Skip to main content
Satellite is an open-source proxy you deploy inside your own infrastructure. It connects to your tools locally, and streams only query results back to Foggy over an outbound TLS connection. Credentials and tool endpoints never leave your network. Use Satellite when direct connectors are off the table — air-gapped clusters, no ingress from the internet, or a security policy that forbids sending tokens to a SaaS.

​
What you get

PropertyDetail
Credential isolationTokens live in your K8s Secrets / Vault / AWS Secrets Manager. Foggy never sees them.
Outbound-onlySatellite initiates the connection to Foggy. No inbound firewall rules.
Same tools as direct connectorsGrafana, Prometheus, Kubernetes, and OpenSearch all work the same way — just executed inside your network.
Stateless relayFoggy’s relay forwards requests but does not store or inspect them.

​
Setup

  1. In the Console sidebar, click Integrations.
  2. On the Satellite card, click Show Setup Command.
  3. Enter a Cluster Name (e.g. prod-us-east-1) and pick an Environment (Production / Staging / Development).
  4. Click Generate Setup Command.
  5. Copy the Helm install command shown in the modal and run it in your target cluster. The command installs the Satellite with an embedded ingest token (fst_...) that authenticates the outbound connection back to Foggy.
  6. Once the Satellite sends its first heartbeat, the card flips to Connected.
Token is shown once. The command in the modal contains the only copy of the ingest token. Foggy stores just a SHA-256 hash. If you lose the command before installing, open the modal again and regenerate — the old token is invalidated.

​
Troubleshooting

  • Card stays on “Waiting for connection” — the Satellite pod has not reached the Foggy relay. Check outbound connectivity from the pod to the relay URL, and confirm the Helm release installed cleanly (kubectl get pods -n <namespace>).
  • Queries time out inside the cluster — the Satellite can reach Foggy but not your tools. Check the Satellite’s own network policies and RBAC against your Grafana / Prometheus / Kubernetes API endpoints.
  • Token compromised — open the Satellite card and use Regenerate Token. The old token stops authenticating on next reconnect; update the Helm values with the new token and re-apply.

​
Next steps

Install Foggy self-hosted

If you also want the Foggy Console inside your own cluster.

Security

Data flow, credential handling, and encryption.