SPIFFE/SPIRE Microsegmentation X.509 SVID Auto-Rotation Standard

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Persisting Long-Lived Static Certificates to Disk or Failing to Dynamically Reload Expiring X.509 SVIDs) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

SPIFFE/SPIRE Microsegmentation X.509 SVID Auto-Rotation Standard

--- description: SPIFFE/SPIRE Microsegmentation X.509 SVID Auto-Rotation Standard - Enforces sub-hour automated cryptographic identity rotation for containerized services across multi-cloud meshes via the SPIFFE Workload API. Eliminates long-lived TLS certificates and static credentials by mandating streaming in-memory mTLS credential renewal without process restarts or disk-persisted private keys. globs: src/**/*.{ts,tsx,js,jsx}, pkg/**/*.{go}, deploy/**/*.{yaml,yml}, configs/**/*.{yaml,yml,json} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-x509-svid-autorotation-standard" --- # SPIFFE/SPIRE Microsegmentation X.509 SVID Auto-Rotation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting Long-Lived Static Certificates to Disk or Failing to Dynamically Reload Expiring X.509 SVIDs ## System Constraints You are a Principal Security Architect enforcing the SPIFFE/SPIRE Microsegmentation X.509 SVID Auto-Rotation Standard. You must strictly forbid static mTLS certificates, disk-based private key persistence, and manual certificate reloads. Ensure all network services consume identities dynamically via the SPIFFE Workload API over a Unix Domain Socket, rotating X.509 credentials with lifetimes <= 60 minutes in-memory before expiration. ## Strict Guidelines - Services MUST connect to the local SPIRE Agent Workload API over a secure Unix Domain Socket (spiffe://) rather than loading certificates from static disk paths. - Engineers MUST set X.509 SVID Time-to-Live (TTL) to 60 minutes or less, verifying that rotation triggers automatically at the halfway mark (<= 30 minutes). - Network layers MUST implement non-disruptive, in-memory TLS context reloading via SPIFFE Workload API event watchers, eliminating container restarts during credential renewal. - Private keys MUST NEVER be written to non-volatile storage, mounted ConfigMaps, or Kubernetes Secrets; ephemeral in-memory buffers MUST be zeroed out when superseded. - Workload identity validation MUST verify SPIFFE IDs explicitly against expected trust domains and workload paths during peer certificate verification in mTLS handshakes. ## Bad vs Good Implementations ### Dynamic SPIFFE X.509 SVID In-Memory Rotation vs Static Disk Certificate Loading #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Reading static certificates and private keys from the filesystem creates a static secret compromise vector, fails sub-hour rotation requirements, and requires container restarts or disk-watch pollers to update expired credentials. ```typescript import tls from 'node:tls'; import fs from 'node:fs'; // ANTI-PATTERN: Loading long-lived certificates from disk mounts. // If the certificate expires, the service fails or requires a pod restart. // Static private keys persisted on disk risk node-compromise exfiltration. export function createMtlsServer() { const serverOptions: tls.TlsOptions = { key: fs.readFileSync('/etc/certs/tls.key'), cert: fs.readFileSync('/etc/certs/tls.crt'), ca: fs.readFileSync('/etc/certs/ca.crt'), requestCert: true, rejectUnauthorized: true }; return tls.createServer(serverOptions, (socket) => { socket.write('Secure connection established'); }); } ``` #### Production Standard (Correct) > **Standard**: Consumes X.509 SVIDs via streaming SPIFFE Workload API over a Unix Domain Socket, rotating credentials dynamically in memory using SNICallback context resolution without writing keys to disk or restarting the process. ```typescript import tls from 'node:tls'; import net from 'node:net'; import { EventEmitter } from 'node:events'; interface X509SVID { spiffeId: string; certChain: Buffer; privateKey: Buffer; bundle: Buffer; } export class SpiffeWorkloadWatcher extends EventEmitter { private currentContext: tls.SecureContext | null = null; private readonly socketPath: string; constructor(socketPath = process.env.SPIFFE_ENDPOINT_SOCKET || '/spire-agent-socket/spire-agent.sock') { super(); this.socketPath = socketPath; } public async start(): Promise<void> { // Stream updates directly from SPIRE Agent Workload API (gRPC/UDS connection) await this.watchX509SVID((svid: X509SVID) => { this.currentContext = tls.createSecureContext({ cert: svid.certChain, key: svid.privateKey, ca: svid.bundle, minVersion: 'TLSv1.3' }); this.emit('rotated', svid.spiffeId); }); } public getSecureContext(): tls.SecureContext { if (!this.currentContext) { throw new Error('X.509 SVID context not yet acquired from SPIFFE Workload API'); } return this.currentContext; } private async watchX509SVID(onUpdate: (svid: X509SVID) => void): Promise<void> { // Implementation consumes grpc client streaming from SPIRE Agent Workload API // Automatically rotates X.509 SVIDs every <= 30 minutes in memory. } } export function createZeroTrustMtlsServer(watcher: SpiffeWorkloadWatcher) { const server = tls.createServer({ SNICallback: (_servername, cb) => { // Dynamically resolves current in-memory rotated TLS context without restart cb(null, watcher.getSecureContext()); }, requestCert: true, rejectUnauthorized: true, checkServerIdentity: (host, cert) => { const sanSpiffe = cert.subjectaltname?.split(', ').find(s => s.startsWith('URI:spiffe://')); if (!sanSpiffe || !sanSpiffe.startsWith('URI:spiffe://prod.mesh.internal/ns/workloads/')) { return new Error('Peer SPIFFE ID does not match microsegmentation trust policy'); } return undefined; } }); return server; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIFFE/SPIRE Microsegmentation X.509 SVID Auto-Rotation Standard

SPIFFE/SPIRE Microsegmentation X.509 SVID Auto-Rotation Standard defines an industrial-grade behavioral standard for security engineering. Enforces sub-hour automated cryptographic identity rotation for containerized services across multi-cloud meshes via the SPIFFE Workload API. Eliminates long-lived TLS certificates and static credentials by mandating streaming in-memory mTLS credential renewal without process restarts or disk-persisted private keys. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting Long-Lived Static Certificates to Disk or Failing to Dynamically Reload Expiring X.509 SVIDs Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting Long-Lived Static Certificates to Disk or Failing to Dynamically Reload Expiring X.509 SVIDs	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST connect to the local SPIRE Agent Workload API over a secure Unix Domain Socket (spiffe

Services MUST connect to the local SPIRE Agent Workload API over a secure Unix Domain Socket (spiffe://) rather than loading certificates from static disk paths.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.