fix(e2e): fix external DB tests for operator deployments

For operator deployments, patching POSTGRES_* env vars directly onto the
deployment is reverted by operator reconciliation. The external DB tests
(Azure DB, RDS) configure postgres-cred secret with connection details,
but those values never reached the RHDH container as env vars.

Fix:
- Add postgres-cred to extraEnvs.secrets in the Backstage CR so the
  operator injects all its keys as env vars automatically
- Skip direct deployment env var patching in prepareForExternalDatabase
  for operator installs (same pattern as schema-mode setup)

Assisted-by: OpenCode

Author: zdrapela

e2e-tests/playwright/e2e/plugin-division-mode-schema/verify-schema-mode.spec.ts

@@ -12,7 +12,7 @@ import { ChildProcessWithoutNullStreams, spawn } from "child_process";
 import { test, expect } from "@support/coverage/test";
 
 import { Common } from "../../utils/common";
-import { resolveInstallMethod } from "../../utils/helper";
+import { getReleaseName, resolveInstallMethod } from "../../utils/helper";
 import { KubeClient } from "../../utils/kube-client";
 import { ensureRuntimeDeployed } from "../../utils/runtime-deploy";
 import { setPortForwardRestarter } from "./schema-mode-db";
@@ -80,7 +80,7 @@ function killPortForward(proc: ChildProcessWithoutNullStreams | undefined): Prom
 
 test.describe("Verify pluginDivisionMode: schema", () => {
   const namespace = process.env.NAME_SPACE_RUNTIME ?? "showcase-runtime";
-  const releaseName = process.env.RELEASE_NAME ?? "rhdh";
+  const releaseName = getReleaseName();
   const installMethod = resolveInstallMethod();
 
   let portForwardProcess: ChildProcessWithoutNullStreams | undefined;

e2e-tests/playwright/utils/helper.ts

@@ -131,6 +131,16 @@ export function resolveInstallMethod(): "helm" | "operator" {
   return job.includes("operator") ? "operator" : "helm";
 }
 
+/**
+ * Canonical release name resolution. Returns the RELEASE_NAME env var if set
+ * and non-empty, otherwise defaults to "rhdh".
+ */
+export function getReleaseName(): string {
+  return process.env.RELEASE_NAME !== undefined && process.env.RELEASE_NAME !== ""
+    ? process.env.RELEASE_NAME
+    : "rhdh";
+}
+
 /** Base64-encode a string. */
 export function base64Encode(value: string): string {
   return Buffer.from(value).toString("base64");

e2e-tests/playwright/utils/kube-client/helpers.ts

@@ -1,7 +1,7 @@
 import * as k8s from "@kubernetes/client-node";
 
 import { getErrorMessage, hasErrorResponse, hasStatusCode } from "../errors";
-import { resolveInstallMethod } from "../helper";
+import { getReleaseName, resolveInstallMethod } from "../helper";
 
 export function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -135,10 +135,7 @@ export function getKubeApiErrorMessage(error: unknown): string {
  * then falls back to JOB_NAME pattern matching.
  */
 export function getRhdhDeploymentName(): string {
-  const releaseName =
-    process.env.RELEASE_NAME !== undefined && process.env.RELEASE_NAME !== ""
-      ? process.env.RELEASE_NAME
-      : "rhdh";
+  const releaseName = getReleaseName();
   return resolveInstallMethod() === "operator"
     ? `backstage-${releaseName}`
     : `${releaseName}-developer-hub`;

e2e-tests/playwright/utils/postgres-config.ts

@@ -14,8 +14,9 @@ import { readFileSync, existsSync } from "fs";
 
 import { Client } from "pg";
 
-import { base64Encode } from "./helper";
+import { base64Encode, getReleaseName, resolveInstallMethod } from "./helper";
 import { KubeClient, BACKSTAGE_BACKEND_CONTAINER } from "./kube-client";
+import { BACKSTAGE_CR_API_VERSION } from "./runtime-config";
 import type { AppConfigYaml } from "./runtime-config";
 
 /**
@@ -128,6 +129,15 @@ export async function configurePostgresCredentials(
     data,
   };
   await kubeClient.createOrUpdateSecret(secret, namespace);
+
+  // For operator installs, ensure the Backstage CR includes postgres-cred in
+  // extraEnvs.secrets so the operator injects the credentials as env vars.
+  // This is done here (not in prepareForExternalDatabase) because the secret
+  // must contain real credentials before the operator reconciles — placeholder
+  // values would break the DB connection and leave readiness at 503.
+  if (resolveInstallMethod() === "operator") {
+    await addPostgresCredToBackstageCR(kubeClient, namespace);
+  }
 }
 
 const SYSTEM_DATABASES = [
@@ -297,7 +307,11 @@ export async function prepareForExternalDatabase(
   // Schema-mode tests may have added individual secretKeyRef env vars pointing
   // to a *-postgresql secret. These override the bulk envFrom injection from
   // postgres-cred and must be removed before external DB tests.
-  await removeSchemaModePatchedEnvVars(kubeClient, deploymentName, namespace);
+  // Skip for operator — the operator manages env vars via extraEnvs.secrets
+  // in the Backstage CR, so there are no direct deployment patches to remove.
+  if (resolveInstallMethod() !== "operator") {
+    await removeSchemaModePatchedEnvVars(kubeClient, deploymentName, namespace);
+  }
 
   // --- 2. Patch app-config ConfigMap to use external DB connection ---
   console.log("Patching app-config to use external database connection (env var placeholders)...");
@@ -314,11 +328,20 @@ export async function prepareForExternalDatabase(
   });
   console.log("App-config patched for external database connection");
 
-  // --- 3. Add POSTGRES_* env vars to the deployment via secretKeyRef ---
-  // The deployment starts with internal DB (no postgres-cred env vars).
-  // Add individual env vars pointing to the postgres-cred secret so the
-  // app-config ${POSTGRES_HOST} etc. placeholders resolve correctly.
-  await ensurePostgresCredEnvVars(kubeClient, deploymentName, namespace);
+  // --- 3. Add POSTGRES_* env vars to the deployment ---
+  // Helm: patch individual env vars pointing to the postgres-cred secret so
+  // the app-config ${POSTGRES_HOST} etc. placeholders resolve correctly.
+  // Operator: the Backstage CR is patched later by configurePostgresCredentials()
+  // after real credentials are written to the postgres-cred secret. Patching the
+  // CR here with placeholder values would trigger operator reconciliation and
+  // break the DB connection (readiness 503).
+  if (resolveInstallMethod() === "operator") {
+    console.log(
+      "Skipping env var setup (operator CR will be patched by configurePostgresCredentials)",
+    );
+  } else {
+    await ensurePostgresCredEnvVars(kubeClient, deploymentName, namespace);
+  }
 }
 
 /**
@@ -371,3 +394,49 @@ async function ensurePostgresCredEnvVars(
   );
   console.log("POSTGRES_* env vars added to deployment from postgres-cred");
 }
+
+/**
+ * Patch the operator Backstage CR to add postgres-cred to extraEnvs.secrets.
+ * This causes the operator to inject all keys from the postgres-cred secret
+ * as env vars into the RHDH container.
+ *
+ * The postgres-cred secret is NOT included in the CR at deployment time —
+ * it contains placeholder values that would override the operator-managed
+ * internal PostgreSQL credentials. It is only added here, when external DB
+ * tests need the real credentials injected.
+ *
+ * Uses JSON merge-patch so the secrets array is replaced wholesale.
+ * The CR is created by generateBackstageCR() with only rhdh-runtime-config
+ * in extraEnvs.secrets, so we set both here explicitly.
+ */
+async function addPostgresCredToBackstageCR(
+  kubeClient: KubeClient,
+  namespace: string,
+): Promise<void> {
+  const releaseName = getReleaseName();
+  const [group, version] = BACKSTAGE_CR_API_VERSION.split("/");
+
+  const patch = {
+    spec: {
+      application: {
+        extraEnvs: {
+          secrets: [{ name: "rhdh-runtime-config" }, { name: "postgres-cred" }],
+        },
+      },
+    },
+  };
+
+  await kubeClient.customObjectsApi.patchNamespacedCustomObject(
+    group,
+    version,
+    namespace,
+    "backstages",
+    releaseName,
+    patch,
+    undefined,
+    undefined,
+    undefined,
+    { headers: { "Content-Type": "application/merge-patch+json" } },
+  );
+  console.log("Patched Backstage CR: added postgres-cred to extraEnvs.secrets");
+}

e2e-tests/playwright/utils/runtime-config.ts

@@ -17,7 +17,13 @@
 
 import * as yaml from "js-yaml";
 
-import { type ImageRef, buildImageRef, imageRefToString, parseCatalogIndexImage } from "./helper";
+import {
+  type ImageRef,
+  buildImageRef,
+  getReleaseName,
+  imageRefToString,
+  parseCatalogIndexImage,
+} from "./helper";
 import { BACKSTAGE_BACKEND_CONTAINER } from "./kube-client";
 
 // Re-export image utilities so existing `import from "./runtime-config"`
@@ -79,7 +85,7 @@ export interface AppConfigYaml {
  * Build a RuntimeDeployConfig from environment variables.
  */
 export function resolveConfig(routerBase: string): RuntimeDeployConfig {
-  const releaseName = process.env.RELEASE_NAME ?? "rhdh";
+  const releaseName = getReleaseName();
   const namespace = process.env.NAME_SPACE_RUNTIME ?? "showcase-runtime";
   const imageRegistry = process.env.IMAGE_REGISTRY ?? "quay.io";
   const imageRepo = process.env.IMAGE_REPO ?? "rhdh-community/rhdh";