> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/tkgi/permissions.md).

# Prerequisites before executing faults on TKGi

This topic describes the HCE platform requires to execute chaos experiments.

### On-premise Kubernetes (TKGi) <a href="#on-premise-kubernetes-tkgi" id="on-premise-kubernetes-tkgi"></a>

| Chaos agent deployment model                       | Centralized Chaos Agent on Kubernetes (leverage kube-api and container-runtime api to inject faults on K8s microservices)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connectivity requirements from agent               | <ul><li>Outbound over port 443 to Harness from Kubernetes cluster.</li><li>Outbound to application health endpoints (ones which will be used for resilience validation) from Kubernetes cluster.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Connectivity requirements from VM/cluster/app      | Application and Chaos Agent Co-Exist as pods on the same cluster.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Access requirements for agent install              | Install agent as a cluster-admin or as a user mapped to cluster role with [these](https://github.com/iKettles/harness-gitbook/tree/main/docs/chaos-engineering/faults/chaos-faults/kubernetes/permissions/Kubernetes%20chaos%20agent%20installation%20access%20requirements/README.md) permissions.                                                                                                                                                                                                                                                                                                                                                            |
| Access requirements for basic chaos experiments    | <ul><li>Chaos ServiceAccount: <a href="https://hce-docs.github.io/platform-wise-chaos-info/TKGi/Kubernetes/basic-pod-chaos-access-requirements.html">consolidated serviceaccount for basic pod chaos</a></li><li>No container runtime privileges required.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                           |
| Access requirements for advanced chaos experiments | <ul><li>Chaos ServiceAccount: <a href="https://hce-docs.github.io/platform-wise-chaos-info/TKGi/Kubernetes/advanced-pod-and-node-chaos-access-requirements.html">consolidated serviceaccount for advanced pod and node chaos</a></li><li>Container Runtime privileges: <a href="https://github.com/hce-docs/platform-wise-chaos-info/blob/main/TKGi/Kubernetes/recommended-psp-for-advanced-pod-chaos.yaml">recommended PSP for advanced chaos</a></li><li>To understand the need for the privileges, refer to <a href="/pages/A2Co1eexsfAhwQ1B3VOT#pod-faults-microservices-based-faults">chaos experiment flow for microservice-based targets.</a></li></ul> |
| Chaos deployment and architecture details          | <ul><li>Go to <a href="https://github.com/iKettles/harness-gitbook/tree/main/docs/chaos-engineering/faults/chaos-faults/cloud-foundry/cf-chaos-components-and-their-deployment-architecture/README.md">Cloud Foundry chaos deployment </a>and <a href="/pages/A2Co1eexsfAhwQ1B3VOT#namespace-scope-mode">namespace-scoped cluster mode </a>to read how chaos is deployed.</li></ul>                                                                                                                                                                                                                                                                            |
| Supported chaos faults                             | <ul><li><a href="https://github.com/hce-docs/platform-wise-chaos-info/blob/main/TKGi/Kubernetes/basic-pod-faults-without-container-privileges.md">Basic pod faults without container privileges.</a></li><li><a href="https://github.com/hce-docs/platform-wise-chaos-info/blob/main/TKGi/Kubernetes/advanced-pod-and-node-faults-which-need-container-privileges.md">Advanced pod and node faults with additional resource permissions and container privileges.</a></li></ul>                                                                                                                                                                                |