Kubernetes

Two enforcement shapes, chosen per namespace: a sidecar injected into each pod, or a node-level DaemonSet for namespaces with many small pods where a sidecar per pod would be wasteful.

Install the chart

$ helm repo add cirvix https://charts.cirvix.com$ helm install cirvix cirvix/cirvix-gateway \    --namespace cirvix --create-namespace \    --set policy.source=git \    --set policy.repo=github.com/your-org/policies

Sidecar injection

Label a namespace or a pod to opt into injection; the mutating webhook adds the gateway container and rewrites egress environment variables at admission time.

metadata:  annotations:    cirvix.com/inject: "true"    cirvix.com/policy-group: "engineering"

DaemonSet / LSM mode

The DaemonSet chart variant enforces at the node level, with an optional eBPF-based LSM mode for environments that need enforcement below the network layer. This mode is newer and rolling out incrementally — check current status before depending on it for a namespace you can't easily fall back from.

Restricting egress to the gateway

apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:  name: agent-egress-via-gatewayspec:  podSelector:    matchLabels: { cirvix.com/governed: "true" }  policyTypes: ["Egress"]  egress:    - to:        - podSelector: { matchLabels: { app: cirvix-gateway } }