Kernel-Attested SPIFFE/SPIRE Workload Identity and Dynamic mTLS Invariant

--- description: Kernel-Attested SPIFFE/SPIRE Workload Identity and Dynamic mTLS Invariant - Mandates the complete elimination of static infrastructure secrets and disk-mounted private keys in favor of short-lived, ephemeral X.509 SVIDs sourced via the SPIFFE Workload API. SPIRE agents bind identities directly to kernel-attested process primitives (UID, GID, cgroups, container IDs), requiring dynamic in-memory credential rotation and explicit SPIFFE ID SAN validation for all zero-trust service communication. globs: src/**/*.{ts,tsx,js}, pkg/**/*.{go}, config/**/*.{yaml,json} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-workload-mtls-attestation-invariant" --- # Kernel-Attested SPIFFE/SPIRE Workload Identity and Dynamic mTLS Invariant > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Bypassing Kernel Attestation Using Static Long-Lived TLS Certificates or File-Mounted Secrets ## System Constraints You are a Principal Security Architect and Rules Author enforcing kernel-level workload attestation and zero-trust mTLS using SPIFFE/SPIRE. You must strictly forbid the persistence, loading, or configuration of static credentials, disk-mounted TLS certificates, or long-lived service account tokens for internal service calls. Require all networking clients and servers to consume dynamic, in-memory X.509 SVIDs streamed directly over the SPIFFE Workload API UNIX Domain Socket, validating peer URI SAN SPIFFE identities on every connection. ## Strict Guidelines - Engineers MUST ALWAYS fetch X.509 SVIDs and trust bundles via the SPIFFE Workload API over a secure local UNIX domain socket (e.g., 'unix:///run/spire/sockets/agent.sock'). - Engineers MUST NOT write SVID private keys to persistent disk, Kubernetes Secrets, or retrieve them via environment variables. - Services MUST continuously stream and rotate X.509 SVIDs and CA trust bundles in-memory without service disruption, process restarts, or connection drops. - Code SHOULD validate peer SPIFFE IDs explicitly against expected trust domains and structural patterns in the TLS peer certificate's URI Subject Alternative Name (SAN). - Components NEVER configure TLS handshakes with 'rejectUnauthorized: false' or bypass kernel-level peer attestation. ## Bad vs Good Implementations ### Node.js TLS/HTTPS Client: Static Disk-Based Cert vs. SPIFFE Workload API Watcher #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Reading static TLS certificates from the filesystem violates zero-trust principles. The credentials are not tied to runtime process attributes, cannot be rotated dynamically without restarting, and present an immediate risk if container storage is inspected or compromised. ```typescript import fs from 'node:fs'; import https from 'node:https'; // ANTI-PATTERN: Loading long-lived certificates from disk or static secrets. // Lacks kernel attestation, risks key leakage, and requires manual rotation/restarts. const agent = new https.Agent({ cert: fs.readFileSync('/etc/tls/client.crt'), key: fs.readFileSync('/etc/tls/client.key'), ca: fs.readFileSync('/etc/tls/ca.crt'), rejectUnauthorized: true, }); export async function callService(path: string): Promise<void> { https.get(`https://payment-service.internal:8443${path}`, { agent }, (res) => { res.on('data', (d) => process.stdout.write(d)); }); } ``` #### Production Standard (Correct) > **Standard**: Identities are dynamic, short-lived X.509 SVIDs fetched in-memory through the local SPIFFE Workload API UNIX socket. Process identity is attested by the kernel (cgroups/UID), and the TLS client strictly verifies the peer's URI SAN against the target SPIFFE ID. ```typescript import tls from 'node:tls'; import https from 'node:https'; import { createWorkloadClient, X509Source } from '@spiffe/spiffe-sdk'; // PRODUCTION INVARIANT: Short-lived SVIDs fetched via kernel-attested UNIX Domain Socket. const workloadSocketPath = process.env.SPIFFE_ENDPOINT_SOCKET || 'unix:///run/spire/sockets/agent.sock'; let x509Source: X509Source; async function initSpiffeSource(): Promise<X509Source> { if (!x509Source) { const client = await createWorkloadClient({ spiffeSocketUrl: workloadSocketPath, }); x509Source = await client.createX509Source(); } return x509Source; } export async function getAttestedAgent(): Promise<https.Agent> { const source = await initSpiffeSource(); const svid = await source.getX509Svid(); const trustBundle = await source.getX509Bundle(); return new https.Agent({ cert: svid.certBuffer, key: svid.privateKeyBuffer, ca: trustBundle.caBuffer, rejectUnauthorized: true, checkServerIdentity: (hostname, cert) => { // Enforce strict URI SAN verification matching target SPIFFE ID const expectedSpiffeId = 'spiffe://acme.org/ns/prod/sa/payment-service'; const san = cert.subjectaltname || ''; const uriSans = san.split(', ').filter((s) => s.startsWith('URI:')); const matches = uriSans.some((s) => s.replace('URI:', '') === expectedSpiffeId); if (!matches) { const err = new Error(`Peer SPIFFE ID mismatch. Expected ${expectedSpiffeId}, got: ${san}`); return err; } return undefined; }, }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Kernel-Attested SPIFFE/SPIRE Workload Identity and Dynamic mTLS Invariant

Kernel-Attested SPIFFE/SPIRE Workload Identity and Dynamic mTLS Invariant defines an industrial-grade behavioral standard for security engineering. Mandates the complete elimination of static infrastructure secrets and disk-mounted private keys in favor of short-lived, ephemeral X.509 SVIDs sourced via the SPIFFE Workload API. SPIRE agents bind identities directly to kernel-attested process primitives (UID, GID, cgroups, container IDs), requiring dynamic in-memory credential rotation and explicit SPIFFE ID SAN validation for all zero-trust service communication. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Kernel Attestation Using Static Long-Lived TLS Certificates or File-Mounted Secrets Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Kernel Attestation Using Static Long-Lived TLS Certificates or File-Mounted Secrets	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS fetch X.509 SVIDs and trust bundles via the SPIFFE Workload API over a secure local UNIX domain socket (e.g., 'unix

Engineers MUST ALWAYS fetch X.509 SVIDs and trust bundles via the SPIFFE Workload API over a secure local UNIX domain socket (e.g., 'unix:///run/spire/sockets/agent.sock').

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.