From cf837fb99497bed93a5479349827351db15a546d Mon Sep 17 00:00:00 2001
From: "Adrian A. Baumann" <ade@adebaumann.com>
Date: Sat, 28 Feb 2026 23:16:51 +0100
Subject: [PATCH] fix: add kubectl preflight check and clarify repo-root usage
 in comment

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 helm/shorefront/values-prod.yaml | 4 ++--
 scripts/create-secrets.sh        | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/helm/shorefront/values-prod.yaml b/helm/shorefront/values-prod.yaml
index 280dc21..b0e325d 100644
--- a/helm/shorefront/values-prod.yaml
+++ b/helm/shorefront/values-prod.yaml
@@ -1,8 +1,8 @@
 ingress:
   host: shorefront.yourdomain.com
 
-# Secrets are NOT managed by Helm. Run scripts/create-secrets.sh before
-# the first helm install/ArgoCD sync:
+# Secrets are NOT managed by Helm. Run scripts/create-secrets.sh from the
+# repository root before the first helm install/ArgoCD sync:
 #
 #   export POSTGRES_PASSWORD=<real-password>
 #   export JWT_SECRET_KEY=<real-jwt-secret>
diff --git a/scripts/create-secrets.sh b/scripts/create-secrets.sh
index 09b2455..787a2e5 100755
--- a/scripts/create-secrets.sh
+++ b/scripts/create-secrets.sh
@@ -3,6 +3,12 @@ set -euo pipefail
 
 NAMESPACE="shorefront"
 
+# --- Preflight checks ---
+if ! command -v kubectl &>/dev/null; then
+  echo "Error: kubectl is not installed or not in PATH" >&2
+  exit 1
+fi
+
 # --- Validate required env vars ---
 : "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}"
 : "${JWT_SECRET_KEY:?JWT_SECRET_KEY is required}"