> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/resilience-testing/chaos-engineering/faults/chaos-fault-categories/cloud-foundry/permissions.md).

# Requirements

This topic describes the permissions required to execute chaos experiments on the Cloud Foundry platform.

### Private cloud <a href="#private-cloud" id="private-cloud"></a>

#### TAS (Tanzu Application Service) platform (for Cloud Foundry) <a href="#tas-tanzu-application-service-platform-for-cloud-foundry" id="tas-tanzu-application-service-platform-for-cloud-foundry"></a>

|                                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Chaos agent deployment model                       | Chaos agent on each Diego cell (systemd-based service within Diego cell)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Chaos agent as a Cloud Foundry app with chaos sidecars (agent runs as CF application, and includes chaos sidecar in application containers)                                                                                                                                                                                                           | Centralized chaos agent on Tanzu Ops manager (jumpbox) (systemd-based service within the jumpbox)                                                                                                                                                                                                                                                                                                                                                                        |
| Connectivity requirements from agent               | <ul><li>Outbound over port 443 to Harness from CF Diego cell.</li><li>Outbound to application health endpoints (ones which will be used for resilience validation) from the VM.</li></ul>                                                                                                                                                                                                                                                                                                                                                                               | <ul><li>Outbound over port 443 to Harness from CF chaos agent app.</li><li>Outbound to application health endpoints (ones which will be used for resilience validation).</li><li>Inbound over port 8081 from target apps (running chaos sidecar process).</li></ul>                                                                                   | <ul><li>Outbound over port 443 to Harness from CF app container.</li><li>Outbound to application health endpoints (ones which will be used for resilience validation) from the VM.</li></ul>                                                                                                                                                                                                                                                                             |
| Connectivity requirements from VM/cluster/app      | Application and chaos agent co-exist on the same VM.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | <ul><li>Application and chaos agent co-exist as apps on the same PCF cluster.</li><li>However, you need to set up network policy for outbound from target apps running chaos sidecar process to the CF chaos agent app.</li></ul>                                                                                                                     | Inbound over port 22 (via cf-ssh) into Diego cell from Tanzu Ops Manager/Jumpbox VM                                                                                                                                                                                                                                                                                                                                                                                      |
| Access requirements for agent install              | Install agent as a root user.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | <ul><li>Install agent pcf app and bundle chaos sidecar into target apps as a CF space developer. Both the app and the sidecar process can run with non-root user. Go to <a href="https://hce-docs.github.io/platform-wise-chaos-info/PCF/sidecar-approach-for-jvm-chaos-in-pcf.html">sidecar-based chaos approach </a>for more information.</li></ul> | Install agent as a root user.                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Access requirements for basic chaos experiments    | Run experiments with non-root user.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Run experiments with non-root user.                                                                                                                                                                                                                                                                                                                   | Run experiments with non-root user.                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Access requirements for advanced chaos experiments | Run experiments with root user.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Run experiments with non-root user.                                                                                                                                                                                                                                                                                                                   | Run experiments with root user.                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Chaos deployment and architecture details          | <ul><li>Go to <a href="https://github.com/iKettles/harness-gitbook/tree/main/docs/chaos-engineering/faults/chaos-faults/cloud-foundry/cf-chaos-components-and-their-deployment-architecture/README.md#run-lci-in-diego-cells-hosting-the-app-instances">HCE CF chaos approach and deployment architecture</a> for more information.</li><li>Go to <a href="https://hce-docs.github.io/platform-wise-chaos-info/PCF/pcf-chaos-faqs.html">FAQ</a> to understand how this model compares with the other deployment models and why the agent runs with root user.</li></ul> | Go to [CF chaos approach and deployment architecture](https://github.com/iKettles/harness-gitbook/tree/main/docs/chaos-engineering/faults/chaos-faults/cloud-foundry/cf-chaos-components-and-their-deployment-architecture/README.md#run-cf-infrastructure-as-native-cf-app-interacting-with-chaos-sidecars).                                         | Go to [CF chaos approach and deployment architecture](https://github.com/iKettles/harness-gitbook/tree/main/docs/chaos-engineering/faults/chaos-faults/cloud-foundry/cf-chaos-components-and-their-deployment-architecture/README.md#run-lci-with-tanzu-ops-manager).                                                                                                                                                                                                    |
| Supported chaos faults                             | <ul><li><a href="https://github.com/hce-docs/platform-wise-chaos-info/blob/main/PCF/basic-faults-supported-by-linux-pcf-infra-running-as-non-root-in-diego-cell.md">Basic CF faults with non-root agent in diego cell</a></li><li><a href="https://github.com/hce-docs/platform-wise-chaos-info/blob/main/PCF/all-supported-chaos-faults-by-linux-pcf-infra-running-as-root-in-diego-cell.md">Basic and advanced CF faults with root agent in diego cell.</a></li></ul>                                                                                                 | [Supported CF faults via app-based chaos agent leveraging chaos sidecars app containers.](https://github.com/hce-docs/platform-wise-chaos-info/blob/main/PCF/all-supported-faults-by-pcf-app-based-chaos-infra-running-sidecars-in-app-containers-as-non-root.md)                                                                                     | <ul><li><a href="https://github.com/hce-docs/platform-wise-chaos-info/blob/main/PCF/basic-faults-supported-by-linux-pcf-infra-running-as-non-root-in-diego-cell.md">Basic CF faults with non-root agent in diego cell.</a></li><li><a href="https://github.com/hce-docs/platform-wise-chaos-info/blob/main/PCF/all-supported-chaos-faults-by-linux-pcf-infra-running-as-root-in-diego-cell.md">Basic and advanced CF faults with root agent in diego cell.</a></li></ul> |