SPIRE Dynamic Attestation Sub-Hour X.509 Ephemeral Rotation Boundary

--- description: SPIRE Dynamic Attestation Sub-Hour X.509 Ephemeral Rotation Boundary - Enforces sub-hour lifetime boundaries for SPIRE/SPIFFE X.509-SVIDs through dynamic kernel-level workload attestation. Workloads must consume ephemeral certificates via active SPIFFE Workload API streams or dynamic memory reloaders, strictly prohibiting static disk credentials, long-lived cert caching, or process restarts during leaf rotation. globs: src/security/**/*.{ts,js,go}, src/transport/**/*.{ts,js,go}, src/network/**/*.{ts,js,go}, src/infra/**/*.{ts,js,yaml,json}, **/*spiffe*/**/*.{ts,js,go}, **/*tls*/**/*.{ts,js,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spire-dynamic-attestation-subhour-rotation-boundary" --- # SPIRE Dynamic Attestation Sub-Hour X.509 Ephemeral Rotation Boundary > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting Static Certificates or Caching X.509-SVIDs Beyond Rotation Thresholds Without Dynamic In-Memory Stream Listeners ## System Constraints You are a Principal Security Architect and Systems Engineer enforcing SPIFFE/SPIRE dynamic workload attestation and ephemeral X.509 certificate rotations. You must reject any code that mounts static credentials, caches TLS contexts beyond the sub-hour boundary, relies on filesystem polling for certificate updates, or requires process restarts to pick up rotated leaf certificates. Mandate kernel-attested identity resolution via the SPIFFE Workload API with in-memory zero-downtime certificate rotation. ## Strict Guidelines - Services MUST interact directly with the SPIRE Workload API over a domain socket (`/run/spire/sockets/agent.sock`) to fetch X.509-SVIDs dynamically. - Engineers MUST configure X.509-SVID validity TTL to 60 minutes or less (sub-hour rotation boundary). - TLS connection contexts MUST use dynamic certificate reloaders (`sniCallback`, `spiffe-tls`, or in-memory keypair providers) that swap leaf certificates without terminating the running process or tearing down active connections. - Engineers MUST NOT persist X.509-SVID private keys or certificates to persistent disks, volumes, or environment variables. - Services MUST validate the peer's SPIFFE ID against an authoritative trust domain and expected workload identity format during mTLS handshakes, rejecting wildcards or unverified Subject Alternative Names (SANs). - Clients MUST maintain an active Workload API streaming subscription (`FetchX509SVID`) and update cryptographic material in memory proactively prior to certificate expiration. ## Bad vs Good Implementations ### Dynamic SPIFFE In-Memory mTLS vs Static Disk TLS Context #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Loads static certificates from disk into an immutable TLS context. When SPIRE rotates the X.509-SVID under the sub-hour boundary, the running process will continue serving stale/expired certificates, causing service degradation or requiring hard process restarts. ```typescript import * as tls from 'tls'; import * as fs from 'fs'; // ANTI-PATTERN: Loading long-lived certificates from static paths into an immutable TLS context const options: tls.SecureContextOptions = { key: fs.readFileSync('/etc/ssl/certs/workload.key'), cert: fs.readFileSync('/etc/ssl/certs/workload.crt'), ca: fs.readFileSync('/etc/ssl/certs/ca.crt'), rejectUnauthorized: true }; // Static context is never refreshed; requires process restart on renewal const staticContext = tls.createSecureContext(options); export function createAgent(): tls.Server { return tls.createServer({ ...options }); } ``` #### Production Standard (Correct) > **Standard**: Connects to the SPIRE agent Workload API via a dynamic UNIX domain socket stream. Listens for kernel-attested X.509-SVID rotations, updates the active TLS context dynamically in memory via SNICallback, and enforces strict SPIFFE ID SAN verification with zero downtime. ```typescript import * as tls from 'tls'; import { WorkloadApiClient } from '@spiffe/workload-api'; class DynamicTlsManager { private currentContext: tls.SecureContext | null = null; private spiffeClient: WorkloadApiClient; private readonly expectedTrustDomain = 'spiffe://prod.internal'; constructor(socketPath: string = 'unix:///run/spire/sockets/agent.sock') { this.spiffeClient = new WorkloadApiClient({ socketPath }); } public async initialize(): Promise<void> { // Stream updates directly from kernel-attested SPIRE agent const svidStream = await this.spiffeClient.watchX509Context(); svidStream.on('data', (x509Context) => { const defaultSvid = x509Context.defaultSvid; const bundle = x509Context.bundles.get(this.expectedTrustDomain); if (!defaultSvid || !bundle) { throw new Error('Kernel attestation returned incomplete SVID bundle'); } // Hot-swap in-memory TLS context without restarting process this.currentContext = tls.createSecureContext({ key: defaultSvid.privateKey, cert: defaultSvid.certificates, ca: bundle.certificates, rejectUnauthorized: true }); }); } public getSNICallback(): (servername: string, cb: (err: Error | null, ctx?: tls.SecureContext) => void) => void { return (_servername, cb) => { if (!this.currentContext) { return cb(new Error('Dynamic SPIRE TLS Context not yet attested')); } cb(null, this.currentContext); }; } } export async function createZeroDowntimeServer(manager: DynamicTlsManager): Promise<tls.Server> { await manager.initialize(); return tls.createServer({ SNICallback: manager.getSNICallback(), checkServerIdentity: (host, cert) => { const sanUri = cert.subjectaltname; if (!sanUri || !sanUri.startsWith('URI:spiffe://prod.internal/ns/workloads/')) { return new Error(`Invalid SPIFFE ID SAN: ${sanUri}`); } return undefined; } }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SPIRE Dynamic Attestation Sub-Hour X.509 Ephemeral Rotation Boundary

SPIRE Dynamic Attestation Sub-Hour X.509 Ephemeral Rotation Boundary defines an industrial-grade behavioral standard for security engineering. Enforces sub-hour lifetime boundaries for SPIRE/SPIFFE X.509-SVIDs through dynamic kernel-level workload attestation. Workloads must consume ephemeral certificates via active SPIFFE Workload API streams or dynamic memory reloaders, strictly prohibiting static disk credentials, long-lived cert caching, or process restarts during leaf rotation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting Static Certificates or Caching X.509-SVIDs Beyond Rotation Thresholds Without Dynamic In-Memory Stream Listeners Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting Static Certificates or Caching X.509-SVIDs Beyond Rotation Thresholds Without Dynamic In-Memory Stream Listeners	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST interact directly with the SPIRE Workload API over a domain socket (`/run/spire/sockets/agent.sock`) to fetch X.509-SVIDs dynamically.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.