Heplon

Create a relay

A relay connects Heplon to systems that have no public endpoint. Install one relay per private network, then reference it from each connector in that network.

1. Create the installation in Heplon

Open Connectors, select Relays, then Add relay. Give it a name.

Heplon shows a values YAML fragment and an enrollment token. Copy both now.

2. Store the enrollment token as a Secret

The token is a credential. Put it in your secret store (Sealed Secrets, External Secrets, Vault, etc.), so it reaches the cluster as this Secret:

apiVersion: v1
kind: Secret
metadata:
  name: heplon-relay-bootstrap
  namespace: heplon-relay
stringData:
  enrollment-token: <enrollment-token>

3. Deploy the chart

Chart: oci://ghcr.io/heplonhq/charts/heplon-relay. No registry login is needed.

Version: Take the latest published version:

helm show chart oci://ghcr.io/heplonhq/charts/heplon-relay | grep '^version:'

Values:

# Paste the YAML fragment you copied in step 1 here:
# ...
# ...
# ...

bootstrap:
  existingSecret:
    name: heplon-relay-bootstrap
    key: enrollment-token

# Insert the origins that you want to use the relay for.
# Each origin is an exact scheme, host, and port.
allowedOrigins:
  - http://prometheus.observability.svc:9090
  - http://loki.observability.svc:3100

The chart creates a <release>-relay-identity Secret. Ensure ArgoCD/Flux doesn't prune or drift-correct it. The relay exchanges the enrollment token for a permanent secret and stores it in that Secret.

4. Confirm it works

If everything worked, in Connectors → Relays, the relay should report Online within a minute.

Then, for each connector in that network, select Relay as its route and pick this installation. The connector URL must match one of the origins from step 3.

Upgrade

Bump the chart version in git. The chart pins the relay image it was released against.