Skip to content

fix(exgentic_a2a_runner): create openai-secret when missing and report patch failures - #71

Open
esnible wants to merge 1 commit into
mainfrom
fix/create-openai-secret-if-missing
Open

fix(exgentic_a2a_runner): create openai-secret when missing and report patch failures#71
esnible wants to merge 1 commit into
mainfrom
fix/create-openai-secret-if-missing

Conversation

@esnible

@esnible esnible commented Sep 2, 2026

Copy link
Copy Markdown
Member

update-secrets.sh patched openai-secret unconditionally and sent kubectl's stderr to /dev/null, so a missing secret failed with no reason shown.

  • Create openai-secret with key apikey when it doesn't exist, instead of failing. Mirrors the existing hf-secret handling; key name matches the secretKeyRef in k8s/job.yaml.
  • Capture kubectl stderr so update/create failures print the reason.
  • deploy-benchmark.sh now echoes the secrets output and aborts when openai-secret can't be set, rather than deploying with a stale key.

Verified with a stubbed kubectl across: secret missing (creates), secret exists (patches), patch fails (reason shown), create fails (reason shown), OPENAI_API_KEY unset (skips). Both scripts pass bash -n.

Note: update-secrets.sh is also called by deploy-agent.sh, which gains the create-if-missing behavior but not the abort-on-failure guard.

🤖 Generated with Claude Code

…t patch failures

- update-secrets.sh: create openai-secret with key "apikey" if it does not
  exist, instead of failing; mirrors the existing hf-secret handling
- update-secrets.sh: capture kubectl stderr so update/create failures print
  the reason rather than discarding it via 2>/dev/null
- deploy-benchmark.sh: surface update-secrets.sh output and abort the deploy
  when openai-secret cannot be set

Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: Ed Snible <snible@us.ibm.com>
@esnible

esnible commented Sep 3, 2026

Copy link
Copy Markdown
Member Author

@webchang reports that this is related to rossoctl/rossoctl#2486 . Rossoctl no longer always creates the secret, so creating it in workload-harness will make Workload Harness able to handle those Rossoctl installs that didn't have the secret.

@esnible
esnible requested a review from yoavkatz September 3, 2026 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: New/ToDo

Development

Successfully merging this pull request may close these issues.

2 participants