diff --git a/CHANGELOG.md b/CHANGELOG.md
index fe50a845..b29f2dbe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,17 @@
-# 0.1.X
+# Changelog
 
-## Initial Alpha Releases
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## 0.2.0
+### Changed
+
+- Moved from calling ngrok-agent sidecar to using the ngrok-go library in process.
+
+## 0.1.X
+
+### Initial Alpha Releases
 
 The ngrok ingress controller is currently in alpha. Releases will have varying features with breaking changes.
diff --git a/VERSION b/VERSION
index 845639ee..0ea3a944 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.1.4
+0.2.0
diff --git a/go.mod b/go.mod
index 86c56a51..50a5cac7 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,9 @@ require (
 	github.com/go-logr/logr v1.2.0
 	github.com/ngrok/ngrok-api-go/v5 v5.0.0
 	github.com/spf13/cobra v1.2.1
-	github.com/stretchr/testify v1.7.0
+	github.com/stretchr/testify v1.8.0
+	golang.ngrok.com/ngrok v0.0.0-20221215203300-45a13036a1ff
+	golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4
 	k8s.io/api v0.23.0
 	k8s.io/apimachinery v0.23.0
 	k8s.io/client-go v0.23.0
@@ -48,12 +50,12 @@ require (
 	github.com/go-openapi/strfmt v0.19.5 // indirect
 	github.com/go-openapi/swag v0.19.14 // indirect
 	github.com/go-openapi/validate v0.19.8 // indirect
-	github.com/go-stack/stack v1.8.0 // indirect
+	github.com/go-stack/stack v1.8.1 // indirect
 	github.com/gobuffalo/flect v0.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/go-cmp v0.5.6 // indirect
+	github.com/google/go-cmp v0.5.8 // indirect
 	github.com/google/gofuzz v1.1.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.1.2 // indirect
@@ -64,12 +66,15 @@ require (
 	github.com/hashicorp/go-safetemp v1.0.0 // indirect
 	github.com/hashicorp/go-version v1.1.0 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
+	github.com/inconshreveable/log15 v3.0.0-testing.3+incompatible // indirect
+	github.com/inconshreveable/log15/v3 v3.0.0-testing.5 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
+	github.com/jpillora/backoff v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/mailru/easyjson v0.7.6 // indirect
-	github.com/mattn/go-colorable v0.1.8 // indirect
-	github.com/mattn/go-isatty v0.0.12 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/mattn/go-runewidth v0.0.7 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
@@ -96,22 +101,21 @@ require (
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
 	go.uber.org/zap v1.19.1 // indirect
-	golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 // indirect
-	golang.org/x/mod v0.4.2 // indirect
-	golang.org/x/net v0.0.0-20210825183410-e898025ed96a // indirect
+	golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
+	golang.org/x/net v0.2.0 // indirect
 	golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f // indirect
-	golang.org/x/sys v0.0.0-20211029165221-6e7872819dc8 // indirect
-	golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b // indirect
-	golang.org/x/text v0.3.7 // indirect
+	golang.org/x/sys v0.2.0 // indirect
+	golang.org/x/term v0.2.0 // indirect
+	golang.org/x/text v0.4.0 // indirect
 	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
-	golang.org/x/tools v0.1.6-0.20210820212750-d4cc65f0b2ff // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+	golang.org/x/tools v0.1.12 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/apiextensions-apiserver v0.23.0 // indirect
 	k8s.io/component-base v0.23.0 // indirect
 	k8s.io/klog/v2 v2.30.0 // indirect
diff --git a/go.sum b/go.sum
index 00747ce9..03171c16 100644
--- a/go.sum
+++ b/go.sum
@@ -266,8 +266,9 @@ github.com/go-openapi/validate v0.18.0/go.mod h1:Uh4HdOzKt19xGIGm1qHf/ofbX1YQ4Y+
 github.com/go-openapi/validate v0.19.2/go.mod h1:1tRCw7m3jtI8eNWEEliiAqUIcBztB2KDnRCRMUi7GTA=
 github.com/go-openapi/validate v0.19.8 h1:YFzsdWIDfVuLvIOF+ZmKjVg1MbPJ1QgY9PihMwei1ys=
 github.com/go-openapi/validate v0.19.8/go.mod h1:8DJv2CVJQ6kGNpFW6eV9N3JviE1C85nY1c2z52x1Gk4=
-github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-stack/stack v1.8.1 h1:ntEHSVwIt7PNXNpgPmVfMrNhLtgjlmnZha2kOpuRiDw=
+github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4=
 github.com/go-toolsmith/astcast v1.0.0/go.mod h1:mt2OdQTeAQcY4DQgPSArJjHCcOwlX+Wl/kwN+LbLGQ4=
 github.com/go-toolsmith/astcopy v1.0.0/go.mod h1:vrgyG+5Bxrnz4MZWPF+pI4R8h3qKRjjyvV/DSez4WVQ=
 github.com/go-toolsmith/astequal v0.0.0-20180903214952-dcb477bfacd6/go.mod h1:H+xSiq0+LtiDC11+h1G32h7Of5O3CYFJ99GVbS5lDKY=
@@ -359,8 +360,8 @@ github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
@@ -434,12 +435,17 @@ github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
 github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
+github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
 github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/inconshreveable/log15 v3.0.0-testing.3+incompatible h1:zaX5fYT98jX5j4UhO/WbfY8T1HkgVrydiDMC9PWqGCo=
+github.com/inconshreveable/log15 v3.0.0-testing.3+incompatible/go.mod h1:cOaXtrgN4ScfRrD9Bre7U1thNq5RtJ8ZoP4iXVGRj6o=
+github.com/inconshreveable/log15/v3 v3.0.0-testing.5 h1:h4e0f3kjgg+RJBlKOabrohjHe47D3bbAB9BgMrc3DYA=
+github.com/inconshreveable/log15/v3 v3.0.0-testing.5/go.mod h1:3GQg1SVrLoWGfRv/kAZMsdyU5cp8eFc1P3cw+Wwku94=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
@@ -447,6 +453,7 @@ github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -473,6 +480,7 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxv
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.0 h1:s5hAObm+yFO5uHYt5dYjxi2rXrsnmRpJx4OYvIWUaQs=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
@@ -496,12 +504,14 @@ github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJ
 github.com/matoous/godox v0.0.0-20190911065817-5d6d842e92eb/go.mod h1:1BELzlh859Sh1c6+90blK8lbYy0kwQf1bYlBhBysy1s=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8=
 github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-runewidth v0.0.7 h1:Ei8KR0497xHyKJPAv59M1dkC+rOZCMBJ+t3fZ+twI54=
 github.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/goveralls v0.0.2/go.mod h1:8d1ZMHsd7fW6IRPKQh46F2WRpyib5/X4FOpevwGNQEw=
@@ -544,7 +554,6 @@ github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+
 github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d/go.mod h1:o96djdrsSGy3AWPyBgZMAGfxZNfgntdJG+11KU4QvbU=
 github.com/ngrok/ngrok-api-go/v5 v5.0.0 h1:eksowVztKNQU0JBaYS2hXGiC/xtGXj8LAx8lAuzYlsw=
 github.com/ngrok/ngrok-api-go/v5 v5.0.0/go.mod h1:cxMRsWuE0EwK/JB/5prvHK0LEWB3KP16iwvIMqvDVP0=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
@@ -659,8 +668,9 @@ github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/objx v0.4.0 h1:M2gUjqZET1qApGOWNSnZ49BAIMX4F/1plDv3+l31EJ4=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.3-0.20181224173747-660f15d67dbb/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
@@ -668,8 +678,10 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
@@ -749,6 +761,8 @@ go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
 go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
 go.uber.org/zap v1.19.1 h1:ue41HOKd1vGURxrmeKIgELGb3jPW9DMUDGtsinblHwI=
 go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI=
+golang.ngrok.com/ngrok v0.0.0-20221215203300-45a13036a1ff h1:y5pvWAg5pERcUXZ0PEJNV3f7Kq++3zuVa3g/mDtMPMM=
+golang.ngrok.com/ngrok v0.0.0-20221215203300-45a13036a1ff/go.mod h1:h0SmDbrHimeTrjlMgUWh21Ni3e4s5SQZm2nMJZe3XHI=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -765,8 +779,9 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 h1:HWj/xjIHfjYU5nVXpTM0s39J9CbLn7Cc5a7IC5rwsMQ=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa h1:zuSxTR4o9y82ebqCUJYNGJbGPo6sKVl54f/TVDObg1c=
+golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -801,8 +816,9 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2 h1:Gz96sIWK3OalVv/I/qNygP42zyoKp3xptRVCWRFEBvo=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 h1:6zppjxzCulZykYSLyVDYbneBfbaBIQPYMevg0bEwv2s=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -856,8 +872,9 @@ golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLd
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210825183410-e898025ed96a h1:bRuuGXV8wwSdGTB+CtJf+FjgO1APK1CoO39T4BN/XBw=
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.2.0 h1:sZfSu1wtKLGlWI4ZZayP0ck9Y73K1ynO6gqzTdBVdPU=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -884,6 +901,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 h1:uVc8UZUe6tr40fFVnUP5Oj+veunVezqYl9z7DYw9xzw=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -958,11 +977,13 @@ golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211029165221-6e7872819dc8 h1:M69LAlWZCshgp0QSzyDcSsSIejIEeuaCVpmwcKwyLMk=
-golang.org/x/sys v0.0.0-20211029165221-6e7872819dc8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0 h1:ljd4t30dBnAvMZaQCevtY0xLLD0A+bRZXbgLMLU1F/A=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b h1:9zKuko04nR4gjZ4+DNjHqRlAJqbJETHwiNKDqTfOjfE=
 golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0 h1:z85xZCsEl7bi/KwbNADeBYoOP0++7W1ipu+aGnpwzRM=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -972,8 +993,9 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1051,12 +1073,12 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.6-0.20210820212750-d4cc65f0b2ff h1:VX/uD7MK0AHXGiScH3fsieUQUcpmRERPDYtqZdJnA+Q=
 golang.org/x/tools v0.1.6-0.20210820212750-d4cc65f0b2ff/go.mod h1:YD9qOF0M9xpSpdWTBbzEl5e/RnCefISl8E5Noe10jFM=
+golang.org/x/tools v0.1.12 h1:VveCTK38A2rkS8ZqFY25HIDFscX5X9OoEhJd3quQmXU=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.2.0 h1:4pT439QV83L+G9FkcCriY6EkpcK6r6bK+A5FBUMI7qY=
 gomodules.xyz/jsonpatch/v2 v2.2.0/go.mod h1:WXp+iVDkoLQqPudfQ9GBlwB2eZ5DKOnjQZCYdOS8GPY=
@@ -1170,14 +1192,15 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
+google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
@@ -1202,8 +1225,9 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200121175148-a6ecf24a6d71/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/helm/ingress-controller/CHANGELOG.md b/helm/ingress-controller/CHANGELOG.md
index ddd37db2..c7e353f5 100644
--- a/helm/ingress-controller/CHANGELOG.md
+++ b/helm/ingress-controller/CHANGELOG.md
@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.3.0
+### Changed
+
+- Moved from calling ngrok-agent sidecar to using the ngrok-go library in the controller process.
+- Moved `apiKey` and `authtoken` to `credentials.apiKey` and `credentials.authtoken` respectively.
+- `credentialSecrets.name` is now `credentials.secret.name`
+- Changed replicas to 1 by default to work better for default/demo setup.
+
 ## 0.2.0
 ### Added
 
diff --git a/helm/ingress-controller/Chart.yaml b/helm/ingress-controller/Chart.yaml
index ddb6a713..ca16f97c 100644
--- a/helm/ingress-controller/Chart.yaml
+++ b/helm/ingress-controller/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
 name: ngrok-ingress-controller
 description: A Kubernetes ingress controller built using ngrok.
-version: 0.2.0
-appVersion: 0.1.0
+version: 0.3.0
+appVersion: 0.2.0
 keywords:
   - ngrok
   - networking
diff --git a/helm/ingress-controller/scripts/gen-agent-config.sh b/helm/ingress-controller/scripts/gen-agent-config.sh
deleted file mode 100755
index 2f5e8489..00000000
--- a/helm/ingress-controller/scripts/gen-agent-config.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/bash
-
-NGROK_REMOTE_MANAGEMENT="${NGROK_REMOTE_MANAGEMENT:-true}"
-
-cat > /var/lib/ngrok/agent-template.yaml <<EOF
-version: 2
-authtoken: $NGROK_AUTHTOKEN
-console_ui: false
-region: $NGROK_REGION
-remote_management: $NGROK_REMOTE_MANAGEMENT
-update_check: false
-EOF
-
-ngrok start --none --config /var/lib/ngrok/agent-template.yaml
diff --git a/helm/ingress-controller/templates/controller-deployment.yaml b/helm/ingress-controller/templates/controller-deployment.yaml
index bc5a396e..b1e6f232 100644
--- a/helm/ingress-controller/templates/controller-deployment.yaml
+++ b/helm/ingress-controller/templates/controller-deployment.yaml
@@ -35,11 +35,6 @@ spec:
       imagePullSecrets:
         {{- toYaml .Values.image.pullSecrets | nindent 8 }}
       {{- end }}
-      volumes:
-      - name: scripts
-        configMap:
-          name: scripts
-          defaultMode: 0755
       containers:
       - name: ngrok-ingress-controller
         image: {{ include "ngrok-ingress-controller.image" . }}
@@ -60,7 +55,12 @@ spec:
           valueFrom:
             secretKeyRef:
               key: API_KEY
-              name: {{ include "ngrok-ingress-controller.credentialsSecretName" .}}
+              name: {{ include "ngrok-ingress-controller.credentialsSecretName" . }}
+        - name: NGROK_AUTHTOKEN
+          valueFrom:
+            secretKeyRef:
+              key: AUTHTOKEN
+              name: {{ include "ngrok-ingress-controller.credentialsSecretName" . }}
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
@@ -79,33 +79,3 @@ spec:
           periodSeconds: 10
         resources:
           {{- toYaml .Values.resources | nindent 10 }}
-      - name: ngrok-cli
-        image: ngrok/ngrok:3
-        command:
-        - ./scripts/gen-agent-config.sh
-        envFrom:
-        - configMapRef:
-            name: {{ include "ngrok-ingress-controller.fullname" . }}-agent-cm
-            optional: true
-        env:
-        - name: NGROK_AUTHTOKEN
-          valueFrom:
-            secretKeyRef:
-              key: AUTHTOKEN
-              name: {{ include "ngrok-ingress-controller.credentialsSecretName" .}}
-        {{- if .Values.region }}
-        - name: NGROK_REGION
-          value: {{ quote .Values.region}}
-        {{- end }}
-        volumeMounts:
-          - name: scripts
-            mountPath: /scripts
-            readOnly: true
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: scripts
-  namespace: {{ .Release.Namespace }}
-data:
-{{ (.Files.Glob "scripts/gen-agent-config.sh").AsConfig | indent 2 }}
diff --git a/helm/ingress-controller/tests/__snapshot__/controller-deployment_test.yaml.snap b/helm/ingress-controller/tests/__snapshot__/controller-deployment_test.yaml.snap
index de24c7c6..28377ff6 100644
--- a/helm/ingress-controller/tests/__snapshot__/controller-deployment_test.yaml.snap
+++ b/helm/ingress-controller/tests/__snapshot__/controller-deployment_test.yaml.snap
@@ -13,8 +13,8 @@ Should match snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: ngrok-ingress-controller
         app.kubernetes.io/part-of: ngrok-ingress-controller
-        app.kubernetes.io/version: 0.1.0
-        helm.sh/chart: ngrok-ingress-controller-0.2.0
+        app.kubernetes.io/version: 0.2.0
+        helm.sh/chart: ngrok-ingress-controller-0.3.0
       name: RELEASE-NAME-ngrok-ingress-controller-manager
       namespace: NAMESPACE
     spec:
@@ -49,6 +49,11 @@ Should match snapshot:
                 secretKeyRef:
                   key: API_KEY
                   name: RELEASE-NAME-ngrok-ingress-controller-credentials
+            - name: NGROK_AUTHTOKEN
+              valueFrom:
+                secretKeyRef:
+                  key: AUTHTOKEN
+                  name: RELEASE-NAME-ngrok-ingress-controller-credentials
             - name: POD_NAMESPACE
               valueFrom:
                 fieldRef:
@@ -73,53 +78,8 @@ Should match snapshot:
               requests: {}
             securityContext:
               allowPrivilegeEscalation: false
-          - command:
-            - ./scripts/gen-agent-config.sh
-            env:
-            - name: NGROK_AUTHTOKEN
-              valueFrom:
-                secretKeyRef:
-                  key: AUTHTOKEN
-                  name: RELEASE-NAME-ngrok-ingress-controller-credentials
-            envFrom:
-            - configMapRef:
-                name: RELEASE-NAME-ngrok-ingress-controller-agent-cm
-                optional: true
-            image: ngrok/ngrok:3
-            name: ngrok-cli
-            volumeMounts:
-            - mountPath: /scripts
-              name: scripts
-              readOnly: true
           serviceAccountName: RELEASE-NAME-ngrok-ingress-controller
-          volumes:
-          - configMap:
-              defaultMode: 493
-              name: scripts
-            name: scripts
   2: |
-    apiVersion: v1
-    data:
-      gen-agent-config.sh: |
-        #!/bin/bash
-
-        NGROK_REMOTE_MANAGEMENT="${NGROK_REMOTE_MANAGEMENT:-true}"
-
-        cat > /var/lib/ngrok/agent-template.yaml <<EOF
-        version: 2
-        authtoken: $NGROK_AUTHTOKEN
-        console_ui: false
-        region: $NGROK_REGION
-        remote_management: $NGROK_REMOTE_MANAGEMENT
-        update_check: false
-        EOF
-
-        ngrok start --none --config /var/lib/ngrok/agent-template.yaml
-    kind: ConfigMap
-    metadata:
-      name: scripts
-      namespace: NAMESPACE
-  3: |
     apiVersion: v1
     data:
       METADATA: ""
@@ -129,7 +89,7 @@ Should match snapshot:
     metadata:
       name: RELEASE-NAME-ngrok-ingress-controller-agent-cm
       namespace: NAMESPACE
-  4: |
+  3: |
     apiVersion: rbac.authorization.k8s.io/v1
     kind: Role
     metadata:
@@ -167,7 +127,7 @@ Should match snapshot:
       verbs:
       - create
       - patch
-  5: |
+  4: |
     apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRole
     metadata:
@@ -185,7 +145,7 @@ Should match snapshot:
       - subjectaccessreviews
       verbs:
       - create
-  6: |
+  5: |
     apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
     metadata:
@@ -199,7 +159,7 @@ Should match snapshot:
     - kind: ServiceAccount
       name: RELEASE-NAME-ngrok-ingress-controller
       namespace: NAMESPACE
-  7: |
+  6: |
     apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRoleBinding
     metadata:
@@ -212,7 +172,7 @@ Should match snapshot:
     - kind: ServiceAccount
       name: RELEASE-NAME-ngrok-ingress-controller
       namespace: NAMESPACE
-  8: |
+  7: |
     apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRoleBinding
     metadata:
@@ -225,7 +185,7 @@ Should match snapshot:
     - kind: ServiceAccount
       name: RELEASE-NAME-ngrok-ingress-controller
       namespace: NAMESPACE
-  9: |
+  8: |
     apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRole
     metadata:
diff --git a/helm/ingress-controller/tests/__snapshot__/controller-serviceaccount_test.yaml.snap b/helm/ingress-controller/tests/__snapshot__/controller-serviceaccount_test.yaml.snap
index b80f4710..915819fc 100644
--- a/helm/ingress-controller/tests/__snapshot__/controller-serviceaccount_test.yaml.snap
+++ b/helm/ingress-controller/tests/__snapshot__/controller-serviceaccount_test.yaml.snap
@@ -9,7 +9,7 @@ Should match the snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: ngrok-ingress-controller
         app.kubernetes.io/part-of: ngrok-ingress-controller
-        app.kubernetes.io/version: 0.1.0
-        helm.sh/chart: ngrok-ingress-controller-0.2.0
+        app.kubernetes.io/version: 0.2.0
+        helm.sh/chart: ngrok-ingress-controller-0.3.0
       name: test-release-ngrok-ingress-controller
       namespace: test-namespace
diff --git a/helm/ingress-controller/tests/__snapshot__/ingress-class_test.yaml.snap b/helm/ingress-controller/tests/__snapshot__/ingress-class_test.yaml.snap
index d261138f..b7c86790 100644
--- a/helm/ingress-controller/tests/__snapshot__/ingress-class_test.yaml.snap
+++ b/helm/ingress-controller/tests/__snapshot__/ingress-class_test.yaml.snap
@@ -11,8 +11,8 @@ Should match snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: ngrok-ingress-controller
         app.kubernetes.io/part-of: ngrok-ingress-controller
-        app.kubernetes.io/version: 0.1.0
-        helm.sh/chart: ngrok-ingress-controller-0.2.0
+        app.kubernetes.io/version: 0.2.0
+        helm.sh/chart: ngrok-ingress-controller-0.3.0
       name: ngrok
     spec:
       controller: k8s.ngrok.com/ingress-controller
diff --git a/helm/ingress-controller/tests/controller-deployment_test.yaml b/helm/ingress-controller/tests/controller-deployment_test.yaml
index 6db4041b..c0541c01 100644
--- a/helm/ingress-controller/tests/controller-deployment_test.yaml
+++ b/helm/ingress-controller/tests/controller-deployment_test.yaml
@@ -23,9 +23,6 @@ tests:
   - matchRegex:
       path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.name
       pattern: test-secret-name
-  - matchRegex:
-      path: spec.template.spec.containers[1].env[0].valueFrom.secretKeyRef.name
-      pattern: test-secret-name
 - it: Should pass the region via container args to the controller if specified
   set:
     region: eu
diff --git a/internal/controllers/tunnel_controller.go b/internal/controllers/tunnel_controller.go
index e7ee51bf..d7d08b6c 100644
--- a/internal/controllers/tunnel_controller.go
+++ b/internal/controllers/tunnel_controller.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 
 	"github.com/go-logr/logr"
-	"github.com/ngrok/ngrok-ingress-controller/pkg/agentapiclient"
+	"github.com/ngrok/ngrok-ingress-controller/pkg/ngrokgodriver"
 	v1 "k8s.io/api/core/v1"
 	netv1 "k8s.io/api/networking/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -31,6 +31,7 @@ type TunnelReconciler struct {
 	Log      logr.Logger
 	Scheme   *runtime.Scheme
 	Recorder record.EventRecorder
+	tm       *ngrokgodriver.TunnelManager
 }
 
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
@@ -61,7 +62,7 @@ func (trec *TunnelReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 	if ingress.ObjectMeta.DeletionTimestamp != nil && !ingress.ObjectMeta.DeletionTimestamp.IsZero() {
 		for _, tunnel := range ingressToTunnels(ingress) {
 			trec.Recorder.Event(ingress, v1.EventTypeNormal, "TunnelDeleting", fmt.Sprintf("Tunnel %s deleting", tunnel.Name))
-			err := agentapiclient.NewAgentApiClient().DeleteTunnel(ctx, tunnel.Name)
+			err := trec.tm.DeleteTunnel(ctx, tunnel.Name)
 			if err != nil {
 				trec.Recorder.Event(ingress, "Warning", "TunnelDeleteFailed", fmt.Sprintf("Tunnel %s delete failed", tunnel.Name))
 				return ctrl.Result{}, err
@@ -73,7 +74,7 @@ func (trec *TunnelReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 
 	for _, tunnel := range ingressToTunnels(ingress) {
 		trec.Recorder.Event(ingress, v1.EventTypeNormal, "TunnelCreating", fmt.Sprintf("Tunnel %s creating", tunnel.Name))
-		err = agentapiclient.NewAgentApiClient().CreateTunnel(ctx, tunnel)
+		err = trec.tm.CreateTunnel(ctx, tunnel)
 		if err != nil {
 			trec.Recorder.Event(ingress, "Warning", "TunnelCreateFailed", fmt.Sprintf("Tunnel %s create failed", tunnel.Name))
 			return ctrl.Result{}, err
@@ -87,6 +88,14 @@ func (trec *TunnelReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 // Create a new Controller that watches Ingress objects.
 // Add it to our manager.
 func (trec *TunnelReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	var err error
+
+	if trec.tm == nil {
+		trec.tm, err = ngrokgodriver.NewTunnelManager()
+		if err != nil {
+			return err
+		}
+	}
 	tCont, err := NewTunnelControllerNew("tunnel-controller", mgr, trec)
 	if err != nil {
 		return err
@@ -128,25 +137,19 @@ func (trec *TunnelController) Start(ctx context.Context) error {
 }
 
 // Converts a k8s Ingress Rule to and ngrok Agent Tunnel configuration.
-func tunnelsPlanner(rule netv1.IngressRuleValue, ingressName, namespace string) []agentapiclient.TunnelsAPIBody {
-	var agentTunnels []agentapiclient.TunnelsAPIBody
+func tunnelsPlanner(rule netv1.IngressRuleValue, ingressName, namespace string) []ngrokgodriver.TunnelsAPIBody {
+	var agentTunnels []ngrokgodriver.TunnelsAPIBody
 
 	for _, httpIngressPath := range rule.HTTP.Paths {
 		serviceName := httpIngressPath.Backend.Service.Name
 		servicePort := int(httpIngressPath.Backend.Service.Port.Number)
 		tunnelAddr := fmt.Sprintf("%s.%s.%s:%d", serviceName, namespace, clusterDomain, servicePort)
-
-		var labels []string
-		for key, value := range backendToLabelMap(httpIngressPath.Backend, ingressName, namespace) {
-			labels = append(labels, fmt.Sprintf("%s=%s", key, value))
-		}
-
 		clean_path := strings.Replace(httpIngressPath.Path, "/", "-", -1)
 
-		agentTunnels = append(agentTunnels, agentapiclient.TunnelsAPIBody{
+		agentTunnels = append(agentTunnels, ngrokgodriver.TunnelsAPIBody{
 			Name:   fmt.Sprintf("%s-%s-%s-%d-%s", ingressName, namespace, serviceName, servicePort, clean_path),
 			Addr:   tunnelAddr,
-			Labels: labels,
+			Labels: backendToLabelMap(httpIngressPath.Backend, ingressName, namespace),
 		})
 	}
 
@@ -155,9 +158,9 @@ func tunnelsPlanner(rule netv1.IngressRuleValue, ingressName, namespace string)
 
 // Converts a k8s ingress object into a slice of ngrok Agent Tunnels
 // TODO: Support multiple Rules per Ingress
-func ingressToTunnels(ingress *netv1.Ingress) []agentapiclient.TunnelsAPIBody {
+func ingressToTunnels(ingress *netv1.Ingress) []ngrokgodriver.TunnelsAPIBody {
 	if ingress == nil || len(ingress.Spec.Rules) == 0 {
-		return []agentapiclient.TunnelsAPIBody{}
+		return []ngrokgodriver.TunnelsAPIBody{}
 	}
 	ingressRule := ingress.Spec.Rules[0]
 
diff --git a/internal/controllers/tunnel_controller_test.go b/internal/controllers/tunnel_controller_test.go
index d675901c..b3217d24 100644
--- a/internal/controllers/tunnel_controller_test.go
+++ b/internal/controllers/tunnel_controller_test.go
@@ -3,7 +3,7 @@ package controllers
 import (
 	"testing"
 
-	"github.com/ngrok/ngrok-ingress-controller/pkg/agentapiclient"
+	"github.com/ngrok/ngrok-ingress-controller/pkg/ngrokgodriver"
 	"github.com/stretchr/testify/assert"
 	netv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -14,12 +14,12 @@ func TestIngressToTunnels(t *testing.T) {
 	testCases := []struct {
 		testName string
 		ingress  *netv1.Ingress
-		tunnels  []agentapiclient.TunnelsAPIBody
+		tunnels  []ngrokgodriver.TunnelsAPIBody
 	}{
 		{
 			testName: "Returns empty list when ingress is nil",
 			ingress:  nil,
-			tunnels:  []agentapiclient.TunnelsAPIBody{},
+			tunnels:  []ngrokgodriver.TunnelsAPIBody{},
 		},
 		{
 			testName: "Returns empty list when ingress has no rules",
@@ -31,7 +31,7 @@ func TestIngressToTunnels(t *testing.T) {
 					Rules: []netv1.IngressRule{},
 				},
 			},
-			tunnels: []agentapiclient.TunnelsAPIBody{},
+			tunnels: []ngrokgodriver.TunnelsAPIBody{},
 		},
 		{
 			ingress: &netv1.Ingress{
@@ -64,16 +64,16 @@ func TestIngressToTunnels(t *testing.T) {
 					},
 				},
 			},
-			tunnels: []agentapiclient.TunnelsAPIBody{
+			tunnels: []ngrokgodriver.TunnelsAPIBody{
 				{
 					Addr:      "test-service.test-namespace.svc.cluster.local:8080",
 					Name:      "test-ingress-test-namespace-test-service-8080--",
 					SubDomain: "",
-					Labels: []string{
-						"k8s.ngrok.com/ingress-name=test-ingress",
-						"k8s.ngrok.com/ingress-namespace=test-namespace",
-						"k8s.ngrok.com/service=test-service",
-						"k8s.ngrok.com/port=8080",
+					Labels: map[string]string{
+						"k8s.ngrok.com/ingress-name":      "test-ingress",
+						"k8s.ngrok.com/ingress-namespace": "test-namespace",
+						"k8s.ngrok.com/service":           "test-service",
+						"k8s.ngrok.com/port":              "8080",
 					},
 				},
 			},
@@ -88,7 +88,7 @@ func TestIngressToTunnels(t *testing.T) {
 			assert.Equal(t, tunnels[i].Name, test.tunnels[i].Name)
 			assert.Equal(t, tunnels[i].Addr, test.tunnels[i].Addr)
 			assert.Equal(t, tunnels[i].SubDomain, test.tunnels[i].SubDomain)
-			assert.ElementsMatch(t, tunnels[i].Labels, test.tunnels[i].Labels)
+			assert.Equal(t, tunnels[i].Labels, test.tunnels[i].Labels)
 		}
 	}
 }
diff --git a/pkg/agentapiclient/tunnel.go b/pkg/agentapiclient/tunnel.go
deleted file mode 100644
index b0bb7ce7..00000000
--- a/pkg/agentapiclient/tunnel.go
+++ /dev/null
@@ -1,74 +0,0 @@
-package agentapiclient
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"time"
-)
-
-const tunnelAPIURL = "http://localhost:4040/api/tunnels"
-
-type AgentAPIClient interface {
-	CreateTunnel(ctx context.Context, t TunnelsAPIBody) error
-	DeleteTunnel(ctx context.Context, name string) error
-}
-
-type agentAPIClient struct {
-	client *http.Client
-}
-
-func NewAgentApiClient() AgentAPIClient {
-	return agentAPIClient{
-		client: &http.Client{Timeout: 1 * time.Second},
-	}
-}
-
-func (ac agentAPIClient) CreateTunnel(ctx context.Context, t TunnelsAPIBody) error {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, tunnelAPIURL+"/"+t.Name, nil)
-	if err != nil {
-		return err
-	}
-	resp, err := ac.client.Do(req)
-	if err != nil {
-		return err
-	}
-	// If the tunnel already exists, we don't need to create it again
-	if resp.StatusCode == 200 {
-		return nil
-	}
-	// If its not a 200 or a 404, we have an error
-	if resp.StatusCode != 404 {
-		return fmt.Errorf("unexpected status code %d", resp.StatusCode)
-	}
-
-	body, err := json.Marshal(t)
-	if err != nil {
-		return err
-	}
-	req, err = http.NewRequestWithContext(ctx, http.MethodPost, tunnelAPIURL, bytes.NewBuffer(body))
-	if err != nil {
-		return err
-	}
-	req.Header.Add("Content-Type", "application/json")
-	_, err = ac.client.Do(req)
-	return err
-}
-
-func (ac agentAPIClient) DeleteTunnel(ctx context.Context, name string) error {
-	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, fmt.Sprintf("%s/%s", tunnelAPIURL, name), nil)
-	if err != nil {
-		return err
-	}
-	_, err = ac.client.Do(req)
-	return err
-}
-
-type TunnelsAPIBody struct {
-	Addr      string   `json:"addr"`
-	Name      string   `json:"name"`
-	SubDomain string   `json:"subdomain,omitempty"`
-	Labels    []string `json:"labels"`
-}
diff --git a/pkg/ngrokapidriver/driver.go b/pkg/ngrokapidriver/driver.go
index 2d94d6f4..781740af 100644
--- a/pkg/ngrokapidriver/driver.go
+++ b/pkg/ngrokapidriver/driver.go
@@ -14,6 +14,10 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 )
 
+const (
+	defaultDescription = "Created by ngrok-ingress-controller"
+)
+
 // NgrkAPIDriver is an interface for managing ngrok API resources
 type NgrokAPIDriver interface {
 	FindEdge(ctx context.Context, id string) (*ngrok.HTTPSEdge, error)
@@ -75,7 +79,7 @@ func (napi ngrokAPIDriver) CreateEdge(ctx context.Context, edgeSummary *Edge) (*
 	_, err = napi.reservedDomains.Create(ctx, &ngrok.ReservedDomainCreate{
 		Name:        domain,
 		Region:      napi.region,
-		Description: "Created by ngrok-ingress-controller",
+		Description: defaultDescription,
 		Metadata:    napi.metadata,
 	})
 	// Swallow conflicts, just always try to create it and don't delete them upon ingress deletion
@@ -90,7 +94,7 @@ func (napi ngrokAPIDriver) CreateEdge(ctx context.Context, edgeSummary *Edge) (*
 
 	newEdge, err := napi.edges.Create(ctx, &ngrok.HTTPSEdgeCreate{
 		Hostports:   []string{edgeSummary.Hostport},
-		Description: "Created by ngrok-ingress-controller",
+		Description: defaultDescription,
 		Metadata:    napi.metadata,
 	})
 	if err != nil {
@@ -101,7 +105,7 @@ func (napi ngrokAPIDriver) CreateEdge(ctx context.Context, edgeSummary *Edge) (*
 		// Create Tunnel-Group Backend
 		backend, err := napi.tgbs.Create(ctx, &ngrok.TunnelGroupBackendCreate{
 			Labels:      route.Labels,
-			Description: "Created by ngrok-ingress-controller",
+			Description: defaultDescription,
 			Metadata:    napi.metadata,
 		})
 		if err != nil {
@@ -112,7 +116,7 @@ func (napi ngrokAPIDriver) CreateEdge(ctx context.Context, edgeSummary *Edge) (*
 			EdgeID:      newEdge.ID,
 			MatchType:   route.MatchType,
 			Match:       route.Match,
-			Description: "Created by ngrok-ingress-controller",
+			Description: defaultDescription,
 			Metadata:    napi.metadata,
 			Backend: &ngrok.EndpointBackendMutate{
 				BackendID: backend.ID,
diff --git a/pkg/ngrokgodriver/driver.go b/pkg/ngrokgodriver/driver.go
new file mode 100644
index 00000000..fcb39b8b
--- /dev/null
+++ b/pkg/ngrokgodriver/driver.go
@@ -0,0 +1,135 @@
+package ngrokgodriver
+
+import (
+	"context"
+	"io"
+	"net"
+	"reflect"
+
+	"github.com/go-logr/logr"
+	"golang.ngrok.com/ngrok"
+	"golang.ngrok.com/ngrok/config"
+	"golang.org/x/sync/errgroup"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+)
+
+type TunnelManager struct {
+	session ngrok.Session
+	tunnels map[string]ngrok.Tunnel
+}
+
+func NewTunnelManager() (*TunnelManager, error) {
+	opts := []ngrok.ConnectOption{
+		ngrok.WithAuthtokenFromEnv(),
+	}
+	session, err := ngrok.Connect(context.Background(), opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &TunnelManager{
+		session: session,
+		tunnels: make(map[string]ngrok.Tunnel),
+	}, nil
+}
+
+func (tm *TunnelManager) CreateTunnel(ctx context.Context, t TunnelsAPIBody) error {
+	log := log.FromContext(ctx)
+
+	if tun, ok := tm.tunnels[t.Name]; ok {
+		if reflect.DeepEqual(tun.Labels(), t.Labels) {
+			log.Info("Tunnel labels match existing tunnel, doing nothing")
+			return nil
+		}
+		// There is already a tunnel with this name, start the new one and defer closing the old one
+		defer tm.stopTunnel(context.Background(), tun)
+	}
+
+	tun, err := tm.session.Listen(ctx, tm.buildTunnelConfig(t))
+	if err != nil {
+		return err
+	}
+	tm.tunnels[t.Name] = tun
+	go tm.startTunnel(ctx, tun, t.Addr)
+	return nil
+}
+
+func (tm *TunnelManager) DeleteTunnel(ctx context.Context, name string) error {
+	log := log.FromContext(ctx).WithValues("name", name)
+
+	tun := tm.tunnels[name]
+	if tun == nil {
+		log.Info("Tunnel not found while trying to delete tunnel")
+		return nil
+	}
+
+	err := tm.stopTunnel(ctx, tun)
+	if err != nil {
+		return err
+	}
+	delete(tm.tunnels, name)
+	log.Info("Tunnel deleted successfully")
+	return nil
+}
+
+func (tm *TunnelManager) stopTunnel(ctx context.Context, tun ngrok.Tunnel) error {
+	if tun == nil {
+		return nil
+	}
+	return tun.CloseWithContext(ctx)
+}
+
+func (tm *TunnelManager) buildTunnelConfig(t TunnelsAPIBody) config.Tunnel {
+	opts := []config.LabeledTunnelOption{}
+	for key, value := range t.Labels {
+		opts = append(opts, config.WithLabel(key, value))
+	}
+	return config.LabeledTunnel(opts...)
+}
+
+func (tm *TunnelManager) startTunnel(ctx context.Context, tun ngrok.Tunnel, dest string) {
+	log := log.FromContext(ctx).WithValues("id", tun.ID())
+	for {
+		conn, err := tun.Accept()
+		if err != nil {
+			log.Error(err, "Error accepting connection")
+		}
+
+		cnxnLogger := log.WithValues("remoteAddr", conn.RemoteAddr())
+		cnxnLogger.Info("Accepted connection")
+
+		go func(address string, logger logr.Logger) {
+			err := handleConn(context.Background(), address, conn)
+			if err != nil {
+				logger.Error(err, "Error handling connection")
+			} else {
+				logger.Info("Connection closed")
+			}
+		}(dest, cnxnLogger)
+	}
+}
+
+type TunnelsAPIBody struct {
+	Addr      string            `json:"addr"`
+	Name      string            `json:"name"`
+	SubDomain string            `json:"subdomain,omitempty"`
+	Labels    map[string]string `json:"labels"`
+}
+
+func handleConn(ctx context.Context, dest string, conn net.Conn) error {
+	next, err := net.Dial("tcp", dest)
+	if err != nil {
+		return err
+	}
+
+	g, _ := errgroup.WithContext(ctx)
+
+	g.Go(func() error {
+		_, err := io.Copy(next, conn)
+		return err
+	})
+	g.Go(func() error {
+		_, err := io.Copy(conn, next)
+		return err
+	})
+	return g.Wait()
+}