# Kubernetes deployment

Deploy Blekline NHIM runtime enforcement in your cluster — **standalone sidecar** (ClusterIP) or **injected sidecar** (mutating webhook).

## Image

```
ghcr.io/blekline/sidecar:0.2.0-nhim
```

NHIM capabilities (Trust Vault, Lineage Firewall) require the NHIM image built from the private runtime engine. OSS `ingress-proxy` source is a contracts-only shell.

## Topology A — Standalone sidecar

Platform team runs one sidecar Deployment; agent pods call it over ClusterIP.

```bash
helm upgrade --install sidecar packages/ingress-proxy/helm/blekline-ingress \
  -n blekline --create-namespace \
  -f deploy/k8s/sidecar/values-production.yaml
```

Agent env: `BLEKLINE_SIDECAR_URL=http://<release>-blekline-ingress:8787`

Requirements:

- `BLEKLINE_SIDECAR_AUTH` — Bearer secret (required)
- `BLEKLINE_VAULT_MASTER_KEY` — Trust Vault encryption key
- `replicaCount: 1` + `Recreate` strategy when Trust Vault enabled
- **Never** expose port 8787 on public Ingress

See [Trust Vault sidecar](/docs/enterprise/trust-vault-sidecar) and [Lineage enforcement](/docs/enterprise/lineage-enforcement).

## Topology B — Injected sidecar (auto-inject)

Mutating webhook adds `blekline-sidecar` to agent pods. Agents use `http://127.0.0.1:8787`.

Opt-in annotation:

```yaml
metadata:
  annotations:
    blekline.com/inject-sidecar: enabled
```

Install:

```bash
helm upgrade --install blekline-admission deploy/k8s/admission/helm/blekline-admission \
  -n blekline --create-namespace
```

Requires cert-manager for webhook TLS (recommended) or manual CA bundle — see private operator pack `deploy/k8s/README.md`.

## SPIFFE workload binding

**Shipped v1:** bind SPIFFE ID at tokenize; hydrate requires matching `spiffeId` or `x-spiffe-id` header.

| Variable | Purpose |
|----------|---------|
| `BLEKLINE_SPIFFE_REQUIRED` | Require SPIFFE ID on all hydrates |
| `BLEKLINE_SPIFFE_ALLOWED_IDS` | Comma-separated allowlist |
| `BLEKLINE_SPIFFE_TRUST_DOMAIN` | Prefix check, e.g. `spiffe://prod.example` |

SPIRE Workload API JWT verification — roadmap.

## Verification

```bash
kubectl -n blekline port-forward svc/sidecar-blekline-ingress 8787:8787
curl -s http://127.0.0.1:8787/health
```

Post-install Job: `deploy/k8s/verify/nhim-smoke-job.yaml`

Interactive demo: [Runtime Simulator](/docs/playground/runtime-enforcement)

## Related

- [NHIM overview](/docs/introduction/nhim)
- [Ingress proxy API](/docs/api/ingress-proxy)
- [Multi-region](/docs/enterprise/multi-region)