server management

2026-06-11 15:09:31 +02:00
parent 343de77810
commit 5da40698ad
152 changed files with 121747 additions and 3884 deletions
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609100654_AddAppRoutes.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609100654_AddAppRoutes.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609100654_AddAppRoutes.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609100654_AddAppRoutes.cs
@@ -0,0 +1,100 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    /// <inheritdoc />
+    public partial class AddAppRoutes : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "AppRoutes",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uuid", nullable: false),
+                    AppId = table.Column<Guid>(type: "uuid", nullable: false),
+                    Hostname = table.Column<string>(type: "character varying(253)", maxLength: 253, nullable: false),
+                    TlsMode = table.Column<string>(type: "character varying(20)", maxLength: 20, nullable: false),
+                    ClusterIssuerName = table.Column<string>(type: "character varying(200)", maxLength: 200, nullable: true),
+                    TlsCertificate = table.Column<string>(type: "text", nullable: true),
+                    TlsPrivateKey = table.Column<string>(type: "text", nullable: true),
+                    IsEnabled = table.Column<bool>(type: "boolean", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppRoutes", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppRoutes_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "AppDeploymentRoutes",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uuid", nullable: false),
+                    AppRouteId = table.Column<Guid>(type: "uuid", nullable: false),
+                    AppDeploymentId = table.Column<Guid>(type: "uuid", nullable: false),
+                    PathPrefix = table.Column<string>(type: "character varying(200)", maxLength: 200, nullable: false),
+                    ServiceName = table.Column<string>(type: "character varying(200)", maxLength: 200, nullable: false),
+                    ServicePort = table.Column<int>(type: "integer", nullable: false),
+                    GatewayName = table.Column<string>(type: "character varying(200)", maxLength: 200, nullable: true),
+                    GatewayNamespace = table.Column<string>(type: "character varying(63)", maxLength: 63, nullable: true),
+                    IsEnabled = table.Column<bool>(type: "boolean", nullable: false),
+                    LastHealthCheckAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: true),
+                    LastStatusCode = table.Column<int>(type: "integer", nullable: true),
+                    IsReachable = table.Column<bool>(type: "boolean", nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppDeploymentRoutes", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppDeploymentRoutes_AppDeployments_AppDeploymentId",
+                        column: x => x.AppDeploymentId,
+                        principalTable: "AppDeployments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppDeploymentRoutes_AppRoutes_AppRouteId",
+                        column: x => x.AppRouteId,
+                        principalTable: "AppRoutes",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppDeploymentRoutes_AppDeploymentId",
+                table: "AppDeploymentRoutes",
+                column: "AppDeploymentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppDeploymentRoutes_AppRouteId",
+                table: "AppDeploymentRoutes",
+                column: "AppRouteId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRoutes_AppId",
+                table: "AppRoutes",
+                column: "AppId");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "AppDeploymentRoutes");
+
+            migrationBuilder.DropTable(
+                name: "AppRoutes");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609111925_GovernancePerEnvironment.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609111925_GovernancePerEnvironment.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609111925_GovernancePerEnvironment.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609111925_GovernancePerEnvironment.cs
@@ -0,0 +1,179 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    /// <inheritdoc />
+    public partial class GovernancePerEnvironment : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_AppRbacPolicies_AppId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppQuotas_AppId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppNetworkPolicies_AppId_Name",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "AppRbacPolicies",
+                type: "uuid",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "AppQuotas",
+                type: "uuid",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "AppNetworkPolicies",
+                type: "uuid",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRbacPolicies_AppId_EnvironmentId",
+                table: "AppRbacPolicies",
+                columns: new[] { "AppId", "EnvironmentId" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRbacPolicies_EnvironmentId",
+                table: "AppRbacPolicies",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppQuotas_AppId_EnvironmentId",
+                table: "AppQuotas",
+                columns: new[] { "AppId", "EnvironmentId" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppQuotas_EnvironmentId",
+                table: "AppQuotas",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppNetworkPolicies_AppId_EnvironmentId_Name",
+                table: "AppNetworkPolicies",
+                columns: new[] { "AppId", "EnvironmentId", "Name" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppNetworkPolicies_EnvironmentId",
+                table: "AppNetworkPolicies",
+                column: "EnvironmentId");
+
+            migrationBuilder.Sql("DELETE FROM \"AppQuotas\" WHERE \"EnvironmentId\" = '00000000-0000-0000-0000-000000000000'");
+            migrationBuilder.Sql("DELETE FROM \"AppNetworkPolicies\" WHERE \"EnvironmentId\" = '00000000-0000-0000-0000-000000000000'");
+            migrationBuilder.Sql("DELETE FROM \"AppRbacPolicies\" WHERE \"EnvironmentId\" = '00000000-0000-0000-0000-000000000000'");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AppNetworkPolicies_Environments_EnvironmentId",
+                table: "AppNetworkPolicies",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AppQuotas_Environments_EnvironmentId",
+                table: "AppQuotas",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AppRbacPolicies_Environments_EnvironmentId",
+                table: "AppRbacPolicies",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_AppNetworkPolicies_Environments_EnvironmentId",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_AppQuotas_Environments_EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_AppRbacPolicies_Environments_EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppRbacPolicies_AppId_EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppRbacPolicies_EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppQuotas_AppId_EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppQuotas_EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppNetworkPolicies_AppId_EnvironmentId_Name",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppNetworkPolicies_EnvironmentId",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRbacPolicies_AppId",
+                table: "AppRbacPolicies",
+                column: "AppId",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppQuotas_AppId",
+                table: "AppQuotas",
+                column: "AppId",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppNetworkPolicies_AppId_Name",
+                table: "AppNetworkPolicies",
+                columns: new[] { "AppId", "Name" },
+                unique: true);
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609115713_GitPerEnvironment.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609115713_GitPerEnvironment.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609115713_GitPerEnvironment.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609115713_GitPerEnvironment.cs
@@ -0,0 +1,126 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    /// <inheritdoc />
+    public partial class GitPerEnvironment : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_UrlPattern",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_Name",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "CustomerGitRepoPolicies",
+                type: "uuid",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "CustomerGitCredentials",
+                type: "uuid",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_EnvironmentId_UrlPattern",
+                table: "CustomerGitRepoPolicies",
+                columns: new[] { "CustomerId", "EnvironmentId", "UrlPattern" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitRepoPolicies_EnvironmentId",
+                table: "CustomerGitRepoPolicies",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_EnvironmentId_Name",
+                table: "CustomerGitCredentials",
+                columns: new[] { "CustomerId", "EnvironmentId", "Name" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitCredentials_EnvironmentId",
+                table: "CustomerGitCredentials",
+                column: "EnvironmentId");
+
+            migrationBuilder.Sql("DELETE FROM \"CustomerGitRepoPolicies\" WHERE \"EnvironmentId\" = '00000000-0000-0000-0000-000000000000'");
+            migrationBuilder.Sql("DELETE FROM \"CustomerGitCredentials\" WHERE \"EnvironmentId\" = '00000000-0000-0000-0000-000000000000'");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_CustomerGitCredentials_Environments_EnvironmentId",
+                table: "CustomerGitCredentials",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_CustomerGitRepoPolicies_Environments_EnvironmentId",
+                table: "CustomerGitRepoPolicies",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_CustomerGitCredentials_Environments_EnvironmentId",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_CustomerGitRepoPolicies_Environments_EnvironmentId",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_EnvironmentId_UrlPattern",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitRepoPolicies_EnvironmentId",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_EnvironmentId_Name",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitCredentials_EnvironmentId",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_UrlPattern",
+                table: "CustomerGitRepoPolicies",
+                columns: new[] { "CustomerId", "UrlPattern" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_Name",
+                table: "CustomerGitCredentials",
+                columns: new[] { "CustomerId", "Name" },
+                unique: true);
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609130903_AddAppEnvironmentNamespace.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609130903_AddAppEnvironmentNamespace.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609130903_AddAppEnvironmentNamespace.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609130903_AddAppEnvironmentNamespace.cs
@@ -0,0 +1,28 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    /// <inheritdoc />
+    public partial class AddAppEnvironmentNamespace : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "Namespace",
+                table: "AppEnvironments",
+                type: "text",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "Namespace",
+                table: "AppEnvironments");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609170945_AddGovernanceAllowlists.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609170945_AddGovernanceAllowlists.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609170945_AddGovernanceAllowlists.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609170945_AddGovernanceAllowlists.cs
@@ -0,0 +1,196 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    /// <inheritdoc />
+    public partial class AddGovernanceAllowlists : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "AppAllowedCaches",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uuid", nullable: false),
+                    AppId = table.Column<Guid>(type: "uuid", nullable: false),
+                    EnvironmentId = table.Column<Guid>(type: "uuid", nullable: false),
+                    RedisClusterId = table.Column<Guid>(type: "uuid", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppAllowedCaches", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedCaches_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedCaches_Environments_EnvironmentId",
+                        column: x => x.EnvironmentId,
+                        principalTable: "Environments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedCaches_RedisClusters_RedisClusterId",
+                        column: x => x.RedisClusterId,
+                        principalTable: "RedisClusters",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "AppAllowedDatabases",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uuid", nullable: false),
+                    AppId = table.Column<Guid>(type: "uuid", nullable: false),
+                    EnvironmentId = table.Column<Guid>(type: "uuid", nullable: false),
+                    CnpgDatabaseId = table.Column<Guid>(type: "uuid", nullable: true),
+                    MongoDatabaseId = table.Column<Guid>(type: "uuid", nullable: true),
+                    RegisteredPostgresDatabaseId = table.Column<Guid>(type: "uuid", nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppAllowedDatabases", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_CnpgDatabases_CnpgDatabaseId",
+                        column: x => x.CnpgDatabaseId,
+                        principalTable: "CnpgDatabases",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_Environments_EnvironmentId",
+                        column: x => x.EnvironmentId,
+                        principalTable: "Environments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_MongoDatabases_MongoDatabaseId",
+                        column: x => x.MongoDatabaseId,
+                        principalTable: "MongoDatabases",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_RegisteredPostgresDatabases_RegisteredP~",
+                        column: x => x.RegisteredPostgresDatabaseId,
+                        principalTable: "RegisteredPostgresDatabases",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "AppAllowedStorages",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uuid", nullable: false),
+                    AppId = table.Column<Guid>(type: "uuid", nullable: false),
+                    EnvironmentId = table.Column<Guid>(type: "uuid", nullable: false),
+                    StorageLinkId = table.Column<Guid>(type: "uuid", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppAllowedStorages", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedStorages_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedStorages_Environments_EnvironmentId",
+                        column: x => x.EnvironmentId,
+                        principalTable: "Environments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedStorages_StorageLinks_StorageLinkId",
+                        column: x => x.StorageLinkId,
+                        principalTable: "StorageLinks",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedCaches_AppId",
+                table: "AppAllowedCaches",
+                column: "AppId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedCaches_EnvironmentId",
+                table: "AppAllowedCaches",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedCaches_RedisClusterId",
+                table: "AppAllowedCaches",
+                column: "RedisClusterId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_AppId",
+                table: "AppAllowedDatabases",
+                column: "AppId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_CnpgDatabaseId",
+                table: "AppAllowedDatabases",
+                column: "CnpgDatabaseId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_EnvironmentId",
+                table: "AppAllowedDatabases",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_MongoDatabaseId",
+                table: "AppAllowedDatabases",
+                column: "MongoDatabaseId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_RegisteredPostgresDatabaseId",
+                table: "AppAllowedDatabases",
+                column: "RegisteredPostgresDatabaseId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedStorages_AppId",
+                table: "AppAllowedStorages",
+                column: "AppId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedStorages_EnvironmentId",
+                table: "AppAllowedStorages",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedStorages_StorageLinkId",
+                table: "AppAllowedStorages",
+                column: "StorageLinkId");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "AppAllowedCaches");
+
+            migrationBuilder.DropTable(
+                name: "AppAllowedDatabases");
+
+            migrationBuilder.DropTable(
+                name: "AppAllowedStorages");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609200000_AddCredentialUrlPattern.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609200000_AddCredentialUrlPattern.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609200000_AddCredentialUrlPattern.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609200000_AddCredentialUrlPattern.cs
@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    /// <inheritdoc />
+    public partial class AddCredentialUrlPattern : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "UrlPattern",
+                table: "CustomerGitCredentials",
+                type: "character varying(500)",
+                maxLength: 500,
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "UrlPattern",
+                table: "CustomerGitCredentials");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260609210000_AddDeploymentRouteApplied.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260609210000_AddDeploymentRouteApplied.cs
@@ -0,0 +1,31 @@
+using System;
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    [DbContext(typeof(PostgresApplicationDbContext))]
+    [Migration("20260609210000_AddDeploymentRouteApplied")]
+    /// <inheritdoc />
+    public partial class AddDeploymentRouteApplied : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql(
+                """ALTER TABLE "AppDeploymentRoutes" ADD COLUMN IF NOT EXISTS "ClusterAppliedAt" timestamp with time zone;""");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "ClusterAppliedAt",
+                table: "AppDeploymentRoutes");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260610120000_AddVaultSecretVersions.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260610120000_AddVaultSecretVersions.cs
@@ -0,0 +1,54 @@
+using System;
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    [DbContext(typeof(PostgresApplicationDbContext))]
+    [Migration("20260610120000_AddVaultSecretVersions")]
+    /// <inheritdoc />
+    public partial class AddVaultSecretVersions : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql(
+                """ALTER TABLE "VaultSecrets" ADD COLUMN IF NOT EXISTS "UpdatedBy" character varying(254);""");
+
+            migrationBuilder.Sql("""
+                CREATE TABLE IF NOT EXISTS "VaultSecretVersions" (
+                    "Id" uuid NOT NULL,
+                    "SecretId" uuid NOT NULL,
+                    "VersionNumber" integer NOT NULL,
+                    "EncryptedValue" bytea NOT NULL,
+                    "Nonce" bytea NOT NULL,
+                    "CreatedBy" character varying(254),
+                    "CreatedAt" timestamp with time zone NOT NULL,
+                    CONSTRAINT "PK_VaultSecretVersions" PRIMARY KEY ("Id"),
+                    CONSTRAINT "FK_VaultSecretVersions_VaultSecrets_SecretId"
+                        FOREIGN KEY ("SecretId") REFERENCES "VaultSecrets" ("Id") ON DELETE CASCADE
+                );
+                """);
+
+            migrationBuilder.Sql("""
+                CREATE INDEX IF NOT EXISTS "IX_VaultSecretVersions_SecretId_VersionNumber"
+                    ON "VaultSecretVersions" ("SecretId", "VersionNumber");
+                """);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "VaultSecretVersions");
+
+            migrationBuilder.DropColumn(
+                name: "UpdatedBy",
+                table: "VaultSecrets");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260611000000_AddOpsTeamFeatures.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260611000000_AddOpsTeamFeatures.cs
@@ -0,0 +1,117 @@
+using System;
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    [DbContext(typeof(PostgresApplicationDbContext))]
+    [Migration("20260611000000_AddOpsTeamFeatures")]
+    /// <inheritdoc />
+    public partial class AddOpsTeamFeatures : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql(
+                """ALTER TABLE "AlertIncidents" ADD COLUMN IF NOT EXISTS "AssignedTo" character varying(256);""");
+
+            migrationBuilder.Sql(
+                """ALTER TABLE "AlertIncidents" ADD COLUMN IF NOT EXISTS "AssignedAt" timestamp with time zone;""");
+
+            migrationBuilder.Sql("""
+                CREATE TABLE IF NOT EXISTS "OnCallSchedules" (
+                    "Id" uuid NOT NULL,
+                    "TenantId" uuid NOT NULL,
+                    "Name" character varying(200) NOT NULL,
+                    "Description" character varying(500),
+                    "IsEnabled" boolean NOT NULL DEFAULT true,
+                    "CreatedAt" timestamp with time zone NOT NULL,
+                    CONSTRAINT "PK_OnCallSchedules" PRIMARY KEY ("Id"),
+                    CONSTRAINT "FK_OnCallSchedules_Tenants_TenantId"
+                        FOREIGN KEY ("TenantId") REFERENCES "Tenants" ("Id") ON DELETE CASCADE
+                );
+                """);
+
+            migrationBuilder.Sql("""
+                CREATE TABLE IF NOT EXISTS "OnCallShifts" (
+                    "Id" uuid NOT NULL,
+                    "ScheduleId" uuid NOT NULL,
+                    "AssigneeName" character varying(256) NOT NULL,
+                    "AssigneeEmail" character varying(256),
+                    "StartsAt" timestamp with time zone NOT NULL,
+                    "EndsAt" timestamp with time zone NOT NULL,
+                    "Notes" character varying(1000),
+                    CONSTRAINT "PK_OnCallShifts" PRIMARY KEY ("Id"),
+                    CONSTRAINT "FK_OnCallShifts_OnCallSchedules_ScheduleId"
+                        FOREIGN KEY ("ScheduleId") REFERENCES "OnCallSchedules" ("Id") ON DELETE CASCADE
+                );
+                """);
+
+            migrationBuilder.Sql("""
+                CREATE TABLE IF NOT EXISTS "AlertRoutingRules" (
+                    "Id" uuid NOT NULL,
+                    "TenantId" uuid NOT NULL,
+                    "Name" character varying(200) NOT NULL,
+                    "Priority" integer NOT NULL DEFAULT 0,
+                    "ChannelId" uuid NOT NULL,
+                    "MatchAlertName" character varying(200),
+                    "MatchNamespace" character varying(200),
+                    "MatchSeverity" character varying(20),
+                    "MatchLabelKey" character varying(100),
+                    "MatchLabelValue" character varying(200),
+                    "IsEnabled" boolean NOT NULL DEFAULT true,
+                    CONSTRAINT "PK_AlertRoutingRules" PRIMARY KEY ("Id"),
+                    CONSTRAINT "FK_AlertRoutingRules_Tenants_TenantId"
+                        FOREIGN KEY ("TenantId") REFERENCES "Tenants" ("Id") ON DELETE CASCADE,
+                    CONSTRAINT "FK_AlertRoutingRules_NotificationChannels_ChannelId"
+                        FOREIGN KEY ("ChannelId") REFERENCES "NotificationChannels" ("Id") ON DELETE CASCADE
+                );
+                """);
+
+            migrationBuilder.Sql("""
+                CREATE INDEX IF NOT EXISTS "IX_OnCallShifts_ScheduleId"
+                    ON "OnCallShifts" ("ScheduleId");
+                """);
+
+            migrationBuilder.Sql("""
+                CREATE INDEX IF NOT EXISTS "IX_OnCallShifts_StartsAt"
+                    ON "OnCallShifts" ("StartsAt");
+                """);
+
+            migrationBuilder.Sql("""
+                CREATE INDEX IF NOT EXISTS "IX_AlertRoutingRules_TenantId"
+                    ON "AlertRoutingRules" ("TenantId");
+                """);
+
+            migrationBuilder.Sql("""
+                CREATE INDEX IF NOT EXISTS "IX_AlertRoutingRules_ChannelId"
+                    ON "AlertRoutingRules" ("ChannelId");
+                """);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "AlertRoutingRules");
+
+            migrationBuilder.DropTable(
+                name: "OnCallShifts");
+
+            migrationBuilder.DropTable(
+                name: "OnCallSchedules");
+
+            migrationBuilder.DropColumn(
+                name: "AssignedTo",
+                table: "AlertIncidents");
+
+            migrationBuilder.DropColumn(
+                name: "AssignedAt",
+                table: "AlertIncidents");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260611010000_AddAlertIncidentRunbookUrl.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260611010000_AddAlertIncidentRunbookUrl.cs
@@ -0,0 +1,28 @@
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    [DbContext(typeof(PostgresApplicationDbContext))]
+    [Migration("20260611010000_AddAlertIncidentRunbookUrl")]
+    public partial class AddAlertIncidentRunbookUrl : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertIncidents"
+                    ADD COLUMN IF NOT EXISTS "RunbookUrl" character varying(500) NOT NULL DEFAULT '';
+                """);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "RunbookUrl",
+                table: "AlertIncidents");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260611020000_AddAlertIncidentEscalation.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260611020000_AddAlertIncidentEscalation.cs
@@ -0,0 +1,35 @@
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    [DbContext(typeof(PostgresApplicationDbContext))]
+    [Migration("20260611020000_AddAlertIncidentEscalation")]
+    public partial class AddAlertIncidentEscalation : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertIncidents"
+                    ADD COLUMN IF NOT EXISTS "EscalatedAt" timestamp with time zone NULL;
+
+                CREATE INDEX IF NOT EXISTS "IX_AlertIncidents_EscalatedAt"
+                    ON "AlertIncidents" ("EscalatedAt");
+                """);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_AlertIncidents_EscalatedAt",
+                table: "AlertIncidents");
+
+            migrationBuilder.DropColumn(
+                name: "EscalatedAt",
+                table: "AlertIncidents");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260611030000_AddDeploymentGitUrl.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260611030000_AddDeploymentGitUrl.cs
@@ -0,0 +1,28 @@
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    [DbContext(typeof(PostgresApplicationDbContext))]
+    [Migration("20260611030000_AddDeploymentGitUrl")]
+    public partial class AddDeploymentGitUrl : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql("""
+                ALTER TABLE "AppDeployments"
+                    ADD COLUMN IF NOT EXISTS "GitUrl" character varying(2000) NULL;
+                """);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "GitUrl",
+                table: "AppDeployments");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260611040000_AddNotificationProviderConfig.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260611040000_AddNotificationProviderConfig.cs
@@ -0,0 +1,46 @@
+using System;
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    [DbContext(typeof(PostgresApplicationDbContext))]
+    [Migration("20260611040000_AddNotificationProviderConfig")]
+    public partial class AddNotificationProviderConfig : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "NotificationProviderConfigs",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uuid", nullable: false),
+                    ProviderType = table.Column<string>(type: "character varying(30)", maxLength: 30, nullable: false),
+                    ConfigurationJson = table.Column<string>(type: "text", nullable: false),
+                    IsEnabled = table.Column<bool>(type: "boolean", nullable: false),
+                    UpdatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    UpdatedByUserId = table.Column<string>(type: "character varying(450)", maxLength: 450, nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_NotificationProviderConfigs", x => x.Id);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_NotificationProviderConfigs_ProviderType",
+                table: "NotificationProviderConfigs",
+                column: "ProviderType",
+                unique: true);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "NotificationProviderConfigs");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260611060000_AddAlertRoutingSuppression.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260611060000_AddAlertRoutingSuppression.cs
@@ -0,0 +1,95 @@
+using System;
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    [DbContext(typeof(PostgresApplicationDbContext))]
+    [Migration("20260611060000_AddAlertRoutingSuppression")]
+    public partial class AddAlertRoutingSuppression : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            // Make ChannelId nullable
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    DROP CONSTRAINT "FK_AlertRoutingRules_NotificationChannels_ChannelId";
+                """);
+
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    ALTER COLUMN "ChannelId" DROP NOT NULL;
+                """);
+
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    ADD CONSTRAINT "FK_AlertRoutingRules_NotificationChannels_ChannelId"
+                    FOREIGN KEY ("ChannelId") REFERENCES "NotificationChannels" ("Id") ON DELETE CASCADE;
+                """);
+
+            // Add new columns
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    ADD COLUMN IF NOT EXISTS "SuppressIncident" boolean NOT NULL DEFAULT false;
+                """);
+
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    ADD COLUMN IF NOT EXISTS "MatchClusterId" uuid;
+                """);
+
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    ADD CONSTRAINT "FK_AlertRoutingRules_KubernetesClusters_MatchClusterId"
+                    FOREIGN KEY ("MatchClusterId") REFERENCES "KubernetesClusters" ("Id") ON DELETE SET NULL;
+                """);
+
+            migrationBuilder.Sql("""
+                CREATE INDEX IF NOT EXISTS "IX_AlertRoutingRules_MatchClusterId"
+                    ON "AlertRoutingRules" ("MatchClusterId");
+                """);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql("""
+                DROP INDEX IF EXISTS "IX_AlertRoutingRules_MatchClusterId";
+                """);
+
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    DROP CONSTRAINT IF EXISTS "FK_AlertRoutingRules_KubernetesClusters_MatchClusterId";
+                """);
+
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    DROP COLUMN IF EXISTS "MatchClusterId";
+                """);
+
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    DROP COLUMN IF EXISTS "SuppressIncident";
+                """);
+
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    DROP CONSTRAINT "FK_AlertRoutingRules_NotificationChannels_ChannelId";
+                """);
+
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    ALTER COLUMN "ChannelId" SET NOT NULL;
+                """);
+
+            migrationBuilder.Sql("""
+                ALTER TABLE "AlertRoutingRules"
+                    ADD CONSTRAINT "FK_AlertRoutingRules_NotificationChannels_ChannelId"
+                    FOREIGN KEY ("ChannelId") REFERENCES "NotificationChannels" ("Id") ON DELETE CASCADE;
+                """);
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260611122524_AddClusterServers.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260611122524_AddClusterServers.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Postgres/20260611122524_AddClusterServers.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/20260611122524_AddClusterServers.cs
@@ -0,0 +1,236 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Postgres
+{
+    /// <inheritdoc />
+    public partial class AddClusterServers : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_OnCallSchedules_TenantId",
+                table: "OnCallSchedules");
+
+            migrationBuilder.AddColumn<string>(
+                name: "UpdatedBy",
+                table: "VaultSecrets",
+                type: "text",
+                nullable: true);
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "OnCallSchedules",
+                type: "boolean",
+                nullable: false,
+                oldClrType: typeof(bool),
+                oldType: "boolean",
+                oldDefaultValue: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "GitUrl",
+                table: "AppDeployments",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "character varying(2000)",
+                oldMaxLength: 2000,
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "SuppressIncident",
+                table: "AlertRoutingRules",
+                type: "boolean",
+                nullable: false,
+                oldClrType: typeof(bool),
+                oldType: "boolean",
+                oldDefaultValue: false);
+
+            migrationBuilder.AlterColumn<int>(
+                name: "Priority",
+                table: "AlertRoutingRules",
+                type: "integer",
+                nullable: false,
+                oldClrType: typeof(int),
+                oldType: "integer",
+                oldDefaultValue: 0);
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "AlertRoutingRules",
+                type: "boolean",
+                nullable: false,
+                oldClrType: typeof(bool),
+                oldType: "boolean",
+                oldDefaultValue: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "RunbookUrl",
+                table: "AlertIncidents",
+                type: "character varying(500)",
+                maxLength: 500,
+                nullable: false,
+                oldClrType: typeof(string),
+                oldType: "character varying(500)",
+                oldMaxLength: 500,
+                oldDefaultValue: "");
+
+            migrationBuilder.CreateTable(
+                name: "ClusterServers",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uuid", nullable: false),
+                    ClusterId = table.Column<Guid>(type: "uuid", nullable: false),
+                    NodeName = table.Column<string>(type: "character varying(253)", maxLength: 253, nullable: true),
+                    DisplayName = table.Column<string>(type: "character varying(200)", maxLength: 200, nullable: false),
+                    IpAddress = table.Column<string>(type: "character varying(45)", maxLength: 45, nullable: true),
+                    ManagementIpAddress = table.Column<string>(type: "character varying(45)", maxLength: 45, nullable: true),
+                    Provider = table.Column<string>(type: "character varying(20)", maxLength: 20, nullable: false),
+                    OsDistribution = table.Column<string>(type: "character varying(200)", maxLength: 200, nullable: true),
+                    CpuCores = table.Column<int>(type: "integer", nullable: true),
+                    RamGb = table.Column<int>(type: "integer", nullable: true),
+                    DiskGb = table.Column<int>(type: "integer", nullable: true),
+                    Location = table.Column<string>(type: "character varying(200)", maxLength: 200, nullable: true),
+                    SshUser = table.Column<string>(type: "character varying(100)", maxLength: 100, nullable: true),
+                    SshPort = table.Column<int>(type: "integer", nullable: false),
+                    JumpHost = table.Column<string>(type: "character varying(500)", maxLength: 500, nullable: true),
+                    Notes = table.Column<string>(type: "character varying(2000)", maxLength: 2000, nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    UpdatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_ClusterServers", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_ClusterServers_KubernetesClusters_ClusterId",
+                        column: x => x.ClusterId,
+                        principalTable: "KubernetesClusters",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "VaultSecretVersions",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uuid", nullable: false),
+                    SecretId = table.Column<Guid>(type: "uuid", nullable: false),
+                    VersionNumber = table.Column<int>(type: "integer", nullable: false),
+                    EncryptedValue = table.Column<byte[]>(type: "bytea", nullable: false),
+                    Nonce = table.Column<byte[]>(type: "bytea", nullable: false),
+                    CreatedBy = table.Column<string>(type: "character varying(254)", maxLength: 254, nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_VaultSecretVersions", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_VaultSecretVersions_VaultSecrets_SecretId",
+                        column: x => x.SecretId,
+                        principalTable: "VaultSecrets",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_OnCallSchedules_TenantId_Name",
+                table: "OnCallSchedules",
+                columns: new[] { "TenantId", "Name" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_ClusterServers_ClusterId_DisplayName",
+                table: "ClusterServers",
+                columns: new[] { "ClusterId", "DisplayName" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_VaultSecretVersions_SecretId_VersionNumber",
+                table: "VaultSecretVersions",
+                columns: new[] { "SecretId", "VersionNumber" });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "ClusterServers");
+
+            migrationBuilder.DropTable(
+                name: "VaultSecretVersions");
+
+            migrationBuilder.DropIndex(
+                name: "IX_OnCallSchedules_TenantId_Name",
+                table: "OnCallSchedules");
+
+            migrationBuilder.DropColumn(
+                name: "UpdatedBy",
+                table: "VaultSecrets");
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "OnCallSchedules",
+                type: "boolean",
+                nullable: false,
+                defaultValue: true,
+                oldClrType: typeof(bool),
+                oldType: "boolean");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "GitUrl",
+                table: "AppDeployments",
+                type: "character varying(2000)",
+                maxLength: 2000,
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "SuppressIncident",
+                table: "AlertRoutingRules",
+                type: "boolean",
+                nullable: false,
+                defaultValue: false,
+                oldClrType: typeof(bool),
+                oldType: "boolean");
+
+            migrationBuilder.AlterColumn<int>(
+                name: "Priority",
+                table: "AlertRoutingRules",
+                type: "integer",
+                nullable: false,
+                defaultValue: 0,
+                oldClrType: typeof(int),
+                oldType: "integer");
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "AlertRoutingRules",
+                type: "boolean",
+                nullable: false,
+                defaultValue: true,
+                oldClrType: typeof(bool),
+                oldType: "boolean");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "RunbookUrl",
+                table: "AlertIncidents",
+                type: "character varying(500)",
+                maxLength: 500,
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "character varying(500)",
+                oldMaxLength: 500);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_OnCallSchedules_TenantId",
+                table: "OnCallSchedules",
+                column: "TenantId");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Postgres/PostgresApplicationDbContextModelSnapshot.cs
+++ b/src/EntKube.Web/Data/Migrations/Postgres/PostgresApplicationDbContextModelSnapshot.cs
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609100704_AddAppRoutes.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609100704_AddAppRoutes.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609100704_AddAppRoutes.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609100704_AddAppRoutes.cs
@@ -0,0 +1,100 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    /// <inheritdoc />
+    public partial class AddAppRoutes : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "AppRoutes",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    AppId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    Hostname = table.Column<string>(type: "nvarchar(253)", maxLength: 253, nullable: false),
+                    TlsMode = table.Column<string>(type: "nvarchar(20)", maxLength: 20, nullable: false),
+                    ClusterIssuerName = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: true),
+                    TlsCertificate = table.Column<string>(type: "nvarchar(max)", nullable: true),
+                    TlsPrivateKey = table.Column<string>(type: "nvarchar(max)", nullable: true),
+                    IsEnabled = table.Column<bool>(type: "bit", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "datetime2", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppRoutes", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppRoutes_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "AppDeploymentRoutes",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    AppRouteId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    AppDeploymentId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    PathPrefix = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: false),
+                    ServiceName = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: false),
+                    ServicePort = table.Column<int>(type: "int", nullable: false),
+                    GatewayName = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: true),
+                    GatewayNamespace = table.Column<string>(type: "nvarchar(63)", maxLength: 63, nullable: true),
+                    IsEnabled = table.Column<bool>(type: "bit", nullable: false),
+                    LastHealthCheckAt = table.Column<DateTime>(type: "datetime2", nullable: true),
+                    LastStatusCode = table.Column<int>(type: "int", nullable: true),
+                    IsReachable = table.Column<bool>(type: "bit", nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "datetime2", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppDeploymentRoutes", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppDeploymentRoutes_AppDeployments_AppDeploymentId",
+                        column: x => x.AppDeploymentId,
+                        principalTable: "AppDeployments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppDeploymentRoutes_AppRoutes_AppRouteId",
+                        column: x => x.AppRouteId,
+                        principalTable: "AppRoutes",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppDeploymentRoutes_AppDeploymentId",
+                table: "AppDeploymentRoutes",
+                column: "AppDeploymentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppDeploymentRoutes_AppRouteId",
+                table: "AppDeploymentRoutes",
+                column: "AppRouteId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRoutes_AppId",
+                table: "AppRoutes",
+                column: "AppId");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "AppDeploymentRoutes");
+
+            migrationBuilder.DropTable(
+                name: "AppRoutes");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609111941_GovernancePerEnvironment.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609111941_GovernancePerEnvironment.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609111941_GovernancePerEnvironment.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609111941_GovernancePerEnvironment.cs
@@ -0,0 +1,179 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    /// <inheritdoc />
+    public partial class GovernancePerEnvironment : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_AppRbacPolicies_AppId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppQuotas_AppId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppNetworkPolicies_AppId_Name",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "AppRbacPolicies",
+                type: "uniqueidentifier",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "AppQuotas",
+                type: "uniqueidentifier",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "AppNetworkPolicies",
+                type: "uniqueidentifier",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRbacPolicies_AppId_EnvironmentId",
+                table: "AppRbacPolicies",
+                columns: new[] { "AppId", "EnvironmentId" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRbacPolicies_EnvironmentId",
+                table: "AppRbacPolicies",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppQuotas_AppId_EnvironmentId",
+                table: "AppQuotas",
+                columns: new[] { "AppId", "EnvironmentId" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppQuotas_EnvironmentId",
+                table: "AppQuotas",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppNetworkPolicies_AppId_EnvironmentId_Name",
+                table: "AppNetworkPolicies",
+                columns: new[] { "AppId", "EnvironmentId", "Name" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppNetworkPolicies_EnvironmentId",
+                table: "AppNetworkPolicies",
+                column: "EnvironmentId");
+
+            migrationBuilder.Sql("DELETE FROM AppQuotas WHERE EnvironmentId = '00000000-0000-0000-0000-000000000000'");
+            migrationBuilder.Sql("DELETE FROM AppNetworkPolicies WHERE EnvironmentId = '00000000-0000-0000-0000-000000000000'");
+            migrationBuilder.Sql("DELETE FROM AppRbacPolicies WHERE EnvironmentId = '00000000-0000-0000-0000-000000000000'");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AppNetworkPolicies_Environments_EnvironmentId",
+                table: "AppNetworkPolicies",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AppQuotas_Environments_EnvironmentId",
+                table: "AppQuotas",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AppRbacPolicies_Environments_EnvironmentId",
+                table: "AppRbacPolicies",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_AppNetworkPolicies_Environments_EnvironmentId",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_AppQuotas_Environments_EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_AppRbacPolicies_Environments_EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppRbacPolicies_AppId_EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppRbacPolicies_EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppQuotas_AppId_EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppQuotas_EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppNetworkPolicies_AppId_EnvironmentId_Name",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppNetworkPolicies_EnvironmentId",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRbacPolicies_AppId",
+                table: "AppRbacPolicies",
+                column: "AppId",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppQuotas_AppId",
+                table: "AppQuotas",
+                column: "AppId",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppNetworkPolicies_AppId_Name",
+                table: "AppNetworkPolicies",
+                columns: new[] { "AppId", "Name" },
+                unique: true);
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609115724_GitPerEnvironment.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609115724_GitPerEnvironment.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609115724_GitPerEnvironment.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609115724_GitPerEnvironment.cs
@@ -0,0 +1,126 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    /// <inheritdoc />
+    public partial class GitPerEnvironment : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_UrlPattern",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_Name",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "CustomerGitRepoPolicies",
+                type: "uniqueidentifier",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "CustomerGitCredentials",
+                type: "uniqueidentifier",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_EnvironmentId_UrlPattern",
+                table: "CustomerGitRepoPolicies",
+                columns: new[] { "CustomerId", "EnvironmentId", "UrlPattern" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitRepoPolicies_EnvironmentId",
+                table: "CustomerGitRepoPolicies",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_EnvironmentId_Name",
+                table: "CustomerGitCredentials",
+                columns: new[] { "CustomerId", "EnvironmentId", "Name" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitCredentials_EnvironmentId",
+                table: "CustomerGitCredentials",
+                column: "EnvironmentId");
+
+            migrationBuilder.Sql("DELETE FROM CustomerGitRepoPolicies WHERE EnvironmentId = '00000000-0000-0000-0000-000000000000'");
+            migrationBuilder.Sql("DELETE FROM CustomerGitCredentials WHERE EnvironmentId = '00000000-0000-0000-0000-000000000000'");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_CustomerGitCredentials_Environments_EnvironmentId",
+                table: "CustomerGitCredentials",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_CustomerGitRepoPolicies_Environments_EnvironmentId",
+                table: "CustomerGitRepoPolicies",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_CustomerGitCredentials_Environments_EnvironmentId",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_CustomerGitRepoPolicies_Environments_EnvironmentId",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_EnvironmentId_UrlPattern",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitRepoPolicies_EnvironmentId",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_EnvironmentId_Name",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitCredentials_EnvironmentId",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_UrlPattern",
+                table: "CustomerGitRepoPolicies",
+                columns: new[] { "CustomerId", "UrlPattern" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_Name",
+                table: "CustomerGitCredentials",
+                columns: new[] { "CustomerId", "Name" },
+                unique: true);
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609130943_AddAppEnvironmentNamespace.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609130943_AddAppEnvironmentNamespace.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609130943_AddAppEnvironmentNamespace.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609130943_AddAppEnvironmentNamespace.cs
@@ -0,0 +1,28 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    /// <inheritdoc />
+    public partial class AddAppEnvironmentNamespace : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "Namespace",
+                table: "AppEnvironments",
+                type: "nvarchar(max)",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "Namespace",
+                table: "AppEnvironments");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609171000_AddGovernanceAllowlists.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609171000_AddGovernanceAllowlists.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609171000_AddGovernanceAllowlists.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609171000_AddGovernanceAllowlists.cs
@@ -0,0 +1,196 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    /// <inheritdoc />
+    public partial class AddGovernanceAllowlists : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "AppAllowedCaches",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    AppId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    EnvironmentId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    RedisClusterId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "datetime2", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppAllowedCaches", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedCaches_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedCaches_Environments_EnvironmentId",
+                        column: x => x.EnvironmentId,
+                        principalTable: "Environments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedCaches_RedisClusters_RedisClusterId",
+                        column: x => x.RedisClusterId,
+                        principalTable: "RedisClusters",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "AppAllowedDatabases",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    AppId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    EnvironmentId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    CnpgDatabaseId = table.Column<Guid>(type: "uniqueidentifier", nullable: true),
+                    MongoDatabaseId = table.Column<Guid>(type: "uniqueidentifier", nullable: true),
+                    RegisteredPostgresDatabaseId = table.Column<Guid>(type: "uniqueidentifier", nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "datetime2", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppAllowedDatabases", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_CnpgDatabases_CnpgDatabaseId",
+                        column: x => x.CnpgDatabaseId,
+                        principalTable: "CnpgDatabases",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_Environments_EnvironmentId",
+                        column: x => x.EnvironmentId,
+                        principalTable: "Environments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_MongoDatabases_MongoDatabaseId",
+                        column: x => x.MongoDatabaseId,
+                        principalTable: "MongoDatabases",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_RegisteredPostgresDatabases_RegisteredPostgresDatabaseId",
+                        column: x => x.RegisteredPostgresDatabaseId,
+                        principalTable: "RegisteredPostgresDatabases",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "AppAllowedStorages",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    AppId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    EnvironmentId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    StorageLinkId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "datetime2", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppAllowedStorages", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedStorages_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedStorages_Environments_EnvironmentId",
+                        column: x => x.EnvironmentId,
+                        principalTable: "Environments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedStorages_StorageLinks_StorageLinkId",
+                        column: x => x.StorageLinkId,
+                        principalTable: "StorageLinks",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedCaches_AppId",
+                table: "AppAllowedCaches",
+                column: "AppId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedCaches_EnvironmentId",
+                table: "AppAllowedCaches",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedCaches_RedisClusterId",
+                table: "AppAllowedCaches",
+                column: "RedisClusterId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_AppId",
+                table: "AppAllowedDatabases",
+                column: "AppId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_CnpgDatabaseId",
+                table: "AppAllowedDatabases",
+                column: "CnpgDatabaseId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_EnvironmentId",
+                table: "AppAllowedDatabases",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_MongoDatabaseId",
+                table: "AppAllowedDatabases",
+                column: "MongoDatabaseId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_RegisteredPostgresDatabaseId",
+                table: "AppAllowedDatabases",
+                column: "RegisteredPostgresDatabaseId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedStorages_AppId",
+                table: "AppAllowedStorages",
+                column: "AppId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedStorages_EnvironmentId",
+                table: "AppAllowedStorages",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedStorages_StorageLinkId",
+                table: "AppAllowedStorages",
+                column: "StorageLinkId");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "AppAllowedCaches");
+
+            migrationBuilder.DropTable(
+                name: "AppAllowedDatabases");
+
+            migrationBuilder.DropTable(
+                name: "AppAllowedStorages");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609200000_AddCredentialUrlPattern.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609200000_AddCredentialUrlPattern.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609200000_AddCredentialUrlPattern.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609200000_AddCredentialUrlPattern.cs
@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    /// <inheritdoc />
+    public partial class AddCredentialUrlPattern : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "UrlPattern",
+                table: "CustomerGitCredentials",
+                type: "nvarchar(500)",
+                maxLength: 500,
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "UrlPattern",
+                table: "CustomerGitCredentials");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260609210000_AddDeploymentRouteApplied.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260609210000_AddDeploymentRouteApplied.cs
@@ -0,0 +1,29 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    /// <inheritdoc />
+    public partial class AddDeploymentRouteApplied : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<DateTime>(
+                name: "ClusterAppliedAt",
+                table: "AppDeploymentRoutes",
+                type: "datetime2",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "ClusterAppliedAt",
+                table: "AppDeploymentRoutes");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260610120000_AddVaultSecretVersions.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260610120000_AddVaultSecretVersions.cs
@@ -0,0 +1,61 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    /// <inheritdoc />
+    public partial class AddVaultSecretVersions : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "UpdatedBy",
+                table: "VaultSecrets",
+                type: "nvarchar(254)",
+                maxLength: 254,
+                nullable: true);
+
+            migrationBuilder.CreateTable(
+                name: "VaultSecretVersions",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    SecretId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    VersionNumber = table.Column<int>(type: "int", nullable: false),
+                    EncryptedValue = table.Column<byte[]>(type: "varbinary(max)", nullable: false),
+                    Nonce = table.Column<byte[]>(type: "varbinary(max)", nullable: false),
+                    CreatedBy = table.Column<string>(type: "nvarchar(254)", maxLength: 254, nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "datetime2", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_VaultSecretVersions", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_VaultSecretVersions_VaultSecrets_SecretId",
+                        column: x => x.SecretId,
+                        principalTable: "VaultSecrets",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_VaultSecretVersions_SecretId_VersionNumber",
+                table: "VaultSecretVersions",
+                columns: new[] { "SecretId", "VersionNumber" });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "VaultSecretVersions");
+
+            migrationBuilder.DropColumn(
+                name: "UpdatedBy",
+                table: "VaultSecrets");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260611000000_AddOpsTeamFeatures.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260611000000_AddOpsTeamFeatures.cs
@@ -0,0 +1,150 @@
+using System;
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    [DbContext(typeof(SqlServerApplicationDbContext))]
+    [Migration("20260611000000_AddOpsTeamFeatures")]
+    public partial class AddOpsTeamFeatures : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "AssignedTo",
+                table: "AlertIncidents",
+                type: "nvarchar(256)",
+                maxLength: 256,
+                nullable: true);
+
+            migrationBuilder.AddColumn<DateTime>(
+                name: "AssignedAt",
+                table: "AlertIncidents",
+                type: "datetime2",
+                nullable: true);
+
+            migrationBuilder.CreateTable(
+                name: "OnCallSchedules",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    TenantId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    Name = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: false),
+                    Description = table.Column<string>(type: "nvarchar(500)", maxLength: 500, nullable: true),
+                    IsEnabled = table.Column<bool>(type: "bit", nullable: false, defaultValue: true),
+                    CreatedAt = table.Column<DateTime>(type: "datetime2", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_OnCallSchedules", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_OnCallSchedules_Tenants_TenantId",
+                        column: x => x.TenantId,
+                        principalTable: "Tenants",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "OnCallShifts",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    ScheduleId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    AssigneeName = table.Column<string>(type: "nvarchar(256)", maxLength: 256, nullable: false),
+                    AssigneeEmail = table.Column<string>(type: "nvarchar(256)", maxLength: 256, nullable: true),
+                    StartsAt = table.Column<DateTime>(type: "datetime2", nullable: false),
+                    EndsAt = table.Column<DateTime>(type: "datetime2", nullable: false),
+                    Notes = table.Column<string>(type: "nvarchar(1000)", maxLength: 1000, nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_OnCallShifts", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_OnCallShifts_OnCallSchedules_ScheduleId",
+                        column: x => x.ScheduleId,
+                        principalTable: "OnCallSchedules",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "AlertRoutingRules",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    TenantId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    Name = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: false),
+                    Priority = table.Column<int>(type: "int", nullable: false, defaultValue: 0),
+                    ChannelId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    MatchAlertName = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: true),
+                    MatchNamespace = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: true),
+                    MatchSeverity = table.Column<string>(type: "nvarchar(20)", maxLength: 20, nullable: true),
+                    MatchLabelKey = table.Column<string>(type: "nvarchar(100)", maxLength: 100, nullable: true),
+                    MatchLabelValue = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: true),
+                    IsEnabled = table.Column<bool>(type: "bit", nullable: false, defaultValue: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AlertRoutingRules", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AlertRoutingRules_Tenants_TenantId",
+                        column: x => x.TenantId,
+                        principalTable: "Tenants",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AlertRoutingRules_NotificationChannels_ChannelId",
+                        column: x => x.ChannelId,
+                        principalTable: "NotificationChannels",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_OnCallShifts_ScheduleId",
+                table: "OnCallShifts",
+                column: "ScheduleId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_OnCallShifts_StartsAt",
+                table: "OnCallShifts",
+                column: "StartsAt");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AlertRoutingRules_TenantId",
+                table: "AlertRoutingRules",
+                column: "TenantId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AlertRoutingRules_ChannelId",
+                table: "AlertRoutingRules",
+                column: "ChannelId");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "AlertRoutingRules");
+
+            migrationBuilder.DropTable(
+                name: "OnCallShifts");
+
+            migrationBuilder.DropTable(
+                name: "OnCallSchedules");
+
+            migrationBuilder.DropColumn(
+                name: "AssignedTo",
+                table: "AlertIncidents");
+
+            migrationBuilder.DropColumn(
+                name: "AssignedAt",
+                table: "AlertIncidents");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260611010000_AddAlertIncidentRunbookUrl.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260611010000_AddAlertIncidentRunbookUrl.cs
@@ -0,0 +1,31 @@
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    [DbContext(typeof(SqlServerApplicationDbContext))]
+    [Migration("20260611010000_AddAlertIncidentRunbookUrl")]
+    public partial class AddAlertIncidentRunbookUrl : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "RunbookUrl",
+                table: "AlertIncidents",
+                type: "nvarchar(500)",
+                maxLength: 500,
+                nullable: false,
+                defaultValue: "");
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "RunbookUrl",
+                table: "AlertIncidents");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260611020000_AddAlertIncidentEscalation.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260611020000_AddAlertIncidentEscalation.cs
@@ -0,0 +1,39 @@
+using System;
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    [DbContext(typeof(SqlServerApplicationDbContext))]
+    [Migration("20260611020000_AddAlertIncidentEscalation")]
+    public partial class AddAlertIncidentEscalation : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<DateTime>(
+                name: "EscalatedAt",
+                table: "AlertIncidents",
+                type: "datetime2",
+                nullable: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AlertIncidents_EscalatedAt",
+                table: "AlertIncidents",
+                column: "EscalatedAt");
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_AlertIncidents_EscalatedAt",
+                table: "AlertIncidents");
+
+            migrationBuilder.DropColumn(
+                name: "EscalatedAt",
+                table: "AlertIncidents");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260611030000_AddDeploymentGitUrl.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260611030000_AddDeploymentGitUrl.cs
@@ -0,0 +1,26 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    public partial class AddDeploymentGitUrl : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "GitUrl",
+                table: "AppDeployments",
+                type: "nvarchar(2000)",
+                maxLength: 2000,
+                nullable: true);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "GitUrl",
+                table: "AppDeployments");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260611040000_AddNotificationProviderConfig.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260611040000_AddNotificationProviderConfig.cs
@@ -0,0 +1,41 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    public partial class AddNotificationProviderConfig : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "NotificationProviderConfigs",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    ProviderType = table.Column<string>(type: "nvarchar(30)", maxLength: 30, nullable: false),
+                    ConfigurationJson = table.Column<string>(type: "nvarchar(max)", nullable: false),
+                    IsEnabled = table.Column<bool>(type: "bit", nullable: false),
+                    UpdatedAt = table.Column<DateTime>(type: "datetime2", nullable: false),
+                    UpdatedByUserId = table.Column<string>(type: "nvarchar(450)", maxLength: 450, nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_NotificationProviderConfigs", x => x.Id);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_NotificationProviderConfigs_ProviderType",
+                table: "NotificationProviderConfigs",
+                column: "ProviderType",
+                unique: true);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "NotificationProviderConfigs");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260611060000_AddAlertRoutingSuppression.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260611060000_AddAlertRoutingSuppression.cs
@@ -0,0 +1,100 @@
+using System;
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    [DbContext(typeof(SqlServerApplicationDbContext))]
+    [Migration("20260611060000_AddAlertRoutingSuppression")]
+    public partial class AddAlertRoutingSuppression : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            // Drop existing FK, make ChannelId nullable, re-add FK
+            migrationBuilder.DropForeignKey(
+                name: "FK_AlertRoutingRules_NotificationChannels_ChannelId",
+                table: "AlertRoutingRules");
+
+            migrationBuilder.AlterColumn<Guid>(
+                name: "ChannelId",
+                table: "AlertRoutingRules",
+                type: "uniqueidentifier",
+                nullable: true,
+                oldClrType: typeof(Guid),
+                oldType: "uniqueidentifier");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AlertRoutingRules_NotificationChannels_ChannelId",
+                table: "AlertRoutingRules",
+                column: "ChannelId",
+                principalTable: "NotificationChannels",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Cascade);
+
+            // Add new columns
+            migrationBuilder.AddColumn<bool>(
+                name: "SuppressIncident",
+                table: "AlertRoutingRules",
+                type: "bit",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "MatchClusterId",
+                table: "AlertRoutingRules",
+                type: "uniqueidentifier",
+                nullable: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AlertRoutingRules_MatchClusterId",
+                table: "AlertRoutingRules",
+                column: "MatchClusterId");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AlertRoutingRules_KubernetesClusters_MatchClusterId",
+                table: "AlertRoutingRules",
+                column: "MatchClusterId",
+                principalTable: "KubernetesClusters",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.SetNull);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_AlertRoutingRules_KubernetesClusters_MatchClusterId",
+                table: "AlertRoutingRules");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AlertRoutingRules_MatchClusterId",
+                table: "AlertRoutingRules");
+
+            migrationBuilder.DropColumn(name: "MatchClusterId", table: "AlertRoutingRules");
+            migrationBuilder.DropColumn(name: "SuppressIncident", table: "AlertRoutingRules");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_AlertRoutingRules_NotificationChannels_ChannelId",
+                table: "AlertRoutingRules");
+
+            migrationBuilder.AlterColumn<Guid>(
+                name: "ChannelId",
+                table: "AlertRoutingRules",
+                type: "uniqueidentifier",
+                nullable: false,
+                oldClrType: typeof(Guid),
+                oldType: "uniqueidentifier",
+                oldNullable: true);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AlertRoutingRules_NotificationChannels_ChannelId",
+                table: "AlertRoutingRules",
+                column: "ChannelId",
+                principalTable: "NotificationChannels",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Cascade);
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260611122526_AddClusterServers.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260611122526_AddClusterServers.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/SqlServer/20260611122526_AddClusterServers.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/20260611122526_AddClusterServers.cs
@@ -0,0 +1,236 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.SqlServer
+{
+    /// <inheritdoc />
+    public partial class AddClusterServers : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_OnCallSchedules_TenantId",
+                table: "OnCallSchedules");
+
+            migrationBuilder.AddColumn<string>(
+                name: "UpdatedBy",
+                table: "VaultSecrets",
+                type: "nvarchar(max)",
+                nullable: true);
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "OnCallSchedules",
+                type: "bit",
+                nullable: false,
+                oldClrType: typeof(bool),
+                oldType: "bit",
+                oldDefaultValue: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "GitUrl",
+                table: "AppDeployments",
+                type: "nvarchar(max)",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "nvarchar(2000)",
+                oldMaxLength: 2000,
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "SuppressIncident",
+                table: "AlertRoutingRules",
+                type: "bit",
+                nullable: false,
+                oldClrType: typeof(bool),
+                oldType: "bit",
+                oldDefaultValue: false);
+
+            migrationBuilder.AlterColumn<int>(
+                name: "Priority",
+                table: "AlertRoutingRules",
+                type: "int",
+                nullable: false,
+                oldClrType: typeof(int),
+                oldType: "int",
+                oldDefaultValue: 0);
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "AlertRoutingRules",
+                type: "bit",
+                nullable: false,
+                oldClrType: typeof(bool),
+                oldType: "bit",
+                oldDefaultValue: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "RunbookUrl",
+                table: "AlertIncidents",
+                type: "nvarchar(500)",
+                maxLength: 500,
+                nullable: false,
+                oldClrType: typeof(string),
+                oldType: "nvarchar(500)",
+                oldMaxLength: 500,
+                oldDefaultValue: "");
+
+            migrationBuilder.CreateTable(
+                name: "ClusterServers",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    ClusterId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    NodeName = table.Column<string>(type: "nvarchar(253)", maxLength: 253, nullable: true),
+                    DisplayName = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: false),
+                    IpAddress = table.Column<string>(type: "nvarchar(45)", maxLength: 45, nullable: true),
+                    ManagementIpAddress = table.Column<string>(type: "nvarchar(45)", maxLength: 45, nullable: true),
+                    Provider = table.Column<string>(type: "nvarchar(20)", maxLength: 20, nullable: false),
+                    OsDistribution = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: true),
+                    CpuCores = table.Column<int>(type: "int", nullable: true),
+                    RamGb = table.Column<int>(type: "int", nullable: true),
+                    DiskGb = table.Column<int>(type: "int", nullable: true),
+                    Location = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: true),
+                    SshUser = table.Column<string>(type: "nvarchar(100)", maxLength: 100, nullable: true),
+                    SshPort = table.Column<int>(type: "int", nullable: false),
+                    JumpHost = table.Column<string>(type: "nvarchar(500)", maxLength: 500, nullable: true),
+                    Notes = table.Column<string>(type: "nvarchar(2000)", maxLength: 2000, nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "datetime2", nullable: false),
+                    UpdatedAt = table.Column<DateTime>(type: "datetime2", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_ClusterServers", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_ClusterServers_KubernetesClusters_ClusterId",
+                        column: x => x.ClusterId,
+                        principalTable: "KubernetesClusters",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "VaultSecretVersions",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    SecretId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    VersionNumber = table.Column<int>(type: "int", nullable: false),
+                    EncryptedValue = table.Column<byte[]>(type: "varbinary(max)", nullable: false),
+                    Nonce = table.Column<byte[]>(type: "varbinary(max)", nullable: false),
+                    CreatedBy = table.Column<string>(type: "nvarchar(254)", maxLength: 254, nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "datetime2", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_VaultSecretVersions", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_VaultSecretVersions_VaultSecrets_SecretId",
+                        column: x => x.SecretId,
+                        principalTable: "VaultSecrets",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_OnCallSchedules_TenantId_Name",
+                table: "OnCallSchedules",
+                columns: new[] { "TenantId", "Name" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_ClusterServers_ClusterId_DisplayName",
+                table: "ClusterServers",
+                columns: new[] { "ClusterId", "DisplayName" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_VaultSecretVersions_SecretId_VersionNumber",
+                table: "VaultSecretVersions",
+                columns: new[] { "SecretId", "VersionNumber" });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "ClusterServers");
+
+            migrationBuilder.DropTable(
+                name: "VaultSecretVersions");
+
+            migrationBuilder.DropIndex(
+                name: "IX_OnCallSchedules_TenantId_Name",
+                table: "OnCallSchedules");
+
+            migrationBuilder.DropColumn(
+                name: "UpdatedBy",
+                table: "VaultSecrets");
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "OnCallSchedules",
+                type: "bit",
+                nullable: false,
+                defaultValue: true,
+                oldClrType: typeof(bool),
+                oldType: "bit");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "GitUrl",
+                table: "AppDeployments",
+                type: "nvarchar(2000)",
+                maxLength: 2000,
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "nvarchar(max)",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "SuppressIncident",
+                table: "AlertRoutingRules",
+                type: "bit",
+                nullable: false,
+                defaultValue: false,
+                oldClrType: typeof(bool),
+                oldType: "bit");
+
+            migrationBuilder.AlterColumn<int>(
+                name: "Priority",
+                table: "AlertRoutingRules",
+                type: "int",
+                nullable: false,
+                defaultValue: 0,
+                oldClrType: typeof(int),
+                oldType: "int");
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "AlertRoutingRules",
+                type: "bit",
+                nullable: false,
+                defaultValue: true,
+                oldClrType: typeof(bool),
+                oldType: "bit");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "RunbookUrl",
+                table: "AlertIncidents",
+                type: "nvarchar(500)",
+                maxLength: 500,
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "nvarchar(500)",
+                oldMaxLength: 500);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_OnCallSchedules_TenantId",
+                table: "OnCallSchedules",
+                column: "TenantId");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/SqlServer/SqlServerApplicationDbContextModelSnapshot.cs
+++ b/src/EntKube.Web/Data/Migrations/SqlServer/SqlServerApplicationDbContextModelSnapshot.cs
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609100644_AddAppRoutes.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609100644_AddAppRoutes.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609100644_AddAppRoutes.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609100644_AddAppRoutes.cs
@@ -0,0 +1,100 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    /// <inheritdoc />
+    public partial class AddAppRoutes : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "AppRoutes",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    AppId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    Hostname = table.Column<string>(type: "TEXT", maxLength: 253, nullable: false),
+                    TlsMode = table.Column<string>(type: "TEXT", maxLength: 20, nullable: false),
+                    ClusterIssuerName = table.Column<string>(type: "TEXT", maxLength: 200, nullable: true),
+                    TlsCertificate = table.Column<string>(type: "TEXT", nullable: true),
+                    TlsPrivateKey = table.Column<string>(type: "TEXT", nullable: true),
+                    IsEnabled = table.Column<bool>(type: "INTEGER", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "TEXT", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppRoutes", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppRoutes_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "AppDeploymentRoutes",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    AppRouteId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    AppDeploymentId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    PathPrefix = table.Column<string>(type: "TEXT", maxLength: 200, nullable: false),
+                    ServiceName = table.Column<string>(type: "TEXT", maxLength: 200, nullable: false),
+                    ServicePort = table.Column<int>(type: "INTEGER", nullable: false),
+                    GatewayName = table.Column<string>(type: "TEXT", maxLength: 200, nullable: true),
+                    GatewayNamespace = table.Column<string>(type: "TEXT", maxLength: 63, nullable: true),
+                    IsEnabled = table.Column<bool>(type: "INTEGER", nullable: false),
+                    LastHealthCheckAt = table.Column<DateTime>(type: "TEXT", nullable: true),
+                    LastStatusCode = table.Column<int>(type: "INTEGER", nullable: true),
+                    IsReachable = table.Column<bool>(type: "INTEGER", nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "TEXT", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppDeploymentRoutes", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppDeploymentRoutes_AppDeployments_AppDeploymentId",
+                        column: x => x.AppDeploymentId,
+                        principalTable: "AppDeployments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppDeploymentRoutes_AppRoutes_AppRouteId",
+                        column: x => x.AppRouteId,
+                        principalTable: "AppRoutes",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppDeploymentRoutes_AppDeploymentId",
+                table: "AppDeploymentRoutes",
+                column: "AppDeploymentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppDeploymentRoutes_AppRouteId",
+                table: "AppDeploymentRoutes",
+                column: "AppRouteId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRoutes_AppId",
+                table: "AppRoutes",
+                column: "AppId");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "AppDeploymentRoutes");
+
+            migrationBuilder.DropTable(
+                name: "AppRoutes");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609111905_GovernancePerEnvironment.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609111905_GovernancePerEnvironment.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609111905_GovernancePerEnvironment.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609111905_GovernancePerEnvironment.cs
@@ -0,0 +1,179 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    /// <inheritdoc />
+    public partial class GovernancePerEnvironment : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_AppRbacPolicies_AppId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppQuotas_AppId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppNetworkPolicies_AppId_Name",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "AppRbacPolicies",
+                type: "TEXT",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "AppQuotas",
+                type: "TEXT",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "AppNetworkPolicies",
+                type: "TEXT",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRbacPolicies_AppId_EnvironmentId",
+                table: "AppRbacPolicies",
+                columns: new[] { "AppId", "EnvironmentId" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRbacPolicies_EnvironmentId",
+                table: "AppRbacPolicies",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppQuotas_AppId_EnvironmentId",
+                table: "AppQuotas",
+                columns: new[] { "AppId", "EnvironmentId" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppQuotas_EnvironmentId",
+                table: "AppQuotas",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppNetworkPolicies_AppId_EnvironmentId_Name",
+                table: "AppNetworkPolicies",
+                columns: new[] { "AppId", "EnvironmentId", "Name" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppNetworkPolicies_EnvironmentId",
+                table: "AppNetworkPolicies",
+                column: "EnvironmentId");
+
+            migrationBuilder.Sql("DELETE FROM AppQuotas WHERE EnvironmentId = '00000000-0000-0000-0000-000000000000'");
+            migrationBuilder.Sql("DELETE FROM AppNetworkPolicies WHERE EnvironmentId = '00000000-0000-0000-0000-000000000000'");
+            migrationBuilder.Sql("DELETE FROM AppRbacPolicies WHERE EnvironmentId = '00000000-0000-0000-0000-000000000000'");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AppNetworkPolicies_Environments_EnvironmentId",
+                table: "AppNetworkPolicies",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AppQuotas_Environments_EnvironmentId",
+                table: "AppQuotas",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_AppRbacPolicies_Environments_EnvironmentId",
+                table: "AppRbacPolicies",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_AppNetworkPolicies_Environments_EnvironmentId",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_AppQuotas_Environments_EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_AppRbacPolicies_Environments_EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppRbacPolicies_AppId_EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppRbacPolicies_EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppQuotas_AppId_EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppQuotas_EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppNetworkPolicies_AppId_EnvironmentId_Name",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_AppNetworkPolicies_EnvironmentId",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "AppRbacPolicies");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "AppQuotas");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "AppNetworkPolicies");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppRbacPolicies_AppId",
+                table: "AppRbacPolicies",
+                column: "AppId",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppQuotas_AppId",
+                table: "AppQuotas",
+                column: "AppId",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppNetworkPolicies_AppId_Name",
+                table: "AppNetworkPolicies",
+                columns: new[] { "AppId", "Name" },
+                unique: true);
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609115702_GitPerEnvironment.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609115702_GitPerEnvironment.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609115702_GitPerEnvironment.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609115702_GitPerEnvironment.cs
@@ -0,0 +1,126 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    /// <inheritdoc />
+    public partial class GitPerEnvironment : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_UrlPattern",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_Name",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "CustomerGitRepoPolicies",
+                type: "TEXT",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.AddColumn<Guid>(
+                name: "EnvironmentId",
+                table: "CustomerGitCredentials",
+                type: "TEXT",
+                nullable: false,
+                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"));
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_EnvironmentId_UrlPattern",
+                table: "CustomerGitRepoPolicies",
+                columns: new[] { "CustomerId", "EnvironmentId", "UrlPattern" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitRepoPolicies_EnvironmentId",
+                table: "CustomerGitRepoPolicies",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_EnvironmentId_Name",
+                table: "CustomerGitCredentials",
+                columns: new[] { "CustomerId", "EnvironmentId", "Name" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitCredentials_EnvironmentId",
+                table: "CustomerGitCredentials",
+                column: "EnvironmentId");
+
+            migrationBuilder.Sql("DELETE FROM CustomerGitRepoPolicies WHERE EnvironmentId = '00000000-0000-0000-0000-000000000000'");
+            migrationBuilder.Sql("DELETE FROM CustomerGitCredentials WHERE EnvironmentId = '00000000-0000-0000-0000-000000000000'");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_CustomerGitCredentials_Environments_EnvironmentId",
+                table: "CustomerGitCredentials",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_CustomerGitRepoPolicies_Environments_EnvironmentId",
+                table: "CustomerGitRepoPolicies",
+                column: "EnvironmentId",
+                principalTable: "Environments",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_CustomerGitCredentials_Environments_EnvironmentId",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_CustomerGitRepoPolicies_Environments_EnvironmentId",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_EnvironmentId_UrlPattern",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitRepoPolicies_EnvironmentId",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_EnvironmentId_Name",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.DropIndex(
+                name: "IX_CustomerGitCredentials_EnvironmentId",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "CustomerGitRepoPolicies");
+
+            migrationBuilder.DropColumn(
+                name: "EnvironmentId",
+                table: "CustomerGitCredentials");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitRepoPolicies_CustomerId_UrlPattern",
+                table: "CustomerGitRepoPolicies",
+                columns: new[] { "CustomerId", "UrlPattern" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_CustomerGitCredentials_CustomerId_Name",
+                table: "CustomerGitCredentials",
+                columns: new[] { "CustomerId", "Name" },
+                unique: true);
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609125708_AddAppEnvironmentNamespace.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609125708_AddAppEnvironmentNamespace.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609125708_AddAppEnvironmentNamespace.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609125708_AddAppEnvironmentNamespace.cs
@@ -0,0 +1,28 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    /// <inheritdoc />
+    public partial class AddAppEnvironmentNamespace : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "Namespace",
+                table: "AppEnvironments",
+                type: "TEXT",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "Namespace",
+                table: "AppEnvironments");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609171012_AddGovernanceAllowlists.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609171012_AddGovernanceAllowlists.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609171012_AddGovernanceAllowlists.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609171012_AddGovernanceAllowlists.cs
@@ -0,0 +1,196 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    /// <inheritdoc />
+    public partial class AddGovernanceAllowlists : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "AppAllowedCaches",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    AppId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    EnvironmentId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    RedisClusterId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "TEXT", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppAllowedCaches", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedCaches_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedCaches_Environments_EnvironmentId",
+                        column: x => x.EnvironmentId,
+                        principalTable: "Environments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedCaches_RedisClusters_RedisClusterId",
+                        column: x => x.RedisClusterId,
+                        principalTable: "RedisClusters",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "AppAllowedDatabases",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    AppId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    EnvironmentId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    CnpgDatabaseId = table.Column<Guid>(type: "TEXT", nullable: true),
+                    MongoDatabaseId = table.Column<Guid>(type: "TEXT", nullable: true),
+                    RegisteredPostgresDatabaseId = table.Column<Guid>(type: "TEXT", nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "TEXT", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppAllowedDatabases", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_CnpgDatabases_CnpgDatabaseId",
+                        column: x => x.CnpgDatabaseId,
+                        principalTable: "CnpgDatabases",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_Environments_EnvironmentId",
+                        column: x => x.EnvironmentId,
+                        principalTable: "Environments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_MongoDatabases_MongoDatabaseId",
+                        column: x => x.MongoDatabaseId,
+                        principalTable: "MongoDatabases",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedDatabases_RegisteredPostgresDatabases_RegisteredPostgresDatabaseId",
+                        column: x => x.RegisteredPostgresDatabaseId,
+                        principalTable: "RegisteredPostgresDatabases",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "AppAllowedStorages",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    AppId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    EnvironmentId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    StorageLinkId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "TEXT", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AppAllowedStorages", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedStorages_Apps_AppId",
+                        column: x => x.AppId,
+                        principalTable: "Apps",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedStorages_Environments_EnvironmentId",
+                        column: x => x.EnvironmentId,
+                        principalTable: "Environments",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_AppAllowedStorages_StorageLinks_StorageLinkId",
+                        column: x => x.StorageLinkId,
+                        principalTable: "StorageLinks",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedCaches_AppId",
+                table: "AppAllowedCaches",
+                column: "AppId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedCaches_EnvironmentId",
+                table: "AppAllowedCaches",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedCaches_RedisClusterId",
+                table: "AppAllowedCaches",
+                column: "RedisClusterId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_AppId",
+                table: "AppAllowedDatabases",
+                column: "AppId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_CnpgDatabaseId",
+                table: "AppAllowedDatabases",
+                column: "CnpgDatabaseId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_EnvironmentId",
+                table: "AppAllowedDatabases",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_MongoDatabaseId",
+                table: "AppAllowedDatabases",
+                column: "MongoDatabaseId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedDatabases_RegisteredPostgresDatabaseId",
+                table: "AppAllowedDatabases",
+                column: "RegisteredPostgresDatabaseId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedStorages_AppId",
+                table: "AppAllowedStorages",
+                column: "AppId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedStorages_EnvironmentId",
+                table: "AppAllowedStorages",
+                column: "EnvironmentId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AppAllowedStorages_StorageLinkId",
+                table: "AppAllowedStorages",
+                column: "StorageLinkId");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "AppAllowedCaches");
+
+            migrationBuilder.DropTable(
+                name: "AppAllowedDatabases");
+
+            migrationBuilder.DropTable(
+                name: "AppAllowedStorages");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609200000_AddCredentialUrlPattern.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609200000_AddCredentialUrlPattern.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609200000_AddCredentialUrlPattern.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609200000_AddCredentialUrlPattern.cs
@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    /// <inheritdoc />
+    public partial class AddCredentialUrlPattern : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "UrlPattern",
+                table: "CustomerGitCredentials",
+                type: "TEXT",
+                maxLength: 500,
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "UrlPattern",
+                table: "CustomerGitCredentials");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260609210000_AddDeploymentRouteApplied.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260609210000_AddDeploymentRouteApplied.cs
@@ -0,0 +1,29 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    /// <inheritdoc />
+    public partial class AddDeploymentRouteApplied : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<DateTime>(
+                name: "ClusterAppliedAt",
+                table: "AppDeploymentRoutes",
+                type: "TEXT",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "ClusterAppliedAt",
+                table: "AppDeploymentRoutes");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260610120000_AddVaultSecretVersions.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260610120000_AddVaultSecretVersions.cs
@@ -0,0 +1,61 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    /// <inheritdoc />
+    public partial class AddVaultSecretVersions : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "UpdatedBy",
+                table: "VaultSecrets",
+                type: "TEXT",
+                maxLength: 254,
+                nullable: true);
+
+            migrationBuilder.CreateTable(
+                name: "VaultSecretVersions",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    SecretId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    VersionNumber = table.Column<int>(type: "INTEGER", nullable: false),
+                    EncryptedValue = table.Column<byte[]>(type: "BLOB", nullable: false),
+                    Nonce = table.Column<byte[]>(type: "BLOB", nullable: false),
+                    CreatedBy = table.Column<string>(type: "TEXT", maxLength: 254, nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "TEXT", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_VaultSecretVersions", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_VaultSecretVersions_VaultSecrets_SecretId",
+                        column: x => x.SecretId,
+                        principalTable: "VaultSecrets",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_VaultSecretVersions_SecretId_VersionNumber",
+                table: "VaultSecretVersions",
+                columns: new[] { "SecretId", "VersionNumber" });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "VaultSecretVersions");
+
+            migrationBuilder.DropColumn(
+                name: "UpdatedBy",
+                table: "VaultSecrets");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260611000000_AddOpsTeamFeatures.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260611000000_AddOpsTeamFeatures.cs
@@ -0,0 +1,150 @@
+using System;
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20260611000000_AddOpsTeamFeatures")]
+    public partial class AddOpsTeamFeatures : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "AssignedTo",
+                table: "AlertIncidents",
+                type: "TEXT",
+                maxLength: 256,
+                nullable: true);
+
+            migrationBuilder.AddColumn<DateTime>(
+                name: "AssignedAt",
+                table: "AlertIncidents",
+                type: "TEXT",
+                nullable: true);
+
+            migrationBuilder.CreateTable(
+                name: "OnCallSchedules",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    TenantId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    Name = table.Column<string>(type: "TEXT", maxLength: 200, nullable: false),
+                    Description = table.Column<string>(type: "TEXT", maxLength: 500, nullable: true),
+                    IsEnabled = table.Column<bool>(type: "INTEGER", nullable: false, defaultValue: true),
+                    CreatedAt = table.Column<DateTime>(type: "TEXT", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_OnCallSchedules", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_OnCallSchedules_Tenants_TenantId",
+                        column: x => x.TenantId,
+                        principalTable: "Tenants",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "OnCallShifts",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    ScheduleId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    AssigneeName = table.Column<string>(type: "TEXT", maxLength: 256, nullable: false),
+                    AssigneeEmail = table.Column<string>(type: "TEXT", maxLength: 256, nullable: true),
+                    StartsAt = table.Column<DateTime>(type: "TEXT", nullable: false),
+                    EndsAt = table.Column<DateTime>(type: "TEXT", nullable: false),
+                    Notes = table.Column<string>(type: "TEXT", maxLength: 1000, nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_OnCallShifts", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_OnCallShifts_OnCallSchedules_ScheduleId",
+                        column: x => x.ScheduleId,
+                        principalTable: "OnCallSchedules",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "AlertRoutingRules",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    TenantId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    Name = table.Column<string>(type: "TEXT", maxLength: 200, nullable: false),
+                    Priority = table.Column<int>(type: "INTEGER", nullable: false, defaultValue: 0),
+                    ChannelId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    MatchAlertName = table.Column<string>(type: "TEXT", maxLength: 200, nullable: true),
+                    MatchNamespace = table.Column<string>(type: "TEXT", maxLength: 200, nullable: true),
+                    MatchSeverity = table.Column<string>(type: "TEXT", maxLength: 20, nullable: true),
+                    MatchLabelKey = table.Column<string>(type: "TEXT", maxLength: 100, nullable: true),
+                    MatchLabelValue = table.Column<string>(type: "TEXT", maxLength: 200, nullable: true),
+                    IsEnabled = table.Column<bool>(type: "INTEGER", nullable: false, defaultValue: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_AlertRoutingRules", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_AlertRoutingRules_Tenants_TenantId",
+                        column: x => x.TenantId,
+                        principalTable: "Tenants",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_AlertRoutingRules_NotificationChannels_ChannelId",
+                        column: x => x.ChannelId,
+                        principalTable: "NotificationChannels",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_OnCallShifts_ScheduleId",
+                table: "OnCallShifts",
+                column: "ScheduleId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_OnCallShifts_StartsAt",
+                table: "OnCallShifts",
+                column: "StartsAt");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AlertRoutingRules_TenantId",
+                table: "AlertRoutingRules",
+                column: "TenantId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AlertRoutingRules_ChannelId",
+                table: "AlertRoutingRules",
+                column: "ChannelId");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "AlertRoutingRules");
+
+            migrationBuilder.DropTable(
+                name: "OnCallShifts");
+
+            migrationBuilder.DropTable(
+                name: "OnCallSchedules");
+
+            migrationBuilder.DropColumn(
+                name: "AssignedTo",
+                table: "AlertIncidents");
+
+            migrationBuilder.DropColumn(
+                name: "AssignedAt",
+                table: "AlertIncidents");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260611010000_AddAlertIncidentRunbookUrl.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260611010000_AddAlertIncidentRunbookUrl.cs
@@ -0,0 +1,31 @@
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20260611010000_AddAlertIncidentRunbookUrl")]
+    public partial class AddAlertIncidentRunbookUrl : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "RunbookUrl",
+                table: "AlertIncidents",
+                type: "TEXT",
+                maxLength: 500,
+                nullable: false,
+                defaultValue: "");
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "RunbookUrl",
+                table: "AlertIncidents");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260611020000_AddAlertIncidentEscalation.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260611020000_AddAlertIncidentEscalation.cs
@@ -0,0 +1,39 @@
+using System;
+using EntKube.Web.Data;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20260611020000_AddAlertIncidentEscalation")]
+    public partial class AddAlertIncidentEscalation : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<DateTime>(
+                name: "EscalatedAt",
+                table: "AlertIncidents",
+                type: "TEXT",
+                nullable: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_AlertIncidents_EscalatedAt",
+                table: "AlertIncidents",
+                column: "EscalatedAt");
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_AlertIncidents_EscalatedAt",
+                table: "AlertIncidents");
+
+            migrationBuilder.DropColumn(
+                name: "EscalatedAt",
+                table: "AlertIncidents");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260611030000_AddDeploymentGitUrl.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260611030000_AddDeploymentGitUrl.cs
@@ -0,0 +1,25 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    public partial class AddDeploymentGitUrl : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "GitUrl",
+                table: "AppDeployments",
+                type: "TEXT",
+                nullable: true);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "GitUrl",
+                table: "AppDeployments");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260611040000_AddNotificationProviderConfig.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260611040000_AddNotificationProviderConfig.cs
@@ -0,0 +1,41 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    public partial class AddNotificationProviderConfig : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "NotificationProviderConfigs",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    ProviderType = table.Column<string>(type: "TEXT", maxLength: 30, nullable: false),
+                    ConfigurationJson = table.Column<string>(type: "TEXT", nullable: false),
+                    IsEnabled = table.Column<bool>(type: "INTEGER", nullable: false),
+                    UpdatedAt = table.Column<DateTime>(type: "TEXT", nullable: false),
+                    UpdatedByUserId = table.Column<string>(type: "TEXT", maxLength: 450, nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_NotificationProviderConfigs", x => x.Id);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_NotificationProviderConfigs_ProviderType",
+                table: "NotificationProviderConfigs",
+                column: "ProviderType",
+                unique: true);
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "NotificationProviderConfigs");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260611060000_AddAlertRoutingSuppression.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260611060000_AddAlertRoutingSuppression.cs
@@ -0,0 +1,106 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    public partial class AddAlertRoutingSuppression : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            // SQLite does not support ALTER COLUMN, so rebuild the table to make ChannelId nullable
+            // and add the two new columns at the same time.
+            migrationBuilder.Sql("PRAGMA foreign_keys = OFF;");
+
+            migrationBuilder.Sql("""
+                CREATE TABLE "AlertRoutingRules_new" (
+                    "Id" TEXT NOT NULL CONSTRAINT "PK_AlertRoutingRules" PRIMARY KEY,
+                    "TenantId" TEXT NOT NULL,
+                    "Name" TEXT NOT NULL,
+                    "Priority" INTEGER NOT NULL DEFAULT 0,
+                    "ChannelId" TEXT,
+                    "MatchAlertName" TEXT,
+                    "MatchNamespace" TEXT,
+                    "MatchSeverity" TEXT,
+                    "MatchLabelKey" TEXT,
+                    "MatchLabelValue" TEXT,
+                    "IsEnabled" INTEGER NOT NULL DEFAULT 1,
+                    "SuppressIncident" INTEGER NOT NULL DEFAULT 0,
+                    "MatchClusterId" TEXT,
+                    CONSTRAINT "FK_AlertRoutingRules_Tenants_TenantId"
+                        FOREIGN KEY ("TenantId") REFERENCES "Tenants" ("Id") ON DELETE CASCADE,
+                    CONSTRAINT "FK_AlertRoutingRules_NotificationChannels_ChannelId"
+                        FOREIGN KEY ("ChannelId") REFERENCES "NotificationChannels" ("Id") ON DELETE CASCADE,
+                    CONSTRAINT "FK_AlertRoutingRules_KubernetesClusters_MatchClusterId"
+                        FOREIGN KEY ("MatchClusterId") REFERENCES "KubernetesClusters" ("Id") ON DELETE SET NULL
+                );
+                """);
+
+            migrationBuilder.Sql("""
+                INSERT INTO "AlertRoutingRules_new"
+                    ("Id","TenantId","Name","Priority","ChannelId","MatchAlertName","MatchNamespace",
+                     "MatchSeverity","MatchLabelKey","MatchLabelValue","IsEnabled","SuppressIncident","MatchClusterId")
+                SELECT
+                    "Id","TenantId","Name","Priority","ChannelId","MatchAlertName","MatchNamespace",
+                    "MatchSeverity","MatchLabelKey","MatchLabelValue","IsEnabled", 0, NULL
+                FROM "AlertRoutingRules";
+                """);
+
+            migrationBuilder.DropTable("AlertRoutingRules");
+
+            migrationBuilder.Sql("""ALTER TABLE "AlertRoutingRules_new" RENAME TO "AlertRoutingRules";""");
+
+            migrationBuilder.CreateIndex("IX_AlertRoutingRules_TenantId", "AlertRoutingRules", "TenantId");
+            migrationBuilder.CreateIndex("IX_AlertRoutingRules_ChannelId", "AlertRoutingRules", "ChannelId");
+            migrationBuilder.CreateIndex("IX_AlertRoutingRules_MatchClusterId", "AlertRoutingRules", "MatchClusterId");
+
+            migrationBuilder.Sql("PRAGMA foreign_keys = ON;");
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql("PRAGMA foreign_keys = OFF;");
+
+            migrationBuilder.Sql("""
+                CREATE TABLE "AlertRoutingRules_old" (
+                    "Id" TEXT NOT NULL CONSTRAINT "PK_AlertRoutingRules" PRIMARY KEY,
+                    "TenantId" TEXT NOT NULL,
+                    "Name" TEXT NOT NULL,
+                    "Priority" INTEGER NOT NULL DEFAULT 0,
+                    "ChannelId" TEXT NOT NULL,
+                    "MatchAlertName" TEXT,
+                    "MatchNamespace" TEXT,
+                    "MatchSeverity" TEXT,
+                    "MatchLabelKey" TEXT,
+                    "MatchLabelValue" TEXT,
+                    "IsEnabled" INTEGER NOT NULL DEFAULT 1,
+                    CONSTRAINT "FK_AlertRoutingRules_Tenants_TenantId"
+                        FOREIGN KEY ("TenantId") REFERENCES "Tenants" ("Id") ON DELETE CASCADE,
+                    CONSTRAINT "FK_AlertRoutingRules_NotificationChannels_ChannelId"
+                        FOREIGN KEY ("ChannelId") REFERENCES "NotificationChannels" ("Id") ON DELETE CASCADE
+                );
+                """);
+
+            migrationBuilder.Sql("""
+                INSERT INTO "AlertRoutingRules_old"
+                    ("Id","TenantId","Name","Priority","ChannelId","MatchAlertName","MatchNamespace",
+                     "MatchSeverity","MatchLabelKey","MatchLabelValue","IsEnabled")
+                SELECT
+                    "Id","TenantId","Name","Priority",COALESCE("ChannelId",'00000000-0000-0000-0000-000000000000'),
+                    "MatchAlertName","MatchNamespace","MatchSeverity","MatchLabelKey","MatchLabelValue","IsEnabled"
+                FROM "AlertRoutingRules"
+                WHERE "SuppressIncident" = 0;
+                """);
+
+            migrationBuilder.DropTable("AlertRoutingRules");
+
+            migrationBuilder.Sql("""ALTER TABLE "AlertRoutingRules_old" RENAME TO "AlertRoutingRules";""");
+
+            migrationBuilder.CreateIndex("IX_AlertRoutingRules_TenantId", "AlertRoutingRules", "TenantId");
+            migrationBuilder.CreateIndex("IX_AlertRoutingRules_ChannelId", "AlertRoutingRules", "ChannelId");
+
+            migrationBuilder.Sql("PRAGMA foreign_keys = ON;");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260611122519_AddClusterServers.Designer.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260611122519_AddClusterServers.Designer.cs
--- a/src/EntKube.Web/Data/Migrations/Sqlite/20260611122519_AddClusterServers.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/20260611122519_AddClusterServers.cs
@@ -0,0 +1,216 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EntKube.Web.Data.Migrations.Sqlite
+{
+    /// <inheritdoc />
+    public partial class AddClusterServers : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_OnCallSchedules_TenantId",
+                table: "OnCallSchedules");
+
+            migrationBuilder.AddColumn<string>(
+                name: "UpdatedBy",
+                table: "VaultSecrets",
+                type: "TEXT",
+                nullable: true);
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "OnCallSchedules",
+                type: "INTEGER",
+                nullable: false,
+                oldClrType: typeof(bool),
+                oldType: "INTEGER",
+                oldDefaultValue: true);
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "SuppressIncident",
+                table: "AlertRoutingRules",
+                type: "INTEGER",
+                nullable: false,
+                oldClrType: typeof(bool),
+                oldType: "INTEGER",
+                oldDefaultValue: false);
+
+            migrationBuilder.AlterColumn<int>(
+                name: "Priority",
+                table: "AlertRoutingRules",
+                type: "INTEGER",
+                nullable: false,
+                oldClrType: typeof(int),
+                oldType: "INTEGER",
+                oldDefaultValue: 0);
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "AlertRoutingRules",
+                type: "INTEGER",
+                nullable: false,
+                oldClrType: typeof(bool),
+                oldType: "INTEGER",
+                oldDefaultValue: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "RunbookUrl",
+                table: "AlertIncidents",
+                type: "TEXT",
+                maxLength: 500,
+                nullable: false,
+                oldClrType: typeof(string),
+                oldType: "TEXT",
+                oldMaxLength: 500,
+                oldDefaultValue: "");
+
+            migrationBuilder.CreateTable(
+                name: "ClusterServers",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    ClusterId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    NodeName = table.Column<string>(type: "TEXT", maxLength: 253, nullable: true),
+                    DisplayName = table.Column<string>(type: "TEXT", maxLength: 200, nullable: false),
+                    IpAddress = table.Column<string>(type: "TEXT", maxLength: 45, nullable: true),
+                    ManagementIpAddress = table.Column<string>(type: "TEXT", maxLength: 45, nullable: true),
+                    Provider = table.Column<string>(type: "TEXT", maxLength: 20, nullable: false),
+                    OsDistribution = table.Column<string>(type: "TEXT", maxLength: 200, nullable: true),
+                    CpuCores = table.Column<int>(type: "INTEGER", nullable: true),
+                    RamGb = table.Column<int>(type: "INTEGER", nullable: true),
+                    DiskGb = table.Column<int>(type: "INTEGER", nullable: true),
+                    Location = table.Column<string>(type: "TEXT", maxLength: 200, nullable: true),
+                    SshUser = table.Column<string>(type: "TEXT", maxLength: 100, nullable: true),
+                    SshPort = table.Column<int>(type: "INTEGER", nullable: false),
+                    JumpHost = table.Column<string>(type: "TEXT", maxLength: 500, nullable: true),
+                    Notes = table.Column<string>(type: "TEXT", maxLength: 2000, nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "TEXT", nullable: false),
+                    UpdatedAt = table.Column<DateTime>(type: "TEXT", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_ClusterServers", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_ClusterServers_KubernetesClusters_ClusterId",
+                        column: x => x.ClusterId,
+                        principalTable: "KubernetesClusters",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "VaultSecretVersions",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    SecretId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    VersionNumber = table.Column<int>(type: "INTEGER", nullable: false),
+                    EncryptedValue = table.Column<byte[]>(type: "BLOB", nullable: false),
+                    Nonce = table.Column<byte[]>(type: "BLOB", nullable: false),
+                    CreatedBy = table.Column<string>(type: "TEXT", maxLength: 254, nullable: true),
+                    CreatedAt = table.Column<DateTime>(type: "TEXT", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_VaultSecretVersions", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_VaultSecretVersions_VaultSecrets_SecretId",
+                        column: x => x.SecretId,
+                        principalTable: "VaultSecrets",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_OnCallSchedules_TenantId_Name",
+                table: "OnCallSchedules",
+                columns: new[] { "TenantId", "Name" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_ClusterServers_ClusterId_DisplayName",
+                table: "ClusterServers",
+                columns: new[] { "ClusterId", "DisplayName" },
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_VaultSecretVersions_SecretId_VersionNumber",
+                table: "VaultSecretVersions",
+                columns: new[] { "SecretId", "VersionNumber" });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "ClusterServers");
+
+            migrationBuilder.DropTable(
+                name: "VaultSecretVersions");
+
+            migrationBuilder.DropIndex(
+                name: "IX_OnCallSchedules_TenantId_Name",
+                table: "OnCallSchedules");
+
+            migrationBuilder.DropColumn(
+                name: "UpdatedBy",
+                table: "VaultSecrets");
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "OnCallSchedules",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: true,
+                oldClrType: typeof(bool),
+                oldType: "INTEGER");
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "SuppressIncident",
+                table: "AlertRoutingRules",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false,
+                oldClrType: typeof(bool),
+                oldType: "INTEGER");
+
+            migrationBuilder.AlterColumn<int>(
+                name: "Priority",
+                table: "AlertRoutingRules",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: 0,
+                oldClrType: typeof(int),
+                oldType: "INTEGER");
+
+            migrationBuilder.AlterColumn<bool>(
+                name: "IsEnabled",
+                table: "AlertRoutingRules",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: true,
+                oldClrType: typeof(bool),
+                oldType: "INTEGER");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "RunbookUrl",
+                table: "AlertIncidents",
+                type: "TEXT",
+                maxLength: 500,
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "TEXT",
+                oldMaxLength: 500);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_OnCallSchedules_TenantId",
+                table: "OnCallSchedules",
+                column: "TenantId");
+        }
+    }
+}
--- a/src/EntKube.Web/Data/Migrations/Sqlite/ApplicationDbContextModelSnapshot.cs
+++ b/src/EntKube.Web/Data/Migrations/Sqlite/ApplicationDbContextModelSnapshot.cs