fix(e2e): fix external DB tests for operator deployments

For operator deployments, patching POSTGRES_* env vars directly onto the
deployment is reverted by operator reconciliation. The external DB tests
(Azure DB, RDS) configure postgres-cred secret with connection details,
but those values never reached the RHDH container as env vars.

Fix:
- Add postgres-cred to extraEnvs.secrets in the Backstage CR so the
  operator injects all its keys as env vars automatically
- Skip direct deployment env var patching in prepareForExternalDatabase
  for operator installs (same pattern as schema-mode setup)

Assisted-by: OpenCode

Author: zdrapela

e2e-tests/playwright/utils/postgres-config.ts

@@ -14,7 +14,7 @@ import { readFileSync, existsSync } from "fs";
 
 import { Client } from "pg";
 
-import { base64Encode } from "./helper";
+import { base64Encode, resolveInstallMethod } from "./helper";
 import { KubeClient, BACKSTAGE_BACKEND_CONTAINER } from "./kube-client";
 import type { AppConfigYaml } from "./runtime-config";
 
@@ -297,7 +297,11 @@ export async function prepareForExternalDatabase(
   // Schema-mode tests may have added individual secretKeyRef env vars pointing
   // to a *-postgresql secret. These override the bulk envFrom injection from
   // postgres-cred and must be removed before external DB tests.
-  await removeSchemaModePatchedEnvVars(kubeClient, deploymentName, namespace);
+  // Skip for operator — the operator manages env vars via extraEnvs.secrets
+  // in the Backstage CR, so there are no direct deployment patches to remove.
+  if (resolveInstallMethod() !== "operator") {
+    await removeSchemaModePatchedEnvVars(kubeClient, deploymentName, namespace);
+  }
 
   // --- 2. Patch app-config ConfigMap to use external DB connection ---
   console.log("Patching app-config to use external database connection (env var placeholders)...");
@@ -315,10 +319,18 @@ export async function prepareForExternalDatabase(
   console.log("App-config patched for external database connection");
 
   // --- 3. Add POSTGRES_* env vars to the deployment via secretKeyRef ---
-  // The deployment starts with internal DB (no postgres-cred env vars).
-  // Add individual env vars pointing to the postgres-cred secret so the
-  // app-config ${POSTGRES_HOST} etc. placeholders resolve correctly.
-  await ensurePostgresCredEnvVars(kubeClient, deploymentName, namespace);
+  // Helm: patch individual env vars pointing to the postgres-cred secret so
+  // the app-config ${POSTGRES_HOST} etc. placeholders resolve correctly.
+  // Operator: skip — the Backstage CR already includes postgres-cred in
+  // extraEnvs.secrets, so the operator injects all keys as env vars.
+  // Patching the deployment directly would be reverted by reconciliation.
+  if (resolveInstallMethod() !== "operator") {
+    await ensurePostgresCredEnvVars(kubeClient, deploymentName, namespace);
+  } else {
+    console.log(
+      "Skipping deployment env var patching (operator injects from postgres-cred via extraEnvs.secrets)",
+    );
+  }
 }
 
 /**

e2e-tests/playwright/utils/runtime-config.ts

@@ -388,7 +388,7 @@ export function generateBackstageCR(config: RuntimeDeployConfig): BackstageCR {
         },
         extraEnvs: {
           envs,
-          secrets: [{ name: "rhdh-runtime-config" }],
+          secrets: [{ name: "rhdh-runtime-config" }, { name: "postgres-cred" }],
         },
         route: { enabled: true },
       },