{"id":"967827d8-5a3e-40d4-870f-aa29c608deb5","task":"Stand up SPIRE server and agents to issue X.509-SVIDs for automatic mTLS between two services","domain":"spiffe.io","steps":["Deploy a SPIRE Server as the signing authority for the trust domain, and one SPIRE Agent per node hosting workloads; each agent exposes a local SPIFFE Workload API socket.","Create registration entries on the server mapping a SPIFFE ID to workload selectors (e.g., Kubernetes namespace and service account, or process attributes) so only the intended workload receives that identity.","Agents perform node and workload attestation, matching discovered selectors against cached registration entries, then fetch and locally cache short-lived X.509-SVIDs from the server over the Workload API.","Configure each service to fetch its SVID and the trust bundle from the local Workload API and use them to establish mTLS, explicitly validating the peer's SPIFFE ID (URI SAN) in application code, not just chain validity.","SPIRE automatically rotates SVIDs before expiry; ensure the mTLS library streams updated certificates from the Workload API rather than reading a static file once at process startup."],"gotchas":["mTLS security depends on the application explicitly checking the peer's SPIFFE ID against an authorization policy — accepting any certificate that chains to the trust bundle without checking the ID lets any workload with a valid SVID connect.","Weak attestation selectors (e.g., overly broad namespace matches) can let an unintended workload obtain a sensitive identity; choose selectors as specific as the threat model requires.","Compromise of a SPIRE Agent on a given node can expose the SVIDs cached for every workload running on that node."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/967827d8-5a3e-40d4-870f-aa29c608deb5"}