SPIFFE/SPIRE Dynamic mTLS Workload Identity Attestation Guardrail

--- description: SPIFFE/SPIRE Dynamic mTLS Workload Identity Attestation Guardrail - Eliminates long-lived static credentials, baked-in certificates, and persistent tokens across hybrid cloud services by enforcing dynamic workload attestation via the local SPIRE Agent Workload API. Demands zero-trust mutual TLS (mTLS) with automated short-lived X.509 SVID rotation and deterministic SPIFFE ID authorization at kernel-attested process boundaries. globs: src/**/*.{ts,tsx,js}, services/**/*.{ts,js,go}, infra/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-dynamic-mtls-workload-attestation" --- # SPIFFE/SPIRE Dynamic mTLS Workload Identity Attestation Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting Long-Lived Static Private Keys and Bypassing SPIRE Workload Attestation Sockets ## System Constraints You are a Principal Security Architect enforcing the SPIFFE/SPIRE Dynamic mTLS Workload Identity Attestation Guardrail. You must prohibit long-lived static secrets, disk-persisted credentials, and hardcoded trust stores. Require workloads to dynamically obtain ephemeral X.509 SVIDs and federated trust bundles directly from the local SPIRE Agent UNIX domain socket. Ensure streaming SVID rotation without process restart, and enforce strict SAN URI validation matching expected SPIFFE IDs across all service-to-service communication. ## Strict Guidelines - Services MUST NOT read static private keys or long-lived certificates from disk, environment variables, or config volumes. - Workloads MUST connect to the local SPIRE Agent Workload API over a secure UNIX domain socket (default: unix:///tmp/spire-agent/public/api.sock). - Services MUST subscribe to real-time X.509 SVID rotation streams and update their in-memory TLS SecureContext without terminating connections or restarting processes. - Engineers MUST explicitly authorize peer SPIFFE IDs during TLS handshake verification by checking the SAN URI against an exact trust domain and workload path pattern. - Services MUST configure automated fallback backoff and circuit-breaking when the Workload API socket becomes temporarily unavailable. - Infrastructure configurations MUST enable kernel-level attestation (e.g., k8s-bundle, docker-cgroup, or unix-uid/gid) in SPIRE Agent registration entries instead of static token attestation. ## Bad vs Good Implementations ### Dynamic SPIRE Workload API X.509 SVID Stream vs Static Disk Certificates #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Loads static, long-lived certificates from disk without kernel-level attestation. Certificates cannot rotate dynamically without dropping traffic or restarting the process, and peer identity is not strictly bound to verified SPIFFE IDs. ```typescript import * as https from 'https'; import * as fs from 'fs'; // ANTI-PATTERN: Baking long-lived static certificates and private keys // Bypasses workload attestation and requires process restarts for credential rotation const serverOptions: https.ServerOptions = { key: fs.readFileSync('/etc/ssl/certs/service-key.pem'), cert: fs.readFileSync('/etc/ssl/certs/service-cert.pem'), ca: fs.readFileSync('/etc/ssl/certs/ca-bundle.pem'), requestCert: true, rejectUnauthorized: true }; export const server = https.createServer(serverOptions, (req, res) => { res.writeHead(200); res.end('Authenticated with static cert'); }); ``` #### Production Standard (Correct) > **Standard**: Connects directly to the SPIRE Agent UNIX domain socket for kernel-level attestation. Automatically streams rotated ephemeral X.509 SVIDs into an in-memory SecureContext via SNICallback without restarting the server, and explicitly validates the peer SPIFFE ID SAN URI during the mTLS handshake. ```typescript import * as https from 'https'; import * as tls from 'tls'; import { WorkloadApiClient } from '@spiffe/spiffe-client'; const EXPECTED_CLIENT_SPIFFE_ID = 'spiffe://acme.internal/ns/prod/sa/order-service'; let activeSecureContext: tls.SecureContext | null = null; // Establish dynamic X.509 SVID watcher via SPIRE Workload API UNIX Domain Socket const spiffeClient = new WorkloadApiClient({ spiffeSocketPath: 'unix:///tmp/spire-agent/public/api.sock' }); async function initializeSpireTls(): Promise<https.Server> { // Continuously listen for attested short-lived SVID rotations spiffeClient.watchX509Context({ onX509Context: (x509Context) => { const defaultSvid = x509Context.defaultSvid; const trustBundle = x509Context.bundle; activeSecureContext = tls.createSecureContext({ cert: defaultSvid.cert, key: defaultSvid.privateKey, ca: trustBundle.x509Authorities, ciphers: 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384', minVersion: 'TLSv1.3' }); }, onError: (err) => { console.error('Critical: SPIRE Workload API attestation error:', err); } }); const server = https.createServer({ SNICallback: (_hostname, cb) => { if (!activeSecureContext) { return cb(new Error('SVID not yet attested by SPIRE'), null); } cb(null, activeSecureContext); }, requestCert: true, rejectUnauthorized: true }, (req, res) => { const peerCert = (req.socket as tls.TLSSocket).getPeerCertificate(true); const sanUri = peerCert.subjectaltname?.split(', ').find(s => s.startsWith('URI:spiffe://')); const clientSpiffeId = sanUri ? sanUri.replace('URI:', '') : null; if (clientSpiffeId !== EXPECTED_CLIENT_SPIFFE_ID) { res.writeHead(403, { 'Content-Type': 'application/json' }); return res.end(JSON.stringify({ error: 'Unauthorized SPIFFE Workload Identity' })); } res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ status: 'Attested & Authorized via SPIFFE mTLS' })); }); return server; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIFFE/SPIRE Dynamic mTLS Workload Identity Attestation Guardrail

SPIFFE/SPIRE Dynamic mTLS Workload Identity Attestation Guardrail defines an industrial-grade behavioral standard for security engineering. Eliminates long-lived static credentials, baked-in certificates, and persistent tokens across hybrid cloud services by enforcing dynamic workload attestation via the local SPIRE Agent Workload API. Demands zero-trust mutual TLS (mTLS) with automated short-lived X.509 SVID rotation and deterministic SPIFFE ID authorization at kernel-attested process boundaries. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting Long-Lived Static Private Keys and Bypassing SPIRE Workload Attestation Sockets Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting Long-Lived Static Private Keys and Bypassing SPIRE Workload Attestation Sockets	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST NOT read static private keys or long-lived certificates from disk, environment variables, or config volumes.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.