> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-ai/use-harness-platform/connectors/cloud-providers/add-tas-connector.md).
# Add a Tanzu Application Service (TAS) connector
Connect Harness to your Tanzu Application Service (TAS) accounts and spaces.
Use a Harness Tanzu Application Service (TAS) connector to connect Harness to your TAS environment. Use the TAS connector to deploy applications to your Tanzu cloud from Harness pipelines.
***
## What you will learn from this topic
* How to [install the Cloud Foundry Command Line Interface (cf CLI)](#install-the-cloud-foundry-command-line-interface-cf-cli-on-your-harness-delegate) on your Harness Delegate.
* How to [create a TAS connector](#create-a-tas-connector) using the Harness Manager.
* How to define a TAS connector using a [YAML example](#yaml-example).
* How Harness supports [refresh token authentication](#refresh-token-support) and [custom configuration for extensible authentication](#custom-configuration-for-extensible-authentication) with TAS.
***
## Before you begin
* **Harness Delegate**: A running Harness Delegate that can reach your TAS environment. Go to [Delegate installation overview](/harness-ai/use-harness-platform/delegates/delegate/install-delegates/overview.md) to install one. Connect through a Harness Delegate rather than the Harness Platform, because you need a delegate later to deploy to your TAS environment.
* **TAS Endpoint URL**: The API endpoint of your TAS environment, for example `https://api.system.tas-mycompany.com`.
* **TAS credentials**: A TAS username and password, stored as a Harness secret.
***
## Install the Cloud Foundry Command Line Interface (cf CLI) on your Harness Delegate
After your delegate pods are created, edit your Harness Delegate YAML to install cf CLI v7, the `autoscaler` plugin, and the `Create-Service-Push` plugin. Harness uses these on the delegate to run Tanzu deployment steps in your pipelines.
{% hint style="info" %}
Harness Delegate uses Red Hat-based distributions such as Red Hat Enterprise Linux (RHEL) or Red Hat Universal Base Image (UBI). Use `microdnf` commands to install cf CLI on your delegate. If your delegate runs a Debian-based distribution such as Ubuntu, use `apt-get` commands instead.
{% endhint %}
{% hint style="info" %}
Use your Pivotal Network (Pivnet) API token in the `pivnet login` command in the script.
{% endhint %}
1. Open `delegate.yaml` in a text editor.
2. Locate the `INIT_SCRIPT` environment variable in the `Deployment` object.
```
- name: INIT_SCRIPT
value: ""
```
3. Replace `value: ""` with the installation script for your delegate's operating system.
{% tabs %}
{% tab title="microdnf" %}
Use `microdnf` commands to install cf CLI on delegates running Red Hat-based distributions such as RHEL or Red Hat UBI.
INIT_SCRIPT for microdnf
```yaml
- name: INIT_SCRIPT
value: |
# update package manager, install necessary packages, and install CF CLI v7
microdnf update
microdnf install yum
microdnf install --nodocs unzip yum-utils
microdnf install -y yum-utils
echo y | yum install wget
wget -O /etc/yum.repos.d/cloudfoundry-cli.repo https://packages.cloudfoundry.org/fedora/cloudfoundry-cli.repo
echo y | yum install cf7-cli -y
# autoscaler plugin
# download and install pivnet
wget -O pivnet https://github.com/pivotal-cf/pivnet-cli/releases/download/v0.0.55/pivnet-linux-amd64-0.0.55 && chmod +x pivnet && mv pivnet /usr/local/bin;
pivnet login --api-token=
# download and install autoscaler plugin by pivnet
pivnet download-product-files --product-slug='pcf-app-autoscaler' --release-version='2.0.295' --product-file-id=912441
cf install-plugin -f autoscaler-for-pcf-cliplugin-linux64-binary-2.0.295
# install Create-Service-Push plugin from community
cf install-plugin -r CF-Community "Create-Service-Push"
# verify cf version
cf --version
# verify plugins
cf plugins
```
{% endtab %}
{% tab title="apt-get" %}
Use `apt-get` commands to install cf CLI on delegates running Debian-based distributions such as Ubuntu.
INIT_SCRIPT for apt-get
```yaml
- name: INIT_SCRIPT
value: |
# update package manager, install necessary packages, and install CF CLI v7
apt-get install wget
wget -q -O - https://packages.cloudfoundry.org/debian/cli.cloudfoundry.org.key | apt-key add -
echo "deb https://packages.cloudfoundry.org/debian stable main" | tee /etc/apt/sources.list.d/cloudfoundry-cli.list
apt-get update
apt-get install cf7-cli
# autoscaler plugin
# download and install pivnet
wget -O pivnet https://github.com/pivotal-cf/pivnet-cli/releases/download/v0.0.55/pivnet-linux-amd64-0.0.55 && chmod +x pivnet && mv pivnet /usr/local/bin;
pivnet login --api-token=
# download and install autoscaler plugin by pivnet
pivnet download-product-files --product-slug='pcf-app-autoscaler' --release-version='2.0.295' --product-file-id=912441
cf install-plugin -f autoscaler-for-pcf-cliplugin-linux64-binary-2.0.295
# install Create-Service-Push plugin from community
cf install-plugin -r CF-Community "Create-Service-Push"
# verify cf version
cf --version
# verify plugins
cf plugins
```
{% endtab %}
{% endtabs %}
4. Apply the script to the delegate and check the logs.
The output for `cf --version` is `cf version 7.2.0+be4a5ce2b.2020-12-10`. The output for `cf plugins` lists the installed plugins, including `App Autoscaler` and `Create-Service-Push`.
{% hint style="info" %}
The CF Command script does not require `cf login`. Harness logs in using the credentials in the TAS connector configured for the infrastructure definition that runs the CF command.
{% endhint %}
***
## Create a TAS connector
Perform the following steps to create the TAS connector using the Harness Manager.
1. Open a Harness project, and select **Connectors** under **Project Setup**. You can also create connectors at the account or organization levels.
2. Select **New Connector**, and then select **Tanzu Application Service** under **Cloud Providers**.
### Overview
Enter a **Name** for the connector. **Description** and **Tags** are optional. Harness automatically creates an **Id** ([entity identifier](/harness-ai/use-harness-platform/references/entity-identifier-reference.md)) for the connector based on the **Name**. Select **Continue** to proceed to **Credentials**.
### Credentials
Select **Continue** after entering the following details:
* **Endpoint URL**: Enter the TAS API endpoint URL, for example `https://api.system.tas-mycompany.com`.
* **Authentication**: Select one of the following options for the username and password:
* **Plaintext**: Enter the username, and select **Create or Select a Secret** to add the password.
* **Encrypted**: Create or select a secret for both the username and the password.
* **Refresh Token** (optional): Create or select a secret for the refresh token used to authenticate with TAS. Go to [Refresh token support](#refresh-token-support) for details.
### Select Connectivity Mode
Under **Connect to the provider**, select how you want Harness to connect to TAS, and then select **Save and Continue**:
* **Connect through Harness Platform**: Harness communicates with TAS securely through the Harness Platform. Credentials are encrypted and stored in the Secret Manager configured in Harness.
* **Connect through a Harness Delegate**: Harness communicates with TAS through a Harness Delegate installed in your environment. Select this option if TAS is behind a corporate firewall.
{% hint style="info" %}
A Harness Delegate is used for deployment operations even if you select **Connect through Harness Platform**.
{% endhint %}
### Delegates Setup
This step appears only if you selected **Connect through a Harness Delegate**. Select one of the following options, and then select **Save and Continue**:
* **Use any available Delegate**.
* **Only use Delegates with all of the following tags**: Enter the tag of the [delegate](#before-you-begin) you installed.
### Connection Test
Harness validates the TAS connector authentication and permissions. Once verification succeeds, select **Finish**.
The connector now appears in the **Connectors** list.
***
## YAML example
The following YAML defines a TAS connector that authenticates using a username and password, and connects through a Harness Delegate.
TAS connector YAML
```yaml
connector:
name: TASconnector # Connector display name shown in the Harness UI
identifier: TASconnector # Unique connector identifier, cannot be changed after creation
description: "" # Optional description for the connector
accountIdentifier: # Harness account identifier that owns the connector
orgIdentifier: default # Harness org identifier that owns the connector
projectIdentifier: # Harness project identifier that owns the connector
type: Tas
spec:
credential:
type: ManualConfig
spec:
username: # Your TAS username
endpointUrl: https://api.system.tas-mycompany.com # TAS API endpoint URL
passwordRef: # Harness secret reference storing your TAS password
executeOnDelegate: true # Set to false to connect through the Harness Platform instead of a delegate
ignoreTestConnection: false # Set to true to skip the connection test when the connector is created
```
***
## Refresh token support
{% hint style="info" %}
Harness Delegate version 23.12.81804 or later is required to use this feature.
{% endhint %}
Harness provides the option to use a refresh token to authenticate with the Tanzu connector. Harness uses this refresh token to verify your Tanzu instance. You still need to provide a username and password to authenticate with Tanzu. Harness uses these credentials to obtain a new refresh token. Once you provide the refresh token in the connector, Harness uses it to authenticate and perform each task. Harness authenticates with the refresh token before executing each Tanzu step defined in the pipeline.
You can retrieve the refresh token from the `config.json` file you receive when authenticating with the CF client. You can pass the refresh token as a secret stored in the Harness Secrets Manager or your secrets manager of choice.
To generate the refresh token using a client ID and client secret instead, go to [Custom configuration for extensible authentication](#custom-configuration-for-extensible-authentication).
***
## Custom configuration for extensible authentication
For Harness Delegate version 23.12.81811 and later, you can create a Tanzu connector by setting the `ENABLE_TAS_REFRESH_TOKEN_CLIENT_ID`, `TAS_REFRESH_TOKEN_CLIENT_ID`, and `TAS_REFRESH_TOKEN_CLIENT_SECRET` parameters, and providing the [refresh token](#refresh-token-support). The connector generates a refresh token using the client ID and secret ID environment variables.
* **`ENABLE_TAS_REFRESH_TOKEN_CLIENT_ID`**: The setting to configure the alternative authentication mode on the Harness Delegate for Tanzu.
* **`TAS_REFRESH_TOKEN_CLIENT_ID`**: The client ID parameter for Tanzu authentication.
* **`TAS_REFRESH_TOKEN_CLIENT_SECRET`**: The client secret parameter for Tanzu authentication.
To configure the delegate YAML, do the following:
1. Go to the Kubernetes delegate YAML (deployment) or the actual deployed resource.
2. Under `spec.template.spec.containers.env`, add the following environment variables.
```yaml
- name: ENABLE_TAS_REFRESH_TOKEN_CLIENT_ID
value: "true"
- name: TAS_REFRESH_TOKEN_CLIENT_ID
value: gam
- name: TAS_REFRESH_TOKEN_CLIENT_SECRET
value: public
```
***
## Next steps
* [Delegate installation overview](/harness-ai/use-harness-platform/delegates/delegate/install-delegates/overview.md): Install and configure a Harness Delegate for your TAS connector.
* [Delegate troubleshooting](/harness-ai/use-harness-platform/delegates/delegate/troubleshooting.md): Resolve common delegate installation and connectivity issues.
{% @harness-feedback/feedback module="harness-ai" pagePath="harness-ai/use-harness-platform/connectors/cloud-providers/add-tas-connector" %}