> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/resilience-testing/chaos-engineering/use-chaos-engineering/governance/governance-in-execution/govern-run.md).

# Configure Rules and Conditions

This topic describes how you can configure **ChaosGuard** to enforce security policies during chaos experiments execution. An additional layer of security that is executed before running a chaos experiment is [ChaosGuard](/resilience-testing/chaos-engineering/use-chaos-engineering/governance/governance-in-execution/governance-in-execution.md).

[This](https://youtu.be/cHFiBvQPCLU) video provides a walkthrough of configuring the rules and conditions in ChaosGuard.

### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

[Install a Harness Delegate or a dedicated chaos infrastructure](/resilience-testing/chaos-engineering/use-chaos-engineering/infrastructure/types/types.md) before creating a condition because a condition is applied to an infrastructure.

### Configure a condition <a href="#configure-a-condition" id="configure-a-condition"></a>

1. In the **Chaos** module, select **ChaosGuard**, and select **Conditions**. The **Conditions** page lists existing conditions (if any).

   ![navigate to chaos](/files/VAskr9LQaM6MMV6LRdEb)
2. To create a condition, click **New condition**.

   ![new-condition](/files/6y7BsKcAND8fDdecVjU5)
3. Provide a name, a description (optional), and tags (optional). Specify the infrastructure. If you select either **Linux** or **Windows**, click **Save**.

   ![infrastructure options](/files/motfnQFayA12t4vSvSax)

   3a. If you select **Kubernetes**, you can select one of **Harness Infrastructures** (also known as Harness Delegate) or **Dedicated Chaos Infrastructure**. Click **Save**.

   ![edit-condition](/files/LgC5c6gnMOJAlJhD3lL8)

This gives you 3 ways to define a condition from the **Condition Editor**:

* [YAML manifest](#define-constraints-using-yaml)
* [Using the visual editor](#define-constraints-using-the-visual-editor)
* [Harness AI](#define-constraints-using-ai)

#### Define constraints using YAML <a href="#define-constraints-using-yaml" id="define-constraints-using-yaml"></a>

1. Select the **YAML** tab.

   ![select](/files/RLWgDwQaecODtTlkWLCm)
2. Specify the relevant values corresponding to the respective names. Click **Save**. In this example, the YAML configuration indicates that a condition is applied to a fault named **pod-delete** with the specified **label**, **namespace**, and **serviceAccount**.

   ![yaml edit](/files/WP7TAqwRYFy9qWdJp1mo)

#### Define constraints using the visual editor <a href="#define-constraints-using-the-visual-editor" id="define-constraints-using-the-visual-editor"></a>

1. To add conditions using a visual editor, navigate to the **VISUAL** tab of the condition you created earlier.

   ![condition](/files/XGAN7u6HJNSXRbuuIbtZ)
2. Add the **WHAT** clause. It blocks a fault whose name is **EQUAL TO** (or matches) or **NOT EQUAL TO** (everything else apart from the given value) pod delete. You can add more than one **WHAT** clause. This clause also takes the experiment name as input.

   ![what](/files/1nH59XwjuXXxrH0ICnnV)
3. Add the **WHERE** clause. It blocks one or more infrastructure. Select more than one infrastructure by hovering over the field.

   ![where](/files/Z0AtXw5MIaxRcBfysYLd)
4. Add the **WHICH** clause. It blocks the infrastructure that has specific entries for **APPLICATION MAP**, **SERVICES**, **NAMESPACE** (mandatory), **KIND** (mandatory), and **APP LABEL**. You can add more than one **WHICH** clause.

   ![which](/files/effnjvX2Exx7Q4ZgdnJj)
5. Add the **USING** clause. It blocks specific service account. You can add more than one service account by clicking the field and adding service account name to it. Click **Save**.

   ![using](/files/xAJbEyYZ9yC058ydfpTg)

{% hint style="info" %}

* You can use both **'EQUAL'** and **'NOT EQUAL TO'** operators in the condition logic for WHAT, WHERE, WHICH and USING.
* You can also use wildcards within the condition entities, which offers flexibility and control in defining conditions.
  {% endhint %}

#### Define constraints using AI <a href="#define-constraints-using-ai" id="define-constraints-using-ai"></a>

1. Instead of selecting the required parameters, you can generate conditions with the help of Harness AI. AI assistant shows up when you are configuring a condition. You can choose one of the suggestions provided by Harness AI by clicking on it or writing something along the same lines as the suggestions.

   ![aida suggestion](/files/7F1pIQwsCGMQy9fx2hdX)
2. When you type a condition, you will see that Harness AI generates a YAML corresponding to your condition. If the YAML generated meets the conditions, you can click **Apply YAML**.

   ![aida generation](/files/EPjhXIMSLO8QpyuVbBOF)
3. If the generated YAML does not meet your conditions, click **Try again**. In the snippet below, you will see that Harness AI applies the YAML generated to the editor.

   ![aida apply](/files/DlI0qipSYhnFXh98A2Ul)

#### Save condition <a href="#save-condition" id="save-condition"></a>

After you define the constraints of a condition either using [YAML](#define-constraints-using-yaml), [visual editor](#define-constraints-using-the-visual-editor), or [Harness AI](#define-constraints-using-ai), select **Save**.

![save constraints](/files/FmJvq4wQeCNqFWcDz6sN)

### Configure a rule <a href="#configure-a-rule" id="configure-a-rule"></a>

1. Click **New rule**.

   ![](/files/SHAFc46F7olCVTrE7kAW)
2. Specify parameters such as name, description (optional), tags (optional), user group to apply the rule (you can apply the rule to multiple user groups), and time window to apply the rule. You can apply multiple time windows to apply the rule. Click **Next**.

   ![](/files/HxKzC0nGxICHi5ttgpjf)
3. Select user groups. Click **Apply Selected**.

   ![](/files/xPQrBFHD0UW1LeW9Gpfg)
4. Select a condition (or multiple conditions) that you wish to apply. Click **Done**.

   ![](/files/XMtOBLeEHDWeaLLkYCyb)

{% hint style="info" %}
**NOTE**

* Below is a snap that shows a successful evaluation of all the rules in a chaos experiment.

  ![](/files/d05IMi4W7ilSQTiEBkh1)
* Below is a snap that shows a failed evaluation of some (or all) rules in a chaos experiment.

  ![](/files/h3toWscix718BMJWKPgY)
  {% endhint %}

#### Enable and disable rules <a href="#enable-and-disable-rules" id="enable-and-disable-rules"></a>

* The image below shows the two different states of a rule (enable and disable).

  ![chaosguard-rules](/files/igMqhU8jGSTLoQ9iEQLp)
