Looks like DO API now can manage DB list (https://developers.digitalocean.com/documentation/changelog/api-v2/managed-databases-firewall-and-sql-mode-management/). I have an idea to add an IP of a CI agent (found an action for GitHub Actions here https://github.com/marketplace/actions/public-ip) via this API and remove it right after the migration is completed.

Don’t know if it is gonna work and if there any problems from a security perspective but will give it a try.

Ok, I come up with the following solution that works. Will keep it for now, probably you (or someone else) can see any problems with it. We use Github Actions so the following config is for it but it doesn’t matter much:

...
      - name: Deploy to DigitalOcean K8s cluster
        run: kubectl apply -f ./k8s

      - name: Get deployment status
        run: kubectl rollout status deploy/pp-app-auth

      - name: Get agent IP address
        id: ip
        uses: haythem/public-ip@v1.2

      - name: Get database firewall rules
        run: |
          INITIAL_FIREWALL_LIST=$(curl -X GET -H "Content-Type: application/json" -H "Authorization: Bearer ${{ secrets.DO_CI_PERSONAL_ACCESS_TOKEN }}" "https://api.digitalocean.com/v2/databases/${{ secrets.DO_DATABASE_ID }}/firewall")
          echo "INITIAL_FIREWALL_LIST=$INITIAL_FIREWALL_LIST" >> $GITHUB_ENV

      - name: Modify IPs list
        run: |
          UPDATED_FIREWALL_LIST=$(jq -r -c '.rules += [{"type": "ip_addr", "value": "${{ steps.ip.outputs.ipv4 }}"}]' <<< '${{ env.INITIAL_FIREWALL_LIST }}')
          echo "UPDATED_FIREWALL_LIST=$UPDATED_FIREWALL_LIST" >> $GITHUB_ENV

      - name: Submit updated IPs list to DO
        run: |
          echo ${{ env.UPDATED_FIREWALL_LIST }}
          curl -X PUT -H "Content-Type: application/json" -H "Authorization: Bearer ${{ secrets.DO_ACCESS_TOKEN }}" -d '${{ env.UPDATED_FIREWALL_LIST }}' "https://api.digitalocean.com/v2/databases/${{ secrets.DO_DATABASE_ID }}/firewall"

      - name: Install Python 3.6
        uses: actions/setup-python@v2
        with:
          python-version: '3.6'

      - name: Install requirements
        run: |
          python -m pip install -r requirements.txt

      - name: Run migration
        run: |
          PYTHONPATH=.:$PYTHONPATH alembic upgrade head

      - name: Revert IPs list
        if: ${{ always() }}
        run: |
          curl -X PUT -H "Content-Type: application/json" -H "Authorization: Bearer ${{ secrets.DO_ACCESS_TOKEN }}" -d '${{ env.INITIAL_FIREWALL_LIST }}' "https://api.digitalocean.com/v2/databases/${{ secrets.DO_DATABASE_ID }}/firewall"

Some feedback would be appreciated to improve the solution. One thing I need to check and improve is to cancel the following step if deployment status is “failed” but that’s another story.