> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/resilience-testing/3.0/chaos-testing/infrastructure/kubernetes/dedicated-delegate.md).

# Dedicated delegate approach

In the dedicated delegate approach, the Harness Delegate runs **inside the target cluster** (one Delegate per cluster). The Delegate's own service account is the chaos service account. This is the strongest isolation pattern and the simplest single-cluster setup.

![Dedicated Delegate on the target cluster](/files/OIH78rsWfVZgEUl9Dc03)

***

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

* **Harness Delegate version `24.09.83900` or above.** Earlier versions cannot execute DDCR experiments.
* **`kubectl` access** to the target cluster.
* **A Kubernetes connector** in Harness, or the ability to create one.
* **A Harness environment** to attach the infrastructure to. Go to [Create an environment](/resilience-testing/chaos-engineering/chaos-experiments/create-experiments.md#create-environment) if you do not have one.

***

### Choose your install method <a href="#choose-your-install-method" id="choose-your-install-method"></a>

* **Basic** *(default)*: the Delegate runs with the standard `cluster-admin` role. Recommended for first installs and dev clusters.
* **Limited Permissions:** the Delegate runs in a dedicated namespace with a custom `Role` and `ClusterRole`. Recommended for production clusters where `cluster-admin` is not acceptable.

{% @harness-package-selector/package-selector platforms="%5B%7B%22label%22%3A%22Basic%22%2C%22slug%22%3A%22basic%22%2C%22path%22%3A%22resilience-testing%2Fchaos-testing%2Finfrastructure%2Fkubernetes%2Fdedicated-delegate%2Fbasic-dedicated-delegate%22%7D%2C%7B%22label%22%3A%22Limited%20Permissions%22%2C%22slug%22%3A%22limited-permissions%22%2C%22path%22%3A%22resilience-testing%2Fchaos-testing%2Finfrastructure%2Fkubernetes%2Fdedicated-delegate%2Flimited-permissions-dedicated-delegate%22%7D%5D" %}

### Next steps <a href="#next-steps" id="next-steps"></a>

* [Cluster permissions](/resilience-testing/chaos-testing/infrastructure/kubernetes/permissions.md): the full API permission reference for the chaos service account, with copy-paste RBAC manifests.
* [Centralized delegate approach](/resilience-testing/chaos-testing/infrastructure/kubernetes/centralized-delegate.md): if one Delegate must serve many target clusters.
* [Network configuration](/resilience-testing/chaos-testing/infrastructure/kubernetes/network-config.md): mTLS and proxy settings for the Delegate and Discovery Agent.