Skip to content

Save Vertex AI Access Token in database

Jessie Young requested to merge jy-bye-forever-tofa into master

What does this MR do and why?

  • Previously we were storing the plaintext value in Rails cache and refreshing 59 minutes.
  • Now we are encrypting it and storing it in the database and refreshing every 50 minutes via a cron job.
  • Storing it encrypted in the database is more secure and in line with our documented guideline: "Credentials must be encrypted while at rest (database or file) with attr_encrypted."
  • Closes https://gitlab.com/gitlab-org/gitlab/-/issues/408829

How to set up and validate locally

Confirming that requests to Vertex still work ensures that the code in this MR is properly fetching and saving the Vertex access token.

  1. Configure Vertex locally: https://docs.gitlab.com/ee/development/ai_features/index.html#configure-gcp-vertex-access (also note changes in this MR to the documentation because I found a few hiccups when going through these steps)
  2. Enable the experimentation feature flag 
    echo "Feature.enable(:ai_experimentation_api)" | gdk rails c
  3. Create or use a personal access token with the api scope (PATs can be created at https://gdk.test:3443/-/profile/personal_access_tokens)
  4. Make a test API request to Vertex: 
    export PAT='gitlab-pat-with-api-scope'
curl --request POST --header "PRIVATE-TOKEN: $PAT" --header "Content-Type: application/json" --data '{"content": "What is Vertex AI?"}' "https://gdk.test:3443/api/v4/ai/experimentation/vertex/chat"
  5. Confirm that the request to Vertex returned a Vertex response ("content" in response body). Then confirm that an access token was saved in the database: 
    Gitlab::CurrentSettings.vertex_ai_access_token
=> aVeryLongStringThatIsAnAccessTokenFromGoogle

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Jessie Young

Merge request reports