Move portal workloads to registry digests

sso-mfa/k8s/identity-provisioner/deployment.yaml

@@ -23,8 +23,8 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: provisioner
-          image: identity-provisioner:12cdef5
-          imagePullPolicy: Never
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:ecd9ba44bb83a4809fb47e0ef016e3f71f38a87f1adbdbf0a102ac24c12f6df8
+          imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:
             - {name: LLDAP_URL, value: "http://lldap.sso.svc.cluster.local:17170"}

sso-mfa/k8s/user-engine/README.md

@@ -6,9 +6,11 @@ no public Ingress until the KeyCape authorization-code/PKCE edge and
 must remain impossible because the application accepts identity only from a
 trusted edge marker plus verified claims.
 
-For the current pre-production bootstrap the image is imported directly into
-k3s and uses `imagePullPolicy: Never`. Replace it with the immutable Forgejo
-OCI digest after the OpenBao package-publisher lane is available.
+The portal image is published through the activity-core workload-scoped
+Forgejo package credential and deployed from
+`forgejo.coulomb.social/coulomb/user-engine` by immutable digest. The public
+package read was verified without an image pull Secret; publishing still uses
+the ExternalSecret-backed credential and temporary client state.
 
 The CloudNativePG operator creates `user-engine-pg-app`, including its `uri`
 field. `user-engine-runtime` contains only the generated edge marker and must

sso-mfa/k8s/user-engine/runtime.yaml

@@ -45,8 +45,8 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: portal
-          image: user-engine:portal-2bcda7f
-          imagePullPolicy: Never
+          image: forgejo.coulomb.social/coulomb/user-engine@sha256:60f4fa1c144c8f7b9e2e74c264e4594e63ac6a0c0f75e5cf536880b8fd99fa28
+          imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:
             - name: USER_ENGINE_DATABASE_URL

sso-mfa/k8s/user-engine/verify-operability.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 namespace=user-engine
 deployment=user-engine
 manifest="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/runtime.yaml"
+rollback_target="${USER_ENGINE_ROLLBACK_IMAGE:-forgejo.coulomb.social/coulomb/user-engine@sha256:d25037e61c0c71dd9fbf89f653797932061b0be1fc5b4b23223821e5c2e3d6d0}"
 exercise_rollback=false
 if [[ "${1:-}" == "--exercise-rollback" ]]; then
   exercise_rollback=true
@@ -47,12 +48,13 @@ print("%s %s %s" % (denied, response.status, int("user_engine_ready 1" in body))
 rollback_image=""
 rollback_restored=true
 if $exercise_rollback; then
-  kubectl -n "$namespace" rollout undo deployment/"$deployment" >/dev/null
+  kubectl -n "$namespace" set image deployment/"$deployment" \
+    "portal=${rollback_target}" >/dev/null
   kubectl -n "$namespace" rollout status deployment/"$deployment" \
     --timeout=180s >/dev/null
   rollback_image="$(kubectl -n "$namespace" get deployment "$deployment" \
     -o jsonpath='{.spec.template.spec.containers[0].image}')"
-  [[ "$rollback_image" != "$current_image" ]]
+  [[ "$rollback_image" == "$rollback_target" ]]
   kubectl apply -f "$manifest" >/dev/null
   kubectl -n "$namespace" rollout status deployment/"$deployment" \
     --timeout=180s >/dev/null