Deploy Blekline NHIM runtime enforcement in your cluster — standalone sidecar (ClusterIP) or injected sidecar (mutating webhook).
Image
ghcr.io/blekline/sidecar:0.2.1-nhim
NHIM capabilities (Trust Vault, Lineage Firewall) require the NHIM image built from the private runtime engine. The open-source repo ships a reference sidecar (contracts enforcement + Helm layout) — platform eval and production use the NHIM image above.
Topology A — Standalone sidecar
Platform team runs one sidecar Deployment; agent pods call it over ClusterIP.
helm upgrade --install sidecar blekline-ingress \
-n blekline --create-namespace \
-f sidecar/values-production.yaml
Full K8s operator pack (admission webhook install, NHIM verification jobs) ships in the enterprise sandbox. A reference Helm layout is in blekline-oss/packages/ingress-proxy/helm; production eval uses the NHIM image above.
Agent env: BLEKLINE_SIDECAR_URL=http://<release>-blekline-ingress:8787
Requirements:
BLEKLINE_SIDECAR_AUTH— Bearer secret (required)BLEKLINE_VAULT_MASTER_KEY— Trust Vault encryption keyreplicaCount: 1+Recreatestrategy when Trust Vault enabled- Never expose port 8787 on public Ingress
See Trust Vault sidecar and Lineage enforcement.
Topology B — Injected sidecar (auto-inject)
Mutating webhook adds blekline-sidecar to agent pods. Agents use http://127.0.0.1:8787.
Opt-in annotation:
metadata:
annotations:
blekline.com/inject-sidecar: enabled
Install:
helm upgrade --install blekline-admission blekline-admission \
-n blekline --create-namespace
Requires cert-manager for webhook TLS (recommended) or manual CA bundle. Full install scripts, NHIM verification jobs, and webhook hardening guides ship in the enterprise sandbox eval repository.
Auto-Route mode {#auto-route-mode}
Auto-Route mode (three enforcement tiers)
When the mutating admission webhook injects blekline-sidecar, it also rewrites SDK env vars on agent containers so OpenAI / Anthropic clients route through http://127.0.0.1:8787 automatically.
| Tier | Mechanism | Code change? |
|---|---|---|
| 1 — Auto-Route | Webhook env inject → sidecar masks LLM ingress/egress | No (OpenAI/Anthropic SDK) |
| 1b — iptables Auto-Route | Init container redirects HTTPS without env vars | No (Phase 2 — annotate blekline.com/auto-route: iptables) |
| 2 — Mandatory hop | NetworkPolicy → agent egress only via sidecar | No (network) |
| 3 — Tool enforce | POST /v1/enforce-tool-call or @blekline/mcp-proxy | Yes* (MCP tool argument policy) |
* Tier 3 is required for MCP tool argument policy (ASI02). Auto-Route covers model API paths only.
Injected env vars (Tier 1)
| Env var | Value |
|---|---|
BLEKLINE_AUTO_ROUTE | true |
BLEKLINE_SIDECAR_URL | http://127.0.0.1:8787 |
OPENAI_BASE_URL | http://127.0.0.1:8787/v1 |
OPENAI_API_BASE | http://127.0.0.1:8787/v1 |
ANTHROPIC_BASE_URL | http://127.0.0.1:8787 |
Opt-out per pod: blekline.com/auto-route: disabled
Roadmap dataplane (not default shipped)
- iptables init redirect — transparent HTTPS redirect without env vars (Tier 1b, Phase 2)
- eBPF / Cilium — optional dataplane integration for platform teams (Phase 3)
See enterprise sandbox AUTO_ROUTE.md for operator install paths.
Progressive enforce {#progressive-enforce}
Roll out NHIM in three Helm-aligned phases:
| Phase | Profile | Behavior |
|---|---|---|
| Audit | deploy/k8s/values-audit-profile.yaml | failureMode: allow — log + SIEM, no block |
| Warn | Staging sidecar + mask policies | Mask / flag hits; agents continue |
| Block | deploy/k8s/values-enforce-profile.yaml | failureMode: block + mandatory-hop NP |
Never run passthrough_with_alert in production. See Enforcement overview in the app.
SPIFFE workload binding
Shipped v1: bind SPIFFE ID at tokenize; hydrate requires matching spiffeId or x-spiffe-id header.
R2: when BLEKLINE_SPIFFE_VERIFY_JWT=true, the sidecar verifies JWT-SVID signatures via JWKS (BLEKLINE_SPIFFE_JWKS_URL or SPIRE agent keys). SPIRE install notes ship in the enterprise sandbox deploy pack.
OpenShift / CRC (R2)
Bank pilots on OpenShift use a values overlay and CRC validation checklist from the enterprise sandbox deploy pack. Default pilot posture remains audit-only until dual-control activate.
Istio / OpenShift Service Mesh adjacency examples ship in the same pack.
| Variable | Purpose |
|---|---|
BLEKLINE_SPIFFE_REQUIRED | Require SPIFFE ID on all hydrates |
BLEKLINE_SPIFFE_ALLOWED_IDS | Comma-separated allowlist |
BLEKLINE_SPIFFE_TRUST_DOMAIN | Prefix check, e.g. spiffe://prod.example |
BLEKLINE_SPIFFE_VERIFY_JWT | Verify JWT-SVID signature via JWKS |
BLEKLINE_SPIFFE_JWKS_URL | SPIRE or IdP JWKS endpoint for signature verify |
Preload JWKS at sidecar startup when verify is enabled.
Verification
kubectl -n blekline port-forward svc/sidecar-blekline-ingress 8787:8787
curl -s http://127.0.0.1:8787/health
Post-install verification Job and step-by-step NHIM checklist are included in the enterprise sandbox Track 01 — K8s.
Interactive demo: Runtime Simulator