Module trase.tools.ducklake.env_export

Print export TRASE_DUCKLAKE__*=... lines for bash sourcing.

Bash entry points that need DuckLake config in their environment (the dbt wrapper, the Elementary report generator) source this module with::

eval "$(python -m trase.tools.ducklake.env_export --role ro)"   # default read-only
eval "$(python -m trase.tools.ducklake.env_export --role rw)"   # read-write

Output covers every TRASE_DUCKLAKE__* value, an absolute-resolved TRASE_DUCKLAKE__SSL_CERT_PATH_ABS, plus the role-agnostic pair DUCKLAKE_ACTIVE_PG_USER / DUCKLAKE_ACTIVE_PG_PASSWORD that profiles.yml reads via env_var(…).

  • --role rw fetches the RW password from Secrets Manager on every invocation (~2 s). The RW credential is never cached at rest.
  • --role ro (default) reuses the on-disk cache populated by trase.tools.ducklake.connect("ro") — see that module for the cache location and hardening details. Disable via TRASE_DUCKLAKE_PASSWORD_CACHE_ENABLED=false.
  • --clear-cache removes the RO cache file and exits without printing export lines (useful for credential rotation / debugging).

Functions

def main(argv: list[str] | None = None) ‑> int