Updated models swapping logic

Author: nuwangeek

DSL/CronManager/DSL/delete_from_vault.yml

@@ -2,4 +2,4 @@ delete_secrets:
   trigger: off
   type: exec
   command: "/app/scripts/delete_secrets_from_vault.sh"
-  allowedEnvs: ['cookie', 'connectionId','llmPlatform', 'llmModel','embeddingModel','embeddingPlatform','deploymentEnvironment']
+  allowedEnvs: ['cookie', 'connectionId','vaultUuid','llmPlatform', 'llmModel','embeddingModel','embeddingPlatform']

DSL/CronManager/DSL/store_in_vault.yml

@@ -2,4 +2,4 @@ store_secrets:
   trigger: off
   type: exec
   command: "/app/scripts/store_secrets_in_vault.sh"
-  allowedEnvs: ['cookie', 'connectionId','llmPlatform', 'llmModel','secretKey','accessKey','deploymentName','targetUrl','apiKey','embeddingModel','embeddingPlatform','embeddingAccessKey','embeddingSecretKey','embeddingDeploymentName','embeddingTargetUri','embeddingAzureApiKey','deploymentEnvironment']
+  allowedEnvs: ['cookie', 'connectionId','vaultUuid','llmPlatform', 'llmModel','secretKey','accessKey','deploymentName','targetUrl','apiKey','embeddingModel','embeddingPlatform','embeddingAccessKey','embeddingSecretKey','embeddingDeploymentName','embeddingTargetUri','embeddingAzureApiKey','deploymentEnvironment']

DSL/CronManager/script/delete_secrets_from_vault.sh

@@ -20,13 +20,19 @@ log "=== Starting Vault Secrets Deletion ==="
 # Debug: Print received parameters
 log "Received parameters:"
 log "  connectionId: $connectionId"
+log "  vaultUuid: $vaultUuid"
 log "  llmPlatform: $llmPlatform"
 log "  llmModel: $llmModel"
 log "  embeddingModel: $embeddingModel"
 log "  embeddingPlatform: $embeddingPlatform"
-log "  deploymentEnvironment: $deploymentEnvironment"
 log "  Vault Address: $VAULT_ADDR"
 
+# Validate required vaultUuid parameter
+if [ -z "$vaultUuid" ]; then
+    log "ERROR: vaultUuid is required but not provided"
+    exit 1
+fi
+
 # Note: No token required - vault agent proxy automatically injects authentication
 
 # Function to determine platform name
@@ -49,17 +55,13 @@ get_model_name() {
     echo "$model_array" | sed 's/\[//g' | sed 's/\]//g' | sed 's/"//g' | cut -d',' -f1 | xargs
 }
 
-# Function to build vault path
+# Function to build vault path (uses vaultUuid as stable path terminal)
 build_vault_path() {
     local secret_type=$1  # "llm" or "embeddings"
     local platform_name=$2
-    local model_name=$3
 
-    if [ "$deploymentEnvironment" = "testing" ]; then
-        echo "secret/$secret_type/connections/$platform_name/$deploymentEnvironment/$connectionId"
-    else
-        echo "secret/$secret_type/connections/$platform_name/$deploymentEnvironment/$model_name"
-    fi
+    # UUID-based path: no environment in path, swap is DB-only
+    echo "secret/$secret_type/connections/$platform_name/$vaultUuid"
 }
 
 # Function to delete vault secret (both data and metadata)
@@ -125,27 +127,26 @@ delete_vault_secret() {
 
 # Function to delete LLM secrets
 delete_llm_secrets() {
-    if [ -z "$llmPlatform" ] || [ -z "$llmModel" ]; then
-        log "No LLM platform or model specified, skipping LLM secrets deletion"
+    if [ -z "$llmPlatform" ]; then
+        log "No LLM platform specified, skipping LLM secrets deletion"
         return 0
     fi
 
     local platform_name=$(get_platform_name "$llmPlatform")
-    local model_name=$(get_model_name "$llmModel")
-    local vault_path=$(build_vault_path "llm" "$platform_name" "$model_name")
+    local vault_path=$(build_vault_path "llm" "$platform_name")
 
     delete_vault_secret "$vault_path" "LLM secrets"
 }
 
 # Function to delete embedding secrets
 delete_embedding_secrets() {
-    if [ -z "$embeddingPlatform" ] || [ -z "$embeddingModel" ]; then
-        log "No embedding platform or model specified, skipping embedding secrets deletion"
+    if [ -z "$embeddingPlatform" ]; then
+        log "No embedding platform specified, skipping embedding secrets deletion"
         return 0
     fi
 
     local platform_name=$(get_platform_name "$embeddingPlatform")
-    local vault_path=$(build_vault_path "embeddings" "$platform_name" "$embeddingModel")
+    local vault_path=$(build_vault_path "embeddings" "$platform_name")
 
     delete_vault_secret "$vault_path" "Embedding secrets"
 }

DSL/CronManager/script/store_secrets_in_vault.sh

@@ -165,11 +165,18 @@ setup_python_environment() {
 log "=== Starting Vault Secrets Storage ==="
 log "Received parameters:"
 log "  connectionId: $connectionId"
+log "  vaultUuid: $vaultUuid"
 log "  llmPlatform: $llmPlatform"
 log "  llmModel: $llmModel"
 log "  deploymentEnvironment: $deploymentEnvironment"
 log "  Vault Address: $VAULT_ADDR"
 
+# Validate required vaultUuid parameter
+if [ -z "$vaultUuid" ]; then
+    log "ERROR: vaultUuid is required but not provided"
+    exit 1
+fi
+
 # Redirect stderr to stdout so cron-manager can capture all logs
 exec 2>&1
 
@@ -197,24 +204,13 @@ get_model_name() {
     echo "$llmModel" | sed 's/\[//g' | sed 's/\]//g' | sed 's/"//g' | cut -d',' -f1 | xargs
 }
 
-# Function to build vault path
+# Function to build vault path (uses vaultUuid as stable path terminal)
 build_vault_path() {
     local secret_type=$1  # "llm" or "embeddings"
     local platform=$(get_platform_name)
 
-    # Use appropriate model based on secret type
-    local model
-    if [ "$secret_type" = "embeddings" ]; then
-        model="$embeddingModel"
-    else
-        model=$(get_model_name)
-    fi
-    
-    if [ "$deploymentEnvironment" = "testing" ]; then
-        echo "secret/$secret_type/connections/$platform/$deploymentEnvironment/$connectionId"
-    else
-        echo "secret/$secret_type/connections/$platform/$deploymentEnvironment/$model"
-    fi
+    # UUID-based path: no environment in path, swap is DB-only
+    echo "secret/$secret_type/connections/$platform/$vaultUuid"
 }
 
 # Function to store LLM secrets
@@ -275,15 +271,13 @@ store_aws_llm_secrets() {
         --arg conn_id "$connectionId" \
         --arg access_key "$decrypted_access_key" \
         --arg secret_key "$decrypted_secret_key" \
-        --arg env "$deploymentEnvironment" \
         --arg model "$model" \
         '{data: {
             connection_id: $conn_id,
             access_key: $access_key,
             secret_key: $secret_key,
-            environment: $env,
             model: $model,
-            tags: "aws,bedrock,\($env),\($model)"
+            tags: "aws,bedrock,\($model)"
         }}')
 
     log "Storing secrets at path: $vault_path"
@@ -337,17 +331,15 @@ store_azure_llm_secrets() {
         --arg endpoint "$targetUrl" \
         --arg api_key "$decrypted_api_key" \
         --arg deploy_name "$deploymentName" \
-        --arg env "$deploymentEnvironment" \
         --arg model "$model" \
         '{data: {
             connection_id: $conn_id,
             endpoint: $endpoint,
             api_key: $api_key,
             deployment_name: $deploy_name,
-            environment: $env,
             model: $model,
             api_version: "2024-05-01-preview",
-            tags: "azure,\($env),\($model)"
+            tags: "azure,\($model)"
         }}')
 
     log "Storing secrets at path: $vault_path"
@@ -405,15 +397,13 @@ store_aws_embedding_secrets() {
         --arg conn_id "$connectionId" \
         --arg access_key "$decrypted_embedding_access_key" \
         --arg secret_key "$decrypted_embedding_secret_key" \
-        --arg env "$deploymentEnvironment" \
         --arg model "$embeddingModel" \
         '{data: {
             connection_id: $conn_id,
             access_key: $access_key,
             secret_key: $secret_key,
-            environment: $env,
             model: $model,
-            tags: "aws,bedrock,embedding,\($env),\($model)"
+            tags: "aws,bedrock,embedding,\($model)"
         }}')
 
     log "Storing secrets at path: $vault_path"
@@ -466,17 +456,15 @@ store_azure_embedding_secrets() {
         --arg endpoint "$embeddingTargetUri" \
         --arg api_key "$decrypted_embedding_api_key" \
         --arg deploy_name "$embeddingDeploymentName" \
-        --arg env "$deploymentEnvironment" \
         --arg model "$embeddingModel" \
         '{data: {
             connection_id: $conn_id,
             endpoint: $endpoint,
             api_key: $api_key,
             deployment_name: $deploy_name,
-            environment: $env,
             model: $model,
             api_version: "2024-12-01-preview",
-            tags: "azure,embedding,\($env),\($model)"
+            tags: "azure,embedding,\($model)"
         }}')
 
     log "Storing secrets at path: $vault_path"

DSL/Liquibase/changelog/rag-search-script-v8-uuid-vault-path.sql

@@ -0,0 +1,16 @@
+-- liquibase formatted sql
+
+-- changeset uuid-vault-path:rag-script-v8-changeset1
+-- Add UUID column to llm_connections for stable Vault secret paths
+ALTER TABLE rag_search.llm_connections
+    ADD COLUMN IF NOT EXISTS vault_uuid UUID DEFAULT gen_random_uuid();
+
+-- Backfill existing rows with unique UUIDs
+UPDATE rag_search.llm_connections SET vault_uuid = gen_random_uuid() WHERE vault_uuid IS NULL;
+
+-- Make it NOT NULL after backfill
+ALTER TABLE rag_search.llm_connections ALTER COLUMN vault_uuid SET NOT NULL;
+
+-- Add unique constraint
+ALTER TABLE rag_search.llm_connections ADD CONSTRAINT llm_connections_vault_uuid_unique UNIQUE (vault_uuid);
+-- rollback ALTER TABLE rag_search.llm_connections DROP CONSTRAINT IF EXISTS llm_connections_vault_uuid_unique; ALTER TABLE rag_search.llm_connections DROP COLUMN IF EXISTS vault_uuid;

DSL/Liquibase/master.yml

@@ -12,4 +12,6 @@ databaseChangeLog:
   - include:
       file: changelog/rag-search-script-v6-endpoints.sql
   - include:
-      file: changelog/rag-search-script-v7-schema-migration.sql
+      file: changelog/rag-search-script-v7-schema-migration.sql
+  - include:
+      file: changelog/rag-search-script-v8-uuid-vault-path.sql

DSL/Liquibase_production/changelog/rag-search-script-v8-uuid-vault-path.sql

@@ -0,0 +1,16 @@
+-- liquibase formatted sql
+
+-- changeset uuid-vault-path:rag-script-v8-changeset1
+-- Add UUID column to llm_connections for stable Vault secret paths
+ALTER TABLE rag_search.llm_connections
+    ADD COLUMN IF NOT EXISTS vault_uuid UUID DEFAULT gen_random_uuid();
+
+-- Backfill existing rows with unique UUIDs
+UPDATE rag_search.llm_connections SET vault_uuid = gen_random_uuid() WHERE vault_uuid IS NULL;
+
+-- Make it NOT NULL after backfill
+ALTER TABLE rag_search.llm_connections ALTER COLUMN vault_uuid SET NOT NULL;
+
+-- Add unique constraint
+ALTER TABLE rag_search.llm_connections ADD CONSTRAINT llm_connections_vault_uuid_unique UNIQUE (vault_uuid);
+-- rollback ALTER TABLE rag_search.llm_connections DROP CONSTRAINT IF EXISTS llm_connections_vault_uuid_unique; ALTER TABLE rag_search.llm_connections DROP COLUMN IF EXISTS vault_uuid;

DSL/Resql/rag-search/POST/get-llm-connection.sql

@@ -1,5 +1,6 @@
 SELECT 
     id,
+    vault_uuid,
     connection_name,
     llm_platform,
     llm_model,

DSL/Resql/rag-search/POST/get-llm-connections-paginated.sql

@@ -1,5 +1,6 @@
 SELECT 
     id,
+    vault_uuid,
     connection_name,
     llm_platform,
     llm_model,

DSL/Resql/rag-search/POST/get-production-connection-filtered.sql

@@ -1,5 +1,6 @@
 SELECT 
     id,
+    vault_uuid,
     connection_name,
     llm_platform,
     llm_model,