refactor(e2e): refactor runtime tests into TypeScript (#4809)

* fix(e2e): consolidate SHOWCASE_RUNTIME_DB into SHOWCASE_RUNTIME project

Merge the SHOWCASE_RUNTIME_DB Playwright project into SHOWCASE_RUNTIME
to simplify runtime test execution. All runtime tests now run
sequentially in a single project (workers: 1) with no inter-project
dependencies.

Key changes:
- Deploy runtime with internal PostgreSQL (Helm sub-chart / operator-
  managed) instead of external Crunchy DB
- External DB tests (RDS, Azure) switch to external DB at runtime via
  prepareForExternalDatabase() which patches ConfigMap + adds env vars
- Operator uses separate rhdh-runtime-config secret for RHDH_RUNTIME_URL
  to avoid POSTGRES_* env var conflicts with internal DB
- schema-mode-env.sh and schema-mode-setup.ts support operator-specific
  service/secret naming (backstage-psql-*) and POSTGRESQL_ADMIN_PASSWORD
  preservation
- SSL connection conditionally applied (skip for internal DB, enable for
  external DB)
- Added waitForRuntimeDeploymentReady() for config-map tests
- Added restartWithRetry() for operator reconciliation resilience
- Removed old resource files (values-showcase-postgres.yaml,
  rds-app-config.yaml, rhdh-start-runtime.yaml)

Assisted-by: OpenCode

* refactor(e2e): extract shared utilities and eliminate duplication

- Extract resolveInstallMethod(), base64Encode/Decode to helper.ts
- Deduplicate AppConfigYaml interface into runtime-config.ts
- Add patchAppConfig(), restartDeploymentWithRetry(), jsonPatchDeployment()
  to KubeClient — eliminates repeated ConfigMap patch + deployment restart
  patterns across postgres-config.ts and schema-mode-setup.ts
- Export getKubeApiErrorMessage, run(), discoverRouterBase() for reuse
- Deduplicate getDeploymentName() via getRhdhDeploymentName()
- Handle @sha256: digest refs in parseCatalogIndexImage()
- Type BackstageCR return value

Assisted-by: OpenCode

* fix(e2e): address review findings

- Fix parseCatalogIndexImage digest reconstruction: add ImageRef.separator
  field (':' for tags, '@' for digests) and imageRefToString() helper so
  downstream consumers reconstruct refs correctly
- Fix patchAppConfig no-op detection: compare YAML before/after mutator
  to skip unnecessary ConfigMap writes and misleading log messages
- Fix removeSchemaModePatchedEnvVars: add explicit backstageIdx === -1
  guard with warning log (consistent with ensurePostgresCredEnvVars)

Assisted-by: OpenCode

* refactor(e2e): unify KubeClient with rhdh-deployment.ts patterns

- KubeClient constructor: switch from loadFromOptions() with explicit
  K8S_CLUSTER_URL/K8S_CLUSTER_TOKEN env vars to loadFromDefault() which
  reads the kubeconfig file (set by oc login / kubectl config). This
  aligns with how rhdh-deployment.ts (auth-providers) connects.
- Extract waitForBackstageCrd() as standalone function in kube-client.ts,
  used by both runtime-deploy.ts and rhdh-deployment.ts — eliminates
  duplicated CRD polling loops.
- rhdh-deployment.ts: adopt base64Encode() from helper.ts,
  getKubeApiErrorMessage() from kube-client.ts for safe error logging.

Assisted-by: OpenCode

* refactor(e2e): standardize on js-yaml, drop yaml package

Migrate rhdh-deployment.ts from the `yaml` npm package to `js-yaml`
which is already used by kube-client.ts and runtime-config.ts. The two
packages have incompatible APIs (`yaml.parse/stringify` vs
`yaml.load/dump`) despite being imported under the same alias,
creating a copy-paste trap for developers.

Changes:
- rhdh-deployment.ts: yaml.parse() -> yaml.load(),
  yaml.stringify() -> yaml.dump()
- package.json: remove direct `yaml` dependency from e2e-tests

Assisted-by: OpenCode

* refactor(e2e): adopt shared helpers and fix createConfigMap typo

- Replace 8 inline Buffer.from() base64 calls with base64Encode/Decode
  from helper.ts (keycloak.ts, api-helper.ts, annotator.spec.ts,
  scaffolder-relation-processor.spec.ts)
- Fix method name typo: createCongifmap -> createConfigMap in KubeClient
- Use kubeClient.createConfigMap() in runtime-deploy.ts instead of
  inline coreV1Api.createNamespacedConfigMap() calls

Assisted-by: OpenCode

* refactor(e2e): extract shared utilities from runtime-*.ts

Move reusable utilities out of runtime-deploy.ts and
runtime-config.ts into shared modules:

helper.ts:
- run() — shell command execution with stdout/stderr capture
- discoverRouterBase() — OpenShift cluster router base discovery
- ImageRef interface, imageRefToString(), parseCatalogIndexImage()
  — image reference parsing utilities

kube-client.ts (KubeClient class):
- createNamespace() — 409-safe namespace creation
- deleteNamespaceIfExists() — 404-safe deletion wrapping
  deleteNamespaceAndWait()

runtime-config.ts re-exports ImageRef, imageRefToString, and
parseCatalogIndexImage from helper.ts so existing callers are
unaffected.

runtime-deploy.ts now imports all shared utilities instead of
defining them locally, reducing file size by ~100 lines.

Assisted-by: OpenCode

* fix(e2e): address review findings in runtime test refactor

- Guard against undefined host in RDS/Azure DB test loops by skipping
  individual DB versions when their host env var is not set, instead of
  crashing with a TypeError in clearDatabase/configurePostgresCredentials
- Fix RELEASE_NAME default mismatch in verify-schema-mode.spec.ts
  ('developer-hub' -> 'rhdh') to match runtime-config.ts and kube-client.ts
- Use resolveInstallMethod() in getRhdhDeploymentName() instead of
  duplicating install method detection logic
- Rewrite updateConfigMapTitle as a thin wrapper around patchAppConfig,
  eliminating ~65 lines of duplicated read-modify-write ConfigMap logic
- Extract deployment env var manipulation from postgres-config.ts into
  KubeClient methods (removeContainerEnvVars, addContainerEnvVarsFromSecret)
  so postgres-config.ts stays at the 'what' level while KubeClient handles
  'how' to patch deployments

Assisted-by: OpenCode

* fix(e2e): extract API version constant and clarify assumptions

- Extract BACKSTAGE_CR_API_VERSION constant in runtime-config.ts and
  import it in runtime-deploy.ts, so there is a single place to update
  when the CRD version bumps
- Document the workers:1 assumption on the module-level deployed flag
  in runtime-deploy.ts to help future readers
- Add comment explaining why the operator path uses a computed route URL
  rather than cluster discovery (deterministic naming convention)

Assisted-by: OpenCode

* fix(e2e): call ensureRuntimeDeployed in every runtime spec

Each runtime spec now calls ensureRuntimeDeployed() in its own
beforeAll instead of relying on alphabetical file discovery order
(configuration-test/ running before external-database/ and
plugin-division-mode-schema/). The call is idempotent — when tests
run in order it detects the existing ready deployment and returns
immediately. When a spec is run standalone via --grep, it deploys
RHDH first.

This removes the hidden ordering dependency that the old explicit
`dependencies: [SHOWCASE_RUNTIME_DB]` used to make visible.

Assisted-by: OpenCode

* fix(e2e): drop stale K8S_CLUSTER_URL/TOKEN from header comment

KubeClient now uses loadFromDefault() so these env vars are no
longer consumed by runtime-deploy.ts. Remove them from the header
to keep the documentation accurate.

Assisted-by: OpenCode

* refactor(e2e): use ImageRef for main container image

Change config.image from a plain {registry, repository, tag} object
to ImageRef which includes a separator field (':' for tags, '@' for
digests). This fixes digest-pinned images (e.g. repo@sha256:...)
being incorrectly joined with ':' in generateBackstageCR().

The same ImageRef/imageRefToString() is already used for
catalogIndex — this unifies both image references under the same
type and construction logic.

Assisted-by: OpenCode

* refactor(e2e): extract BACKSTAGE_BACKEND_CONTAINER constant

Centralize the backstage-backend container name as a named constant
in kube-client.ts alongside getRhdhDeploymentName(). Replace
hardcoded strings in runtime-config.ts, postgres-config.ts, and
schema-mode-setup.ts.

rhdh-deployment.ts (auth-providers) also uses the same string but
is left for a future PR to avoid expanding scope.

Assisted-by: OpenCode

* refactor(e2e): extract buildImageRef helper for separator detection

Extract the duplicated `tag.startsWith("sha256:") ? "@" : ":"
separator logic into a buildImageRef() helper in helper.ts. Used by
both runtime-config.ts and rhdh-deployment.ts to construct ImageRef
from individual registry/repository/tag env vars.

Assisted-by: OpenCode

* refactor(e2e): extract shared POSTGRES_ENV_KEYS constant

Deduplicate the overlapping POSTGRES_* env var key lists across
postgres-config.ts and schema-mode-setup.ts into a shared
POSTGRES_ENV_KEYS constant. The external-DB function extends it
with PGSSLMODE and NODE_EXTRA_CA_CERTS via POSTGRES_CRED_ENV_KEYS.

Assisted-by: OpenCode

* refactor(e2e): move schema-mode config to schema-mode-db.ts

Move configureSchemaMode() and the default DB user/password constants
from runtime-deploy.ts to schema-mode-db.ts where the rest of the
schema-mode database utilities live. runtime-deploy.ts imports and
calls the function — it no longer owns any schema-mode-specific logic.

Assisted-by: OpenCode

* refactor(e2e): remove updateConfigMapTitle, use patchAppConfig directly

updateConfigMapTitle was a thin wrapper around patchAppConfig with
an unused _configMapName parameter and a single caller. Inline the
title-update logic into config-map.spec.ts and remove the method
from KubeClient.

Assisted-by: OpenCode

* fix(e2e): fix naming convention lint error for private constant

Rename POSTGRES_CRED_ENV_KEYS to postgresCredEnvKeys — private
(non-exported) const must be camelCase per the eslint
@typescript-eslint/naming-convention rule.

Assisted-by: OpenCode

* fix(e2e): don't inject POSTGRES_DB env var in external DB tests

The placeholder postgres-cred secret doesn't contain a POSTGRES_DB key,
causing CreateContainerConfigError when prepareForExternalDatabase()
adds a secretKeyRef for it. External DB tests don't need POSTGRES_DB —
Backstage auto-creates per-plugin databases when it's unset.

Schema-mode tests are unaffected; they manage env vars via their own
configureSchemaMode() / schema-mode-setup.ts mechanism.

Assisted-by: OpenCode

* fix(e2e): adapt new KubeClient methods to modular kube-client structure

After rebasing onto main, the kube-client.ts monolith was split into
kube-client/ directory modules. Add methods and constants that our PR
introduced to the new modular structure:

- BACKSTAGE_BACKEND_CONTAINER constant
- patchAppConfig, jsonPatchDeployment, restartDeploymentWithRetry
- removeContainerEnvVars, addContainerEnvVarsFromSecret
- waitForBackstageCrd, createConfigMap, deleteNamespaceIfExists, createNamespace
- getRhdhDeploymentName: use resolveInstallMethod() for INSTALL_METHOD env var

Fix all oxlint violations to comply with strict + pedantic linting:
- Replace || with ?? for nullish coalescing
- Add explicit nullish/empty checks for strict-boolean-expressions
- Fix setTimeout in Promise executors for strict-void-return
- Move inline comments to separate lines
- Add type annotations and safe type assertions
- Swap negated conditions to positive form

Assisted-by: OpenCode

* fix(e2e): fix inverted pod failure detection for transient container states

The checkWaitingContainerState function had inverted logic — it treated
transient states like PodInitializing and ContainerCreating as failures
while silently ignoring actual failure states like CrashLoopBackOff and
ImagePullBackOff.

This caused the runtime tests to fail immediately during operator
deployment because the init container (install-dynamic-plugins) triggers
PodInitializing state, which was incorrectly flagged as a pod failure.

Assisted-by: OpenCode

* fix(e2e): fix runtime test timeouts caused by WebSocket teardown hang

Runtime tests that navigate to the RHDH UI establish WebSocket
connections (event-stream). When the test body completes, Playwright's
page fixture teardown hangs for up to 10 minutes waiting for the browser
context to close because the WebSocket connections are never dropped.

Fix: navigate to about:blank at the end of each test that uses the page
fixture to close all active connections before Playwright tears down the
context.

Also add a 10-minute project-level timeout for the SHOWCASE_RUNTIME
project — runtime tests restart the RHDH deployment (ConfigMap changes,
external DB reconfiguration, schema-mode setup) which takes 60-90s per
restart.

Assisted-by: OpenCode

Author: zdrapela

.ci/pipelines/jobs/ocp-nightly.sh

@@ -47,35 +47,17 @@ run_standard_deployment_tests() {
 }
 
 run_runtime_config_change_tests() {
-  # Deploy `showcase-runtime` to run tests that require configuration changes at runtime
-
-  # Create the namespace first (this will delete/recreate it)
-  namespace::configure "${NAME_SPACE_RUNTIME}"
-
-  # Configure external PostgreSQL credentials and certificates for runtime namespace
-  # This creates postgres-crt and postgres-cred secrets needed by values-showcase-postgres.yaml
-  # IMPORTANT: Must be called AFTER namespace is created but BEFORE helm install
-  configure_external_postgres_db "${NAME_SPACE_RUNTIME}"
-
-  # Deploy RHDH with Helm (skip namespace creation since we already did it)
-  helm::uninstall "${NAME_SPACE_RUNTIME}" "${RELEASE_NAME}"
-  oc apply -f "$DIR/resources/postgres-db/dynamic-plugins-root-PVC.yaml" -n "${NAME_SPACE_RUNTIME}"
-  # shellcheck disable=SC2046
-  helm upgrade -i "${RELEASE_NAME}" -n "${NAME_SPACE_RUNTIME}" \
-    "${HELM_CHART_URL}" --version "${CHART_VERSION}" \
-    -f "$DIR/resources/postgres-db/values-showcase-postgres.yaml" \
-    --set global.clusterRouterBase="${K8S_CLUSTER_ROUTER_BASE}" \
-    $(helm::get_image_params)
-
-  # Configure schema-mode environment (opt-in: tests skip if env not configured)
-  if configure_schema_mode_runtime_env "${NAME_SPACE_RUNTIME}" "${RELEASE_NAME}" helm; then
-    log::info "Schema-mode environment configured successfully; schema-mode tests will run"
-  else
-    log::warn "Schema-mode environment not configured; schema-mode tests will skip (this is expected if PostgreSQL is not available)"
-  fi
-
+  # Runtime tests handle their own deployment via TypeScript (runtime-deploy.ts).
+  # The first test file (config-map.spec.ts) calls ensureRuntimeDeployed() which:
+  #   - Creates the namespace
+  #   - Deploys RHDH with Helm + internal PostgreSQL sub-chart
+  #   - Configures schema-mode env vars for port-forwarding
+  # Subsequent test files reuse the existing deployment (workers: 1).
+  #
+  # The CI wrapper only needs to set environment variables and invoke Playwright.
+
+  export INSTALL_METHOD="helm"
   local runtime_url="https://${RELEASE_NAME}-developer-hub-${NAME_SPACE_RUNTIME}.${K8S_CLUSTER_ROUTER_BASE}"
-  # Run tests - allow failures since schema-mode tests are opt-in
   testing::run_tests "${RELEASE_NAME}" "${NAME_SPACE_RUNTIME}" "${PW_PROJECT_SHOWCASE_RUNTIME}" "${runtime_url}" || true
 }
 

.ci/pipelines/jobs/ocp-operator.sh

@@ -68,48 +68,15 @@ initiate_operator_deployments_osd_gcp() {
 }
 
 run_operator_runtime_config_change_tests() {
-  # Deploy `showcase-runtime` to run tests that require configuration changes at runtime.
-  # Uses enableLocalDb=false with external Crunchy PostgreSQL for both runtime and schema-mode tests.
-  namespace::configure "${NAME_SPACE_RUNTIME}"
-
+  # Runtime tests handle their own deployment via TypeScript (runtime-deploy.ts).
+  # The first test file (config-map.spec.ts) calls ensureRuntimeDeployed() which:
+  #   - Creates the namespace
+  #   - Deploys RHDH via the operator with internal PostgreSQL
+  #   - Configures schema-mode env vars for port-forwarding
+  # Subsequent test files reuse the existing deployment (workers: 1).
+  #
+  # INSTALL_METHOD=operator is already exported in handle_ocp_operator().
   local runtime_url="https://backstage-${RELEASE_NAME}-${NAME_SPACE_RUNTIME}.${K8S_CLUSTER_ROUTER_BASE}"
-  local postgres_ready
-  postgres_ready=false
-
-  # Set up real external PostgreSQL (Crunchy) instead of placeholder secrets.
-  # Creates postgres-cred and postgres-crt secrets in NAME_SPACE_RUNTIME.
-  # IMPORTANT: Must be called AFTER namespace is created but BEFORE operator deployment.
-  namespace::configure "${NAME_SPACE_POSTGRES_DB}"
-  if configure_external_postgres_db "${NAME_SPACE_RUNTIME}"; then
-    postgres_ready=true
-    # Add RHDH_RUNTIME_URL to postgres-cred (rds-app-config.yaml references it for baseUrl).
-    # configure_external_postgres_db creates postgres-cred with POSTGRES_* keys only.
-    local runtime_url_b64
-    runtime_url_b64=$(common::base64_encode "${runtime_url}")
-    oc patch secret postgres-cred -n "${NAME_SPACE_RUNTIME}" \
-      --type=json \
-      -p "[{\"op\":\"add\",\"path\":\"/data/RHDH_RUNTIME_URL\",\"value\":\"${runtime_url_b64}\"}]"
-  else
-    log::warn "External PostgreSQL setup failed; falling back to placeholder secrets (schema-mode tests will skip)"
-    create_postgres_cred_secret "${NAME_SPACE_RUNTIME}" "tmp" "tmp" "RHDH_RUNTIME_URL=${runtime_url}"
-    oc apply -f "$DIR/resources/postgres-db/postgres-crt.yaml" -n "${NAME_SPACE_RUNTIME}"
-  fi
-
-  config::create_app_config_map "$DIR/resources/postgres-db/rds-app-config.yaml" "${NAME_SPACE_RUNTIME}"
-  config::create_dynamic_plugins_config "${DIR}/resources/postgres-db/values-showcase-postgres.yaml" "/tmp/configmap-dynamic-plugins-runtime.yaml"
-  oc apply -f /tmp/configmap-dynamic-plugins-runtime.yaml -n "${NAME_SPACE_RUNTIME}"
-  deploy_rhdh_operator "${NAME_SPACE_RUNTIME}" "${DIR}/resources/rhdh-operator/rhdh-start-runtime.yaml" "true"
-
-  # Configure schema-mode environment variables (opt-in: tests skip if not configured).
-  # Only attempt if external PostgreSQL was set up successfully.
-  if [[ "${postgres_ready}" == "true" ]]; then
-    if configure_schema_mode_runtime_env "${NAME_SPACE_RUNTIME}" "${RELEASE_NAME}" operator; then
-      log::info "Schema-mode environment configured successfully; schema-mode tests will run"
-    else
-      log::warn "Schema-mode environment not configured; schema-mode tests will skip (this is expected if PostgreSQL is not available)"
-    fi
-  fi
-
   testing::run_tests "${RELEASE_NAME}" "${NAME_SPACE_RUNTIME}" "${PW_PROJECT_SHOWCASE_RUNTIME}" "${runtime_url}" || true
 }
 

.ci/pipelines/lib/schema-mode-env.sh

@@ -24,12 +24,14 @@ configure_schema_mode_runtime_env() {
   local forward_via_pod=0
   local rhdh_psql_svc_name="redhat-developer-hub-postgresql"
 
-  local -a helm_svc_candidates=(
+  # Service candidates: Helm sub-chart pattern first, then operator pattern
+  local -a svc_candidates=(
     "${release_name}-postgresql"
     "${rhdh_psql_svc_name}"
+    "backstage-psql-${release_name}"
   )
   local hsvc
-  for hsvc in "${helm_svc_candidates[@]}"; do
+  for hsvc in "${svc_candidates[@]}"; do
     if oc get svc "${hsvc}" -n "${runtime_namespace}" &> /dev/null; then
       postgres_service="${hsvc}"
       forward_namespace="${runtime_namespace}"
@@ -38,9 +40,11 @@ configure_schema_mode_runtime_env() {
   done
 
   if [[ -n "${postgres_service}" ]]; then
+    # Secret candidates: Helm pattern first, then operator pattern
     local -a secret_candidates=(
       "${release_name}-postgresql"
       "${rhdh_psql_svc_name}"
+      "backstage-psql-secret-${release_name}"
       "postgres-cred"
     )
     local sec
@@ -49,6 +53,9 @@ configure_schema_mode_runtime_env() {
         continue
       fi
       admin_password=$(oc get secret "${sec}" -n "${runtime_namespace}" -o jsonpath='{.data.postgres-password}' 2> /dev/null | base64 -d || true)
+      if [[ -z "${admin_password}" ]]; then
+        admin_password=$(oc get secret "${sec}" -n "${runtime_namespace}" -o jsonpath='{.data.POSTGRESQL_ADMIN_PASSWORD}' 2> /dev/null | base64 -d || true)
+      fi
       if [[ -z "${admin_password}" ]]; then
         admin_password=$(oc get secret "${sec}" -n "${runtime_namespace}" -o jsonpath='{.data.POSTGRES_PASSWORD}' 2> /dev/null | base64 -d || true)
       fi

.ci/pipelines/resources/postgres-db/rds-app-config.yaml

@@ -260,7 +260,7 @@ configure_external_postgres_db() {
   fi
 
   # Create postgres-crt secret for Backstage deployment (Helm/Operator)
-  # This secret is referenced by rhdh-start-runtime.yaml and values-showcase-postgres.yaml
+  # This secret is referenced by RBAC deployment values and operator CRs
   if ! oc create secret generic postgres-crt \
     --from-file=postgres-crt.pem=postgres-ca \
     --dry-run=client -o yaml | oc apply -f - --namespace="${project}"; then
@@ -433,7 +433,7 @@ cluster_setup_k8s_helm() {
 # Functions: base_deployment, rbac_deployment, initiate_deployments,
 #            base_deployment_osd_gcp, rbac_deployment_osd_gcp, initiate_deployments_osd_gcp,
 #            initiate_upgrade_base_deployments, initiate_upgrade_deployments,
-#            initiate_runtime_deployment, initiate_sanity_plugin_checks_deployment,
+#            initiate_sanity_plugin_checks_deployment,
 #            apply_yaml_files, deploy_test_backstage_customization_provider,
 #            deploy_redis_cache, configure_external_postgres_db
 # ==============================================================================
@@ -650,22 +650,6 @@ initiate_upgrade_deployments() {
   save_all_pod_logs "$namespace"
 }
 
-initiate_runtime_deployment() {
-  local release_name=$1
-  local namespace=$2
-  namespace::configure "${namespace}"
-  helm::uninstall "${namespace}" "${release_name}"
-
-  oc apply -f "$DIR/resources/postgres-db/dynamic-plugins-root-PVC.yaml" -n "${namespace}"
-
-  # shellcheck disable=SC2046
-  helm upgrade -i "${release_name}" -n "${namespace}" \
-    "${HELM_CHART_URL}" --version "${CHART_VERSION}" \
-    -f "$DIR/resources/postgres-db/values-showcase-postgres.yaml" \
-    --set global.clusterRouterBase="${K8S_CLUSTER_ROUTER_BASE}" \
-    $(helm::get_image_params)
-}
-
 initiate_sanity_plugin_checks_deployment() {
   local release_name=$1
   local name_space_sanity_plugins_check=$2

.ci/pipelines/resources/postgres-db/values-showcase-postgres.yaml

@@ -10,7 +10,6 @@
     "showcase-rbac-k8s": "playwright test --project=showcase-rbac-k8s",
     "showcase-operator": "playwright test --project=showcase-operator",
     "showcase-operator-rbac": "playwright test --project=showcase-operator-rbac",
-    "showcase-runtime-db": "playwright test --project=showcase-runtime-db",
     "showcase-runtime": "playwright test --project=showcase-runtime",
     "showcase-upgrade": "playwright test --project=showcase-upgrade",
     "showcase-auth-providers": "playwright test --project=showcase-auth-providers",
@@ -40,8 +39,7 @@
     "octokit": "4.1.4",
     "pg": "8.22.0",
     "uuid": "14.0.0",
-    "winston": "3.14.2",
-    "yaml": "2.9.0"
+    "winston": "3.14.2"
   },
   "devDependencies": {
     "@axe-core/playwright": "4.11.3",

.ci/pipelines/resources/rhdh-operator/rhdh-start-runtime.yaml

@@ -171,21 +171,19 @@ export default defineConfig({
       dependencies: [PW_PROJECT.SMOKE_TEST],
       testMatch: ["**/playwright/e2e/**/*-rbac.spec.ts"],
     },
-    {
-      name: PW_PROJECT.SHOWCASE_RUNTIME_DB,
-      workers: 1,
-      testMatch: [
-        "**/playwright/e2e/external-database/verify-tls-config-with-external-rds.spec.ts",
-        "**/playwright/e2e/external-database/verify-tls-config-with-external-azure-db.spec.ts",
-      ],
-    },
     {
       name: PW_PROJECT.SHOWCASE_RUNTIME,
       workers: 1,
-      dependencies: [PW_PROJECT.SHOWCASE_RUNTIME_DB],
+      // Runtime tests restart the RHDH deployment (ConfigMap changes,
+      // external DB reconfiguration, schema-mode setup). Each restart
+      // takes ~60-90 s on a typical cluster, so the default 90 s global
+      // timeout is insufficient. 10 minutes gives comfortable headroom.
+      timeout: 10 * 60 * 1000,
       testMatch: [
         "**/playwright/e2e/configuration-test/config-map.spec.ts",
         "**/playwright/e2e/plugin-division-mode-schema/verify-schema-mode.spec.ts",
+        "**/playwright/e2e/external-database/verify-tls-config-with-external-rds.spec.ts",
+        "**/playwright/e2e/external-database/verify-tls-config-with-external-azure-db.spec.ts",
       ],
     },