From 1d367ffedd4c351ea6117b084652d21496559bd9 Mon Sep 17 00:00:00 2001
From: Ed Snible <snible@us.ibm.com>
Date: Wed, 2 Sep 2026 16:05:09 -0400
Subject: [PATCH] fix(exgentic_a2a_runner): create openai-secret when missing
 and report patch failures

- update-secrets.sh: create openai-secret with key "apikey" if it does not
  exist, instead of failing; mirrors the existing hf-secret handling
- update-secrets.sh: capture kubectl stderr so update/create failures print
  the reason rather than discarding it via 2>/dev/null
- deploy-benchmark.sh: surface update-secrets.sh output and abort the deploy
  when openai-secret cannot be set

Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: Ed Snible <snible@us.ibm.com>
---
 exgentic_a2a_runner/deploy-benchmark.sh | 15 ++++++++++-
 exgentic_a2a_runner/update-secrets.sh   | 33 +++++++++++++++++++------
 2 files changed, 40 insertions(+), 8 deletions(-)

diff --git a/exgentic_a2a_runner/deploy-benchmark.sh b/exgentic_a2a_runner/deploy-benchmark.sh
index 7884a6f..9758c13 100755
--- a/exgentic_a2a_runner/deploy-benchmark.sh
+++ b/exgentic_a2a_runner/deploy-benchmark.sh
@@ -339,7 +339,20 @@ echo ""
 # Step 7.1.1 + 7.1.2: Update secrets
 echo "Step 7.1.1: Updating secrets..."
 if [ "$CLUSTER_MODE" = "kind" ]; then
-    "$SCRIPT_DIR_BENCH/update-secrets.sh" --namespace "$NAMESPACE"
+    # Don't let set -e abort before the reason can be printed.
+    SECRETS_OUTPUT=$("$SCRIPT_DIR_BENCH/update-secrets.sh" --namespace "$NAMESPACE" 2>&1) && SECRETS_RC=0 || SECRETS_RC=$?
+    echo "$SECRETS_OUTPUT"
+    if [ "$SECRETS_RC" -ne 0 ]; then
+        echo "ERROR: update-secrets.sh failed (exit $SECRETS_RC) — see the output above for the reason" >&2
+        exit "$SECRETS_RC"
+    fi
+    # update-secrets.sh exits 0 even when an individual patch fails, so check
+    # its output for the warning and surface the reason it printed.
+    if echo "$SECRETS_OUTPUT" | grep -qE "Could not (update|create) openai-secret"; then
+        echo "ERROR: could not set secret openai-secret in namespace $NAMESPACE" >&2
+        echo "$SECRETS_OUTPUT" | grep -E -A 1 "Could not (update|create) openai-secret" >&2
+        exit 1
+    fi
 else
     echo "Step 7.1.1: Updating secrets... (skipped — secrets are pre-provisioned on OpenShift/in-cluster)"
 fi
diff --git a/exgentic_a2a_runner/update-secrets.sh b/exgentic_a2a_runner/update-secrets.sh
index 704b8fc..fb268a9 100755
--- a/exgentic_a2a_runner/update-secrets.sh
+++ b/exgentic_a2a_runner/update-secrets.sh
@@ -36,13 +36,32 @@ if [ -z "$OPENAI_API_KEY" ]; then
     echo "Warning: OPENAI_API_KEY is not set — skipping"
 else
     ENCODED_KEY=$(echo -n "$OPENAI_API_KEY" | base64)
-    kubectl patch secret openai-secret -n "$NAMESPACE" --type='json' -p="[
-      {
-        \"op\": \"replace\",
-        \"path\": \"/data/apikey\",
-        \"value\": \"$ENCODED_KEY\"
-      }
-    ]" 2>/dev/null && echo "✓ openai-secret updated" || echo "Warning: Could not update openai-secret"
+    # Patch when the secret already exists, create it otherwise. Stderr is
+    # captured (2>&1 >/dev/null) so a real failure reports why kubectl refused
+    # — RBAC denial, missing namespace, missing /data/apikey key, ...
+    if kubectl get secret openai-secret -n "$NAMESPACE" >/dev/null 2>&1; then
+        if PATCH_ERR=$(kubectl patch secret openai-secret -n "$NAMESPACE" --type='json' -p="[
+          {
+            \"op\": \"replace\",
+            \"path\": \"/data/apikey\",
+            \"value\": \"$ENCODED_KEY\"
+          }
+        ]" 2>&1 >/dev/null); then
+            echo "✓ openai-secret updated"
+        else
+            echo "Warning: Could not update openai-secret (kubectl patch secret openai-secret -n $NAMESPACE failed)"
+            [ -n "$PATCH_ERR" ] && echo "  Reason: $PATCH_ERR"
+        fi
+    else
+        # Key must be "apikey" — that is what k8s/job.yaml's secretKeyRef reads.
+        if CREATE_ERR=$(kubectl create secret generic openai-secret -n "$NAMESPACE" \
+            --from-literal=apikey="$OPENAI_API_KEY" 2>&1 >/dev/null); then
+            echo "✓ openai-secret created"
+        else
+            echo "Warning: Could not create openai-secret (kubectl create secret generic openai-secret -n $NAMESPACE failed)"
+            [ -n "$CREATE_ERR" ] && echo "  Reason: $CREATE_ERR"
+        fi
+    fi
 fi
 
 echo ""