Shouldn't the migration task be separate from the application running the web server?

If you had this within an application running in a Kubernetes pod, then each instance will attempt to run the migration.

Additionally, the application will need a DB user credentials that is capable of powerful actions like dropping a table, so that the migrator is capable of doing that - this would be a potential security vulnerability.