Skip to content

decorative_secrets.databricks

DatabricksWorkspaceClientArguments dataclass

An object holding arguments to pass to a Databricks workspace client if/when retrieving secrets remotely.

Source code in src/decorative_secrets/databricks.py 
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
@dataclass
class DatabricksWorkspaceClientArguments:
    """
    An object holding arguments to pass to a Databricks workspace client
    if/when retrieving secrets remotely.
    """

    host: str | None = None
    account_id: str | None = None
    username: str | None = None
    password: str | None = None
    client_id: str | None = None
    client_secret: str | None = None
    token: str | None = None
    profile: str | None = None
    config_file: str | None = None
    azure_workspace_resource_id: str | None = None
    azure_client_secret: str | None = None
    azure_client_id: str | None = None
    azure_tenant_id: str | None = None
    azure_environment: str | None = None
    auth_type: str | None = None
    cluster_id: str | None = None
    google_credentials: str | None = None
    google_service_account: str | None = None
    debug_truncate_bytes: int | None = None
    debug_headers: bool | None = None
    product: str | None = None
    product_version: str | None = None
    credentials_strategy: CredentialsStrategy | None = None
    credentials_provider: CredentialsStrategy | None = None
    token_audience: str | None = None

apply_databricks_secrets_arguments 

apply_databricks_secrets_arguments(
    *args: decorative_secrets.databricks.DatabricksWorkspaceClientArguments,
    **kwargs: str
) -> collections.abc.Callable

This decorator maps parameter names to Databricks secrets. Each key in databricks_secret_arguments represents the name of a parameter in the decorated function which accepts an explicit input, and the corresponding mapped value is a parameter name accepting a tuple with the secret scope and key with which to lookup a secret to pass to the mapped parameter in lieu of an explicitly provided argument.

Parameters:

  • *args (decorative_secrets.databricks.DatabricksWorkspaceClientArguments, default: () ) –

    A DatabricksWorkspaceConfigArguments instance to configure a workspace client when retrieving secrets remotely (if more than one is provided, only the first is used).

  • **kwargs (str, default: {} ) –

    A mapping of static parameter names to the parameter names of arguments accepting Databricks secret scope + key tuples from which to retrieve a value when the key argument is not explicitly provided.

Example 
from functools import (
    cache,
)
from decorative_secrets.databricks import (
    apply_databricks_secret_arguments,
)
from my_client_sdk import (
    Client,
)


@cache
@apply_databricks_secret_arguments(
    client_id="client_id_databricks_secret",
    client_secret="client_secret_databricks_secret",
)
def get_client(
    client_id: str | None = None,
    client_secret: str = None,
    client_id_databricks_secret: str | None = None,
    client_secret_databricks_secret: str | None = None,
) -> Client:
    return Client(
        oauth2_client_id=client_id,
        oauth2_client_secret=client_secret,
    )


client: Client = get_client(
    client_id_databricks_secret=(
        "client",
        "client-id",
    ),
    client_secret_databricks_secret=(
        "client",
        "client-secret",
    ),
)
Source code in src/decorative_secrets/databricks.py 
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
def apply_databricks_secrets_arguments(
    *args: DatabricksWorkspaceClientArguments,
    **kwargs: str,
) -> Callable:
    """
    This decorator maps parameter names to Databricks secrets.
    Each key in `databricks_secret_arguments` represents the name of a
    parameter in the decorated function which accepts an explicit input, and
    the corresponding mapped value is a parameter name accepting a tuple with
    the secret scope and key with which to lookup a secret to pass to the
    mapped parameter in lieu of an explicitly provided argument.

    Parameters:
        *args: A `DatabricksWorkspaceConfigArguments` instance to configure
            a workspace client when retrieving secrets remotely
            (if more than one  is provided, only the first is used).
        **kwargs: A mapping of static parameter names to the parameter names
            of arguments accepting Databricks secret scope + key tuples
            from which to retrieve a value when the key argument is not
            explicitly provided.

    Example:
        ```python
        from functools import (
            cache,
        )
        from decorative_secrets.databricks import (
            apply_databricks_secret_arguments,
        )
        from my_client_sdk import (
            Client,
        )


        @cache
        @apply_databricks_secret_arguments(
            client_id="client_id_databricks_secret",
            client_secret="client_secret_databricks_secret",
        )
        def get_client(
            client_id: str | None = None,
            client_secret: str = None,
            client_id_databricks_secret: str | None = None,
            client_secret_databricks_secret: str | None = None,
        ) -> Client:
            return Client(
                oauth2_client_id=client_id,
                oauth2_client_secret=client_secret,
            )


        client: Client = get_client(
            client_id_databricks_secret=(
                "client",
                "client-id",
            ),
            client_secret_databricks_secret=(
                "client",
                "client-secret",
            ),
        )
        ```
    """
    databricks_workspace_client_arguments: (
        DatabricksWorkspaceClientArguments | None
    ) = _get_args_options(*args)[1]
    get_scope_key_secret: Callable[[str | tuple[str, str]], str] = (
        partial(
            _get_scope_key_secret,
            **asdict(databricks_workspace_client_arguments),
        )
        if databricks_workspace_client_arguments
        else _get_scope_key_secret
    )
    return apply_callback_arguments(
        get_scope_key_secret,
        **kwargs,
    )

which_databricks 

which_databricks() -> str

Find the databricks executable, or install the Databricks CLI if not found.

Source code in src/decorative_secrets/databricks.py 
253
254
255
256
257
258
259
260
261
262
263
264
def which_databricks() -> str:
    """
    Find the `databricks` executable, or install the Databricks CLI if not
    found.
    """
    databricks: str = which("databricks") or "databricks"
    try:
        check_output((databricks, "--version"))
    except (CalledProcessError, FileNotFoundError):
        _install_databricks_cli()
        databricks = which("databricks") or "databricks"
    return databricks

databricks_auth_login 

databricks_auth_login(
    host: str | None = None,
    profile: str | None = None,
    target: str | None = None,
) -> None

Log in to Databricks using the CLI if not already logged in.

Parameters:

  • host (str | None, default: None ) –

    A Databricks workspace host URL.

  • profile (str | None, default: None ) –

    A Databricks Configuration Profile.

  • target (str | None, default: None ) –

    A Databricks CLI target.

Source code in src/decorative_secrets/databricks.py 
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
def databricks_auth_login(
    host: str | None = None,
    profile: str | None = None,
    target: str | None = None,
) -> None:
    """
    Log in to Databricks using the CLI if not already logged in.

    Parameters:
        host: A Databricks workspace host URL.
        profile: A Databricks Configuration Profile.
        target: A Databricks CLI target.
    """
    if (host is None) and (profile is None) and (target is None):
        host = os.getenv("DATABRICKS_HOST")
        profile = os.getenv("DATABRICKS_CONFIG_PROFILE")
    # with suppress(CalledProcessError):
    # If we are already authenticated, don't attempt to log in again
    if (
        _databricks_auth_describe(
            host=host, profile=profile, target=target
        ).get("status")
        == "success"
    ):
        return
    return _databricks_auth_login(host=host, profile=profile, target=target)

get_databricks_workspace_client 

get_databricks_workspace_client(
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str | None = None,
    product_version: str | None = None,
    credentials_strategy: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    credentials_provider: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    token_audience: str | None = None,
    config: databricks.sdk.config.Config | None = None
) -> databricks.sdk.WorkspaceClient

Get a Databricks WorkspaceClient configured from environment variables.

Source code in src/decorative_secrets/databricks.py 
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
def get_databricks_workspace_client(
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str | None = None,
    product_version: str | None = None,
    credentials_strategy: CredentialsStrategy | None = None,
    credentials_provider: CredentialsStrategy | None = None,
    token_audience: str | None = None,
    config: Config | None = None,
) -> WorkspaceClient:
    """
    Get a Databricks WorkspaceClient configured from environment variables.
    """
    return _get_env_databricks_workspace_client(
        host=host,
        account_id=account_id,
        username=username,
        password=password,
        client_id=client_id,
        client_secret=client_secret,
        token=token,
        profile=profile,
        config_file=config_file,
        azure_workspace_resource_id=azure_workspace_resource_id,
        azure_client_secret=azure_client_secret,
        azure_client_id=azure_client_id,
        azure_tenant_id=azure_tenant_id,
        azure_environment=azure_environment,
        auth_type=auth_type,
        cluster_id=cluster_id,
        google_credentials=google_credentials,
        google_service_account=google_service_account,
        debug_truncate_bytes=debug_truncate_bytes,
        debug_headers=debug_headers,
        product=product,
        product_version=product_version,
        credentials_strategy=credentials_strategy,
        credentials_provider=credentials_provider,
        token_audience=token_audience,
        config=config,
        **os.environ,
    )

get_dbutils 

get_dbutils(
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str = "unknown",
    product_version: str = "0.0.0",
    credentials_strategy: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    credentials_provider: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    token_audience: str | None = None,
    config: databricks.sdk.config.Config | None = None
) -> databricks.sdk.dbutils.RemoteDbUtils

Get dbutils using an existing instance from the runtime if found, otherwise, creating one using a workspace client (this requires either having these environment variables set , or providing the equivalent optional arguments.

Source code in src/decorative_secrets/databricks.py 
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
def get_dbutils(
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str = "unknown",
    product_version: str = "0.0.0",
    credentials_strategy: CredentialsStrategy | None = None,
    credentials_provider: CredentialsStrategy | None = None,
    token_audience: str | None = None,
    config: Config | None = None,
) -> RemoteDbUtils:  # pragma: no cover - environment dependent
    """
    Get [dbutils](https://docs.databricks.com/dev-tools/databricks-utils.html)
    using an existing instance from the runtime if found, otherwise,
    creating one using a workspace client (this requires either having
    [these environment variables set
    ](https://docs.databricks.com/aws/en/dev-tools/auth#environment-variables),
    or providing the equivalent optional arguments.
    """
    dbutils: RemoteDbUtils | None = None
    with suppress(ImportError):
        from IPython.core.getipython import (  # type: ignore[import-not-found]  # noqa: PLC0415
            get_ipython,
        )

        if TYPE_CHECKING:
            from IPython.core.interactiveshell import (  # type: ignore[import-not-found]  # noqa: PLC0415
                InteractiveShell,
            )

        ipython: InteractiveShell = get_ipython()
        if ipython is not None:
            user_namespace_attribute: str
            user_namespace: dict
            for user_namespace_attribute in "user_ns", "user_global_ns":
                dbutils = getattr(ipython, user_namespace_attribute, {}).get(
                    "dbutils", None
                )
                if dbutils is not None:
                    return dbutils
    dbutils = globals().get("dbutils")
    if dbutils is not None:
        return dbutils
    databricks_workspace_client: WorkspaceClient = (
        get_databricks_workspace_client(
            host=host,
            account_id=account_id,
            username=username,
            password=password,
            client_id=client_id,
            client_secret=client_secret,
            token=token,
            profile=profile,
            config_file=config_file,
            azure_workspace_resource_id=azure_workspace_resource_id,
            azure_client_secret=azure_client_secret,
            azure_client_id=azure_client_id,
            azure_tenant_id=azure_tenant_id,
            azure_environment=azure_environment,
            auth_type=auth_type,
            cluster_id=cluster_id,
            google_credentials=google_credentials,
            google_service_account=google_service_account,
            debug_truncate_bytes=debug_truncate_bytes,
            debug_headers=debug_headers,
            product=product,
            product_version=product_version,
            credentials_strategy=credentials_strategy,
            credentials_provider=credentials_provider,
            token_audience=token_audience,
            config=config,
        )
    )
    return databricks_workspace_client.dbutils

get_databricks_secret 

get_databricks_secret(
    scope: str,
    key: str,
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str = "unknown",
    product_version: str = "0.0.0",
    credentials_strategy: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    credentials_provider: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    token_audience: str | None = None,
    config: databricks.sdk.config.Config | None = None
) -> str

Get a secret from Databricks.

Parameters:

  • scope (str) –

    The Databricks secret scope.

  • key (str) –

    The Databricks secret key.

  • host (str | None, default: None ) –

    A Databricks workspace host URL.

  • account_id (str | None, default: None ) –

    A Databricks account ID.

  • username (str | None, default: None ) –

    A Databricks username.

  • password (str | None, default: None ) –

    A Databricks password.

  • client_id (str | None, default: None ) –

    A Databricks OAuth2 Client ID.

  • client_secret (str | None, default: None ) –

    A Databricks OAuth2 Client Secret.

  • token (str | None, default: None ) –

    A Databricks Personal Access Token.

  • profile (str | None, default: None ) –

    A Databricks Configuration Profile.

  • config_file (str | None, default: None ) –

    A Databricks Configuration File path.

  • azure_workspace_resource_id (str | None, default: None ) –

    An Azure Databricks Workspace Resource ID.

  • azure_client_secret (str | None, default: None ) –

    An Azure Client Secret for Azure Databricks auth.

  • azure_client_id (str | None, default: None ) –

    An Azure Client ID for Azure Databricks auth.

  • azure_tenant_id (str | None, default: None ) –

    An Azure Tenant ID for Azure Databricks auth.

  • azure_environment (str | None, default: None ) –

    An Azure Environment for Azure Databricks auth.

  • auth_type (str | None, default: None ) –

    A Databricks authentication type.

  • cluster_id (str | None, default: None ) –

    A Databricks cluster ID.

  • google_credentials (str | None, default: None ) –

    Google Cloud credentials for GCP Databricks auth.

  • google_service_account (str | None, default: None ) –

    A Google Service Account for GCP Databricks auth.

  • debug_truncate_bytes (int | None, default: None ) –

    Number of bytes to truncate in debug logs.

  • debug_headers (bool | None, default: None ) –

    Whether to enable debug logging of HTTP headers.

  • product (str, default: 'unknown' ) –

    The product name using the SDK.

  • product_version (str, default: '0.0.0' ) –

    The product version using the SDK.

  • credentials_strategy (databricks.sdk.credentials_provider.CredentialsStrategy | None, default: None ) –

    A credentials strategy for the SDK.

  • credentials_provider (databricks.sdk.credentials_provider.CredentialsStrategy | None, default: None ) –

    A credentials provider for the SDK.

  • token_audience (str | None, default: None ) –

    A token audience for the SDK.

  • config (databricks.sdk.config.Config | None, default: None ) –

    A Databricks SDK Config instance.

Source code in src/decorative_secrets/databricks.py 
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
def get_databricks_secret(
    scope: str,
    key: str,
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str = "unknown",
    product_version: str = "0.0.0",
    credentials_strategy: CredentialsStrategy | None = None,
    credentials_provider: CredentialsStrategy | None = None,
    token_audience: str | None = None,
    config: Config | None = None,
) -> str:
    """
    Get a secret from Databricks.

    Parameters:
        scope: The Databricks secret scope.
        key: The Databricks secret key.
        host: A Databricks workspace host URL.
        account_id: A Databricks account ID.
        username: A Databricks username.
        password: A Databricks password.
        client_id: A Databricks OAuth2 Client ID.
        client_secret: A Databricks OAuth2 Client Secret.
        token: A Databricks Personal Access Token.
        profile: A Databricks Configuration Profile.
        config_file: A Databricks Configuration File path.
        azure_workspace_resource_id: An Azure Databricks Workspace Resource ID.
        azure_client_secret: An Azure Client Secret for Azure Databricks auth.
        azure_client_id: An Azure Client ID for Azure Databricks auth.
        azure_tenant_id: An Azure Tenant ID for Azure Databricks auth.
        azure_environment: An Azure Environment for Azure Databricks auth.
        auth_type: A Databricks authentication type.
        cluster_id: A Databricks cluster ID.
        google_credentials: Google Cloud credentials for GCP Databricks auth.
        google_service_account: A Google Service Account for GCP Databricks
            auth.
        debug_truncate_bytes: Number of bytes to truncate in debug logs.
        debug_headers: Whether to enable debug logging of HTTP headers.
        product: The product name using the SDK.
        product_version: The product version using the SDK.
        credentials_strategy: A credentials strategy for the SDK.
        credentials_provider: A credentials provider for the SDK.
        token_audience: A token audience for the SDK.
        config: A Databricks SDK Config instance.
    """
    return _get_secret(
        scope,
        key,
        host=host,
        account_id=account_id,
        username=username,
        password=password,
        client_id=client_id,
        client_secret=client_secret,
        token=token,
        profile=profile,
        config_file=config_file,
        azure_workspace_resource_id=azure_workspace_resource_id,
        azure_client_secret=azure_client_secret,
        azure_client_id=azure_client_id,
        azure_tenant_id=azure_tenant_id,
        azure_environment=azure_environment,
        auth_type=auth_type,
        cluster_id=cluster_id,
        google_credentials=google_credentials,
        google_service_account=google_service_account,
        debug_truncate_bytes=debug_truncate_bytes,
        debug_headers=debug_headers,
        product=product,
        product_version=product_version,
        credentials_strategy=credentials_strategy,
        credentials_provider=credentials_provider,
        token_audience=token_audience,
        config=config,
        **os.environ,
    )

main 

main() -> None

Run a command: - install: Install the Databricks CLI if not already installed - get: Get a secret from Databricks and print it to stdout

Source code in src/decorative_secrets/databricks.py 
 936
 937
 938
 939
 940
 941
 942
 943
 944
 945
 946
 947
 948
 949
 950
 951
 952
 953
 954
 955
 956
 957
 958
 959
 960
 961
 962
 963
 964
 965
 966
 967
 968
 969
 970
 971
 972
 973
 974
 975
 976
 977
 978
 979
 980
 981
 982
 983
 984
 985
 986
 987
 988
 989
 990
 991
 992
 993
 994
 995
 996
 997
 998
 999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
def main() -> None:
    """
    Run a command:
    -   install: Install the Databricks CLI if not already installed
    -   get: Get a secret from Databricks and print it to stdout
    """
    command = _get_command()
    if command in ("--help", "-h"):
        _print_help()
        return
    parser: argparse.ArgumentParser
    if command == "install":
        parser = argparse.ArgumentParser(
            prog="decorative-secrets databricks install",
            description="Install the Databricks CLI",
        )
        parser.parse_args()
        _install_databricks_cli()
    elif command == "get":
        parser = argparse.ArgumentParser(
            prog="decorative-secrets databricks get",
            description="Get a secret from Databricks",
        )
        parser.add_argument(
            "scope",
            type=str,
        )
        parser.add_argument(
            "key",
            type=str,
        )
        parser.add_argument(
            "--host",
            default=None,
            type=str,
            help="A Databricks workspace host URL",
        )
        parser.add_argument(
            "-cid",
            "--client-id",
            default=None,
            type=str,
            help="A Databricks OAuth2 Client ID",
        )
        parser.add_argument(
            "-cs",
            "--client-secret",
            default=None,
            type=str,
            help="A Databricks OAuth2 Client Secret",
        )
        parser.add_argument(
            "-t",
            "--token",
            default=None,
            type=str,
            help="A Databricks Personal Access Token",
        )
        parser.add_argument(
            "-p",
            "--profile",
            default=None,
            type=str,
            help="A Databricks Configuration Profile",
        )
        namespace: argparse.Namespace = parser.parse_args()
        print(  # noqa: T201
            get_databricks_secret(
                namespace.scope,
                namespace.key,
                host=namespace.host,
                client_id=namespace.client_id,
                client_secret=namespace.client_secret,
                token=namespace.token,
                profile=namespace.profile,
            )
        )