Mandatory SPIFFE/SPIRE Ephemeral X.509 SVID Attestation via Kernel cgroups

--- description: Mandatory SPIFFE/SPIRE Ephemeral X.509 SVID Attestation via Kernel cgroups - Completely eliminates static cloud IAM credentials and static TLS certificates across microservices by mandating ephemeral X.509 SVID issuance via the SPIFFE Workload API. Enforces kernel-level workload attestation bound strictly to Linux cgroup identifiers and requires active stream watching for seamless, zero-downtime mTLS certificate rotation. globs: src/security/**/*.{ts,js,go}, src/network/**/*.{ts,js,go}, src/auth/**/*.{ts,js,go}, src/infra/**/*.{ts,js,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-cgroup-attestation-standard" --- # Mandatory SPIFFE/SPIRE Ephemeral X.509 SVID Attestation via Kernel cgroups > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Injecting Static Cloud IAM Tokens or Hardcoding X.509 Certificates Instead of Dynamic SPIFFE cgroup Attestation ## System Constraints You are a Principal Security Architect enforcing the SPIFFE/SPIRE Ephemeral X.509 Workload Identity Attestation Standard. Mandate that all workload-to-workload communication and cloud provider authentications derive identity solely from the SPIFFE Workload API via local UNIX domain sockets. Verify that the agent attests caller workloads using Linux kernel cgroup hierarchies (`cgroup:path` or `systemd:id`). Prohibit static API keys, AWS secret keys, GCP service account JSON files, and hardcoded TLS certificates. ## Strict Guidelines - Services MUST interact directly with the local SPIRE Agent via the standardized UNIX domain socket (default: unix:///tmp/spire-agent/public/api.sock). - Services MUST NOT read static cloud credentials, access keys, or ambient IAM secrets from environment variables or persistent storage. - Workload identities MUST be attested against Linux cgroups (e.g., /sys/fs/cgroup) to guarantee unforgeable kernel-level process boundary identification. - Applications MUST establish an active streaming watcher on the SPIFFE Workload API to dynamically reload ephemeral X.509-SVIDs before certificate expiration without restarting the host process. - Services MUST validate peer SPIFFE IDs on all incoming and outgoing mTLS connections against a strictly defined Trust Domain and expected SPIFFE ID regex/pattern. - All TLS configurations MUST reject connections that fail to present a valid X.509-SVID anchored in the local SPIFFE Trust Bundle. ## Bad vs Good Implementations ### SPIFFE Workload API Client Attestation and Dynamic mTLS Context #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Loads static certificates and relies on long-lived cloud IAM credentials passed via environment variables. It lacks dynamic rotation, does not use kernel cgroup attestation, and creates a critical vulnerability if credentials leak or certificates expire. ```typescript import https from 'https'; import fs from 'fs'; // ANTI-PATTERN: Relying on static certs from filesystem and long-lived cloud keys const staticCa = fs.readFileSync('/etc/ssl/certs/internal-ca.crt'); const staticCert = fs.readFileSync('/etc/ssl/certs/workload.crt'); const staticKey = fs.readFileSync('/etc/ssl/certs/workload.key'); const cloudSecret = process.env.AWS_SECRET_ACCESS_KEY; export function createSecureAgent(): https.Agent { if (!cloudSecret) { throw new Error('Missing AWS credentials'); } return new https.Agent({ ca: staticCa, cert: staticCert, key: staticKey, rejectUnauthorized: true, }); } ``` #### Production Standard (Correct) > **Standard**: Connects to the SPIRE Agent UNIX socket, which asserts the workload's cgroup boundary via kernel metadata. It listens to real-time SVID stream rotations, ensures strict TLS 1.3 settings, validates the SPIFFE Trust Domain, and eliminates all static secrets. ```typescript import tls from 'tls'; import { WorkloadApiClient } from '@spiffe/spiffe-sdk'; // PRODUCTION INVARIANT: Ephemeral SVID fetch via SPIFFE Agent UNIX socket (cgroup-attested) const SPIRE_SOCKET_PATH = 'unix:///tmp/spire-agent/public/api.sock'; const EXPECTED_TRUST_DOMAIN = 'prod.acme.internal'; export class SpiffeTlsProvider { private client: WorkloadApiClient; private currentTlsContext: tls.SecureContext | null = null; constructor() { this.client = new WorkloadApiClient({ spiffeSocketPath: SPIRE_SOCKET_PATH, }); } public async initialize(): Promise<void> { // Watch X.509 SVID stream; SPIRE Agent verifies caller's cgroup automatically const stream = await this.client.watchX509Context(); stream.on('data', (x509Context) => { const defaultSvid = x509Context.defaultSvid; if (!defaultSvid.id.trustDomain.is(EXPECTED_TRUST_DOMAIN)) { throw new Error(`Untrusted SPIFFE Trust Domain: ${defaultSvid.id.trustDomain.value}`); } // Hot-reload TLS SecureContext on rotation events this.currentTlsContext = tls.createSecureContext({ cert: defaultSvid.certificates, key: defaultSvid.privateKey, ca: x509Context.bundles.get(EXPECTED_TRUST_DOMAIN)?.certificates, minVersion: 'TLSv1.3', }); }); stream.on('error', (err) => { throw new Error(`SPIFFE Workload API stream error: ${err.message}`); }); } public getSecureContext(): tls.SecureContext { if (!this.currentTlsContext) { throw new Error('SPIFFE TLS Context not ready or not attested'); } return this.currentTlsContext; } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Mandatory SPIFFE/SPIRE Ephemeral X.509 SVID Attestation via Kernel cgroups

Mandatory SPIFFE/SPIRE Ephemeral X.509 SVID Attestation via Kernel cgroups defines an industrial-grade behavioral standard for security engineering. Completely eliminates static cloud IAM credentials and static TLS certificates across microservices by mandating ephemeral X.509 SVID issuance via the SPIFFE Workload API. Enforces kernel-level workload attestation bound strictly to Linux cgroup identifiers and requires active stream watching for seamless, zero-downtime mTLS certificate rotation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Injecting Static Cloud IAM Tokens or Hardcoding X.509 Certificates Instead of Dynamic SPIFFE cgroup Attestation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Injecting Static Cloud IAM Tokens or Hardcoding X.509 Certificates Instead of Dynamic SPIFFE cgroup Attestation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST interact directly with the local SPIRE Agent via the standardized UNIX domain socket (default

Services MUST interact directly with the local SPIRE Agent via the standardized UNIX domain socket (default: unix:///tmp/spire-agent/public/api.sock).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.