Am I missing an obvious best-practice for automating db migrations in a db in a private subnet?
Feels like every solution I have is tedious.

what does your application deployment process look like?

we run k8s nodes within private subnets and use ArgoCD which can run a pre-deployment hook. in our case, it spawns a k8s job that runs a binary we package for each release to do our migrations

k8s+argocd here; current thinking is GH Action builds/pushes a migration image, helm hook runs it. That what you're doing? Just feels cumbersome to make a separate migration image; I'd prefer to just call the migration in Actions or something.

what does your application deployment process look like?

we run k8s nodes within private subnets and use ArgoCD which can run a pre-deployment hook. in our case, it spawns a k8s job that runs a binary we package for each release to do our migrations

https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks/