Enforce Zero-Static-Secret In-Kernel SPIFFE/SPIRE Workload Identity Projection

Workloads must eliminate all static API tokens and long-lived cloud credentials by deriving cryptographically verifiable identities directly from ephemeral X.509 SVIDs projected into the runtime via kernel-managed CSI volume mounts or Unix domain sockets. Client architectures must continuously hot-reload projected credentials without pod restarts and strictly validate peer SPIFFE IDs against expected trust domains. Any fallback to static environment secrets, Kubernetes Secrets for auth tokens, or unrotated mTLS certificates breaks zero-trust non-repudiation invariants.

--- description: Enforce Zero-Static-Secret In-Kernel SPIFFE/SPIRE Workload Identity Projection - Workloads must eliminate all static API tokens and long-lived cloud credentials by deriving cryptographically verifiable identities directly from ephemeral X.509 SVIDs projected into the runtime via kernel-managed CSI volume mounts or Unix domain sockets. Client architectures must continuously hot-reload projected credentials without pod restarts and strictly validate peer SPIFFE IDs against expected trust domains. Any fallback to static environment secrets, Kubernetes Secrets for auth tokens, or unrotated mTLS certificates breaks zero-trust non-repudiation invariants. globs: deploy/**/*.yaml, k8s/**/*.yaml, src/**/*.{ts,tsx,js,mjs}, src/security/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-in-kernel-workload-identity-projection" --- # Enforce Zero-Static-Secret In-Kernel SPIFFE/SPIRE Workload Identity Projection > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting Static Service Credentials or Bypassing Projected Ephemeral SPIRE Workload Sockets ## System Constraints You are a Principal Security Architect enforcing zero-trust SPIFFE/SPIRE workload identity standards. You must strictly prevent the introduction of static service tokens, static API keys, and long-lived service account secrets. Enforce the consumption of short-lived X.509 and JWT SVIDs projected directly from SPIRE via kernel-level CSI mounts and Unix Domain Sockets (UDS). Ensure all mTLS handshakes validate peer SPIFFE IDs explicitly against authorized trust domains and that applications implement zero-downtime certificate rotation by reacting to in-kernel projected volume updates. ## Strict Guidelines - Engineers MUST ALWAYS authenticate workloads using ephemeral SPIFFE SVIDs delivered via SPIRE CSI kernel projections or the local Unix Domain Socket at /spiffe-workload-api/spire-agent.sock. - Engineers MUST NOT inject long-lived static tokens, API keys, or long-lived service account secrets via pod environment variables or raw Kubernetes Secret mounts. - Code MUST actively watch the projected SVID certificate files on disk or continuously listen to the SPIFFE Workload API stream to rotate in-memory TLS contexts prior to credential expiration. - Services MUST validate the peer SAN URI during mTLS negotiation against an explicit SPIFFE ID format: spiffe://<trust-domain>/ns/<namespace>/sa/<serviceaccount>. - Components NEVER fall back to unencrypted or unauthenticated transport if the SPIRE CSI projection or Workload API is temporarily unreachable; fail closed immediately. ## Bad vs Good Implementations ### Client Mutual-TLS Configuration with SPIFFE Projected SVID Rotation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Loads static secrets from an unmanaged file or environment variable at boot time with no certificate rotation handling. It omits SPIFFE ID validation on the peer certificate, allowing any valid certificate from the CA to impersonate downstream services. ```typescript import tls from 'node:tls'; import fs from 'node:fs'; // ANTI-PATTERN: Loading static secrets once into memory with no rotation logic // and performing standard hostname verification instead of SPIFFE SAN validation. const cert = fs.readFileSync(process.env.STATIC_CLIENT_CERT_PATH || '/etc/secrets/cert.pem'); const key = fs.readFileSync(process.env.STATIC_CLIENT_KEY_PATH || '/etc/secrets/key.pem'); const ca = fs.readFileSync(process.env.STATIC_CA_PATH || '/etc/secrets/ca.pem'); export function createSecureContext(): tls.SecureContext { return tls.createSecureContext({ cert, key, ca, minVersion: 'TLSv1.3' }); } ``` #### Production Standard (Correct) > **Standard**: Reads short-lived certificates projected into the container by the SPIRE CSI driver, watches the filesystem mount for automated atomic rotations, and provides deterministic verification for peer SPIFFE IDs matching strict trust boundaries. ```typescript import tls from 'node:tls'; import fs from 'node:fs'; import path from 'node:path'; const SPIFFE_DIR = '/run/spiffe/projected'; const CERT_PATH = path.join(SPIFFE_DIR, 'svid.pem'); const KEY_PATH = path.join(SPIFFE_DIR, 'svid.key'); const BUNDLE_PATH = path.join(SPIFFE_DIR, 'bundle.pem'); let activeContext: tls.SecureContext = reloadContext(); function reloadContext(): tls.SecureContext { return tls.createSecureContext({ cert: fs.readFileSync(CERT_PATH), key: fs.readFileSync(KEY_PATH), ca: fs.readFileSync(BUNDLE_PATH), minVersion: 'TLSv1.3' }); } // Watch in-kernel projected volume for atomic rotations by SPIRE Agent fs.watch(SPIFFE_DIR, (eventType, filename) => { if (filename === 'svid.pem' || filename === 'bundle.pem') { activeContext = reloadContext(); } }); export function verifySpiffePeer(cert: tls.PeerCertificate, expectedSpiffeId: string): boolean { const sanUri = cert.subjectaltname ?.split(',') .map(entry => entry.trim()) .find(entry => entry.startsWith('URI:spiffe://')) ?.replace('URI:', ''); return sanUri === expectedSpiffeId; } export function getSecureContext(): tls.SecureContext { return activeContext; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Enforce Zero-Static-Secret In-Kernel SPIFFE/SPIRE Workload Identity Projection

Enforce Zero-Static-Secret In-Kernel SPIFFE/SPIRE Workload Identity Projection defines an industrial-grade behavioral standard for security engineering. Workloads must eliminate all static API tokens and long-lived cloud credentials by deriving cryptographically verifiable identities directly from ephemeral X.509 SVIDs projected into the runtime via kernel-managed CSI volume mounts or Unix domain sockets. Client architectures must continuously hot-reload projected credentials without pod restarts and strictly validate peer SPIFFE IDs against expected trust domains. Any fallback to static environment secrets, Kubernetes Secrets for auth tokens, or unrotated mTLS certificates breaks zero-trust non-repudiation invariants. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting Static Service Credentials or Bypassing Projected Ephemeral SPIRE Workload Sockets Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting Static Service Credentials or Bypassing Projected Ephemeral SPIRE Workload Sockets	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS authenticate workloads using ephemeral SPIFFE SVIDs delivered via SPIRE CSI kernel projections or the local Unix Domain Socket at /spiffe-workload-api/spire-agent.sock.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.