feat(ai-rag): support resolving secrets from environment variables and secret vaults

apisix/plugins/ai-rag.lua

@@ -25,6 +25,8 @@ local protocols = require("apisix.plugins.ai-protocols")
 local azure_openai_embeddings = require("apisix.plugins.ai-rag.embeddings.azure_openai").schema
 local azure_ai_search_schema = require("apisix.plugins.ai-rag.vector-search.azure_ai_search").schema
 
+local fetch_secrets     = require("apisix.secret").fetch_secrets
+
 local HTTP_INTERNAL_SERVER_ERROR = ngx.HTTP_INTERNAL_SERVER_ERROR
 local HTTP_BAD_REQUEST = ngx.HTTP_BAD_REQUEST
 
@@ -116,6 +118,9 @@ function _M.access(conf, ctx)
     local vector_search_driver = require("apisix.plugins.ai-rag.vector-search." ..
                                         vector_search_provider)
 
+    embeddings_provider_conf = fetch_secrets(embeddings_provider_conf, true)
+    vector_search_provider_conf = fetch_secrets(vector_search_provider_conf, true)
+
     local vs_req_schema = vector_search_driver.request_schema
     local emb_req_schema = embeddings_driver.request_schema
 

docs/en/latest/plugins/ai-rag.md

@@ -53,7 +53,7 @@ The Plugin supports using [Azure OpenAI](https://azure.microsoft.com/en-us/produ
 | `vector_search_provider` | object | True | | | Vector search provider configurations. |
 | `vector_search_provider.azure_ai_search` | object | True | | | Configurations of [Azure AI Search](https://azure.microsoft.com/en-us/products/ai-services/ai-search). |
 | `vector_search_provider.azure_ai_search.endpoint` | string | True | | | Azure AI Search endpoint. |
-| `vector_search_provider.azure_ai_search.api_key` | string | True | | | Azure AI Search API key. |
+| `vector_search_provider.azure_ai_search.api_key` | string | True | | | Azure AI Search API key. Supports [secret references](../terminology/secret.md) via environment variables (e.g. `$ENV://AI_RAG_APIKEY`) and secret managers. |
 
 ## Request Body Format
 
@@ -390,3 +390,24 @@ You should receive an `HTTP/1.1 200 OK` response similar to the following:
   }
 }
 ```
+
+## Secret References
+
+The `api_key` fields support APISIX secret resolution, via environment variable and secret manager. For secret reference formats and setup, see [APISIX Secret](../terminology/secret.md). Example:
+
+```json
+{
+  "embeddings_provider": {
+    "azure_openai": {
+      "endpoint": "'"$AZ_EMBEDDINGS_ENDPOINT"'",
+      "api_key": "$ENV://API_KEY"
+    }
+  },
+  "vector_search_provider": {
+    "azure_ai_search": {
+      "endpoint": "'"$AZ_AI_SEARCH_ENDPOINT"'",
+      "api_key": "$secret://$manager/$id/$secret_name/$key"
+    }
+  }
+}
+```

docs/zh/latest/plugins/ai-rag.md

@@ -53,7 +53,7 @@ import TabItem from '@theme/TabItem';
 | `vector_search_provider` | object | 是 | | | 向量搜索提供商的配置。 |
 | `vector_search_provider.azure_ai_search` | object | 是 | | | [Azure AI Search](https://azure.microsoft.com/en-us/products/ai-services/ai-search) 的配置。 |
 | `vector_search_provider.azure_ai_search.endpoint` | string | 是 | | | Azure AI Search 端点。 |
-| `vector_search_provider.azure_ai_search.api_key` | string | 是 | | | Azure AI Search API 密钥。 |
+| `vector_search_provider.azure_ai_search.api_key` | string | 是 | | | Azure AI Search API 密钥。支持通过环境变量（如 `$ENV://AI_RAG_APIKEY`）和密钥管理器进行[密钥引用](../terminology/secret.md)。 |
 
 ## 请求体格式
 
@@ -390,3 +390,24 @@ curl "http://127.0.0.1:9080/rag" -X POST \
   }
 }
 ```
+
+## 密钥引用
+
+`api_key` 字段支持通过环境变量和密钥管理器进行 APISIX 密钥解析。有关密钥引用格式和设置，请参阅 [APISIX 密钥](../terminology/secret.md)。示例：
+
+```json
+{
+  "embeddings_provider": {
+    "azure_openai": {
+      "endpoint": "'"$AZ_EMBEDDINGS_ENDPOINT"'",
+      "api_key": "$ENV://API_KEY"
+    }
+  },
+  "vector_search_provider": {
+    "azure_ai_search": {
+      "endpoint": "'"$AZ_AI_SEARCH_ENDPOINT"'",
+      "api_key": "$secret://$manager/$id/$secret_name/$key"
+    }
+  }
+}
+```

t/plugin/ai-rag.t

@@ -41,6 +41,12 @@ add_block_preprocessor(sub {
         $block->set_value("request", "GET /t");
     }
 
+    my $main_config = $block->main_config // <<_EOC_;
+        env AI_RAG_APIKEY=key;
+_EOC_
+
+    $block->set_value("main_config", $main_config);
+
     my $http_config = $block->http_config // <<_EOC_;
         server {
             listen 3623;
@@ -596,3 +602,60 @@ false
 done
 --- error_log
 ai_rag ssl_verify: false
+
+
+
+=== TEST 18: configure plugin with api_key via nginx env directive secret reference
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/routes/1',
+                 ngx.HTTP_PUT,
+                 [[{
+                    "uri": "/echo",
+                    "plugins": {
+                        "ai-rag": {
+                            "embeddings_provider": {
+                                "azure_openai": {
+                                    "endpoint": "http://localhost:3623/embeddings",
+                                    "api_key": "$ENV://AI_RAG_APIKEY"
+                                }
+                            },
+                            "vector_search_provider": {
+                                "azure_ai_search": {
+                                    "endpoint": "http://localhost:3623/search",
+                                    "api_key": "$ENV://AI_RAG_APIKEY"
+                                }
+                            }
+                        }
+                    },
+                    "upstream": {
+                        "type": "roundrobin",
+                        "nodes": {
+                            "127.0.0.1:1980": 1
+                        },
+                        "scheme": "http",
+                        "pass_host": "node"
+                    }
+                }]]
+            )
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 19: send request with api_key resolved from environment variable
+--- request
+POST /echo
+{"ai_rag":{"vector_search":{"fields":"something"},"embeddings":{"input":"which service is good for devops"}}}
+--- error_code: 200
+--- response_body eval
+qr/\{"messages":\[\{"content":"passed","role":"user"\}\]\}|\{"messages":\[\{"role":"user","content":"passed"\}\]\}/