Dedicated delegate approach

Last updated on Jul 17, 2026

---

In the dedicated delegate approach, the Harness Delegate runs inside the target cluster (one Delegate per cluster). The Delegate's own service account is the chaos service account. This is the strongest isolation pattern and the simplest single-cluster setup.

---

Before you begin

• Harness Delegate version 24.09.83900 or above. Earlier versions cannot execute DDCR experiments.
• kubectl access to the target cluster.
• A Kubernetes connector in Harness, or the ability to create one.
• A Harness environment to attach the infrastructure to. Go to Create an environment if you do not have one.

---

Choose your install method

• Basic (default): the Delegate runs with the standard cluster-admin role. Recommended for first installs and dev clusters.
• Limited Permissions: the Delegate runs in a dedicated namespace with a custom Role and ClusterRole. Recommended for production clusters where cluster-admin is not acceptable.

Next steps

• Cluster permissions: the full API permission reference for the chaos service account, with copy-paste RBAC manifests.
• Centralized delegate approach: if one Delegate must serve many target clusters.
• Network configuration: mTLS and proxy settings for the Delegate and Discovery Agent.