Add user-engine backup and rollback verification

sso-mfa/k8s/user-engine/runtime.yaml

@@ -45,7 +45,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: portal
-          image: user-engine:portal-746bf21
+          image: user-engine:portal-2bcda7f
           imagePullPolicy: Never
           ports: [{name: http, containerPort: 8080}]
           env:
@@ -151,6 +151,12 @@ spec:
         - {protocol: TCP, port: 5432}
         - {protocol: TCP, port: 8000}
         - {protocol: TCP, port: 9187}
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: user-engine-backup
+              app.kubernetes.io/part-of: user-engine
+      ports: [{protocol: TCP, port: 5432}]
   egress:
     # CNPG instance manager must read its Cluster resource during bootstrap.
     # K3s network policy evaluates the API service after DNAT on port 6443.