feat: 12-rag-integration.sh — koble RAG corpus til Cloud Run agent via Secret Manager
This commit is contained in:
parent
021c84756a
commit
250c150d73
127
infrastructure/12-rag-integration.sh
Normal file
127
infrastructure/12-rag-integration.sh
Normal file
|
|
@ -0,0 +1,127 @@
|
|||
#!/usr/bin/env bash
|
||||
# 12-rag-integration.sh — Koble Vertex AI RAG corpus til Cloud Run-agenten
|
||||
#
|
||||
# Hva scriptet gjør:
|
||||
# 1. Lagrer RAG_CORPUS_NAME som Secret Manager-secret ("RAG_CORPUS")
|
||||
# 2. Gir Cloud Run service account tilgang til secret
|
||||
# 3. Gir AGENT_SA roles/aiplatform.user (RAG retrieval)
|
||||
# 4. Oppdaterer Cloud Run-tjenesten med RAG_CORPUS env-var via Secret Manager
|
||||
# 5. Kjører smoke-test mot /run endepunktet
|
||||
#
|
||||
# Forutsetter at 07-rag-setup.sh er kjørt og .env inneholder:
|
||||
# RAG_CORPUS_NAME, RAG_REGION, CLOUD_RUN_SERVICE, AGENT_SA
|
||||
#
|
||||
# Idempotent — trygt å kjøre flere ganger
|
||||
# Source .env før kjøring: source .env
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
: "${PROJECT_ID:?Set PROJECT_ID}"
|
||||
: "${REGION:?Set REGION}"
|
||||
: "${RAG_CORPUS_NAME:?Set RAG_CORPUS_NAME (kjør 07-rag-setup.sh først)}"
|
||||
: "${CLOUD_RUN_SERVICE:?Set CLOUD_RUN_SERVICE}"
|
||||
: "${AGENT_SA:?Set AGENT_SA}"
|
||||
|
||||
echo "=== 12: RAG Integration — kobler corpus til Cloud Run ==="
|
||||
echo " Project : ${PROJECT_ID}"
|
||||
echo " Region : ${REGION}"
|
||||
echo " Cloud Run : ${CLOUD_RUN_SERVICE}"
|
||||
echo " Corpus : ${RAG_CORPUS_NAME}"
|
||||
echo ""
|
||||
|
||||
bash "$(dirname "$0")/00-authcheck.sh"
|
||||
|
||||
# ── 1. Secret Manager: lagre RAG_CORPUS_NAME som secret "RAG_CORPUS" ──────────
|
||||
SECRET_NAME="RAG_CORPUS"
|
||||
|
||||
if gcloud secrets describe "${SECRET_NAME}" \
|
||||
--project="${PROJECT_ID}" &>/dev/null; then
|
||||
echo " Secret finnes — oppdaterer verdi..."
|
||||
echo -n "${RAG_CORPUS_NAME}" | \
|
||||
gcloud secrets versions add "${SECRET_NAME}" \
|
||||
--data-file=- \
|
||||
--project="${PROJECT_ID}"
|
||||
else
|
||||
echo " Oppretter secret '${SECRET_NAME}'..."
|
||||
echo -n "${RAG_CORPUS_NAME}" | \
|
||||
gcloud secrets create "${SECRET_NAME}" \
|
||||
--data-file=- \
|
||||
--replication-policy=automatic \
|
||||
--project="${PROJECT_ID}"
|
||||
fi
|
||||
echo "✓ Secret '${SECRET_NAME}' oppdatert"
|
||||
|
||||
# ── 2. IAM: gi AGENT_SA tilgang til secret ────────────────────────────────────
|
||||
gcloud secrets add-iam-policy-binding "${SECRET_NAME}" \
|
||||
--member="serviceAccount:${AGENT_SA}" \
|
||||
--role="roles/secretmanager.secretAccessor" \
|
||||
--project="${PROJECT_ID}" \
|
||||
--quiet
|
||||
echo "✓ IAM: ${AGENT_SA} kan lese secret '${SECRET_NAME}'"
|
||||
|
||||
# ── 3. IAM: gi AGENT_SA Vertex AI RAG-tilgang ─────────────────────────────────
|
||||
# roles/aiplatform.user dekker både import og retrieval
|
||||
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
||||
--member="serviceAccount:${AGENT_SA}" \
|
||||
--role="roles/aiplatform.user" \
|
||||
--quiet
|
||||
echo "✓ IAM: ${AGENT_SA} har roles/aiplatform.user"
|
||||
|
||||
# ── 4. Cloud Run: inject RAG_CORPUS via Secret Manager ────────────────────────
|
||||
# agent.py leser os.environ["RAG_CORPUS"] — secret monteres direkte som env-var
|
||||
echo " Oppdaterer Cloud Run-tjenesten med RAG_CORPUS secret..."
|
||||
gcloud run services update "${CLOUD_RUN_SERVICE}" \
|
||||
--region="${REGION}" \
|
||||
--project="${PROJECT_ID}" \
|
||||
--update-secrets="RAG_CORPUS=${SECRET_NAME}:latest" \
|
||||
--quiet
|
||||
echo "✓ Cloud Run: RAG_CORPUS montert fra Secret Manager"
|
||||
|
||||
# ── 5. Hent Cloud Run URL og verifiser RAG-svar ───────────────────────────────
|
||||
SERVICE_URL=$(gcloud run services describe "${CLOUD_RUN_SERVICE}" \
|
||||
--region="${REGION}" \
|
||||
--project="${PROJECT_ID}" \
|
||||
--format='value(status.url)' 2>/dev/null || echo '')
|
||||
|
||||
if [[ -z "${SERVICE_URL}" ]]; then
|
||||
echo " ADVARSEL: Kunne ikke hente Cloud Run URL — hopper over smoke-test"
|
||||
else
|
||||
echo " Cloud Run URL: ${SERVICE_URL}"
|
||||
echo " Kjører RAG smoke-test mot /run..."
|
||||
TOKEN=$(gcloud auth print-identity-token 2>/dev/null || gcloud auth print-access-token)
|
||||
|
||||
HTTP_STATUS=$(curl -s -o /tmp/rag_smoke.json -w "%{http_code}" \
|
||||
-X POST "${SERVICE_URL}/run" \
|
||||
-H "Authorization: Bearer ${TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"message": "Hva er OSVauco MASTERPLAN?"}' \
|
||||
--max-time 30 || echo '000')
|
||||
|
||||
if [[ "${HTTP_STATUS}" == "200" ]]; then
|
||||
echo "✓ Smoke-test OK (HTTP 200)"
|
||||
python3 -c "
|
||||
import json
|
||||
with open('/tmp/rag_smoke.json') as f:
|
||||
d = json.load(f)
|
||||
resp = d.get('response') or d.get('output') or d.get('text') or str(d)
|
||||
print(' Svar (truncated):', str(resp)[:300])
|
||||
" 2>/dev/null || cat /tmp/rag_smoke.json | head -5
|
||||
else
|
||||
echo " ADVARSEL: Smoke-test returnerte HTTP ${HTTP_STATUS}"
|
||||
cat /tmp/rag_smoke.json 2>/dev/null || true
|
||||
echo ""
|
||||
echo " Tips: sjekk Cloud Run logs for detaljer:"
|
||||
echo " gcloud run services logs read ${CLOUD_RUN_SERVICE} --region=${REGION} --limit=20"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== 12: RAG Integration COMPLETE ==="
|
||||
echo " Corpus : ${RAG_CORPUS_NAME}"
|
||||
echo " Secret : ${SECRET_NAME} (Secret Manager)"
|
||||
echo " Agent : ${CLOUD_RUN_SERVICE} @ ${SERVICE_URL:-ukjent}"
|
||||
echo ""
|
||||
echo " Verifiser manuelt:"
|
||||
echo " RAG corpus : https://console.cloud.google.com/vertex-ai/rag?project=${PROJECT_ID}"
|
||||
echo " Cloud Run : https://console.cloud.google.com/run/detail/${REGION}/${CLOUD_RUN_SERVICE}/logs?project=${PROJECT_ID}"
|
||||
echo ""
|
||||
Loading…
Reference in New Issue
Block a user