Blekline | Non-Human Identity & Runtime Enforcement

Track 03 deploys Blekline NHIM runtime enforcement in your cluster — standalone sidecar (ClusterIP) or injected sidecar (mutating webhook). Plan ~2 hours for a full eval pass.

Step 0 — NHIM audit

Run static audit before sandbox install:

npx @blekline/nhim-audit audit --plain --json -o nhim-audit.json

See [NHIM audit quickstart](/docs/get-started/nhim-audit-quickstart). Attach JSON to your sandbox grant for a scoped probe token.

Images

ghcr.io/blekline/sidecar:0.2.0-nhim
ghcr.io/blekline/admission:0.2.0-nhim

Topology A — Standalone sidecar

Platform team runs one sidecar Deployment; agent pods call it over ClusterIP.

kubectl create namespace blekline
kubectl -n blekline create secret generic blekline-sidecar-auth \
  --from-literal=token="$(openssl rand -hex 32)"
kubectl -n blekline create secret generic blekline-vault-master \
  --from-literal=masterKey="$(openssl rand -hex 32)"

helm upgrade --install sidecar blekline-ingress \
  -n blekline \
  -f sidecar/values-production.yaml

Agent env: BLEKLINE_SIDECAR_URL=http://<release>-blekline-ingress:8787

Never expose port 8787 on public Ingress.

Topology B — Injected sidecar

Mutating webhook adds blekline-sidecar to agent pods. Agents use http://127.0.0.1:8787.

Opt-in annotation:

metadata:
  annotations:
    blekline.com/inject-sidecar: enabled

helm upgrade --install blekline-admission blekline-admission \
  -n blekline --create-namespace

Requires cert-manager for webhook TLS (recommended) or manual CA bundle. Eval default: failurePolicy: Ignore; production fail-closed options ship in the enterprise sandbox pack.

Mandatory-hop NetworkPolicy

Agent pods must not reach downstream tools except via the sidecar Service. Apply the chart's agent egress NetworkPolicy template after sidecar install.

Verification: direct curl from an agent pod to a downstream tool should fail; enforce-skipped calls should not appear in Activity.

SPIFFE workload binding

Variable	Purpose
`BLEKLINE_SPIFFE_REQUIRED`	Require SPIFFE ID on all hydrates
`BLEKLINE_SPIFFE_ALLOWED_IDS`	Comma-separated allowlist
`BLEKLINE_SPIFFE_TRUST_DOMAIN`	Prefix check, e.g. `spiffe://prod.example`

Verification checklist

kubectl port-forward sidecar Service → curl /health returns 200 with auth
Apply NHIM smoke job or run NHIM verification steps
Optional: --probe pass with eval token for active bypass checks
Confirm block/mask event in Operations → Activity

Full install scripts, webhook hardening, and NHIM client verification checklist ship in the enterprise sandbox Track 03 repository.

Kubernetes deployment — extended topology reference
Multi-region — ingress routing
Ingress proxy API

Next steps: [Eval journey](/docs/get-started/eval-journey) · Compliance evidence · Open workspace