Inlets Uplink

Reach private customer networks from a control plane you own.

A multi-tenant tunnel layer that runs inside your own Kubernetes cluster, so your product can reach customer services, fleets, and devices over a single outbound connection. No VPNs, no inbound firewall rules.

Request a demo Read the docs

Outbound-only Multi-tenant Runs in your cluster Your data plane

Creating a per-customer tunnel with the inlets-pro CLI and handing the customer a connect command

Create a namespace and a tunnel per customer, then hand them one connect command. You reach the service privately from inside your cluster.

How it works

One control plane, one tunnel per tenant.

Install Uplink once, then provision an isolated tunnel for every customer, cluster, or device. Clients dial home outbound, and you reach their private services from inside your own cluster.

Install the control plane

Run Uplink in your Kubernetes cluster with Helm, ArgoCD, or Flux.

Create a tunnel per tenant

One namespace and one command generate an isolated tunnel and its own token.

Hand over a connect string

The customer runs a client outbound, and you reach the service privately by ClusterIP.

Also included Billing Management API High-throughput demux tunnels Client handoff as a CLI command, systemd unit, or Kubernetes YAML

Where Uplink fits

Two ways to package private connectivity.

Embed Uplink

Private access inside your SaaS product

Create per-tenant tunnels so your product can reach customer Kubernetes APIs, Windows apps, IdPs, databases, and devices from one control plane.

Build on Uplink

A foundation for a managed tunnel service

Use Uplink as the regional substrate for instant HTTPS, custom-domain, and BYO-TLS tunnels across Kubernetes ingress, Caddy, Nginx, and Traefik.

In production

What teams build on Uplink.

Operate Kubernetes fleets from one ArgoCD

Manage internal, tenant, or customer clusters from a single control plane.

Connect customer hardware without inbound access

Run a client beside a Windows program on customer hardware and dial home.

Reach private IdPs and databases for sync services

Sync from on-prem identity providers and databases without exposing them.

Power a managed tunnel service

Inlets Cloud runs on Uplink regions for one-click HTTPS tunnels and managed TLS.

Why not a VPN?

Built for repeatable service access, not one-off connections.

Anyone can make a single connection work. The hard part is making precise service access repeatable across tenants, regions, and customer networks.

Instead of

The limitation

With Uplink

A VPN

Grants whole-network access and needs inbound setup on every site.

Service-level tunnels, outbound-only.

An OSS tunnel

Useful primitives, but you still build tenancy, lifecycle, and support.

Multi-tenant, monitored, and commercially supported.

A DIY agent

Cheap to prototype, expensive to secure, observe, and operate.

Set up in ~30 minutes, in production for years.

Cloud tunnels

Metered bandwidth, per-seat pricing, and EULA limits add up.

Pay per tunnel, on your own data plane and logs.

Talk to us about your tenant model.

Tell us the customer networks you need to reach and the services behind them.