SPIFFE/SPIRE Dynamic X.509 SVID Workload Identity & Multi-Cloud Federation Guardrail

--- description: SPIFFE/SPIRE Dynamic X.509 SVID Workload Identity & Multi-Cloud Federation Guardrail - Enforces dynamic, short-lived X.509 SVID issuance and automated rotation via the SPIFFE Workload API over a secure Unix Domain Socket (UDS). Prohibits long-lived static API tokens, disk-persisted credentials, and manual CA synchronization across heterogeneous multi-cloud Kubernetes clusters by mandating in-memory rotation and cryptographically verified SPIFFE Trust Domain Federation. globs: src/**/*.{ts,tsx,js,jsx}, pkg/**/*.go, cmd/**/*.go, deployments/**/*.yaml, helm/**/*.yaml, k8s/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-workload-identity-federation-standard" --- # SPIFFE/SPIRE Dynamic X.509 SVID Workload Identity & Multi-Cloud Federation Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Bypassing SPIFFE Workload API with Long-Lived Static Secrets, File-Persisted Certificates, or Missing In-Memory SVID Watchers ## System Constraints You are a Principal Security Architect enforcing the SPIFFE/SPIRE Zero-Trust Workload Identity Federation Standard. Mandate that all workload authentication across multi-cloud Kubernetes clusters consumes dynamic X.509 SVIDs or JWT-SVIDs directly from the local SPIRE Agent Unix Domain Socket via the Workload API. Reject any architecture or code snippet relying on static API keys, Kubernetes Secret-mounted certificates without automated in-memory rotation handlers, hardcoded trust domain certificates, or unverified cross-cluster identities. ## Strict Guidelines - Workloads MUST ALWAYS communicate with the SPIRE Agent exclusively via the local Unix Domain Socket (e.g., 'unix:///run/spire/sockets/agent.sock') over the standard SPIFFE Workload API. - Engineers MUST NEVER write SVID private keys or X.509 leaf certificates to persistent storage, local disk, ConfigMaps, or Kubernetes Secrets. - Application clients and servers MUST implement an in-memory dynamic X509Source watcher (or equivalent SPIFFE Workload API client loop) that automatically updates active TLS configurations upon SVID rotation without process restarts. - Services communicating cross-cluster or cross-cloud MUST validate peer SPIFFE IDs against explicit Trust Domain profiles using SPIFFE Federation bundles rather than relying on global public CAs or untrusted self-signed root certificates. - Engineers MUST NOT disable TLS peer verification ('InsecureSkipVerify: true' or equivalent) when validating mTLS connections mediated by SPIFFE. - Kubernetes Pod specs MUST mount the SPIRE Agent socket directory as a read-only or dedicated hostPath/CSI volume and define strict SPIRE selector annotations without granted privileged host access. ## Bad vs Good Implementations ### Cross-Cluster Workload Client Authentication #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Loads static TLS assets from the filesystem without an active rotation loop. Fails to validate target SPIFFE IDs, cannot handle automatic SVID renewal by SPIRE, and relies on brittle, long-lived Kubernetes Secret distribution across clusters. ```typescript import https from 'https'; import fs from 'fs'; import axios from 'axios'; // ANTI-PATTERN: Reading static, long-lived certificates from disk or mounted k8s secrets // If the certificate expires, the container must be restarted. No SPIFFE validation is performed. const httpsAgent = new https.Agent({ cert: fs.readFileSync('/etc/secrets/tls.crt'), key: fs.readFileSync('/etc/secrets/tls.key'), ca: fs.readFileSync('/etc/secrets/ca.crt'), rejectUnauthorized: true }); export async function callRemoteService(url: string, data: unknown) { return axios.post(url, data, { httpsAgent }); } ``` #### Production Standard (Correct) > **Standard**: Uses the SPIFFE Workload API via the Unix Domain Socket with an in-memory X509Source. Handles continuous cryptographic rotation transparently and strictly enforces peer SPIFFE ID authorization across federated trust domains. ```typescript import { WorkloadApiClient, X509Source } from '@spiffe/spiffe-node'; import https from 'https'; import axios from 'axios'; // PRODUCTION INVARIANT: Connect to the SPIRE Agent UDS and maintain dynamic in-memory SVID rotation let x509Source: X509Source | null = null; async function getOrCreateSource(): Promise<X509Source> { if (!x509Source) { const client = new WorkloadApiClient({ spiffeSocketPath: process.env.SPIFFE_ENDPOINT_SOCKET ?? 'unix:///run/spire/sockets/agent.sock' }); // Automatically streams updates and rotates in-memory certificates before expiration x509Source = await client.createX509Source(); } return x509Source; } export async function callRemoteService(url: string, expectedSpiffeId: string, data: unknown) { const source = await getOrCreateSource(); const svid = await source.getX509Svid(); const bundle = await source.getX509Bundle(); const httpsAgent = new https.Agent({ cert: svid.certBuffer, key: svid.keyBuffer, ca: bundle.caBuffer, checkServerIdentity: (_host, cert) => { // Enforce strict Trust Domain and Workload identity assertion const uriSans = cert.subjectaltname?.split(', ').filter(s => s.startsWith('URI:spiffe://')) ?? []; if (!uriSans.includes(`URI:${expectedSpiffeId}`)) { throw new Error(`Unauthorized peer identity: ${uriSans.join(', ')} does not match ${expectedSpiffeId}`); } return undefined; } }); return axios.post(url, data, { httpsAgent }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIFFE/SPIRE Dynamic X.509 SVID Workload Identity & Multi-Cloud Federation Guardrail

SPIFFE/SPIRE Dynamic X.509 SVID Workload Identity & Multi-Cloud Federation Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces dynamic, short-lived X.509 SVID issuance and automated rotation via the SPIFFE Workload API over a secure Unix Domain Socket (UDS). Prohibits long-lived static API tokens, disk-persisted credentials, and manual CA synchronization across heterogeneous multi-cloud Kubernetes clusters by mandating in-memory rotation and cryptographically verified SPIFFE Trust Domain Federation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing SPIFFE Workload API with Long-Lived Static Secrets, File-Persisted Certificates, or Missing In-Memory SVID Watchers Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing SPIFFE Workload API with Long-Lived Static Secrets, File-Persisted Certificates, or Missing In-Memory SVID Watchers	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Workloads MUST ALWAYS communicate with the SPIRE Agent exclusively via the local Unix Domain Socket (e.g., 'unix

Workloads MUST ALWAYS communicate with the SPIRE Agent exclusively via the local Unix Domain Socket (e.g., 'unix:///run/spire/sockets/agent.sock') over the standard SPIFFE Workload API.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.