SPIFFE/SPIRE In-Memory X.509 SVID Continuous Rotation Fence

--- description: SPIFFE/SPIRE In-Memory X.509 SVID Continuous Rotation Fence - Mandates dynamic, memory-only consumption of sub-hour ephemeral X.509 SVIDs via the SPIFFE Workload API Unix Domain Socket (UDS). Prohibits writing private keys or certificates to persistent storage, preventing credential leakage in zero-trust mesh architectures. Enforces real-time TLS SecureContext hot-swapping without connection termination or process restarts. globs: src/**/*.{ts,js,mjs}, server/**/*.{ts,js,mjs}, pkg/**/*.{go}, deploy/**/*.{yaml,yml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-x509-svid-continuous-rotation" --- # SPIFFE/SPIRE In-Memory X.509 SVID Continuous Rotation Fence > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting SVID Private Keys to Disk or Initializing Static, Non-Rotating TLS Contexts ## System Constraints You are a Principal Security Architect enforcing the SPIFFE/SPIRE Workload Identity Ephemeral X.509 SVID Continuous Rotation Fence. You must strictly mandate that all inter-service communications obtain their cryptographic identity via the SPIFFE Workload API over a secure Unix Domain Socket (UDS). SVID private keys must NEVER touch physical or virtual disk (no temp files, no logs, no environment variables). SVIDs must be ephemeral (TTL < 60 minutes) and renewed continuously via streaming WatchX509Context APIs. TLS contexts must be dynamically reloaded in-memory via secure context swapping without dropping active TCP connections. ## Strict Guidelines - Services MUST communicate with the local SPIRE Agent exclusively via Unix Domain Sockets (e.g., `unix:///run/spire/sockets/agent.sock`). - Services MUST NEVER write X.509 SVID certificates, intermediate bundles, or private keys to disk or ephemeral filesystems (e.g., `/tmp`). - Cryptographic keys and SVID payloads MUST reside strictly in volatile memory and be cleared or overwritten upon rotation. - Workload identities MUST be requested with short time-to-live (sub-hour TTL, recommended 10–30 minutes) to eliminate reliance on static revocation lists (CRLs). - TLS servers and clients MUST implement hot-swappable in-memory context updates (e.g., `tls.SecureContext` replacement or dynamic SNI callbacks) triggered by SPIFFE Workload API streaming events. - Services MUST strictly validate peer SPIFFE IDs against an explicit authorization policy using SPIFFE ID pattern matching or exact URI SAN verification, rejecting generic DNS SAN assertions. ## Bad vs Good Implementations ### Dynamic In-Memory X.509 SVID Rotation vs. Static File-Based TLS Context #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Reading SVIDs from disk exposes private keys to node storage, sidecar file inspection, and container layer leaks. Using static options causes cryptographic outage when ephemeral sub-hour SVIDs expire, as `tls.createServer` does not automatically reload certificates from filesystem changes. ```typescript import * as tls from 'node:tls'; import * as fs from 'node:fs'; // ANTI-PATTERN: Reading static certs from disk with no rotation capability const staticOptions: tls.TlsOptions = { cert: fs.readFileSync('/var/run/secrets/spiffe/svid.crt'), key: fs.readFileSync('/var/run/secrets/spiffe/svid.key'), ca: fs.readFileSync('/var/run/secrets/spiffe/bundle.crt'), requestCert: true, rejectUnauthorized: true }; export const server = tls.createServer(staticOptions, (socket) => { // Anti-Pattern: Will fail when cert expires in < 1 hour without full process restart console.log('Secure client connected'); }); server.listen(8443); ``` #### Production Standard (Correct) > **Standard**: Subscribes directly to the SPIFFE Workload API stream over UDS. SVIDs and private keys remain exclusively in memory. The TLS server leverages `SNICallback` to supply the continuously updated `tls.SecureContext`, allowing non-disruptive sub-hour cryptographic rotation and explicit SPIFFE ID SAN validation. ```typescript import * as tls from 'node:tls'; import { EventEmitter } from 'node:events'; interface X509SVID { certPem: string; keyPem: string; bundlePem: string; spiffeId: string; } // Mock client representing the SPIFFE Workload API UDS stream class WorkloadApiClient extends EventEmitter { public watchX509Context(): void { // Stream updates from unix:///run/spire/sockets/agent.sock } } export class DynamicSpiffeServer { private currentContext: tls.SecureContext | null = null; private expectedSpiffeIdPrefix = 'spiffe://example.org/ns/production/sa/'; constructor(private readonly client: WorkloadApiClient) { this.client.on('svid_update', (svid: X509SVID) => this.onSvidUpdate(svid)); } private onSvidUpdate(svid: X509SVID): void { // Memory-only SecureContext compilation without persisting private keys to disk this.currentContext = tls.createSecureContext({ cert: svid.certPem, key: svid.keyPem, ca: svid.bundlePem, minVersion: 'TLSv1.3' }); } public createServer(): tls.Server { return tls.createServer({ requestCert: true, rejectUnauthorized: true, SNICallback: (_servername, cb) => { if (!this.currentContext) { return cb(new Error('SPIFFE SVID not yet acquired from agent socket'), undefined); } cb(null, this.currentContext); } }, (socket: tls.TLSSocket) => { const peerCert = socket.getPeerCertificate(true); const uriSans = peerCert.subjectaltname?.split(', ').filter(s => s.startsWith('URI:')) ?? []; const peerSpiffeId = uriSans[0]?.replace('URI:', ''); if (!peerSpiffeId || !peerSpiffeId.startsWith(this.expectedSpiffeIdPrefix)) { socket.destroy(new Error(`Unauthorized SPIFFE ID: ${peerSpiffeId}`)); } }); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIFFE/SPIRE In-Memory X.509 SVID Continuous Rotation Fence

SPIFFE/SPIRE In-Memory X.509 SVID Continuous Rotation Fence defines an industrial-grade behavioral standard for security engineering. Mandates dynamic, memory-only consumption of sub-hour ephemeral X.509 SVIDs via the SPIFFE Workload API Unix Domain Socket (UDS). Prohibits writing private keys or certificates to persistent storage, preventing credential leakage in zero-trust mesh architectures. Enforces real-time TLS SecureContext hot-swapping without connection termination or process restarts. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting SVID Private Keys to Disk or Initializing Static, Non-Rotating TLS Contexts Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting SVID Private Keys to Disk or Initializing Static, Non-Rotating TLS Contexts	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST communicate with the local SPIRE Agent exclusively via Unix Domain Sockets (e.g., `unix

Services MUST communicate with the local SPIRE Agent exclusively via Unix Domain Sockets (e.g., `unix:///run/spire/sockets/agent.sock`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.