SPIFFE/SPIRE Ephemeral X.509 SVID Sub-Minute Micro-Rotation Standard

--- description: SPIFFE/SPIRE Ephemeral X.509 SVID Sub-Minute Micro-Rotation Standard - Enforces dynamic, continuous Workload API streaming for sub-minute X.509 SVID rotation across zero-trust mTLS channels. Eliminates static credential theft and stale connection failures by mandating dynamic TLS contexts driven by SPIRE Agent Unix Domain Sockets rather than disk-cached certificates. Guarantees zero-downtime certificate hot-reloading with deterministic SPIFFE ID peer SAN validation. globs: src/security/**/*.{ts,js,go}, src/transport/**/*.{ts,js,go}, src/network/**/*.{ts,js,go}, src/infra/**/*.{ts,js,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-x509-svid-micro-rotation-standard" --- # SPIFFE/SPIRE Ephemeral X.509 SVID Sub-Minute Micro-Rotation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Static Initialization and In-Memory Caching of Ephemeral SPIFFE X.509 SVIDs ## System Constraints You are a Principal Security Architect enforcing the SPIFFE/SPIRE Ephemeral X.509 SVID Sub-Minute Micro-Rotation Standard. Workload identity certificates in this environment possess aggressive, sub-minute TTLs (typically 30 to 60 seconds) to mitigate credential exfiltration. You must strictly prevent any code pattern that caches TLS credentials across connections, writes SVID keys to persistent storage, or initializes TLS contexts once at process startup. Mandate streaming SPIFFE Workload API integrations over Unix Domain Sockets, atomic hot-swapping of in-memory TLS contexts, and strict SPIFFE ID SAN verification. ## Strict Guidelines - Engineers MUST ALWAYS stream X.509 SVID updates dynamically from the local SPIRE Agent via Unix Domain Socket (UDS) using the SPIFFE Workload API. - Engineers MUST NOT cache TLS SecureContext, certificate buffers, or private keys across connection boundaries without an atomic reference update mechanism. - Services MUST implement atomic dynamic TLS context providers (e.g., dynamic SNICallback/secureContext in Node.js or GetCertificate/GetClientCertificate in Go) to guarantee zero-downtime micro-rotation. - Components NEVER persist ephemeral SVID private keys or X.509 certificates to disk, environment variables, or distributed config stores. - Services MUST validate the peer's SPIFFE ID extracted from the SAN (Subject Alternative Name) URI against an explicit trust domain and authorized workload path policy. - Engineers MUST configure exponential backoff and continuous reconnect loops for the SPIRE Agent Workload API watcher to tolerate transient agent restarts without dropping active connections. ## Bad vs Good Implementations ### Dynamic SPIFFE SVID Watcher with Atomic Context Swap vs Static Init #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Reading SVIDs statically at startup or from disk storage fails catastrophically when SVIDs rotate every 30-60 seconds. Connections will fail immediately upon expiration, and keys on disk risk exfiltration. ```typescript import * as tls from 'node:tls'; import * as fs from 'node:fs'; // ANTI-PATTERN: Loading certificates once at startup from disk or static API response. // With sub-minute (e.g., 30s) SPIRE SVIDs, this server will begin rejecting // connections or fail handshakes within 60 seconds due to certificate expiration. const staticKey = fs.readFileSync('/var/run/secrets/spire/svid.key'); const staticCert = fs.readFileSync('/var/run/secrets/spire/svid.crt'); const staticBundle = fs.readFileSync('/var/run/secrets/spire/bundle.crt'); export const insecureServer = tls.createServer({ key: staticKey, cert: staticCert, ca: [staticBundle], requestCert: true, rejectUnauthorized: true, }, (socket) => { // Flawed: Peer identity validation is missing or relies on static DN console.log('Client connected with static context'); }); insecureServer.listen(8443); ``` #### Production Standard (Correct) > **Standard**: Implements dynamic atomic SecureContext replacement driven by Workload API rotation events. The server evaluates fresh contexts per handshake without dropping connections or saving private keys to persistent storage. ```typescript import * as tls from 'node:tls'; import { EventEmitter } from 'node:events'; interface SpiffeX509Svid { spiffeId: string; certChainPem: string; privateKeyPem: string; bundlePem: string; } // Active watcher maintaining atomic TLS context updates from SPIFFE Workload API export class DynamicSpiffeTlsManager extends EventEmitter { private currentContext: tls.SecureContext | null = null; private activeSpiffeId: string | null = null; private expectedTrustDomain: string; constructor(trustDomain: string) { super(); this.expectedTrustDomain = trustDomain; } public updateSvid(svid: SpiffeX509Svid): void { // Validate trust domain before applying if (!svid.spiffeId.startsWith(`spiffe://${this.expectedTrustDomain}/`)) { throw new Error(`Untrusted SPIFFE ID trust domain: ${svid.spiffeId}`); } // Atomically create new SecureContext; in-flight handshakes finish cleanly this.currentContext = tls.createSecureContext({ key: svid.privateKeyPem, cert: svid.certChainPem, ca: [svid.bundlePem], }); this.activeSpiffeId = svid.spiffeId; this.emit('rotated', svid.spiffeId); } public getSecureContext(): tls.SecureContext { if (!this.currentContext) { throw new Error('SPIFFE SVID not yet acquired from Workload API'); } return this.currentContext; } public verifyPeerSpiffeId(cert: tls.PeerCertificate, allowedPathPrefix: string): boolean { const uriSans = cert.subjectaltname ?.split(',') .map((s) => s.trim()) .filter((s) => s.startsWith('URI:')) .map((s) => s.substring(4)) ?? []; const expectedPrefix = `spiffe://${this.expectedTrustDomain}/${allowedPathPrefix}`; return uriSans.some((uri) => uri.startsWith(expectedPrefix)); } } // Usage with SNICallback / dynamic context switching export function createZeroTrustServer(manager: DynamicSpiffeTlsManager): tls.Server { return tls.createServer({ SNICallback: (_servername, cb) => { try { cb(null, manager.getSecureContext()); } catch (err) { cb(err as Error); } }, requestCert: true, rejectUnauthorized: true, }, (socket) => { const peerCert = socket.getPeerCertificate(true); if (!manager.verifyPeerSpiffeId(peerCert, 'workloads/authorized-client')) { socket.destroy(new Error('Unauthorized SPIFFE ID identity')); } }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIFFE/SPIRE Ephemeral X.509 SVID Sub-Minute Micro-Rotation Standard

SPIFFE/SPIRE Ephemeral X.509 SVID Sub-Minute Micro-Rotation Standard defines an industrial-grade behavioral standard for security engineering. Enforces dynamic, continuous Workload API streaming for sub-minute X.509 SVID rotation across zero-trust mTLS channels. Eliminates static credential theft and stale connection failures by mandating dynamic TLS contexts driven by SPIRE Agent Unix Domain Sockets rather than disk-cached certificates. Guarantees zero-downtime certificate hot-reloading with deterministic SPIFFE ID peer SAN validation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Static Initialization and In-Memory Caching of Ephemeral SPIFFE X.509 SVIDs Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Static Initialization and In-Memory Caching of Ephemeral SPIFFE X.509 SVIDs	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS stream X.509 SVID updates dynamically from the local SPIRE Agent via Unix Domain Socket (UDS) using the SPIFFE Workload API.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.