Delegate Connection Requirements
This article lists the permissions and ports required by the Harness Delegate to access your artifact servers, cloud providers, verification, and security providers.
How does Harness Connect to Providers?
The Harness Manager connects to the artifact servers, cloud providers, verification, and security providers using the Harness Delegate. You download the Harness Delegate from the Harness Manager and install it in your network or VPC.
For information on Harness architecture, see Harness Architecture.
The Delegate only connects to the Harness Manager via an outbound HTTPS/WSS connection over port 443. There is no inbound connection from the Harness Manager to the Delegate.
The Delegate and the Harness Manager (via SaaS) establish a Secure WebSocket channel (WebSocket over TLS) to send new Delegate task event notifications (not the tasks themselves) and exchange connection heartbeats. In the case that the WebSocket connection is dropped, the Harness Delegate falls back to outbound-only, polling-based task fetch.
In the Harness Manager, you configure artifact servers, cloud providers, verification, and security providers using your account credentials with those providers. The Delegate uses those credentials when it uses your providers in the Harness deployment, verification, and security processes.
Harness Delegate Connection to Harness Manager
The Delegate runs from within your enterprise network or VPC and only connects to the Harness Manager with a secure outbound HTTPS connection over port 443.
- HTTPS port 443 outbound from locally-installed delegate to the Harness Manager.
- HTTPS port 443 from your browser to the Harness Manager.
Permissions and Ports for Harness Connections
The following table lists the permissions and ports needed for the Harness Delegate to access artifact servers, cloud providers, verification, and security providers. You configure these settings in the Harness Manager.
- Artifact servers: The Delegate pulls artifacts and metadata from artifact servers using the account and ports required by the artifact server.
- Deployments: Most Harness deployments to Virtual Machines (for example, AWS, GCP, Azure, Datacenter) are performed using SSH over port 22. The VPC firewall setting might also require additional open ports for administration, such as HTTP 443.
- Verifications: The Delegate makes API calls to verification providers using the access keys required by the providers.
- Security: For security, such as SAML and LDAP, the Delegate uses the account and ports required by the provider, such as a Active Directory domain controller running in a Azure or AWS VPC.
Connections | Permissions and Harness Docs | Ports for Delegate Connections to Services | Provider References |
Active Directory LDAP | User account in the Active Directory. | HTTPS: 443. LDAP without SSL: 389. Secure LDAP (LDAPS): 636. | |
AppDynamics | General permission: View, Edit and Delete permissions for new applications can be set as part of the default permissions for a custom role. | HTTP: 80 | |
AWS Cloud | IAM user to be able to make API requests to AWS. | Depends on the firewall settings of your VPC, but typically, HTTP: 443. | |
AWS CodeDeploy | Policies:
| HTTPS: 443. | |
AWS EC2 | Policy: AmazonEC2FullAccess | HTTP: 80. HTTP: 443. TCP: 9090. | |
AWS ELB, ALB, ECS | Policy for Elastic Load Balancer, Application Load Balancer, and Elastic Container Service: | Well-known ports: 25, 80, 443, 465, and 587. | |
AWS S3 | Policy: AmazonS3ReadOnlyAccess | HTTP: 443. | |
Azure | Client (Application) and Tenant (Directory) IDs, and Key. | Windows VMs (WinRM ports): HTTP: 5985, HTTPS: 5986. | |
Bamboo | Username and password for account. | HTTP: 443. TCP: 8085. | |
Bugsnag | Data Access API Auth Token. | The Bugsnag Data Access API is exposed on the same TCP port as the dashboard, 49080. | |
Datadog | API Key. | HTTPS: 443. | |
Docker Registry | User permission level. | TCP: 8083. | |
Dynatrace | Access token. | HTTPS: 443. | |
ELK Elasticsearch | User (Read permission) or Token Header and Token Value. | TCP: 9200. | |
Github Repo | User account: repository owner. Organization account: read and write. | HTTP: 443. | |
Google Cloud Platform (GCP) | Policies:
| SSH: 22. | |
JFrog Artifactory | Privileged User: Read permission. | HTTP: 443. | |
Jenkins | Matrix-based: Read permission. Execute Permission, if jobs are triggered from Workflow. | HTTPS: 443. | |
Kubernetes Cluster | One of the following:
| Depends where the cluster is hosted, such as GCP or AWS. | |
Logz | Token-based. | HTTPS: 443. | |
OpenShift | Kubernetes service account token. | HTTPS: 443. | |
New Relic | API key. | HTTPS: 443. | |
Nexus | User account with Repository View Privilege or read for repository. | TCP: 8081. | |
Pivotal Cloud Foundry | User account with Admin, Org Manager, or Space Manager role. The user account must be able to update spaces, orgs, and applications. | HTTP: 80 or 443. | |
Prometheus | None. | Depends on where the Prometheus server is hosted. For example, on AWS, port 9090 might be required. | |
SMTP | None. | TCP: 25. | |
Splunk | User account with Read permissions on eventtypes objects. | TCP: 8089 for API. | |
Sumo Logic | User account with access ID and key and query permissions. | HTTPS: 443. | |
WinRM | User account in the same Active Directory domain as the Windows instances the connection uses. | HTTP: 5985. HTTPS: 5986 and 443. SSH: 22. | Installation and Configuration for Windows Remote Management |