Datbricks CLI is encoding the secrets in base 64 automatically

[spearitchmeta]

Hello Everyone,

I am using my MAc terminal to save a databricks primary key using a specific scope and secret.

Now everything runs smoothly ! except when I get to the step where I generate a secret. Problem is that my primary key is for example "test123" and when I use the following I get

"databricks secrets get-secret "caefe_prod" "cosmosdb_prod_prim_key"

Output

{

  "key":"cosmosdb_prod_prim_key",

  "value":"cGFzdGVfeW91cl9rZXlfaGVyZQ=="

}

Why is this happening? Am I missing something?

[szymon_dybczak · Accepted solution]

Hi @spearitchmeta ,

Yes, you're right. In order to read the value of a secret using the Databricks CLI, you must decode the base64 encoded value. You can use jq to extract the value and base --decode to decode it:

databricks secrets get-secret <scope-name> <key-name> | jq -r .value | base64 --decode

Secret management | Databricks Documentation

[Khaja_Zaffer]

@szymon_dybczak Exactly 

Thank you. 🙂

[spearitchmeta]

 @szymon_dybczak 

Thank you for yor fast reponse. But the secret is still encoded in that case. Meaning that when I read the secret in databricks to access the azure resource I generally use:  key = dbutils.secrets.get(scope="some-name", key="key-name")

In this case I assume that the encoded key will be read as well right? (which explains the failed connection attempt as well)

[szymon_dybczak · Accepted solution]

Hi @spearitchmeta ,

You will get encoded secret value when you use databricks cli (version 0.205 and above). 

But when you use secret utility (dbutils.secrets) it should be not encoded. So you can use it directly.

[spearitchmeta]

Somehow it did not work before but now the connection is properly established ! Thank you very much

[szymon_dybczak]

No problem, cool that it worked.