or SLA commitments — The operator depends on cloud provider VM availability and network stability. Production workloads requiring strict SLAs should use managed Kubernetes with built-in LoadBalancer support or dedicated enterprise tunnel platforms.
- Your organization prohibits cloud provider egress or has strict data residency rules — The tunnel traffic routes through cloud VMs, which may violate compliance requirements or regulatory constraints. On-premises only solutions would be required in such cases.
- You are unfamiliar with Kubernetes operators and custom resources — The operator requires understanding of Kubernetes service annotations, CRDs, and cloud provider credential management. Teams new to Kubernetes may find it operationally complex.
License & commercial use
Licensed under MIT (MIT License), a permissive OSI-approved license allowing commercial use, modification, and distribution with minimal restrictions.
MIT license explicitly permits commercial use. However, the operator itself is free, but you will incur cloud provider charges for the VMs it provisions (typically $5–10/month per tunnel). Verify your cloud provider's terms and licensing compliance for production deployments.
DEV.co evaluation signals
Editorial assessment — not user reviews. Directional, with an explicit confidence level.
| Signal | Assessment |
|---|---|
| Maintenance | Active |
| Documentation | Adequate |
| License clarity | Clear |
| Deployment complexity | Moderate |
| DEV.co fit | Good |
| Assessment confidence | High |
Traffic is encrypted via the inlets tunnel; README claims 'encrypted' but details of encryption protocol, cipher suites, and certificate pinning are Not clearly stated in provided data. Cloud provider credentials are stored as Kubernetes secrets; ensure proper RBAC and audit logging. Proxy-protocol v1/v2 support allows client IP forwarding, reducing anonymity. Review inlets tunnel documentation for TLS/mTLS implementation details before production use.
Alternatives to consider
Cloudflare Tunnel / Argo Tunnel
Managed, zero-infrastructure tunneling without VMs; no cost for basic tier but with stricter rate limits and vendor lock-in. Better for cost-sensitive, low-traffic use cases.
ngrok
Developer-focused, simple to set up; free tier suitable for quick demos but with aggressive rate limiting and short session lifetimes. Not designed for production ingress.
Tailscale/WireGuard-based VPN solutions
Provides private network tunneling without public IPs; good for secure team access but not suitable for public-facing services or third-party API webhooks.
Build on inlets-operator with DEV.co software developers
Evaluate inlets-operator for your team's DevOps and cloud integration needs. Review the installation guide, test with your preferred cloud provider, and confirm cost estimates before production deployment.
Talk to DEV.coRelated open-source tools
Surfaced by semantic similarity across the DEV.co open-source index.
Related on DEV.co
Explore the category and the services that help you build with it.
inlets-operator FAQ
Do I own the public IP address, or is it ephemeral?
Can I use inlets-operator with services that are not of type LoadBalancer?
What happens if the tunnel exits server fails or is terminated?
Is there support for UDP or non-TCP protocols?
Software development & web development with DEV.co
From first prototype to production, DEV.co delivers software development services around tools like inlets-operator. Our software development agency staffs experienced software developers and web developers for custom software development, web development, integrations, and ongoing support across open-source devops and beyond.
Ready to expose your local Kubernetes cluster?
Evaluate inlets-operator for your team's DevOps and cloud integration needs. Review the installation guide, test with your preferred cloud provider, and confirm cost estimates before production deployment.