Move portal workloads to registry digests

sso-mfa/k8s/user-engine/verify-operability.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 namespace=user-engine
 deployment=user-engine
 manifest="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/runtime.yaml"
+rollback_target="${USER_ENGINE_ROLLBACK_IMAGE:-forgejo.coulomb.social/coulomb/user-engine@sha256:d25037e61c0c71dd9fbf89f653797932061b0be1fc5b4b23223821e5c2e3d6d0}"
 exercise_rollback=false
 if [[ "${1:-}" == "--exercise-rollback" ]]; then
   exercise_rollback=true
@@ -47,12 +48,13 @@ print("%s %s %s" % (denied, response.status, int("user_engine_ready 1" in body))
 rollback_image=""
 rollback_restored=true
 if $exercise_rollback; then
-  kubectl -n "$namespace" rollout undo deployment/"$deployment" >/dev/null
+  kubectl -n "$namespace" set image deployment/"$deployment" \
+    "portal=${rollback_target}" >/dev/null
   kubectl -n "$namespace" rollout status deployment/"$deployment" \
     --timeout=180s >/dev/null
   rollback_image="$(kubectl -n "$namespace" get deployment "$deployment" \
     -o jsonpath='{.spec.template.spec.containers[0].image}')"
-  [[ "$rollback_image" != "$current_image" ]]
+  [[ "$rollback_image" == "$rollback_target" ]]
   kubectl apply -f "$manifest" >/dev/null
   kubectl -n "$namespace" rollout status deployment/"$deployment" \
     --timeout=180s >/dev/null