The migration versioning appears to be regressing. The previous version of this file (Migration 37) moved the system to version 38. This updated version moves it to 37. Any system that has already applied the previous version of migration 37 will have its cozystack-version set to 38, causing the migration runner to skip this updated script. To ensure this migration runs on all existing installations, it should be assigned a higher version number (e.g., 38 or 39) and update the ConfigMap accordingly.

The set -o pipefail option is a bashism and is not supported by all POSIX-compliant shells, such as dash (the default /bin/sh on many Debian-based systems). Since the shebang is #!/bin/sh, this may cause the script to fail with an Illegal option -o pipefail error. Consider changing the shebang to #!/bin/bash or removing pipefail if POSIX compatibility is required.

The migration script uses a hardcoded list of database names. For Harbor, the database name is defined in the Helm template as {{ .Values.harbor.fullnameOverride }}-db. If a user has configured a fullnameOverride, this migration script will fail to identify and update the Harbor database. Consider using a more flexible matching pattern or checking for specific labels if available.

Performing multiple kubectl get calls (lines 32 and 52) inside a loop for every cluster is inefficient and can significantly slow down the migration process as the number of clusters grows. It also increases the load on the Kubernetes API server. It is recommended to fetch all required fields (namespace, name, labels, and imageName) in a single kubectl get call using a more comprehensive jsonpath or by processing the JSON output.

⚠️ Potential issue | 🟠 Major

Use a system-owned selector instead of name-only matching.

This still does not isolate “system databases”: any unlabeled CNPG cluster in any namespace named keycloak-db, grafana-db, alerta-db, or seaweedfs-db will be patched. Harbor can also be missed, because Line 5 of packages/system/harbor/templates/database.yaml renders the name from .Values.harbor.fullnameOverride, not a literal harbor-db. Please filter on a stable system-owned namespace/label before patching; otherwise a false match or miss will be locked in when this migration advances the version.

Also applies to: 22-49

Verify each finding against the current code and only fix it if needed.

In `@packages/core/platform/images/migrations/migrations/37` around lines 16 - 18,
The migration currently matches databases by name via the DB_NAMES variable
which can patch non-system clusters or miss Harbor (whose name is rendered from
.Values.harbor.fullnameOverride); update the migration to restrict to
system-owned resources by adding a stable selector (e.g., a label like
app.kubernetes.io/part-of=system or a dedicated system-owned label) and use that
selector when listing/patching CNPG clusters instead of name-only matching, and
also include logic to resolve Harbor's actual rendered name from
packages/system/harbor/templates/database.yaml (fullnameOverride) or match it by
the same system selector; modify the code that references DB_NAMES to combine
name AND label selection (or namespace filter) so only system databases are
patched.

⚠️ Potential issue | 🔴 Critical

Publish a new platform-migrations image with this target bump.

Line 9 makes the hook run migration 37, but migrations.image is still pinned to the existing digest on Line 8. The job will therefore execute the old /migrations/37 contents instead of the script added in this PR. Please build and reference a new image tag/digest in the same change.

Verify each finding against the current code and only fix it if needed.

In `@packages/core/platform/values.yaml` at line 9, The targetVersion bump to 38
means the deployment will still run the old migrations because migrations.image
is pinned to the previous digest; build a new platform-migrations image that
includes the new /migrations/38 script, push it, and update the migrations.image
reference in values.yaml to the new tag or digest so the job executes the newly
added migration rather than the old /migrations/37 content.