# Kubernetes fleet

**Track 03** deploys Blekline NHIM runtime enforcement in your cluster — **standalone sidecar** (ClusterIP) or **injected sidecar** (mutating webhook). Plan ~2 hours for a full eval pass.

## Step 0 — NHIM audit

Run static audit before sandbox install:

```bash
npx @blekline/nhim-audit audit --plain --json -o nhim-audit.json
```

See [NHIM audit quickstart](/docs/get-started/nhim-audit-quickstart). Attach JSON to your sandbox grant for a scoped probe token.

## Images

```
ghcr.io/blekline/sidecar:0.2.0-nhim
ghcr.io/blekline/admission:0.2.0-nhim
```

## Topology A — Standalone sidecar

Platform team runs one sidecar Deployment; agent pods call it over ClusterIP.

```bash
kubectl create namespace blekline
kubectl -n blekline create secret generic blekline-sidecar-auth \
  --from-literal=token="$(openssl rand -hex 32)"
kubectl -n blekline create secret generic blekline-vault-master \
  --from-literal=masterKey="$(openssl rand -hex 32)"

helm upgrade --install sidecar blekline-ingress \
  -n blekline \
  -f sidecar/values-production.yaml
```

Agent env: `BLEKLINE_SIDECAR_URL=http://<release>-blekline-ingress:8787`

**Never** expose port 8787 on public Ingress.

## Topology B — Injected sidecar

Mutating webhook adds `blekline-sidecar` to agent pods. Agents use `http://127.0.0.1:8787`.

Opt-in annotation:

```yaml
metadata:
  annotations:
    blekline.com/inject-sidecar: enabled
```

```bash
helm upgrade --install blekline-admission blekline-admission \
  -n blekline --create-namespace
```

Requires cert-manager for webhook TLS (recommended) or manual CA bundle. Eval default: `failurePolicy: Ignore`; production fail-closed options ship in the enterprise sandbox pack.

## Mandatory-hop NetworkPolicy

Agent pods **must not** reach downstream tools except via the sidecar Service. Apply the chart's agent egress NetworkPolicy template after sidecar install.

Verification: direct curl from an agent pod to a downstream tool should **fail**; enforce-skipped calls should not appear in Activity.

## SPIFFE workload binding

| Variable | Purpose |
|----------|---------|
| `BLEKLINE_SPIFFE_REQUIRED` | Require SPIFFE ID on all hydrates |
| `BLEKLINE_SPIFFE_ALLOWED_IDS` | Comma-separated allowlist |
| `BLEKLINE_SPIFFE_TRUST_DOMAIN` | Prefix check, e.g. `spiffe://prod.example` |

## Verification checklist

1. `kubectl port-forward` sidecar Service → `curl /health` returns 200 with auth
2. Apply NHIM smoke job or run [NHIM verification](/docs/enterprise/nhim-verification) steps
3. Optional: `--probe` pass with eval token for active bypass checks
4. Confirm block/mask event in **Operations → Activity**

Full install scripts, webhook hardening, and NHIM client verification checklist ship in the **enterprise sandbox Track 03** repository.

## Related

- [Kubernetes deployment](/docs/enterprise/k8s-deployment) — extended topology reference
- [Multi-region](/docs/enterprise/multi-region) — ingress routing
- [Ingress proxy API](/docs/api/ingress-proxy)

---

**Next steps:** [Eval journey](/docs/get-started/eval-journey) · [Compliance evidence](/docs/enterprise/compliance-evidence) · [Open workspace](https://app.blekline.com)