chore: move ClusterPromotion code out

Dockerfile

@@ -8,9 +8,10 @@ WORKDIR /workspace
 # Copy the Go Modules manifests
 COPY go.mod go.mod
 COPY go.sum go.sum
-# cache deps before building and copying source so that we don't need to re-download as much
-# and so that source changes don't invalidate our downloaded layer
-RUN go mod download
+# Deps are downloaded as part of the build step below, not in a separate "go mod download"
+# layer: go.mod lists the private sveltos-enterprise module (needed only for `-tags
+# enterprise` builds), and unlike `go build`, bare `go mod download` is not build-tag-aware
+# and would eagerly try to resolve it even for this default (non-enterprise) build.
 
 # Copy the go source
 COPY cmd/main.go cmd/main.go

Dockerfile.enterprise

@@ -0,0 +1,52 @@
+# syntax=docker/dockerfile:1.4
+
+# Build the manager binary (Enterprise build - links in the private sveltos-enterprise module)
+FROM golang:1.26.5 AS builder
+
+ARG BUILDOS
+ARG TARGETARCH
+
+WORKDIR /workspace
+# Copy the Go Modules manifests
+COPY go.mod go.mod
+COPY go.sum go.sum
+
+# github.com/projectsveltos/sveltos-enterprise is a private module. Unlike the default
+# Dockerfile, this build always needs it (it's the enterprise variant), so it's fetched here
+# via git over SSH, authenticated with a key forwarded from the host through BuildKit's ssh
+# mount (see Makefile's docker-buildx target: --ssh default=<path-to-key>).
+RUN git config --global url."git@github.com:".insteadOf "https://github.com/" && \
+    mkdir -p -m 0700 /root/.ssh && ssh-keyscan github.com >> /root/.ssh/known_hosts
+RUN --mount=type=ssh GOPRIVATE=github.com/projectsveltos/sveltos-enterprise go mod download
+
+# Copy the go source
+COPY cmd/main.go cmd/main.go
+COPY api/ api/
+COPY lib/ lib/
+COPY controllers/ controllers/
+COPY pkg/ pkg/
+COPY internal/ internal/
+
+# Build
+RUN CGO_ENABLED=0 GOOS=$BUILDOS GOARCH=$TARGETARCH go build -tags enterprise -a -o manager cmd/main.go
+
+# Use distroless as minimal base image to package the manager binary
+# Refer to https://github.com/GoogleContainerTools/distroless for more details
+FROM gcr.io/distroless/static:nonroot
+
+ARG GIT_VERSION=unknown
+
+LABEL org.opencontainers.image.source="https://github.com/projectsveltos/addon-controller" \
+      org.opencontainers.image.url="https://projectsveltos.io" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.vendor="projectsveltos" \
+      org.opencontainers.image.title="addon-controller" \
+      org.opencontainers.image.description="Deploys Kubernetes add-ons and applications (Helm charts, Kustomize, raw YAML) across fleets of clusters, with built-in multi-tenancy support." \
+      org.opencontainers.image.version="$GIT_VERSION" \
+      org.opencontainers.image.revision="$GIT_VERSION"
+
+WORKDIR /
+COPY --from=builder /workspace/manager .
+USER 65532:65532
+
+ENTRYPOINT ["/manager"]

Dockerfile_WithGit

@@ -8,9 +8,10 @@ WORKDIR /workspace
 # Copy the Go Modules manifests
 COPY go.mod go.mod
 COPY go.sum go.sum
-# cache deps before building and copying source so that we don't need to re-download as much
-# and so that source changes don't invalidate our downloaded layer
-RUN go mod download
+# Deps are downloaded as part of the build step below, not in a separate "go mod download"
+# layer: go.mod lists the private sveltos-enterprise module (needed only for `-tags
+# enterprise` builds), and unlike `go build`, bare `go mod download` is not build-tag-aware
+# and would eagerly try to resolve it even for this default (non-enterprise) build.
 
 # Copy the go source
 COPY cmd/main.go cmd/main.go

Dockerfile_WithGit.enterprise

@@ -0,0 +1,52 @@
+# syntax=docker/dockerfile:1.4
+
+# Build the manager binary (Enterprise build - links in the private sveltos-enterprise module)
+FROM golang:1.26.5 AS builder
+
+ARG BUILDOS
+ARG TARGETARCH
+
+WORKDIR /workspace
+# Copy the Go Modules manifests
+COPY go.mod go.mod
+COPY go.sum go.sum
+
+# github.com/projectsveltos/sveltos-enterprise is a private module. Unlike the default
+# Dockerfile, this build always needs it (it's the enterprise variant), so it's fetched here
+# via git over SSH, authenticated with a key forwarded from the host through BuildKit's ssh
+# mount (see Makefile's docker-buildx target: --ssh default=<path-to-key>).
+RUN git config --global url."git@github.com:".insteadOf "https://github.com/" && \
+    mkdir -p -m 0700 /root/.ssh && ssh-keyscan github.com >> /root/.ssh/known_hosts
+RUN --mount=type=ssh GOPRIVATE=github.com/projectsveltos/sveltos-enterprise go mod download
+
+# Copy the go source
+COPY cmd/main.go cmd/main.go
+COPY api/ api/
+COPY lib/ lib/
+COPY controllers/ controllers/
+COPY pkg/ pkg/
+COPY internal/ internal/
+
+# Build
+RUN CGO_ENABLED=0 GOOS=$BUILDOS GOARCH=$TARGETARCH go build -tags enterprise -a -o manager cmd/main.go
+
+# This is needed to support kustomization that points to a oci/git repo that utilizes remote kustomization references.
+FROM alpine
+
+ARG GIT_VERSION=unknown
+
+LABEL org.opencontainers.image.source="https://github.com/projectsveltos/addon-controller" \
+      org.opencontainers.image.url="https://projectsveltos.io" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.vendor="projectsveltos" \
+      org.opencontainers.image.title="addon-controller" \
+      org.opencontainers.image.description="Deploys Kubernetes add-ons and applications (Helm charts, Kustomize, raw YAML) across fleets of clusters, with built-in multi-tenancy support. This variant bundles git for Kustomize remote-reference support." \
+      org.opencontainers.image.version="$GIT_VERSION" \
+      org.opencontainers.image.revision="$GIT_VERSION"
+
+RUN apk add --no-cache git
+WORKDIR /
+COPY --from=builder /workspace/manager .
+USER 65532:65532
+
+ENTRYPOINT ["/manager"]

Makefile

@@ -36,6 +36,11 @@ K8S_LATEST_VER ?= $(shell curl -s https://dl.k8s.io/release/stable.txt)
 export CONTROLLER_IMG ?= $(REGISTRY)/$(IMAGE_NAME)
 TAG ?= v1.13.0
 
+# SSH key with read access to the private github.com/projectsveltos/sveltos-enterprise repo,
+# forwarded into the enterprise docker-buildx build (see Dockerfile.enterprise) so it can
+# fetch that module. Override with e.g. `make docker-buildx SVELTOS_ENTERPRISE_SSH_KEY=~/.ssh/other_key`.
+SVELTOS_ENTERPRISE_SSH_KEY ?= $(HOME)/.ssh/id_ed25519
+
 .PHONY: all
 all: build
 
@@ -542,9 +547,9 @@ docker-push: ## Push docker image with the manager.
 	docker push $(CONTROLLER_IMG):$(TAG)
 
 .PHONY: docker-buildx
-docker-buildx: ## docker build for multiple arch and push to docker hub
-	docker buildx build --push --platform linux/amd64,linux/arm64 --build-arg GIT_VERSION=$(TAG) -t $(CONTROLLER_IMG):$(TAG) .
-	docker buildx build --push --platform linux/amd64,linux/arm64 --build-arg GIT_VERSION=$(TAG) -t $(CONTROLLER_IMG)-git:$(TAG) -f Dockerfile_WithGit .
+docker-buildx: ## docker build for multiple arch and push to docker hub (enterprise build - requires SSH access to sveltos-enterprise)
+	docker buildx build --push --platform linux/amd64,linux/arm64 --ssh default=$(SVELTOS_ENTERPRISE_SSH_KEY) --build-arg GIT_VERSION=$(TAG) -t $(CONTROLLER_IMG):$(TAG) -f Dockerfile.enterprise .
+	docker buildx build --push --platform linux/amd64,linux/arm64 --ssh default=$(SVELTOS_ENTERPRISE_SSH_KEY) --build-arg GIT_VERSION=$(TAG) -t $(CONTROLLER_IMG)-git:$(TAG) -f Dockerfile_WithGit.enterprise .
 
 .PHONY: load-image
 load-image: docker-build $(KIND)