feat: Implement automated database migration flow for PostgREST services

apps/operator/config/crd/bases/app.helios.io_heliosapps.yaml

@@ -101,9 +101,9 @@ spec:
                 description: ContextSubpath is the path where the Dockerfile is located
                 type: string
               databaseSecretRef:
-                default: api-db-secret
-                description: DatabaseSecretRef is the name of the secret containing
-                  database credentials for migrations
+                description: |-
+                  DatabaseSecretRef is the name of the secret containing database credentials for migrations.
+                  Defaults to {appName}-db-secret if not set.
                 type: string
               description:
                 description: Description of the application

apps/operator/config/manager/kustomization.yaml

@@ -4,3 +4,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
 - name: controller
+  newName: controller
+  newTag: latest

apps/operator/config/rbac/role.yaml

@@ -70,6 +70,8 @@ rules:
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
+  - clusterrolebindings
+  - clusterroles
   - rolebindings
   - roles
   verbs:

apps/operator/internal/controller/argocd/application.go

@@ -8,13 +8,68 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 )
 
-// GenerateArgoApplication creates an ArgoCD Application manifest.
+// GenerateArgoApplication creates an ArgoCD Application manifest with PreSync hooks
+// if the HeliosApp has a database trait for automatic database migrations.
 func GenerateArgoApplication(heliosApp *appv1alpha1.HeliosApp) (*unstructured.Unstructured, error) {
 	appName := heliosApp.Name + "-argocd"
 	targetNamespace := cmp.Or(heliosApp.Spec.ArgoCDNamespace, "argocd")
 	project := cmp.Or(heliosApp.Spec.ArgoCDProject, "default")
 	gitOpsBranch := cmp.Or(heliosApp.Spec.GitOpsBranch, "main")
 
+	spec := map[string]any{
+		"project": project,
+		"source": map[string]any{
+			"repoURL":        shared.RewriteGiteaURL(heliosApp.Spec.GitOpsRepo),
+			"targetRevision": gitOpsBranch,
+			"path":           heliosApp.Spec.GitOpsPath,
+		},
+		"destination": map[string]any{
+			"server":    "https://kubernetes.default.svc",
+			"namespace": heliosApp.Namespace,
+		},
+		"syncPolicy": map[string]any{
+			"automated": map[string]any{
+				"prune":    true,
+				"selfHeal": true,
+			},
+			"syncOptions": []any{
+				"CreateNamespace=true",
+			},
+		},
+		"ignoreDifferences": []any{
+			map[string]any{
+				"group": "apps",
+				"kind":  "Deployment",
+				"jqPathExpressions": []any{
+					`.spec.template.spec.containers[].env[]? | select(.name | test("^DB_"))`,
+				},
+			},
+		},
+	}
+
+	// Add PreSync hook if database trait exists
+	if HasDatabaseTrait(heliosApp) {
+		spec["syncPolicy"] = map[string]any{
+			"automated": map[string]any{
+				"prune":    true,
+				"selfHeal": true,
+			},
+			"syncOptions": []any{
+				"CreateNamespace=true",
+			},
+		}
+
+		// Add PreSync hook to application
+		// Note: PreSync Job is created and managed by PreSyncReconciler
+		// This is referenced via Job annotations, not stored in Application spec
+		syncPolicy := spec["syncPolicy"].(map[string]any)
+		syncPolicy["syncOptions"] = append(
+			syncPolicy["syncOptions"].([]any),
+			"SkipDryRunOnMissingResource=true",
+		)
+		spec["syncPolicy"] = syncPolicy
+	}
+
 	app := map[string]any{
 		"apiVersion": "argoproj.io/v1alpha1",
 		"kind":       "Application",
@@ -26,36 +81,7 @@ func GenerateArgoApplication(heliosApp *appv1alpha1.HeliosApp) (*unstructured.Un
 				"app.kubernetes.io/managed-by": "helios-operator",
 			},
 		},
-		"spec": map[string]any{
-			"project": project,
-			"source": map[string]any{
-				"repoURL":        shared.RewriteGiteaURL(heliosApp.Spec.GitOpsRepo),
-				"targetRevision": gitOpsBranch,
-				"path":           heliosApp.Spec.GitOpsPath,
-			},
-			"destination": map[string]any{
-				"server":    "https://kubernetes.default.svc",
-				"namespace": heliosApp.Namespace,
-			},
-			"syncPolicy": map[string]any{
-				"automated": map[string]any{
-					"prune":    true,
-					"selfHeal": true,
-				},
-				"syncOptions": []any{
-					"CreateNamespace=true",
-				},
-			},
-			"ignoreDifferences": []any{
-				map[string]any{
-					"group": "apps",
-					"kind":  "Deployment",
-					"jqPathExpressions": []any{
-						`.spec.template.spec.containers[].env[]? | select(.name | test("^DB_"))`,
-					},
-				},
-			},
-		},
+		"spec": spec,
 	}
 
 	return &unstructured.Unstructured{Object: app}, nil