SPIFFE/SPIRE Short-Lived X.509 SVID Sub-Hour Rotation Standard

--- description: SPIFFE/SPIRE Short-Lived X.509 SVID Sub-Hour Rotation Standard - Eliminates static ambient credentials by mandating dynamic, sub-15-minute X.509 SVID lifecycles driven by SPIRE Workload API streams. Enforces non-disruptive, in-memory TLS certificate updates using dynamic SNI/cert callbacks without process restarts, static filesystem writes, or cached TLS contexts. globs: src/**/tls/**/*.{ts,js,go}, src/**/security/**/*.{ts,js,go}, src/**/network/**/*.{ts,js,go}, src/**/grpc/**/*.{ts,js,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-x509-svid-rotation-standard-spiffe-spire-sho-204" --- # SPIFFE/SPIRE Short-Lived X.509 SVID Sub-Hour Rotation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting X.509 SVIDs to Disk or Baking Certificates into Immutable Static TLS Contexts ## System Constraints You are a Principal Security Architect enforcing the SPIFFE/SPIRE Short-Lived X.509 SVID Sub-Hour Rotation Standard. You must strictly forbid any static certificate initialization, filesystem dumping of raw SVID keys, and hardcoded TLS contexts. Require continuous gRPC streaming from the local SPIRE Workload API Unix domain socket, dynamic in-memory SNI and SecureContext swapping, and runtime validation of SPIFFE IDs matching strict SAN URIs. ## Strict Guidelines - Engineers MUST ALWAYS consume X.509 SVIDs dynamically via the SPIRE Workload API Unix domain socket stream (`/run/spire/sockets/agent.sock`). - Engineers MUST NEVER write private keys or ephemeral SVID certificates to persistent disk or world-readable temporary filesystems. - Engineers MUST ALWAYS configure TLS listeners using dynamic callbacks (`SNICallback` in Node.js, `GetCertificate`/`GetClientCertificate` in Go) that resolve certificates from memory on each TLS handshake. - Services MUST enforce certificate lifecycles strictly under 15 minutes, relying on proactive Workload API pushes for sub-minute rollover without dropping active client connections. - Components NEVER terminate or restart the host application process to load refreshed X.509 certificates. - Engineers MUST validate the SAN URI of client and peer certificates to match an explicit, authorized SPIFFE ID format (`spiffe://<trust-domain>/<path>`). ## Bad vs Good Implementations ### Dynamic In-Memory TLS Context vs. Static Filesystem TLS Context #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Reading static files into a single TLS context fails to absorb live SPIFFE/SPIRE certificate rotations. When short-lived certificates expire (sub-15 minutes), the server starts rejecting incoming mTLS handshakes until manually restarted. ```typescript import * as https from 'node:https'; import * as fs from 'node:fs'; // ANTI-PATTERN: Loading certificates once from disk at boot time. // When SPIRE rotates certificates in the background, this context stays stale, // resulting in downtime after the 10-15 minute SVID validity window expires. const staticTlsOptions: https.ServerOptions = { key: fs.readFileSync('/tmp/svid.key'), cert: fs.readFileSync('/tmp/svid.crt'), ca: fs.readFileSync('/tmp/bundle.crt'), requestCert: true, rejectUnauthorized: true }; export const server = https.createServer(staticTlsOptions, (req, res) => { res.writeHead(200); res.end('Authenticated via static certificate'); }); ``` #### Production Standard (Correct) > **Standard**: Uses Node.js `SNICallback` to fetch the current `SecureContext` directly from memory during each TLS handshake. When the SPIRE client updates the SVID, the server immediately and seamlessly serves the newly rotated certificate without downtime or dropped sockets. ```typescript import * as tls from 'node:tls'; import * as https from 'node:https'; interface SpiffeX509Svid { certChain: string; privateKey: string; bundle: string; spiffeId: string; } class DynamicTlsManager { private currentContext: tls.SecureContext | null = null; public updateSvid(svid: SpiffeX509Svid): void { // Dynamically regenerate in-memory SecureContext upon Workload API stream update this.currentContext = tls.createSecureContext({ cert: svid.certChain, key: svid.privateKey, ca: svid.bundle }); } public getSNICallback(): (servername: string, cb: (err: Error | null, ctx?: tls.SecureContext) => void) => void { return (_servername, cb) => { if (!this.currentContext) { return cb(new Error('SPIFFE X.509 SVID context not yet initialized')); } // Non-disruptive, returns newest in-memory context for every handshake return cb(null, this.currentContext); }; } } export const tlsManager = new DynamicTlsManager(); export const server = https.createServer({ SNICallback: tlsManager.getSNICallback(), requestCert: true, rejectUnauthorized: true }, (req, res) => { res.writeHead(200); res.end('Authenticated via dynamically rotated SVID'); }); ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIFFE/SPIRE Short-Lived X.509 SVID Sub-Hour Rotation Standard

SPIFFE/SPIRE Short-Lived X.509 SVID Sub-Hour Rotation Standard defines an industrial-grade behavioral standard for security engineering. Eliminates static ambient credentials by mandating dynamic, sub-15-minute X.509 SVID lifecycles driven by SPIRE Workload API streams. Enforces non-disruptive, in-memory TLS certificate updates using dynamic SNI/cert callbacks without process restarts, static filesystem writes, or cached TLS contexts. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting X.509 SVIDs to Disk or Baking Certificates into Immutable Static TLS Contexts Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting X.509 SVIDs to Disk or Baking Certificates into Immutable Static TLS Contexts	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS consume X.509 SVIDs dynamically via the SPIRE Workload API Unix domain socket stream (`/run/spire/sockets/agent.sock`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.