Environment Variables

Complete reference of all environment variables used by the package.

Recommended Variables

These are optional but commonly set to control deployment behavior:

Variable	Description	Example	Default
RHDH_VERSION	RHDH version to deploy	"1.5"	"next"
INSTALLATION_METHOD	Deployment method	"helm" or "operator"	"helm"

Auto-Generated Variables

These are set automatically during deployment:

Variable	Description	Set By
K8S_CLUSTER_ROUTER_BASE	OpenShift ingress domain	Global setup
RHDH_BASE_URL	Full RHDH URL	RHDHDeployment

Playwright Variables

Variable	Description	Default
PLAYWRIGHT_WORKERS	Number of parallel workers (e.g., "4", "50%")	"50%"
PLAYWRIGHT_RETRIES	Number of test retries on failure	0

Local Secret Execution

Variable	Description	Required
BW_SESSION	Session from an already unlocked local bw CLI installation	For rhdh-e2e-secrets
RHDH_E2E_SECRET_FD	Internal child marker for the opt-in secret stream on FD 3	Set by the CLI

Export BW_SESSION in the invoking shell before running rhdh-e2e-secrets exec, create, update, or delete. The wrapper uses it to retrieve or update selected Bitwarden items and removes it from child test processes. The describe and list commands query GSM only and do not need BW_SESSION.

Normal rhdh-e2e-secrets exec execution remains environment-based. To opt in to the stream transport, run rhdh-e2e-secrets exec --stream-secrets -- <command>. The CLI removes the selected secret names from the child environment, sends their {name,value} entries over inherited file descriptor 3, and sets RHDH_E2E_SECRET_FD=3. This marker is not a secret value or a user-configured credential. The child's stdin remains inherited, and a consumer must decode the stream and close FD 3 immediately afterward.

GSM secret operations use the cached OpenShift CI wrapper. Run rhdh-e2e-secrets gsm-login once before the first GSM operation; use rhdh-e2e-secrets gsm-clean to remove its cached credentials. The wrapper honors its existing CONTAINER_ENGINE and SECRET_MANAGER_IMAGE variables. SECRET_MANAGER_IMAGE must refer to the quay.io/openshift/ci-public repository; the wrapper and image follow the upstream moving release channel and are not version-pinned. The package verifies the download URL and wrapper structure, but this remains an explicit trust boundary on OpenShift CI's GitHub and Quay repositories. The wrapper cache defaults to ~/.cache/rhdh-e2e-secrets/gsm and mutation locks default to ~/.local/state/rhdh-e2e-secrets; XDG_CACHE_HOME and XDG_STATE_HOME override those locations when set to absolute paths. For corporate network setups, start Node with NODE_USE_ENV_PROXY=1 to use HTTP_PROXY/HTTPS_PROXY, and use NODE_EXTRA_CA_CERTS for an additional trusted CA.

Secret mutation files are created below os.tmpdir()/rhdh-e2e-secrets with 0700 directories and 0600 files. They are removed after each mutation operation completes, and abandoned directories from processes that no longer exist are removed before the next operation that creates a temporary secret. Read-only commands and dry runs do not trigger this cleanup. The operating system's temporary-file cleanup is only a final fallback after an ungraceful termination such as SIGKILL. See Temporary secret files for the cleanup and manual recovery procedures.

Optional Variables

Variable	Description	Default
CI	Enables auto-cleanup	-
CHART_URL	Custom Helm chart URL	oci://quay.io/rhdh/chart
SKIP_KEYCLOAK_DEPLOYMENT	Skip Keycloak auto-deploy	false
SKIP_OPERATOR_INSTALLATION	Skip operator installation in global setup	-
RHDH_SKIP_PLUGIN_METADATA_INJECTION	Disable plugin metadata injection (local only, ignored in CI)	-

Plugin Metadata Variables

These control automatic plugin configuration injection from metadata files.

DPDY refers to dynamic-plugins.default.yaml in the catalog index image shipped with RHDH. The list of DPDY packages is defined in default.packages.yaml.

Variable	Description	Effect
GIT_PR_NUMBER	PR number (set by OpenShift CI)	Enables OCI URL generation for PR builds
E2E_NIGHTLY_MODE	When "true", activates nightly mode	Plugins in default.packages.yaml with OCI metadata use (RHDH resolves both OCI tag and config from DPDY); other OCI plugins use full metadata refs with config injection
RHDH_SKIP_PLUGIN_METADATA_INJECTION	When "true", disables metadata injection	Local-only opt-out (ignored when CI=true)
RELEASE_BRANCH_NAME	Release branch (set by OpenShift CI step registry)	Used to fetch default.packages.yaml for DPDY resolution in nightly mode. Required in CI, defaults to main locally
NIGHTLY_DPDY_OCI_REGISTRY	OCI registry for refs	Overrides default registry.access.redhat.com/rhdh for all plugins using in nightly mode
NIGHTLY_DPDY_OCI_REGISTRY_MAP	JSON: {"registry": ["pkg1", "pkg2"]}	Per-plugin registry override for refs (takes precedence over NIGHTLY_DPDY_OCI_REGISTRY)
JOB_NAME	CI job name (set by OpenShift CI/Prow)	If contains periodic-, nightly mode is activated
JOB_MODE	CI-only: nightly or pr-check (set by step registry)	Informational

The package defaults include the current RHDH frontend plugins. Override their OCI references in your workspace tests/config/dynamic-plugins.yaml using the same pattern as any other plugin; workspace values are merged after package defaults.

OCI URL Generation

When GIT_PR_NUMBER is set, the package replaces local plugin paths with OCI URLs:

# Before
- package: ./dynamic-plugins/dist/my-plugin

# After (with GIT_PR_NUMBER=1234)
- package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/my-plugin:pr_1234__1.0.0

See Plugin Metadata for complete details.

Keycloak Variables

Required when using auth: "keycloak":

Variable	Description
KEYCLOAK_BASE_URL	Keycloak instance URL
KEYCLOAK_REALM	Realm name
KEYCLOAK_CLIENT_ID	OIDC client ID
KEYCLOAK_CLIENT_SECRET	OIDC client secret
KEYCLOAK_METADATA_URL	OIDC discovery URL
KEYCLOAK_LOGIN_REALM	Login realm name
KEYCLOAK_USER_NAME	Default test username
KEYCLOAK_USER_PASSWORD	Default test password

These are automatically set by KeycloakHelper.configureForRHDH().

GitHub Variables

For GitHub integration:

Variable	Description	Required
VAULT_GITHUB_USER_TOKEN	GitHub personal access token	For API/auth
VAULT_GH_USER_ID	GitHub username	For login
VAULT_GH_USER_PASS	GitHub password	For login
VAULT_GH_2FA_SECRET	2FA secret for OTP	For login

Custom Variables

Use in configuration files:

# tests/config/app-config-rhdh.yaml
myPlugin:
  apiUrl: ${MY_PLUGIN_API_URL}
  apiKey: ${MY_PLUGIN_API_KEY:-default-key}

# tests/config/rhdh-secrets.yaml
stringData:
  MY_PLUGIN_API_KEY: ${MY_PLUGIN_API_KEY}

Setting Variables

.env File

Create .env in your project root:

RHDH_VERSION="1.5"
INSTALLATION_METHOD="helm"
SKIP_KEYCLOAK_DEPLOYMENT=false

# Secrets
GITHUB_TOKEN=ghp_xxxxx
MY_API_KEY=secret-value

The .env file is automatically loaded by global setup. During local runs, .env values override inherited values, including values supplied by the local secret wrapper. In CI, inherited environment values take priority and .env only fills missing values.

CI/CD

Set in your CI pipeline:

# GitHub Actions
env:
  RHDH_VERSION: "1.5"
  INSTALLATION_METHOD: "helm"
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Runtime

Set programmatically:

test.beforeAll(async ({ rhdh }) => {
  process.env.MY_CUSTOM_URL = await rhdh.k8sClient.getRouteLocation(
    rhdh.deploymentConfig.namespace,
    "my-service",
  );

  await rhdh.deploy();
});

Variable Precedence

During global setup:

• Local runs: .env > inherited environment > default values
• CI runs: inherited environment > .env > default values

Values assigned to process.env after global setup override both sources.