Skip to content

decorative_secrets.databricks

DatabricksWorkspaceClientArguments dataclass

An object holding arguments to pass to a Databricks workspace client if/when retrieving secrets remotely.

Source code in src/decorative_secrets/databricks.py 
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
@dataclass
class DatabricksWorkspaceClientArguments:
    """
    An object holding arguments to pass to a Databricks workspace client
    if/when retrieving secrets remotely.
    """

    host: str | None = None
    account_id: str | None = None
    username: str | None = None
    password: str | None = None
    client_id: str | None = None
    client_secret: str | None = None
    token: str | None = None
    profile: str | None = None
    config_file: str | None = None
    azure_workspace_resource_id: str | None = None
    azure_client_secret: str | None = None
    azure_client_id: str | None = None
    azure_tenant_id: str | None = None
    azure_environment: str | None = None
    auth_type: str | None = None
    cluster_id: str | None = None
    google_credentials: str | None = None
    google_service_account: str | None = None
    debug_truncate_bytes: int | None = None
    debug_headers: bool | None = None
    product: str | None = None
    product_version: str | None = None
    credentials_strategy: CredentialsStrategy | None = None
    credentials_provider: CredentialsStrategy | None = None
    token_audience: str | None = None

apply_databricks_secrets_arguments 

apply_databricks_secrets_arguments(
    *args: decorative_secrets.databricks.DatabricksWorkspaceClientArguments,
    **kwargs: str
) -> collections.abc.Callable

This decorator maps parameter names to Databricks secrets. Each key in databricks_secret_arguments represents the name of a parameter in the decorated function which accepts an explicit input, and the corresponding mapped value is a parameter name accepting a tuple with the secret scope and key with which to lookup a secret to pass to the mapped parameter in lieu of an explicitly provided argument.

Parameters:

  • *args (decorative_secrets.databricks.DatabricksWorkspaceClientArguments, default: () ) –

    A DatabricksWorkspaceConfigArguments instance to configure a workspace client when retrieving secrets remotely (if more than one is provided, only the first is used).

  • **kwargs (str, default: {} ) –

    A mapping of static parameter names to the parameter names of arguments accepting Databricks secret scope + key tuples from which to retrieve a value when the key argument is not explicitly provided.

Example 
from functools import (
    cache,
)
from decorative_secrets.databricks import (
    apply_databricks_secret_arguments,
)
from my_client_sdk import (
    Client,
)


@cache
@apply_databricks_secret_arguments(
    client_id="client_id_databricks_secret",
    client_secret="client_secret_databricks_secret",
)
def get_client(
    client_id: str | None = None,
    client_secret: str = None,
    client_id_databricks_secret: str | None = None,
    client_secret_databricks_secret: str | None = None,
) -> Client:
    return Client(
        oauth2_client_id=client_id,
        oauth2_client_secret=client_secret,
    )


client: Client = get_client(
    client_id_databricks_secret=(
        "client",
        "client-id",
    ),
    client_secret_databricks_secret=(
        "client",
        "client-secret",
    ),
)
Source code in src/decorative_secrets/databricks.py 
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
def apply_databricks_secrets_arguments(
    *args: DatabricksWorkspaceClientArguments,
    **kwargs: str,
) -> Callable:
    """
    This decorator maps parameter names to Databricks secrets.
    Each key in `databricks_secret_arguments` represents the name of a
    parameter in the decorated function which accepts an explicit input, and
    the corresponding mapped value is a parameter name accepting a tuple with
    the secret scope and key with which to lookup a secret to pass to the
    mapped parameter in lieu of an explicitly provided argument.

    Parameters:
        *args: A `DatabricksWorkspaceConfigArguments` instance to configure
            a workspace client when retrieving secrets remotely
            (if more than one  is provided, only the first is used).
        **kwargs: A mapping of static parameter names to the parameter names
            of arguments accepting Databricks secret scope + key tuples
            from which to retrieve a value when the key argument is not
            explicitly provided.

    Example:
        ```python
        from functools import (
            cache,
        )
        from decorative_secrets.databricks import (
            apply_databricks_secret_arguments,
        )
        from my_client_sdk import (
            Client,
        )


        @cache
        @apply_databricks_secret_arguments(
            client_id="client_id_databricks_secret",
            client_secret="client_secret_databricks_secret",
        )
        def get_client(
            client_id: str | None = None,
            client_secret: str = None,
            client_id_databricks_secret: str | None = None,
            client_secret_databricks_secret: str | None = None,
        ) -> Client:
            return Client(
                oauth2_client_id=client_id,
                oauth2_client_secret=client_secret,
            )


        client: Client = get_client(
            client_id_databricks_secret=(
                "client",
                "client-id",
            ),
            client_secret_databricks_secret=(
                "client",
                "client-secret",
            ),
        )
        ```
    """
    databricks_workspace_client_arguments: (
        DatabricksWorkspaceClientArguments | None
    ) = _get_args_options(*args)[1]
    get_scope_key_secret: Callable[[str | tuple[str, str]], str] = (
        partial(
            _get_scope_key_secret,
            **asdict(databricks_workspace_client_arguments),
        )
        if databricks_workspace_client_arguments
        else _get_scope_key_secret
    )
    return apply_callback_arguments(
        get_scope_key_secret,
        **kwargs,
    )

which_databricks 

which_databricks() -> str

Find the databricks executable, or install the Databricks CLI if not found.

Source code in src/decorative_secrets/databricks.py 
253
254
255
256
257
258
259
260
261
262
263
264
def which_databricks() -> str:
    """
    Find the `databricks` executable, or install the Databricks CLI if not
    found.
    """
    databricks: str = which("databricks") or "databricks"
    try:
        check_output((databricks, "--version"))
    except (CalledProcessError, FileNotFoundError):
        _install_databricks_cli()
        databricks = which("databricks") or "databricks"
    return databricks

databricks_auth_login 

databricks_auth_login(
    host: str | None = None,
    profile: str | None = None,
    target: str | None = None,
) -> None

Log in to Databricks using the CLI if not already logged in.

Parameters:

  • host (str | None, default: None ) –

    A Databricks workspace host URL.

  • profile (str | None, default: None ) –

    A Databricks Configuration Profile.

  • target (str | None, default: None ) –

    A Databricks CLI target.

Source code in src/decorative_secrets/databricks.py 
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
def databricks_auth_login(
    host: str | None = None,
    profile: str | None = None,
    target: str | None = None,
) -> None:
    """
    Log in to Databricks using the CLI if not already logged in.

    Parameters:
        host: A Databricks workspace host URL.
        profile: A Databricks Configuration Profile.
        target: A Databricks CLI target.
    """
    if (host is None) and (profile is None) and (target is None):
        host = os.getenv("DATABRICKS_HOST")
        profile = os.getenv("DATABRICKS_CONFIG_PROFILE")
    # with suppress(CalledProcessError):
    # If we are already authenticated, don't attempt to log in again
    if (
        _databricks_auth_describe(
            host=host,
            profile=profile,
            target=target,
        ).get("status")
        == "success"
    ):
        return
    return _databricks_auth_login(
        host=host, profile=profile, target=target, **os.environ
    )

get_databricks_workspace_client 

get_databricks_workspace_client(
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str | None = None,
    product_version: str | None = None,
    credentials_strategy: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    credentials_provider: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    token_audience: str | None = None,
    config: databricks.sdk.config.Config | None = None
) -> databricks.sdk.WorkspaceClient

Get a Databricks WorkspaceClient configured from environment variables.

Source code in src/decorative_secrets/databricks.py 
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
def get_databricks_workspace_client(
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str | None = None,
    product_version: str | None = None,
    credentials_strategy: CredentialsStrategy | None = None,
    credentials_provider: CredentialsStrategy | None = None,
    token_audience: str | None = None,
    config: Config | None = None,
) -> WorkspaceClient:
    """
    Get a Databricks WorkspaceClient configured from environment variables.
    """
    return _get_env_databricks_workspace_client(
        host=host,
        account_id=account_id,
        username=username,
        password=password,
        client_id=client_id,
        client_secret=client_secret,
        token=token,
        profile=profile,
        config_file=config_file,
        azure_workspace_resource_id=azure_workspace_resource_id,
        azure_client_secret=azure_client_secret,
        azure_client_id=azure_client_id,
        azure_tenant_id=azure_tenant_id,
        azure_environment=azure_environment,
        auth_type=auth_type,
        cluster_id=cluster_id,
        google_credentials=google_credentials,
        google_service_account=google_service_account,
        debug_truncate_bytes=debug_truncate_bytes,
        debug_headers=debug_headers,
        product=product,
        product_version=product_version,
        credentials_strategy=credentials_strategy,
        credentials_provider=credentials_provider,
        token_audience=token_audience,
        config=config,
        **os.environ,
    )

get_dbutils 

get_dbutils(
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str = "unknown",
    product_version: str = "0.0.0",
    credentials_strategy: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    credentials_provider: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    token_audience: str | None = None,
    config: databricks.sdk.config.Config | None = None
) -> databricks.sdk.dbutils.RemoteDbUtils

Get dbutils using an existing instance from the runtime if found, otherwise, creating one using a workspace client (this requires either having these environment variables set , or providing the equivalent optional arguments.

Source code in src/decorative_secrets/databricks.py 
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
def get_dbutils(
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str = "unknown",
    product_version: str = "0.0.0",
    credentials_strategy: CredentialsStrategy | None = None,
    credentials_provider: CredentialsStrategy | None = None,
    token_audience: str | None = None,
    config: Config | None = None,
) -> RemoteDbUtils:  # pragma: no cover - environment dependent
    """
    Get [dbutils](https://docs.databricks.com/dev-tools/databricks-utils.html)
    using an existing instance from the runtime if found, otherwise,
    creating one using a workspace client (this requires either having
    [these environment variables set
    ](https://docs.databricks.com/aws/en/dev-tools/auth#environment-variables),
    or providing the equivalent optional arguments.
    """
    dbutils: RemoteDbUtils | None = None
    with suppress(ImportError):
        from IPython.core.getipython import (  # type: ignore[import-not-found]  # noqa: PLC0415
            get_ipython,
        )

        if TYPE_CHECKING:
            from IPython.core.interactiveshell import (  # type: ignore[import-not-found]  # noqa: PLC0415
                InteractiveShell,
            )

        ipython: InteractiveShell = get_ipython()
        if ipython is not None:
            user_namespace_attribute: str
            user_namespace: dict
            for user_namespace_attribute in "user_ns", "user_global_ns":
                dbutils = getattr(ipython, user_namespace_attribute, {}).get(
                    "dbutils", None
                )
                if dbutils is not None:
                    return dbutils
    dbutils = globals().get("dbutils")
    if dbutils is not None:
        return dbutils
    databricks_workspace_client: WorkspaceClient = (
        get_databricks_workspace_client(
            host=host,
            account_id=account_id,
            username=username,
            password=password,
            client_id=client_id,
            client_secret=client_secret,
            token=token,
            profile=profile,
            config_file=config_file,
            azure_workspace_resource_id=azure_workspace_resource_id,
            azure_client_secret=azure_client_secret,
            azure_client_id=azure_client_id,
            azure_tenant_id=azure_tenant_id,
            azure_environment=azure_environment,
            auth_type=auth_type,
            cluster_id=cluster_id,
            google_credentials=google_credentials,
            google_service_account=google_service_account,
            debug_truncate_bytes=debug_truncate_bytes,
            debug_headers=debug_headers,
            product=product,
            product_version=product_version,
            credentials_strategy=credentials_strategy,
            credentials_provider=credentials_provider,
            token_audience=token_audience,
            config=config,
        )
    )
    return databricks_workspace_client.dbutils

get_databricks_secret 

get_databricks_secret(
    scope: str,
    key: str,
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str = "unknown",
    product_version: str = "0.0.0",
    credentials_strategy: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    credentials_provider: (
        databricks.sdk.credentials_provider.CredentialsStrategy
        | None
    ) = None,
    token_audience: str | None = None,
    config: databricks.sdk.config.Config | None = None
) -> str

Get a secret from Databricks.

Parameters:

  • scope (str) –

    The Databricks secret scope.

  • key (str) –

    The Databricks secret key.

  • host (str | None, default: None ) –

    A Databricks workspace host URL.

  • account_id (str | None, default: None ) –

    A Databricks account ID.

  • username (str | None, default: None ) –

    A Databricks username.

  • password (str | None, default: None ) –

    A Databricks password.

  • client_id (str | None, default: None ) –

    A Databricks OAuth2 Client ID.

  • client_secret (str | None, default: None ) –

    A Databricks OAuth2 Client Secret.

  • token (str | None, default: None ) –

    A Databricks Personal Access Token.

  • profile (str | None, default: None ) –

    A Databricks Configuration Profile.

  • config_file (str | None, default: None ) –

    A Databricks Configuration File path.

  • azure_workspace_resource_id (str | None, default: None ) –

    An Azure Databricks Workspace Resource ID.

  • azure_client_secret (str | None, default: None ) –

    An Azure Client Secret for Azure Databricks auth.

  • azure_client_id (str | None, default: None ) –

    An Azure Client ID for Azure Databricks auth.

  • azure_tenant_id (str | None, default: None ) –

    An Azure Tenant ID for Azure Databricks auth.

  • azure_environment (str | None, default: None ) –

    An Azure Environment for Azure Databricks auth.

  • auth_type (str | None, default: None ) –

    A Databricks authentication type.

  • cluster_id (str | None, default: None ) –

    A Databricks cluster ID.

  • google_credentials (str | None, default: None ) –

    Google Cloud credentials for GCP Databricks auth.

  • google_service_account (str | None, default: None ) –

    A Google Service Account for GCP Databricks auth.

  • debug_truncate_bytes (int | None, default: None ) –

    Number of bytes to truncate in debug logs.

  • debug_headers (bool | None, default: None ) –

    Whether to enable debug logging of HTTP headers.

  • product (str, default: 'unknown' ) –

    The product name using the SDK.

  • product_version (str, default: '0.0.0' ) –

    The product version using the SDK.

  • credentials_strategy (databricks.sdk.credentials_provider.CredentialsStrategy | None, default: None ) –

    A credentials strategy for the SDK.

  • credentials_provider (databricks.sdk.credentials_provider.CredentialsStrategy | None, default: None ) –

    A credentials provider for the SDK.

  • token_audience (str | None, default: None ) –

    A token audience for the SDK.

  • config (databricks.sdk.config.Config | None, default: None ) –

    A Databricks SDK Config instance.

Source code in src/decorative_secrets/databricks.py 
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
def get_databricks_secret(
    scope: str,
    key: str,
    host: str | None = None,
    account_id: str | None = None,
    username: str | None = None,
    password: str | None = None,
    client_id: str | None = None,
    client_secret: str | None = None,
    token: str | None = None,
    profile: str | None = None,
    config_file: str | None = None,
    azure_workspace_resource_id: str | None = None,
    azure_client_secret: str | None = None,
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_environment: str | None = None,
    auth_type: str | None = None,
    cluster_id: str | None = None,
    google_credentials: str | None = None,
    google_service_account: str | None = None,
    debug_truncate_bytes: int | None = None,
    *,
    debug_headers: bool | None = None,
    product: str = "unknown",
    product_version: str = "0.0.0",
    credentials_strategy: CredentialsStrategy | None = None,
    credentials_provider: CredentialsStrategy | None = None,
    token_audience: str | None = None,
    config: Config | None = None,
) -> str:
    """
    Get a secret from Databricks.

    Parameters:
        scope: The Databricks secret scope.
        key: The Databricks secret key.
        host: A Databricks workspace host URL.
        account_id: A Databricks account ID.
        username: A Databricks username.
        password: A Databricks password.
        client_id: A Databricks OAuth2 Client ID.
        client_secret: A Databricks OAuth2 Client Secret.
        token: A Databricks Personal Access Token.
        profile: A Databricks Configuration Profile.
        config_file: A Databricks Configuration File path.
        azure_workspace_resource_id: An Azure Databricks Workspace Resource ID.
        azure_client_secret: An Azure Client Secret for Azure Databricks auth.
        azure_client_id: An Azure Client ID for Azure Databricks auth.
        azure_tenant_id: An Azure Tenant ID for Azure Databricks auth.
        azure_environment: An Azure Environment for Azure Databricks auth.
        auth_type: A Databricks authentication type.
        cluster_id: A Databricks cluster ID.
        google_credentials: Google Cloud credentials for GCP Databricks auth.
        google_service_account: A Google Service Account for GCP Databricks
            auth.
        debug_truncate_bytes: Number of bytes to truncate in debug logs.
        debug_headers: Whether to enable debug logging of HTTP headers.
        product: The product name using the SDK.
        product_version: The product version using the SDK.
        credentials_strategy: A credentials strategy for the SDK.
        credentials_provider: A credentials provider for the SDK.
        token_audience: A token audience for the SDK.
        config: A Databricks SDK Config instance.
    """
    return _get_secret(
        scope,
        key,
        host=host,
        account_id=account_id,
        username=username,
        password=password,
        client_id=client_id,
        client_secret=client_secret,
        token=token,
        profile=profile,
        config_file=config_file,
        azure_workspace_resource_id=azure_workspace_resource_id,
        azure_client_secret=azure_client_secret,
        azure_client_id=azure_client_id,
        azure_tenant_id=azure_tenant_id,
        azure_environment=azure_environment,
        auth_type=auth_type,
        cluster_id=cluster_id,
        google_credentials=google_credentials,
        google_service_account=google_service_account,
        debug_truncate_bytes=debug_truncate_bytes,
        debug_headers=debug_headers,
        product=product,
        product_version=product_version,
        credentials_strategy=credentials_strategy,
        credentials_provider=credentials_provider,
        token_audience=token_audience,
        config=config,
        **os.environ,
    )

main 

main() -> None

Run a command: - install: Install the Databricks CLI if not already installed - get: Get a secret from Databricks and print it to stdout

Source code in src/decorative_secrets/databricks.py 
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
def main() -> None:
    """
    Run a command:
    -   install: Install the Databricks CLI if not already installed
    -   get: Get a secret from Databricks and print it to stdout
    """
    command = _get_command()
    if command in ("--help", "-h"):
        _print_help()
        return
    parser: argparse.ArgumentParser
    if command == "install":
        parser = argparse.ArgumentParser(
            prog="decorative-secrets databricks install",
            description="Install the Databricks CLI",
        )
        parser.parse_args()
        _install_databricks_cli()
    elif command == "get":
        parser = argparse.ArgumentParser(
            prog="decorative-secrets databricks get",
            description="Get a secret from Databricks",
        )
        parser.add_argument(
            "scope",
            type=str,
        )
        parser.add_argument(
            "key",
            type=str,
        )
        parser.add_argument(
            "--host",
            default=None,
            type=str,
            help="A Databricks workspace host URL",
        )
        parser.add_argument(
            "-cid",
            "--client-id",
            default=None,
            type=str,
            help="A Databricks OAuth2 Client ID",
        )
        parser.add_argument(
            "-cs",
            "--client-secret",
            default=None,
            type=str,
            help="A Databricks OAuth2 Client Secret",
        )
        parser.add_argument(
            "-t",
            "--token",
            default=None,
            type=str,
            help="A Databricks Personal Access Token",
        )
        parser.add_argument(
            "-p",
            "--profile",
            default=None,
            type=str,
            help="A Databricks Configuration Profile",
        )
        namespace: argparse.Namespace = parser.parse_args()
        print(  # noqa: T201
            get_databricks_secret(
                namespace.scope,
                namespace.key,
                host=namespace.host,
                client_id=namespace.client_id,
                client_secret=namespace.client_secret,
                token=namespace.token,
                profile=namespace.profile,
            )
        )