Kubernetes access requires Foggy to run inside — or talk through — your cluster. Cloud Foggy alone cannot reach a private Kubernetes API server. Use one of the two paths below.
Two supported paths
There is no third path. Pointing Foggy directly at an internet-exposed Kubernetes API with a static token is not a supported configuration.
What Foggy can do
All operations are read-only. The
foggy-readonly ClusterRole grants exactly get, list, and watch on the relevant resource kinds. See Kubernetes RBAC for the exhaustive list and any namespace-scoped installation options.
Security properties
- Read-only. Foggy never creates, updates, or deletes resources. Write verbs are not granted, regardless of which path you use.
- Credentials stay local. With self-hosted, the ServiceAccount token never leaves the cluster. With Satellite, the agent holds the credentials inside your network and only streams query results out.
- Outbound-only (Satellite path). No inbound port has to be opened on your cluster. Satellite initiates all connections.
Troubleshooting
- “No Kubernetes data” in an investigation — on self-hosted, confirm the Helm release installed the
foggy-readonlyClusterRole and that the Foggy pods mounted the ServiceAccount. On Satellite, confirm the card on Integrations → Satellite shows Connected. - Self-hosted Foggy can’t see a namespace — the install may be namespace-scoped. Check
values.yamlforrbac.namespaceand widen if needed. See Kubernetes RBAC. - Satellite is connected but Kubernetes queries time out — the Satellite pod can reach Foggy but not the API server. Check network policies and the Satellite’s own ServiceAccount permissions inside the target cluster.
Next steps
Install Foggy self-hosted
In-cluster install. Kubernetes is auto-connected on first boot.
Satellite
Outbound-only agent for any cluster you cannot expose to Foggy directly.
Kubernetes RBAC
The exact verbs and resource kinds Foggy requests.
Grafana
Pair with Grafana to correlate cluster state with metrics and logs.