feat: deploy operator in-cluster v0.1.1

- Dockerfile: fix golang 1.23→1.25, add internal/ + migrations/ to image
- deployments/k8s/operator.yaml: ConfigMap + Secret + Deployment + Service + Ingress
- Ingress: sless-api.kube5s.ru, TLS via cert-manager letsencrypt-prod
- naeel/sless-operator:v0.1.1 — running in namespace sless
- E2E: https://sless-api.kube5s.ru → HTTP/2 200

Dockerfile

@@ -1,33 +1,33 @@
-# Build the manager binary
-FROM golang:1.19 as builder
+# Изменено: 2026-03-07
+# Multi-stage build для sless оператора.
+# Stage 1: сборка бинаря (golang:1.23-alpine)
+# Stage 2: минимальный образ (alpine:3.19, не distroless — нужен ca-certificates для S3/HTTPS)
+FROM golang:1.25-alpine AS builder
 ARG TARGETOS
 ARG TARGETARCH
 
 WORKDIR /workspace
-# Copy the Go Modules manifests
 COPY go.mod go.mod
 COPY go.sum go.sum
-# cache deps before building and copying source so that we don't need to re-download as much
-# and so that source changes don't invalidate our downloaded layer
 RUN go mod download
 
-# Copy the go source
+# Копируем весь исходный код (включая internal/ — там основная логика)
 COPY main.go main.go
 COPY api/ api/
 COPY controllers/ controllers/
+COPY internal/ internal/
+COPY migrations/ migrations/
 
-# Build
-# the GOARCH has not a default value to allow the binary be built according to the host where the command
-# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
-# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
-# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
 RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager main.go
 
-# Use distroless as minimal base image to package the manager binary
-# Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot
+FROM alpine:3.19
+# ca-certificates нужны для TLS (S3 HTTPS, DockerHub)
+RUN apk add --no-cache ca-certificates
 WORKDIR /
 COPY --from=builder /workspace/manager .
+# migrations нужны при старте — оператор читает SQL файлы для инициализации БД
+COPY migrations/ migrations/
+# Запускаем от непривилегированного пользователя
 USER 65532:65532
 
 ENTRYPOINT ["/manager"]