Module trase.tools.ducklake.env_export

Print export TRASE_DUCKLAKE__*=... lines for bash sourcing.

Bash entry points that need DuckLake config in their environment (the dbt wrapper, the Elementary report generator) source this module with::

eval "$(python -m trase.tools.ducklake.env_export --role ro)"   # default read-only
eval "$(python -m trase.tools.ducklake.env_export --role rw)"   # read-write

Output covers every TRASE_DUCKLAKE__* value, an absolute-resolved TRASE_DUCKLAKE__SSL_CERT_PATH_ABS, the role-agnostic pair DUCKLAKE_ACTIVE_PG_USER / DUCKLAKE_ACTIVE_PG_PASSWORD that profiles.yml reads via env_var(…), and DUCKLAKE_READ_ONLY / DUCKLAKE_S3_REGION for the getenv(…) calls in trase/data_pipeline/tools/ducklake_init.sql. The values themselves come from :func:build_exports(), which is also what connect() feeds to that same init script — one description of the environment, whichever way you connect.

  • --role rw fetches the RW password from Secrets Manager on every invocation (~2 s). The RW credential is never cached at rest.
  • --role ro (default) reuses the on-disk cache populated by trase.tools.ducklake.connect("ro") — see that module for the cache location and hardening details. Disable via TRASE_DUCKLAKE_PASSWORD_CACHE_ENABLED=false.
  • --clear-cache removes the RO cache file and exits without printing export lines (useful for credential rotation / debugging).

Functions

def main(argv: list[str] | None = None) ‑> int