From f680984c694d41149183e237488e5d8f6c6e3c97 Mon Sep 17 00:00:00 2001
From: root <root@v2202607378382480008.hotsrv.de>
Date: Tue, 21 Jul 2026 10:18:59 +0200
Subject: [PATCH] fix: isolate OpenFGA migration from Argo sync

---
 scripts/gitops-render.test.ts                 | 10 ++++--
 .../src/gitops-render/runtime-manifests.mjs   | 34 +++++--------------
 2 files changed, 16 insertions(+), 28 deletions(-)

diff --git a/scripts/gitops-render.test.ts b/scripts/gitops-render.test.ts
index 90bf82fd..9f260be7 100644
--- a/scripts/gitops-render.test.ts
+++ b/scripts/gitops-render.test.ts
@@ -583,16 +583,20 @@ test("v02 render follows TypeScript runtime checks and does not self-patch boots
     const openfga = JSON.parse(await readFile(path.join(outDir, "runtime-v02", "openfga.yaml"), "utf8"));
     const openfgaDeployment = openfga.items.find((item) => item.kind === "Deployment" && item.metadata?.name === "hwlab-openfga");
     const openfgaService = openfga.items.find((item) => item.kind === "Service" && item.metadata?.name === "hwlab-openfga");
-    const openfgaMigrate = openfga.items.find((item) => item.kind === "Job" && item.metadata?.name === "hwlab-openfga-migrate");
     assert.ok(openfgaDeployment, "expected v02 OpenFGA deployment");
     assert.ok(openfgaService, "expected v02 OpenFGA ClusterIP service");
-    assert.ok(openfgaMigrate, "expected v02 OpenFGA migration job");
+    assert.equal(openfga.items.some((item) => item.kind === "Job" && item.metadata?.name === "hwlab-openfga-migrate"), false);
     assert.equal(openfgaService.spec.type, "ClusterIP");
     assert.equal(openfga.items.some((item) => item.kind === "Ingress"), false);
     assert.equal(openfgaDeployment.spec.template.spec.containers[0].image, "127.0.0.1:5000/hwlab/openfga:v1.17.0");
     assert.deepEqual(openfgaDeployment.spec.template.spec.containers[0].args, ["run"]);
-    assert.deepEqual(openfgaMigrate.spec.template.spec.containers[0].args, ["migrate"]);
     const openfgaEnv = openfgaDeployment.spec.template.spec.containers[0].env;
+    const openfgaMigrate = openfgaDeployment.spec.template.spec.initContainers[0];
+    assert.equal(openfgaMigrate.name, "openfga-migrate");
+    assert.equal(openfgaMigrate.image, "127.0.0.1:5000/hwlab/openfga:v1.17.0");
+    assert.deepEqual(openfgaMigrate.args, ["migrate"]);
+    assert.deepEqual(openfgaMigrate.env, openfgaEnv.filter((entry) => entry.name === "OPENFGA_DATASTORE_ENGINE" || entry.name === "OPENFGA_DATASTORE_URI"));
+    assert.deepEqual(openfgaMigrate.resources, { requests: { cpu: "50m", memory: "64Mi" }, limits: { cpu: "500m", memory: "256Mi" } });
     assert.ok(openfgaEnv.some((entry) => entry.name === "OPENFGA_DATASTORE_ENGINE" && entry.value === "postgres"));
     assert.ok(openfgaEnv.some((entry) => entry.name === "OPENFGA_DATASTORE_URI" && entry.valueFrom?.secretKeyRef?.name === "hwlab-v02-openfga" && entry.valueFrom?.secretKeyRef?.key === "datastore-uri"));
     assert.ok(openfgaEnv.some((entry) => entry.name === "OPENFGA_AUTHN_METHOD" && entry.value === "preshared"));
diff --git a/scripts/src/gitops-render/runtime-manifests.mjs b/scripts/src/gitops-render/runtime-manifests.mjs
index 5cd0ff37..6d0e37e8 100644
--- a/scripts/src/gitops-render/runtime-manifests.mjs
+++ b/scripts/src/gitops-render/runtime-manifests.mjs
@@ -908,37 +908,13 @@ function v02OpenFgaManifest({ profile = "v02", source, deploy = null }) {
     { name: "OPENFGA_HTTP_ADDR", value: "0.0.0.0:8080" },
     { name: "OPENFGA_GRPC_ADDR", value: "0.0.0.0:8081" }
   ];
+  const migrationEnv = env.filter((entry) => entry.name === "OPENFGA_DATASTORE_ENGINE" || entry.name === "OPENFGA_DATASTORE_URI");
   const templateLabels = { ...labels, ...selector };
   const runtimeAnnotations = { ...annotations, "argocd.argoproj.io/sync-wave": "2" };
   return {
     apiVersion: "v1",
     kind: "List",
     items: [
-      {
-        apiVersion: "batch/v1",
-        kind: "Job",
-        metadata: {
-          name: `${name}-migrate`,
-          namespace,
-          labels,
-          annotations: {
-            ...annotations,
-            "argocd.argoproj.io/hook": "Sync",
-            "argocd.argoproj.io/sync-wave": "1",
-            "argocd.argoproj.io/hook-delete-policy": "BeforeHookCreation,HookSucceeded"
-          }
-        },
-        spec: {
-          backoffLimit: 3,
-          template: {
-            metadata: { labels: templateLabels, annotations },
-            spec: {
-              restartPolicy: "OnFailure",
-              containers: [{ name: "openfga-migrate", image, imagePullPolicy: "IfNotPresent", args: ["migrate"], env }]
-            }
-          }
-        }
-      },
       {
         apiVersion: "apps/v1",
         kind: "Deployment",
@@ -949,6 +925,14 @@ function v02OpenFgaManifest({ profile = "v02", source, deploy = null }) {
           template: {
             metadata: { labels: templateLabels, annotations },
             spec: {
+              initContainers: [{
+                name: "openfga-migrate",
+                image,
+                imagePullPolicy: "IfNotPresent",
+                args: ["migrate"],
+                env: migrationEnv,
+                resources: { requests: { cpu: "50m", memory: "64Mi" }, limits: { cpu: "500m", memory: "256Mi" } }
+              }],
               containers: [{
                 name: "openfga",
                 image,