fix(conformance): workload-mTLS certificates may use a private CA, if they prove they are workload-internal

R-TLS-01/docs/08 govern externally reachable TLS and ADR-0006 puts workload mTLS out of scope, but
tls-lifecycle-automated required ACME for every Certificate, which platform/buildkit's internal CA
cannot satisfy. Clause (5b) accepts the tls-scope=workload-mtls annotation only when the
certificate proves it: no Gateway serves it, internal names only, namespaced selfSigned/ca issuer
backed by an exempt CA certificate. Also fixes yamllint comma spacing in the buildkitd mounts.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/buildkit/certificates.yaml

@@ -14,6 +14,15 @@
 # tls.key from the Secret below into the repository secrets BUILDKIT_CA, BUILDKIT_CLIENT_CERT and
 # BUILDKIT_CLIENT_KEY without printing them. Re-run it after every renewal (see renewBefore).
 #
+# WHY A PRIVATE CA AND NOT LET'S ENCRYPT. The platform's TLS rule (R-TLS-01/02, docs/08,
+# ADR-0006: ACME DNS-01) is about EXTERNALLY REACHABLE services; ADR-0006 itself says "mTLS between
+# workloads is a separate concern … not covered here", and a public CA cannot issue for a
+# `*.svc.cluster.local` name or a client-auth certificate anyway. buildkitd is ClusterIP-only. Each
+# Certificate below is therefore annotated `homelab.keithjackson.dev/tls-scope: workload-mtls`,
+# which the L0 check tls-lifecycle-automated accepts ONLY if the certificate proves it: no
+# Gateway serves its Secret, every name is cluster-internal, and the issuer is a namespaced
+# selfSigned/CA Issuer whose CA is itself issued here. Issuance and renewal stay unattended.
+#
 # ROTATION. cert-manager renews both leaves `renewBefore` their expiry and rewrites the Secrets.
 #   * server: buildkitd reads its certificate at START, so the pod must restart inside the 30-day
 #     renewal window (a node reboot by kured, a Deployment rollout, or a manual restart).
@@ -32,6 +41,8 @@ kind: Certificate
 metadata:
   name: buildkit-ca
   namespace: buildkit
+  annotations:
+    homelab.keithjackson.dev/tls-scope: workload-mtls   # see the header: R-TLS-01 is about external TLS
 spec:
   isCA: true
   commonName: buildkit-ca
@@ -58,6 +69,8 @@ kind: Certificate
 metadata:
   name: buildkitd-tls
   namespace: buildkit
+  annotations:
+    homelab.keithjackson.dev/tls-scope: workload-mtls
 spec:
   secretName: buildkitd-tls
   commonName: buildkitd.buildkit.svc.cluster.local
@@ -83,6 +96,8 @@ kind: Certificate
 metadata:
   name: buildkit-client-ci
   namespace: buildkit
+  annotations:
+    homelab.keithjackson.dev/tls-scope: workload-mtls
 spec:
   secretName: buildkit-client-ci
   commonName: gitea-actions-image-pipeline

platform/buildkit/deployment.yaml

@@ -114,13 +114,13 @@ spec:
             limits:
               memory: 4Gi
           volumeMounts:
-            - { name: certs,   mountPath: /certs, readOnly: true }
-            - { name: config,  mountPath: /etc/buildkit, readOnly: true }
-            - { name: cache,   mountPath: /home/user/.local/share/buildkit }
-            - { name: run,     mountPath: /run/user }
-            - { name: tmpdir,  mountPath: /home/user/.local/tmp }   # the image's TMPDIR
-            - { name: tmp,     mountPath: /tmp }
-            - { name: clicfg,  mountPath: /home/user/.docker }      # buildctl (the probes) writes here
+            - { name: certs, mountPath: /certs, readOnly: true }
+            - { name: config, mountPath: /etc/buildkit, readOnly: true }
+            - { name: cache, mountPath: /home/user/.local/share/buildkit }
+            - { name: run, mountPath: /run/user }
+            - { name: tmpdir, mountPath: /home/user/.local/tmp }   # the image's TMPDIR
+            - { name: tmp, mountPath: /tmp }
+            - { name: clicfg, mountPath: /home/user/.docker }      # buildctl (the probes) writes here
       volumes:
         - name: certs
           secret: