From 250c150d73cc3af473b9dda2143e7f29bc0c067e Mon Sep 17 00:00:00 2001
From: chrischristiansen-glitch <chris.christiansen@vauco.no>
Date: Sun, 24 May 2026 15:06:28 +0200
Subject: [PATCH] =?UTF-8?q?feat:=2012-rag-integration.sh=20=E2=80=94=20kob?=
 =?UTF-8?q?le=20RAG=20corpus=20til=20Cloud=20Run=20agent=20via=20Secret=20?=
 =?UTF-8?q?Manager?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 infrastructure/12-rag-integration.sh | 127 +++++++++++++++++++++++++++
 1 file changed, 127 insertions(+)
 create mode 100644 infrastructure/12-rag-integration.sh

diff --git a/infrastructure/12-rag-integration.sh b/infrastructure/12-rag-integration.sh
new file mode 100644
index 0000000..d2b6754
--- /dev/null
+++ b/infrastructure/12-rag-integration.sh
@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+# 12-rag-integration.sh — Koble Vertex AI RAG corpus til Cloud Run-agenten
+#
+# Hva scriptet gjør:
+#   1. Lagrer RAG_CORPUS_NAME som Secret Manager-secret ("RAG_CORPUS")
+#   2. Gir Cloud Run service account tilgang til secret
+#   3. Gir AGENT_SA roles/aiplatform.user (RAG retrieval)
+#   4. Oppdaterer Cloud Run-tjenesten med RAG_CORPUS env-var via Secret Manager
+#   5. Kjører smoke-test mot /run endepunktet
+#
+# Forutsetter at 07-rag-setup.sh er kjørt og .env inneholder:
+#   RAG_CORPUS_NAME, RAG_REGION, CLOUD_RUN_SERVICE, AGENT_SA
+#
+# Idempotent — trygt å kjøre flere ganger
+# Source .env før kjøring: source .env
+
+set -euo pipefail
+
+: "${PROJECT_ID:?Set PROJECT_ID}"
+: "${REGION:?Set REGION}"
+: "${RAG_CORPUS_NAME:?Set RAG_CORPUS_NAME (kjør 07-rag-setup.sh først)}"
+: "${CLOUD_RUN_SERVICE:?Set CLOUD_RUN_SERVICE}"
+: "${AGENT_SA:?Set AGENT_SA}"
+
+echo "=== 12: RAG Integration — kobler corpus til Cloud Run ==="
+echo "    Project        : ${PROJECT_ID}"
+echo "    Region         : ${REGION}"
+echo "    Cloud Run      : ${CLOUD_RUN_SERVICE}"
+echo "    Corpus         : ${RAG_CORPUS_NAME}"
+echo ""
+
+bash "$(dirname "$0")/00-authcheck.sh"
+
+# ── 1. Secret Manager: lagre RAG_CORPUS_NAME som secret "RAG_CORPUS" ──────────
+SECRET_NAME="RAG_CORPUS"
+
+if gcloud secrets describe "${SECRET_NAME}" \
+  --project="${PROJECT_ID}" &>/dev/null; then
+  echo "  Secret finnes — oppdaterer verdi..."
+  echo -n "${RAG_CORPUS_NAME}" | \
+    gcloud secrets versions add "${SECRET_NAME}" \
+      --data-file=- \
+      --project="${PROJECT_ID}"
+else
+  echo "  Oppretter secret '${SECRET_NAME}'..."
+  echo -n "${RAG_CORPUS_NAME}" | \
+    gcloud secrets create "${SECRET_NAME}" \
+      --data-file=- \
+      --replication-policy=automatic \
+      --project="${PROJECT_ID}"
+fi
+echo "✓ Secret '${SECRET_NAME}' oppdatert"
+
+# ── 2. IAM: gi AGENT_SA tilgang til secret ────────────────────────────────────
+gcloud secrets add-iam-policy-binding "${SECRET_NAME}" \
+  --member="serviceAccount:${AGENT_SA}" \
+  --role="roles/secretmanager.secretAccessor" \
+  --project="${PROJECT_ID}" \
+  --quiet
+echo "✓ IAM: ${AGENT_SA} kan lese secret '${SECRET_NAME}'"
+
+# ── 3. IAM: gi AGENT_SA Vertex AI RAG-tilgang ─────────────────────────────────
+# roles/aiplatform.user dekker både import og retrieval
+gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
+  --member="serviceAccount:${AGENT_SA}" \
+  --role="roles/aiplatform.user" \
+  --quiet
+echo "✓ IAM: ${AGENT_SA} har roles/aiplatform.user"
+
+# ── 4. Cloud Run: inject RAG_CORPUS via Secret Manager ────────────────────────
+# agent.py leser os.environ["RAG_CORPUS"] — secret monteres direkte som env-var
+echo "  Oppdaterer Cloud Run-tjenesten med RAG_CORPUS secret..."
+gcloud run services update "${CLOUD_RUN_SERVICE}" \
+  --region="${REGION}" \
+  --project="${PROJECT_ID}" \
+  --update-secrets="RAG_CORPUS=${SECRET_NAME}:latest" \
+  --quiet
+echo "✓ Cloud Run: RAG_CORPUS montert fra Secret Manager"
+
+# ── 5. Hent Cloud Run URL og verifiser RAG-svar ───────────────────────────────
+SERVICE_URL=$(gcloud run services describe "${CLOUD_RUN_SERVICE}" \
+  --region="${REGION}" \
+  --project="${PROJECT_ID}" \
+  --format='value(status.url)' 2>/dev/null || echo '')
+
+if [[ -z "${SERVICE_URL}" ]]; then
+  echo "  ADVARSEL: Kunne ikke hente Cloud Run URL — hopper over smoke-test"
+else
+  echo "  Cloud Run URL: ${SERVICE_URL}"
+  echo "  Kjører RAG smoke-test mot /run..."
+  TOKEN=$(gcloud auth print-identity-token 2>/dev/null || gcloud auth print-access-token)
+
+  HTTP_STATUS=$(curl -s -o /tmp/rag_smoke.json -w "%{http_code}" \
+    -X POST "${SERVICE_URL}/run" \
+    -H "Authorization: Bearer ${TOKEN}" \
+    -H "Content-Type: application/json" \
+    -d '{"message": "Hva er OSVauco MASTERPLAN?"}' \
+    --max-time 30 || echo '000')
+
+  if [[ "${HTTP_STATUS}" == "200" ]]; then
+    echo "✓ Smoke-test OK (HTTP 200)"
+    python3 -c "
+import json
+with open('/tmp/rag_smoke.json') as f:
+    d = json.load(f)
+resp = d.get('response') or d.get('output') or d.get('text') or str(d)
+print('  Svar (truncated):', str(resp)[:300])
+" 2>/dev/null || cat /tmp/rag_smoke.json | head -5
+  else
+    echo "  ADVARSEL: Smoke-test returnerte HTTP ${HTTP_STATUS}"
+    cat /tmp/rag_smoke.json 2>/dev/null || true
+    echo ""
+    echo "  Tips: sjekk Cloud Run logs for detaljer:"
+    echo "    gcloud run services logs read ${CLOUD_RUN_SERVICE} --region=${REGION} --limit=20"
+  fi
+fi
+
+echo ""
+echo "=== 12: RAG Integration COMPLETE ==="
+echo "    Corpus   : ${RAG_CORPUS_NAME}"
+echo "    Secret   : ${SECRET_NAME} (Secret Manager)"
+echo "    Agent    : ${CLOUD_RUN_SERVICE} @ ${SERVICE_URL:-ukjent}"
+echo ""
+echo "    Verifiser manuelt:"
+echo "      RAG corpus  : https://console.cloud.google.com/vertex-ai/rag?project=${PROJECT_ID}"
+echo "      Cloud Run   : https://console.cloud.google.com/run/detail/${REGION}/${CLOUD_RUN_SERVICE}/logs?project=${PROJECT_ID}"
+echo ""