fix(deploy): stop the migrate Job failing every sync on an immutable field

[izzywdev]

Closes #110.

The failure

fuzekeys-platform has been OutOfSync / Degraded since 2026-08-24:

Job.batch "fuzekeys-migrate" is invalid: spec.template: ... field is immutable (retried 5 times)

Why it can never recover on its own

A Job's spec.template is immutable in Kubernetes. fuzekeys.labels stamps helm.sh/chart and app.kubernetes.io/version onto the pod template, so every chart version bump mutates an immutable field. The apply is rejected, Argo retries 5 times, the Application goes Degraded.

This isn't an unlucky upgrade — it's guaranteed on every release. That's why it has been stuck for a week rather than self-healing.

The fix

argocd.argoproj.io/sync-options: Replace=true — Argo deletes and recreates the Job instead of patching it. Safe here for the reason the template already documents: alembic upgrade head is a no-op when the DB is already at head.

Why not the Helm-hook pattern used by vault-bootstrap-job.yaml

That sibling template in this same chart solves its own recreation problem with helm.sh/hook: post-install,post-upgrade + hook-delete-policy: before-hook-creation. Copying it here would be wrong:

Argo maps helm.sh/hook: pre-upgrade to PreSync, which runs before the entire sync — including before the wave -2 ConfigMap and the Secret this Job consumes via envFrom. The migration would then run against absent or stale config.

The existing sync-wave ordering (config -2 → migrate -1 → workloads 0) is precisely what makes that config available, so it stays. Replace=true fixes the immutability without touching the ordering.

Verification

helm template renders both annotations on the Job:

annotations:
  argocd.argoproj.io/sync-wave: "-1"
  argocd.argoproj.io/sync-options: Replace=true

Not verified against the live cluster — that happens when Argo syncs this. The check that it worked is fuzekeys-platform returning to Synced/Healthy.

Chart version bumped 0.1.11 → 0.1.12.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.06%. Comparing base (8362dd2) to head (2eded97).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #122   +/-   ##
=======================================
  Coverage   41.06%   41.06%           
=======================================
  Files          81       81           
  Lines        6171     6171           
  Branches      250      252    +2     
=======================================
  Hits         2534     2534           
  Misses       3634     3634           
  Partials        3        3           

Flag	Coverage Δ
backend	41.06% <ø> (ø)
frontend	41.06% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.