update

Signed-off-by: Fortune-Ndlovu <fndlovu@redhat.com>

Author: Fortune-Ndlovu

e2e-tests/container-init.sh

@@ -184,4 +184,4 @@ if [[ "$DEPLOYMENT_EXIT_CODE" -ne 0 ]]; then
     exit $DEPLOYMENT_EXIT_CODE
 fi
 
-# Container will exit and local-run.sh will show next steps
+# Container will exit and local-run.sh will show next steps

e2e-tests/playwright/e2e/plugin-division-mode-schema/schema-mode-db.ts

@@ -5,9 +5,11 @@
 
 import { expect } from "@playwright/test";
 import { Client } from "pg";
-import { quoteIdent } from "../../utils/postgres-config";
 
-export { quoteIdent } from "../../utils/postgres-config";
+/** Quote a PostgreSQL identifier (safe against injection in dynamic SQL). */
+function quoteIdent(name: string): string {
+  return '"' + String(name).replace(/"/g, '""') + '"';
+}
 
 /** Escape a string for use inside PostgreSQL single-quoted literal (doubles single quotes). */
 function escapePasswordLiteral(value: string): string {

e2e-tests/playwright/utils/kube-client.ts

@@ -511,8 +511,7 @@ export class KubeClient {
 
   /**
    * Create or update a Kubernetes secret (upsert pattern).
-   * Replaces the secret's data entirely so that keys not in secret.data are removed
-   * (avoids stale keys when switching e.g. from SSL to non-SSL).
+   * Tries to update the secret first; if it doesn't exist, creates it.
    */
   async createOrUpdateSecret(
     secret: k8s.V1Secret,

e2e-tests/playwright/utils/postgres-config.ts

@@ -22,14 +22,6 @@ function unescapeNewlines(value: string): string {
   return value.replace(/\\n/g, "\n");
 }
 
-/**
- * Quote a PostgreSQL identifier (safe against injection).
- * Use for database, schema, and role names in dynamic SQL.
- */
-export function quoteIdent(name: string): string {
-  return '"' + String(name).replace(/"/g, '""') + '"';
-}
-
 /**
  * Read certificate content from a file path.
  * @param filePath - Path to the certificate file
@@ -82,24 +74,15 @@ export async function configurePostgresCredentials(
     sslMode?: string;
   },
 ): Promise<void> {
-  const sslMode = credentials.sslMode || "require";
   const data: Record<string, string> = {
     POSTGRES_HOST: Buffer.from(credentials.host).toString("base64"),
     POSTGRES_PORT: Buffer.from(credentials.port || "5432").toString("base64"),
-    PGSSLMODE: Buffer.from(sslMode).toString("base64"),
+    PGSSLMODE: Buffer.from(credentials.sslMode || "require").toString("base64"),
+    NODE_EXTRA_CA_CERTS: Buffer.from(
+      "/opt/app-root/src/postgres-crt.pem",
+    ).toString("base64"),
   };
 
-  // In-cluster path where RHDH reads the mounted postgres TLS bundle (override via POSTGRES_NODE_EXTRA_CA_CERTS).
-  const nodeExtraCaCerts =
-    process.env.POSTGRES_NODE_EXTRA_CA_CERTS ||
-    "/opt/app-root/src/postgres-crt.pem";
-  // Only set certificate path when SSL is enabled. When disable, we omit
-  // NODE_EXTRA_CA_CERTS; createOrUpdateSecret replaces secret data entirely
-  // so a previously set value is removed.
-  if (sslMode !== "disable") {
-    data.NODE_EXTRA_CA_CERTS = Buffer.from(nodeExtraCaCerts).toString("base64");
-  }
-
   if (credentials.user) {
     data.POSTGRES_USER = Buffer.from(credentials.user).toString("base64");
   }
@@ -203,9 +186,7 @@ export async function clearDatabase(credentials: {
       for (let attempt = 1; attempt <= maxRetries; attempt++) {
         try {
           // WITH (FORCE) atomically terminates connections and drops the database
-          await client.query(
-            `DROP DATABASE IF EXISTS ${quoteIdent(db)} WITH (FORCE)`,
-          );
+          await client.query(`DROP DATABASE IF EXISTS "${db}" WITH (FORCE)`);
           success = true;
           break;
         } catch (error) {