You can use your Weaviate database instance, which is an open source database,
with RAG Engine to index and conduct a vector-based similarity search. A
similarity search is a way to find pieces of text that are similar to the text
that you're looking for, which requires the use of an embedding
model. The embedding model produces vector data for each
piece of text being compared. The similarity search is used to retrieve semantic
contexts for
grounding to
return the most accurate content from your LLM.
With RAG Engine, you can continue to use your fully-managed vector
database instance, which you are responsible for provisioning.
RAG Engine uses the vector database for storage, index management,
and search.
Considerations
Consider the following steps before using the Weaviate database:
You must create, configure, and deploy your Weaviate database instance and
collection. Follow the instructions in Create your Weaviate
collection to set up a collection based on your schema.
You must provide a Weaviate API key, which allows RAG Engine to interact
with the Weaviate database. RAG Engine supports the API key-based AuthN
and AuthZ, which connects to your Weaviate database and supports an HTTPS
connection.
RAG Engine doesn't store and manage your Weaviate API key. Instead, you
must do the following:
Store your key in the Google Cloud Secret Manager.
Grant your project's service account permissions to access your secret.
Provide RAG Engine access to your secret's resource name.
When you interact with your Weaviate database, RAG Engine accesses your
secret resource using your service account.
RAG Engine corpus and the Weaviate collection have a one-to-one
mapping. RAG files are stored in a Weaviate database collection. When a call is
made to the CreateRagCorpus API or the UpdateRagCorpus API, the RAG corpus
is associated to the database collection.
In addition to dense embeddings-based semantic searches, the
hybrid search is also supported with RAG Engine through
a Weaviate database. You can also adjust the weight between dense and sparse
vector similarity in a hybrid search.
Provision the Weaviate database
Before using the Weaviate database with RAG Engine, you must do the
following:
Configure and deploy your Weaviate database instance.
Prepare the HTTPS endpoint.
Create your Weaviate collection.
Use your API key to provision Weaviate using AuthN and AuthZ.
Provision your RAG Engine service account.
Configure and deploy your Weaviate database instance
You can set up your Weaviate instance anywhere as long as the Weaviate endpoint
is accessible to configure and deploy in your project. You can then fully manage
your Weaviate database instance.
Because RAG Engine isn't involved in any stage of your Weaviate database
instance lifecycle, it is your responsibility to grant permissions to
RAG Engine so it can store and search for data in your Weaviate database.
It is also your responsibility to ensure that the data in your database can be
used by RAG Engine. For example, if you change your data, RAG Engine
isn't responsible for any unexpected behaviors because of those changes.
Prepare the HTTPS endpoint
During Weaviate provisioning, ensure that you create an HTTPS endpoint. Although
HTTP connections are supported, we prefer that RAG Engine and Weaviate
database traffic use an HTTPS connection.
Create your Weaviate collection
Because the RAG Engine corpus and the Weaviate collection have a one-to-one
mapping, you must create a collection in your Weaviate database before
associating your collection with the RAG Engine corpus. This one-time
association is made when you call the CreateRagCorpus API or the
UpdateRagCorpus API.
When creating a collection in Weaviate, you must use the following schema:
Property name
Data type
fileId
text
corpusId
text
chunkId
text
chunkDataType
text
chunkData
text
fileOriginalUri
text
Use your API key to provision Weaviate using AuthN and AuthZ
Provisioning the Weaviate API key involves the following steps:
Create the Weaviate API key.
Configure Weaviate using your Weaviate API key.
Store your Weaviate API key in Secret Manager.
Create the API key
RAG Engine can only connect to your Weaviate database instances by using
your API key for authentication and authorization. You must follow the
Weaviate official guide to authentication
to configure the API key-based authentication in your Weaviate database
instance.
If creating the Weaviate API key requires identity information to associate with
that comes from RAG Engine, you must create your first corpus, and use your
RAG Engine service account as an identity.
Store your API key in Secret Manager
An API key holds Sensitive Personally Identifiable Information (SPII), which is
subject to legal requirements. If the SPII data is compromised or misused, an
individual might experience a significant risk or harm. To minimize risks to an
individual while using RAG Engine, don't store and manage your API key, and
avoid sharing the unencrypted API key.
To protect SPII, do the following:
Store your API key in Secret Manager.
Grant your RAG Engine service account the permissions to your secret(s),
and manage the access control at the secret resource level.
Add the Secret Manager Secret Accessor role to the service
account.
During the creation or update of the RAG corpus, pass the secret resource
name to RAG Engine, and store the secret resource name.
When you make API requests to your Weaviate database instance(s),
RAG Engine uses each service account to read the API key that corresponds
to your secret resources in Secret Manager from your project(s).
Provision your RAG Engine service account
When you create the first resource in your project, RAG Engine creates a
dedicated service account. You can find your service account from your project's
IAM page. The service account follows this
format:
For example, service-123456789@gcp-sa-vertex-rag.iam.gserviceaccount.com.
When integrating with the Weaviate database, your service account is used in the
following scenarios:
You can use your service account to generate your Weaviate API key for
authentication. In some cases, generating the API key doesn't require any user
information, which means that a service account isn't required when generating
the API key.
You can bind your service account with the API key in your Weaviate database
to configure the authentication (AuthN) and authorization (AuthZ).
However, your service account isn't required.
You can store the API key Secret Manager in your project, and you
can grant your service account permissions to these secret resources.
RAG Engine uses service accounts to access the API key from the
Secret Manager in your projects.
Set up your Google Cloud console environment
Click to learn how to set up your environment
Learn how to set up your environment by selecting one of the following
tabs:
Python
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
If you're using a local shell, then create local authentication credentials for your user
account:
gcloudauthapplication-defaultlogin
You don't need to do this if you're using Cloud Shell.
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
If you're using a local shell, then create local authentication credentials for your user
account:
gcloudauthapplication-defaultlogin
You don't need to do this if you're using Cloud Shell.
Install or update the Agent Platform SDK for
Node.js by running the following command:
npm install @google-cloud/vertexai
Java
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
If you're using a local shell, then create local authentication credentials for your user
account:
gcloudauthapplication-defaultlogin
You don't need to do this if you're using Cloud Shell.
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
If you're using a local shell, then create local authentication credentials for your user
account:
gcloudauthapplication-defaultlogin
You don't need to do this if you're using Cloud Shell.
vertexai is a human authored package that provides access
to common capabilities and features.
This package is recommended as the starting point for most developers
building with the Agent Platform API. To access capabilities and
features not yet covered by this package, use the auto-generated
aiplatform instead.
This package is intended for projects that require access to
Agent Platform API capabilities and features not yet provided by the
human authored vertexai package.
Install the desired Go package based on your project's needs by running
one of the following commands:
# Human authored package. Recommended for most developers.
go get cloud.google.com/go/vertexai
# Auto-generated package.
go get cloud.google.com/go/aiplatform
C#
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
If you're using a local shell, then create local authentication credentials for your user
account:
gcloudauthapplication-defaultlogin
You don't need to do this if you're using Cloud Shell.
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Roles required to select or create a project
Select a project: Selecting a project doesn't require a specific
IAM role—you can select any project that you've been
granted a role on.
Create a project: To create a project, you need the Project Creator role
(roles/resourcemanager.projectCreator), which contains the
resourcemanager.projects.create permission. Learn how to grant
roles.
To enable APIs, you need the Service Usage Admin IAM
role (roles/serviceusage.serviceUsageAdmin), which
contains the serviceusage.services.enable permission. Learn how to grant
roles.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
Configure environment variables by entering the following. Replace
PROJECT_ID with the ID of your Google Cloud project.
Optional: If you are using Cloud Shell and you are asked to authorize Cloud Shell, click
Authorize.
Prepare your RAG corpus
To access data from your Weaviate database, RAG Engine must have access to
a RAG corpus. This section provides the steps for creating a single RAG corpus
and additional RAG corpora.
Use CreateRagCorpus and UpdateRagCorpus APIs
You must specify the following fields when calling the CreateRagCorpus and
UpdateRagCorpus APIs:
rag_vector_db_config.weaviate: After you call the CreateRagCorpus API,
the vector database configuration is chosen. The vector database configuration
contains all of the configuration fields. If the rag_vector_db_config.weaviate
field isn't set, then rag_vector_db_config.rag_managed_db is set by default.
weaviate.http_endpoint: The HTTPS or HTTP Weaviate endpoint is created
during provisioning of the Weaviate database instance.
weaviate.collection_name: The name of the collection that is created
during the Weaviate instance provisioning. The name must start with a capital
letter.
api_auth.api_key_config: The configuration specifies to use
an API key to authorize your access to the vector database.
api_key_config.api_key_secret_version: The resource name of the secret
that is stored in Secret Manager, which contains your Weaviate API
key.
You can create and associate your RAG corpus to the Weaviate collection in your
database instance. However, you might need the service account to generate your
API key and to configure your Weaviate database instance. When you create your
first RAG corpus, the service account is generated. After you create your first
RAG corpus, the association between the Weaviate database and the API key might
not be ready for use in the creation of another RAG corpus.
Just in case your database and key aren't ready to be associated to your
RAG corpus, do the following to your RAG corpus:
Set the weaviate field in rag_vector_db_config.
You can't change the associated vector database.
Leave both the http_endpoint and the collection_name fields empty. Both
fields can be updated at a later time.
If you don't have your API key stored in Secret Manager, then you
can leave the api_auth field empty. When you call the UpdateRagCorpus
API, you can update the api_auth field. Weaviate requires that the
following be done:
Set the api_key_config in the api_auth field.
Set the api_key_secret_version of your Weaviate API key in
Secret Manager. The api_key_secret_version field
uses the following format:
If you specify fields that can only be set one time, like http_endpoint or
collection_name, you can't change them unless you delete your RAG corpus,
and create your RAG corpus again. Other fields like the API key field,
api_key_secret_version, can be updated.
When you call UpdateRagCorpus, you can set the vector_db field. The
vector_db should be set to weaviate by your CreateRagCorpus API call.
Otherwise, the system chooses the RAG Managed Database option, which is
the default. This option can't be changed when you call the UpdateRagCorpus
API. When you call UpdateRagCorpus and the vector_db field is partially
set, you can update the fields that are marked as Changeable (also referred
to as mutable).
This table lists the WeaviateConfig mutable and immutable fields that are used
in your code.
Field name
Mutable or Immutable
http_endpoint
Immutable once set
collection_name
Immutable once set
api_key_authentication
Mutable
Create the first RAG corpus
When the RAG Engine service account doesn't exist, do the following:
Create a RAG corpus in RAG Engine with an empty Weaviate configuration,
which initiates RAG Engine provisioning to create a service account.
Choose a name for your RAG Engine service account that follows this
format:
For example, service-123456789@gcp-sa-vertex-rag.iam.gserviceaccount.com.
Using your service account, access your secret that is stored in your
project's Secret Manager, which contains your Weaviate API key.
Get the following information after Weaviate provisioning completes:
Your Weaviate HTTPS or HTTP endpoint.
The name of your Weaviate collection.
Call the CreateRagCorpus API to create a RAG corpus with an empty
Weaviate configuration, and call the UpdateRagCorpus API to update the
RAG corpus with the following information:
Your Weaviate HTTPS or HTTP endpoint.
The name of your Weaviate collection.
The API key resource name.
Create another RAG corpus
When the RAG Engine service account exists, do the following:
Using your service account, access your secret that is stored in your
project's Secret Manager, which contains your Weaviate API key.
During Weaviate provisioning, get the following information:
The Weaviate HTTPS or HTTP endpoint.
The name of your Weaviate collection.
Create a RAG corpus in RAG Engine, and connect with your Weaviate
collection by doing one of the following:
Make a CreateRagCorpus API call to create a RAG corpus with a populated
Weaviate configuration, which is the preferred option.
Make a CreateRagCorpus API call to create a RAG corpus with an empty
Weaviate configuration, and make an UpdateRagCorpus API call to update
the RAG corpus with the following information:
Weaviate database HTTP endpoint
Weaviate Collection name
API key
Examples
This section presents sample code that demonstrates how to set up your Weaviate
database, Secret Manager, the RAG corpus, and the RAG file. Sample code
is also provided to demonstrate how to import files, to retrieve context, to
generate content, and to delete the RAG corpus and RAG files.
Enter the Name of your secret. Secret names can only contain English
letters (A-Z), numbers (0-9), dashes (-), and underscores (_).
Specifying the following fields is optional:
To upload the file with your secret, click Browse.
Read the Replication policy.
If you want to manually manage the locations for your secret, then check
Manually manage locations for this secret. At least one region must be
selected.
Select your encryption option.
If you want to manually set your rotation period, then check Set rotation
period.
If you want to specify Publish or subscribe topic(s) to receive event
notifications, click Add topics.
By default, the secret never expires. If you want to set an expiration date,
then check Set expiration date.
By default, secret versions are destroyed upon request. To delay the
destruction of secret versions, check Set duration for delayed
destruction.
If you want to use labels to organize and categorize your secrets, then click
+ Add label.
If you want to use annotations to attach non-identifying metadata to your
secrets, then click + Add annotation.
Click Create secret.
REST
# Create a secret in SecretManager.
curl"https://secretmanager.googleapis.com/v1/projects/${PROJECT_ID}/secrets?secretId=${SECRET_NAME}"\--request"POST"\--header"authorization: Bearer $(gcloudauthprint-access-token)"\--header"content-type: application/json"\--data"{\"replication\": {\"automatic\": {}}}"
# Import the Secret Manager client library.fromgoogle.cloudimportsecretmanagerdefcreate_secret(project_id:str,secret_id:str,ttl:Optional[str]=None)-> secretmanager.Secret:""" Create a new secret with the given name. A secret is a logical wrapper around a collection of secret versions. Secret versions hold the actual secret material. Args: project_id (str): The project ID where the secret is to be created. secret_id (str): The ID to assign to the new secret. This ID must be unique within the project. ttl (Optional[str]): An optional string that specifies the secret's time-to-live in seconds with format (e.g., "900s" for 15 minutes). If specified, the secret versions will be automatically deleted upon reaching the end of the TTL period. Returns: secretmanager.Secret: An object representing the newly created secret, containing details like the secret's name, replication settings, and optionally its TTL. Example: # Create a secret with automatic replication and no TTL new_secret = create_secret("my-project", "my-new-secret") # Create a secret with a TTL of 30 days new_secret_with_ttl = create_secret("my-project", "my-timed-secret", "7776000s") """# Create the Secret Manager client.client=secretmanager.SecretManagerServiceClient()# Build the resource name of the parent project.parent=f"projects/{project_id}"# Create the secret.response=client.create_secret(request={"parent":parent,"secret_id":secret_id,"secret":{"replication":{"automatic":{}},"ttl":ttl},})# Print the new secret name.print(f"Created secret: {response.name}")
Set permissions
You must grant Secret Manager permissions to your service account.
Console
In the IAM & Admin section of your Google Cloud console, find your service
account account, and click the pencil icon to edit.
In the Role field, select Secret Manager Secret Accessor.
defiam_grant_access(project_id:str,secret_id:str,member:str)-> iam_policy_pb2.SetIamPolicyRequest:""" Grant the given member access to a secret. """# Import the Secret Manager client library.fromgoogle.cloudimportsecretmanager# Create the Secret Manager client.client=secretmanager.SecretManagerServiceClient()# Build the resource name of the secret.name=client.secret_path(project_id,secret_id)# Get the current IAM policy.policy=client.get_iam_policy(request={"resource":name})# Add the given member with access permissions.policy.bindings.add(role="roles/secretmanager.secretAccessor",members=[member])# Update the IAM Policy.new_policy=client.set_iam_policy(request={"resource":name,"policy":policy})# Print data about the secret.print(f"Updated IAM policy on {secret_id}")
Add Secret Version
REST
# TODO(developer): Update the variables.# Select a resource name for your Secret, which contains your API Key.SECRET_NAME="MyWeaviateApiKeySecret"# Your Weaviate API Key.WEAVIATE_API_KEY="example-api-key"# Encode your WEAVIATE_API_KEY using base 64.SECRET_DATA=$(echo${WEAVIATE_API_KEY}|base64)# Create a new version of your secret which uses SECRET_DATA as payload
curl"https://secretmanager.googleapis.com/v1/projects/${PROJECT_ID}/secrets/${SECRET_NAME}:addVersion"\--request"POST"\--header"authorization: Bearer $(gcloudauthprint-access-token)"\--header"content-type: application/json"\--data"{\"payload\": {\"data\": \"${SECRET_DATA}\"}}"
fromgoogle.cloudimportsecretmanagerimportgoogle_crc32c# type: ignoredefadd_secret_version(project_id:str,secret_id:str,payload:str)-> secretmanager.SecretVersion:""" Add a new secret version to the given secret with the provided payload. """# Create the Secret Manager client.client=secretmanager.SecretManagerServiceClient()# Build the resource name of the parent secret.parent=client.secret_path(project_id,secret_id)# Convert the string payload into a bytes. This step can be omitted if you# pass in bytes instead of a str for the payload argument.payload_bytes=payload.encode("UTF-8")# Calculate payload checksum. Passing a checksum in add-version request# is optional.crc32c=google_crc32c.Checksum()crc32c.update(payload_bytes)# Add the secret version.response=client.add_secret_version(request={"parent":parent,"payload":{"data":payload_bytes,"data_crc32c":int(crc32c.hexdigest(),16),},})# Print the new secret version name.print(f"Added secret version: {response.name}")
Use Weaviate with Llama 3
The Model Garden RAG API notebook demonstrates how to use the
Agent Platform SDK for Python with a Weaviate corpus and Llama 3 model. To use the
notebook, you must do the following:
This code sample demonstrates how to create a RAG corpus, and sets the Weaviate
instance as its vector database.
REST
# TODO(developer): Update the variables.PROJECT_ID="YOUR_PROJECT_ID"# The HTTPS/HTTP Weaviate endpoint you created during provisioning.HTTP_ENDPOINT_NAME="https://your.weaviate.endpoint.com"# Your Weaviate collection name, which roughly corresponds to a Agent Platform Knowledge Engine Corpus.# For example, "MyCollectionName"# Note that the first letter needs to be capitalized.# Otherwise, Weaviate will capitalize it for you.WEAVIATE_COLLECTION_NAME="MyCollectionName"# The resource name of your Weaviate API Key your Secret.SECRET_NAME="MyWeaviateApiKeySecret"# The Secret Manager resource name containing the API Key for your Weaviate endpoint.# For example, projects/{project}/secrets/{secret}/versions/latestAPIKEY_SECRET_VERSION="projects/${PROJECT_ID}/secrets/${SECRET_NAME}/versions/latest"# Select a Corpus display name.CORPUS_DISPLAY_NAME="SpecialCorpus"# Call CreateRagCorpus API and set all Vector DB Config parameters for Weaviate to create a new corpus associated to your selected Weaviate collection.curl-XPOST\-H"Authorization: Bearer $(gcloudauthprint-access-token)"\-H"Content-Type: application/json"\https://us-central1-aiplatform.googleapis.com/v1beta1/projects/${PROJECT_ID}/locations/us-central1/ragCorpora\-d'{ "display_name" : '\""${CORPUS_DISPLAY_NAME}"\"', "rag_vector_db_config" : { "weaviate": { "http_endpoint": '\""${HTTP_ENDPOINT_NAME}"\"', "collection_name": '\""${WEAVIATE_COLLECTION_NAME}"\"' }, "api_auth" : { "api_key_config": { "api_key_secret_version": '\""${APIKEY_SECRET_VERSION}"\"' } } } }'# TODO(developer): Update the variables.# Get operation_id returned in CreateRagCorpus.OPERATION_ID="your-operation-id"# Poll Operation status until done = true in the response.curl-XGET\-H"Authorization: Bearer $(gcloudauthprint-access-token)"\-H"Content-Type: application/json"\https://us-central1-aiplatform.googleapis.com/v1beta1/projects/${PROJECT_ID}/locations/us-central1/operations/${OPERATION_ID}# Call ListRagCorpora API to verify the RAG corpus is created successfully.curl-sS-XGET\-H"Content-Type: application/json"\-H"Authorization: Bearer $(gcloudauthprint-access-token)"\"https://us-central1-aiplatform.googleapis.com/v1beta1/projects/${PROJECT_ID}/locations/us-central1/ragCorpora"
When a user asks a question or provides a prompt, the retrieval component in RAG
searches through its knowledge base to find information that is relevant to the
query.
Hybrid search is supported with Weaviate database, which combines both semantic
and keyword searches to improve the relevance of search results. During the
retrieval of search results, a combination of similarity scores from semantic (a
dense vector) and keyword matching (a sparse vector) produces the final ranked
results.
Hybrid search using the RAG Engine retrieval API
This is an example of how to enable a hybrid search using the RAG Engine
retrieval API.
REST
# TODO(developer): Update the variables.PROJECT_ID="YOUR_PROJECT_ID"# The HTTPS/HTTP Weaviate endpoint you created during provisioning.HTTP_ENDPOINT_NAME="https://your.weaviate.endpoint.com"# Your Weaviate collection name, which roughly corresponds to a Agent Platform Knowledge Engine Corpus.# For example, "MyCollectionName"# Note that the first letter needs to be capitalized.# Otherwise, Weaviate will capitalize it for you.WEAVIATE_COLLECTION_NAME="MyCollectionName"# The resource name of your Weaviate API Key your Secret.SECRET_NAME="MyWeaviateApiKeySecret"# The Secret Manager resource name containing the API Key for your Weaviate endpoint.# For example, projects/{project}/secrets/{secret}/versions/latestAPIKEY_SECRET_VERSION="projects/${PROJECT_ID}/secrets/${SECRET_NAME}/versions/latest"# Select a Corpus display name.CORPUS_DISPLAY_NAME="SpecialCorpus"# Call CreateRagCorpus API and set all Vector DB Config parameters for Weaviate to create a new corpus associated to your selected Weaviate collection.curl-XPOST\-H"Authorization: Bearer $(gcloudauthprint-access-token)"\-H"Content-Type: application/json"\https://us-central1-aiplatform.googleapis.com/v1beta1/projects/${PROJECT_ID}/locations/us-central1/ragCorpora\-d'{ "display_name" : '\""${CORPUS_DISPLAY_NAME}"\"', "rag_vector_db_config" : { "weaviate": { "http_endpoint": '\""${HTTP_ENDPOINT_NAME}"\"', "collection_name": '\""${WEAVIATE_COLLECTION_NAME}"\"' }, "api_auth" : { "api_key_config": { "api_key_secret_version": '\""${APIKEY_SECRET_VERSION}"\"' } } } }'# TODO(developer): Update the variables.# Get operation_id returned in CreateRagCorpus.OPERATION_ID="your-operation-id"# Poll Operation status until done = true in the response.curl-XGET\-H"Authorization: Bearer $(gcloudauthprint-access-token)"\-H"Content-Type: application/json"\https://us-central1-aiplatform.googleapis.com/v1beta1/projects/${PROJECT_ID}/locations/us-central1/operations/${OPERATION_ID}# Call ListRagCorpora API to verify the RAG corpus is created successfully.curl-sS-XGET\-H"Content-Type: application/json"\-H"Authorization: Bearer $(gcloudauthprint-access-token)"\"https://us-central1-aiplatform.googleapis.com/v1beta1/projects/${PROJECT_ID}/locations/us-central1/ragCorpora"
fromvertexaiimportragimportvertexai# TODO(developer): Update and un-comment below lines# PROJECT_ID = "your-project-id"# corpus_name = "projects/[PROJECT_ID]/locations/us-central1/ragCorpora/[rag_corpus_id]"# Initialize Vertex AI API once per sessionvertexai.init(project=PROJECT_ID,location="us-central1")response=rag.retrieval_query(rag_resources=[rag.RagResource(rag_corpus=corpus_name,# Optional: supply IDs from `rag.list_files()`.# rag_file_ids=["rag-file-1", "rag-file-2", ...],)],text="Hello World!",rag_retrieval_config=rag.RagRetrievalConfig(top_k=10,filter=rag.utils.resources.Filter(vector_distance_threshold=0.5),),)print(response)# Example response:# contexts {# contexts {# source_uri: "gs://your-bucket-name/file.txt"# text: "....# ....
Use hybrid search and RAG Engine for grounded generation
This is an example of how to use hybrid search and RAG Engine for grounded
generation.
REST
# TODO(developer): Update the variables.PROJECT_ID="YOUR_PROJECT_ID"# The HTTPS/HTTP Weaviate endpoint you created during provisioning.HTTP_ENDPOINT_NAME="https://your.weaviate.endpoint.com"# Your Weaviate collection name, which roughly corresponds to a Agent Platform Knowledge Engine Corpus.# For example, "MyCollectionName"# Note that the first letter needs to be capitalized.# Otherwise, Weaviate will capitalize it for you.WEAVIATE_COLLECTION_NAME="MyCollectionName"# The resource name of your Weaviate API Key your Secret.SECRET_NAME="MyWeaviateApiKeySecret"# The Secret Manager resource name containing the API Key for your Weaviate endpoint.# For example, projects/{project}/secrets/{secret}/versions/latestAPIKEY_SECRET_VERSION="projects/${PROJECT_ID}/secrets/${SECRET_NAME}/versions/latest"# Select a Corpus display name.CORPUS_DISPLAY_NAME="SpecialCorpus"# Call CreateRagCorpus API and set all Vector DB Config parameters for Weaviate to create a new corpus associated to your selected Weaviate collection.curl-XPOST\-H"Authorization: Bearer $(gcloudauthprint-access-token)"\-H"Content-Type: application/json"\https://us-central1-aiplatform.googleapis.com/v1beta1/projects/${PROJECT_ID}/locations/us-central1/ragCorpora\-d'{ "display_name" : '\""${CORPUS_DISPLAY_NAME}"\"', "rag_vector_db_config" : { "weaviate": { "http_endpoint": '\""${HTTP_ENDPOINT_NAME}"\"', "collection_name": '\""${WEAVIATE_COLLECTION_NAME}"\"' }, "api_auth" : { "api_key_config": { "api_key_secret_version": '\""${APIKEY_SECRET_VERSION}"\"' } } } }'# TODO(developer): Update the variables.# Get operation_id returned in CreateRagCorpus.OPERATION_ID="your-operation-id"# Poll Operation status until done = true in the response.curl-XGET\-H"Authorization: Bearer $(gcloudauthprint-access-token)"\-H"Content-Type: application/json"\https://us-central1-aiplatform.googleapis.com/v1beta1/projects/${PROJECT_ID}/locations/us-central1/operations/${OPERATION_ID}# Call ListRagCorpora API to verify the RAG corpus is created successfully.curl-sS-XGET\-H"Content-Type: application/json"\-H"Authorization: Bearer $(gcloudauthprint-access-token)"\"https://us-central1-aiplatform.googleapis.com/v1beta1/projects/${PROJECT_ID}/locations/us-central1/ragCorpora"
fromvertexaiimportragfromvertexai.generative_modelsimportGenerativeModel,Toolimportvertexai# TODO(developer): Update and un-comment below lines# PROJECT_ID = "your-project-id"# corpus_name = "projects/{PROJECT_ID}/locations/us-central1/ragCorpora/{rag_corpus_id}"# Initialize Vertex AI API once per sessionvertexai.init(project=PROJECT_ID,location="us-central1")rag_retrieval_tool=Tool.from_retrieval(retrieval=rag.Retrieval(source=rag.VertexRagStore(rag_resources=[rag.RagResource(rag_corpus=corpus_name,# Optional: supply IDs from `rag.list_files()`.# rag_file_ids=["rag-file-1", "rag-file-2", ...],)],rag_retrieval_config=rag.RagRetrievalConfig(top_k=10,filter=rag.utils.resources.Filter(vector_distance_threshold=0.5),),),))rag_model=GenerativeModel(model_name="gemini-2.0-flash-001",tools=[rag_retrieval_tool])response=rag_model.generate_content("Why is the sky blue?")print(response.text)# Example response:# The sky appears blue due to a phenomenon called Rayleigh scattering.# Sunlight, which contains all colors of the rainbow, is scattered# by the tiny particles in the Earth's atmosphere....# ...
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-06-10 UTC."],[],[]]
