SPIFFE/SPIRE Ephemeral X.509 SVID Inter-Cluster Zero-Trust Attestation

--- description: SPIFFE/SPIRE Ephemeral X.509 SVID Inter-Cluster Zero-Trust Attestation - Mandates continuous ephemeral X.509 SVID issuance and verification via the SPIFFE Workload API, eliminating static long-lived credentials across multi-cloud meshes. Enforces non-blocking dynamic mTLS certificate reloads in memory and rejects permissive or wildcard SAN verification in favor of explicit federated SPIFFE ID validation. globs: **/transport/**, **/tls/**, **/security/**, **/auth/**, **/*spiffe*, **/*mtls*, **/*client*.go, **/*server*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-ephemeral-svid-attestation" --- # SPIFFE/SPIRE Ephemeral X.509 SVID Inter-Cluster Zero-Trust Attestation > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Bypassing SPIFFE Workload API with Long-Lived Static Certificates or Permissive TLS SAN Validation ## System Constraints You are a Principal Security Architect enforcing SPIFFE/SPIRE ephemeral X.509 SVID inter-cluster zero-trust attestation. You must reject any hardcoded certificates, file-based static keys, environment variable tokens, and permissive TLS validation schemes. Mandate dynamic integration with the SPIFFE Workload API over a secure Unix Domain Socket, ensuring zero persistent secrets and cryptographic federated trust domain authorization. ## Strict Guidelines - Workloads MUST retrieve X.509 SVIDs and federated trust bundles strictly in-memory via the SPIFFE Workload API over a local Unix Domain Socket (UDS). - Engineers MUST NOT persist X.509 private keys to non-volatile disks, shared volumes, or environment variables. - mTLS connections MUST utilize dynamic X.509 sources that automatically rotate certificates before expiration without restarting the process. - Clients and servers MUST enforce explicit SPIFFE ID authorization (e.g., spiffe://trust-domain/workload) or trust-domain membership verification; wildcard DNS matching or InsecureSkipVerify MUST NEVER be permitted. - Inter-cluster federated trust MUST validate the remote peer's trust domain using bundle federation provided by SPIRE, rather than public CA hierarchies or pre-shared roots. - Workload callers MUST gracefully handle transient SPIFFE Workload API reconnects without terminating in-flight connections or falling back to unauthenticated channels. ## Bad vs Good Implementations ### SPIFFE/SPIRE Workload API Dynamic mTLS vs Static Disk Certificates #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Loads static certificates from the local disk that require external rotation or pod restarts, while disabling TLS verification. Bypasses cryptographic attestation, allows spoofing of remote identities, and risks key compromise from persistent storage leakage. ```go package transport import ( "crypto/tls" "net/http" ) // ANTI-PATTERN: Loading long-lived certificates from disk with static TLS config // and disabling or bypassing explicit SPIFFE ID subject alternative name checks. func NewHTTPClient() (*http.Client, error) { cert, err := tls.LoadX509KeyPair("/var/run/secrets/tls.crt", "/var/run/secrets/tls.key") if err != nil { return nil, err } tlsConfig := &tls.Config{ Certificates: []tls.Certificate{cert}, InsecureSkipVerify: true, // Fatal: Completely bypasses remote attestation and trust verification } return &http.Client{ Transport: &http.Transport{TLSClientConfig: tlsConfig}, }, nil } ``` #### Production Standard (Correct) > **Standard**: Establishes zero-trust identity dynamically via the local SPIRE agent Workload API over a Unix Domain Socket. The X509Source rotates ephemeral certificates in-memory without downtime and authorizes the remote peer strictly against its cryptographically verified SPIFFE ID. ```go package transport import ( "context" "net/http" "github.com/spiffe/go-spiffe/v2/spiffeid" "github.com/spiffe/go-spiffe/v2/spiffetls/tlsconfig" "github.com/spiffe/go-spiffe/v2/workloadapi" ) // PRODUCTION INVARIANT: Fetch dynamic X.509 SVID in-memory via SPIRE Workload API // with non-blocking rotation and explicit federated SPIFFE ID peer authorization. func NewSecureSPIFFEClient(ctx context.Context, serverID spiffeid.ID) (*http.Client, func() error, error) { // Connect to local SPIRE agent Workload API socket source, err := workloadapi.NewX509Source(ctx, workloadapi.WithClientOptions( workloadapi.WithAddress("unix:///run/spire/sockets/agent.sock"), )) if err != nil { return nil, nil, err } // Configure mTLS client with dynamic rotation and strict SPIFFE ID SAN validation tlsConfig := tlsconfig.MTLSClientConfig( source, source, tlsconfig.AuthorizeID(serverID), ) client := &http.Client{ Transport: &http.Transport{ TLSClientConfig: tlsConfig, }, } return client, source.Close, nil } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIFFE/SPIRE Ephemeral X.509 SVID Inter-Cluster Zero-Trust Attestation

SPIFFE/SPIRE Ephemeral X.509 SVID Inter-Cluster Zero-Trust Attestation defines an industrial-grade behavioral standard for security engineering. Mandates continuous ephemeral X.509 SVID issuance and verification via the SPIFFE Workload API, eliminating static long-lived credentials across multi-cloud meshes. Enforces non-blocking dynamic mTLS certificate reloads in memory and rejects permissive or wildcard SAN verification in favor of explicit federated SPIFFE ID validation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing SPIFFE Workload API with Long-Lived Static Certificates or Permissive TLS SAN Validation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing SPIFFE Workload API with Long-Lived Static Certificates or Permissive TLS SAN Validation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Workloads MUST retrieve X.509 SVIDs and federated trust bundles strictly in-memory via the SPIFFE Workload API over a local Unix Domain Socket (UDS).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.