SPIFFE/SPIRE Ephemeral X.509 SVID Attestation Lifecycle Standard

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Persisting Workload Credentials to Disk or Using Long-Lived Static TLS Pairs Instead of In-Memory Dynamic SVID Streams) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

SPIFFE/SPIRE Ephemeral X.509 SVID Attestation Lifecycle Standard

--- description: SPIFFE/SPIRE Ephemeral X.509 SVID Attestation Lifecycle Standard - Enforces sub-one-hour ephemeral X.509 SVID lifecycles and continuous kernel-level attestation via the local SPIRE Workload API over UNIX domain sockets. Guarantees that cryptographic private keys remain in-memory only and that dynamic TLS configurations automatically rotate identities prior to expiry to eliminate exfiltration windows and lateral movement. globs: **/*.go, src/**/*.ts, deploy/**/*.yaml, charts/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-ephemeral-x509-svid-lifecycle-standard" --- # SPIFFE/SPIRE Ephemeral X.509 SVID Attestation Lifecycle Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting Workload Credentials to Disk or Using Long-Lived Static TLS Pairs Instead of In-Memory Dynamic SVID Streams ## System Constraints You are a Principal Security Architect enforcing the SPIFFE/SPIRE Ephemeral X.509 SVID Attestation Lifecycle Standard. Workload identities must be kernel-attested, non-persisted to disk, bounded to a maximum lifetime of 60 minutes (with rotation occurring at 50% lifetime), and managed exclusively via the Workload API dynamic streams. Reject any pattern caching X.509 private keys to non-volatile storage or accepting static certificate configurations for inter-service communication. ## Strict Guidelines - Services MUST communicate with the SPIRE Workload API exclusively over an authenticated local UNIX domain socket (UDS) using kernel attestation (e.g., cgroup, PID, UID/GID verification). - Workload SVID lifetimes MUST be configured with a maximum time-to-live (TTL) of 60 minutes or less; rotation MUST occur dynamically at 50% of the active certificate's lifecycle. - Engineers MUST NOT persist SVID X.509 private keys or certificates to non-volatile disk storage, shared volumes, or environment variables. - mTLS client and server configurations MUST consume dynamic X.509 source streams (e.g., `workloadapi.X509Source`) that reload cryptographic material without process restarts. - SPIFFE ID authorization MUST strictly validate the expected Trust Domain and specific Workload Path via exact match or trusted SPIFFE ID authorizers rather than relying on wildcard SAN matches. - Services MUST NEVER accept arbitrary root CA bundles for mTLS peer verification; CA trust bundles MUST be sourced dynamically from the SPIRE Workload API bundle stream. ## Bad vs Good Implementations ### Dynamic SPIFFE X.509 SVID Source vs Static File Loading #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Loads static certificates directly from non-volatile disk mounts. This bypasses kernel-level attestation, leaves long-lived private keys vulnerable to disk-scraping attacks, and fails to rotate ephemeral credentials dynamically. ```go package main import ( "crypto/tls" "net/http" "time" ) func startMTLSServer() error { // ANTI-PATTERN: Reading static certificates dumped to disk with long TTLs (>24h). // If the disk volume is inspected or keys are leaked, revoked identities remain valid. // Certificate expiry requires manual restart or static file polling without kernel attestation. crtPath := "/var/run/secrets/tls/tls.crt" keyPath := "/var/run/secrets/tls/tls.key" cer, err := tls.LoadX509KeyPair(crtPath, keyPath) if err != nil { return err } tlsConfig := &tls.Config{ Certificates: []tls.Certificate{cer}, ClientAuth: tls.RequireAndVerifyClientCert, } server := &http.Server{ Addr: ":8443", TLSConfig: tlsConfig, ReadTimeout: 5 * time.Second, WriteTimeout: 10 * time.Second, } return server.ListenAndServeTLS("", "") } ``` #### Production Standard (Correct) > **Standard**: Implements the go-spiffe v2 Workload API using a UNIX domain socket. Private keys remain strictly in-memory, SVID rotation is non-disruptive, kernel-level peer attestation is maintained, and authorization is bounded to an explicit SPIFFE ID. ```go package main import ( "context" "net/http" "time" "github.com/spiffe/go-spiffe/v2/spiffeid" "github.com/spiffe/go-spiffe/v2/spiffetls/tlsconfig" "github.com/spiffe/go-spiffe/v2/workloadapi" ) func startMTLSServer(ctx context.Context) error { // PRODUCTION INVARIANT: Connect to SPIRE Agent via UDS with kernel attestation. // SVIDs are kept strictly in-memory and automatically rotated (< 1hr TTL). source, err := workloadapi.NewX509Source(ctx, workloadapi.WithClientOptions( workloadapi.WithAddress("unix:///run/spire/sockets/agent.sock"), )) if err != nil { return err } defer source.Close() // Authorize only specific callers within the trusted SPIFFE domain allowedClientID := spiffeid.RequireMust("example.org", "backend", "order-processor") authorizer := tlsconfig.AuthorizeID(allowedClientID) // Dynamic TLS config automatically updates active keys and trust bundles tlsConfig := tlsconfig.MTLSServerConfig(source, source, authorizer) server := &http.Server{ Addr: ":8443", TLSConfig: tlsConfig, ReadTimeout: 5 * time.Second, WriteTimeout: 10 * time.Second, } return server.ListenAndServeTLS("", "") } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIFFE/SPIRE Ephemeral X.509 SVID Attestation Lifecycle Standard

SPIFFE/SPIRE Ephemeral X.509 SVID Attestation Lifecycle Standard defines an industrial-grade behavioral standard for security engineering. Enforces sub-one-hour ephemeral X.509 SVID lifecycles and continuous kernel-level attestation via the local SPIRE Workload API over UNIX domain sockets. Guarantees that cryptographic private keys remain in-memory only and that dynamic TLS configurations automatically rotate identities prior to expiry to eliminate exfiltration windows and lateral movement. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting Workload Credentials to Disk or Using Long-Lived Static TLS Pairs Instead of In-Memory Dynamic SVID Streams Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting Workload Credentials to Disk or Using Long-Lived Static TLS Pairs Instead of In-Memory Dynamic SVID Streams	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST communicate with the SPIRE Workload API exclusively over an authenticated local UNIX domain socket (UDS) using kernel attestation (e.g., cgroup, PID, UID/GID verification).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.