This topic lists the requirements for Harness Delegate.
Note the following important information about delegates:
Deployment limits are set by account type.
You might need to install multiple delegates, depending on how many continuous delivery tasks you do concurrently, and on the number of compute resources you provide to each delegate. Typically, you need one delegate for every 300 to 500 service instances across your applications.
A service instance is created when you use Harness to deploy the underlying infrastructure for the instance.
For example, an instance of a Kubernetes workload where Harness creates the pods, or an instance of an ECS task where Harness creates the service for the task.
The delegate is installed in your network and connects to the Harness Manager.
The requirements for memory and CPU support only the delegate. The delegate host, pod, and container require additional compute resources to support other operations, systems, and services, such as Docker or Kubernetes.
The delegate runs in a Linux/UNIX container.
The minimum memory for the delegate must be provided in addition to enough memory for the host/node system. For example, an AWS EC2 instance type such as m5a.xlarge has 16GB of RAM; 8 for the delegate and 8 for the remaining operations.
The Shell Script delegate requires cURL 7.64.1 or later.
Access to artifact servers, deployment environments, and cloud providers is required, as shown in the following illustration:
Allowlist Harness domains and IPs
Harness SaaS delegates only need outbound access to the Harness domain name, most commonly, app.harness.io, and optionally, to logging.googleapis.com. The URL logging.googleapis.com is used to provide logs to Harness Support.
The following network requirements are for connectivity between the Harness Delegate you run in your network and the Harness Manager (SaaS or on-prem), and for your browser connection to the Harness Manager.
All network connections from your local network to Harness SaaS are outbound-only.
HTTPS port 443 outbound from the delegate to Harness.
Delegate requirements: The delegate needs API/SSH/HTTP access to the providers you add to Harness, such as:
Artifact Servers (repos).
SSH access to target physical and virtual servers
If you do not enable gRPC connections, the following limitations apply:
- Cloud Cost Management (CCM) does not collect events.
Add certificates and other software to the delegate
For steps on adding certificates or other software to the delegate, go to Common delegate initialization scripts.
Delegate access requirements
Harness Delegates do not require root account access. Kubernetes and Docker delegates do, however, run as root by default. If you do not need to install applications during the initialization process (
INIT_SCRIPT), you can use a non-root account or install the application without the delegate. For more information, go to Delegate installation overview.
If you do not run the delegate as root, you cannot use delegate initialization scripts to install software.