5 — Databricks Secrets

Pre-class Checklist — 2 weeks before (Module 8)

TRAINER ONLY

2 weeks before Step 5 of 9

Databricks CLI & Secrets (Module 8)

Requires Databricks workspace and Aiven credentials.

    • Where: Local terminal → pip install databricks-cli (or Databricks CLI v0.205+) → databricks configure --token
    • Configure: Host = workspace URL · Token = PAT from next item
    • Verify: databricks workspace list returns paths
    • Doc: Databricks CLI
    • Where: Databricks → your username → Settings → Developer → Access tokens → Generate new token
    • Configure: Label e.g. workshop-cli · Lifetime per org policy · copy token once
    • Doc: Personal access tokens
    • Where: Terminal → databricks secrets create-scope --scope workshop-scope
    • Alternative (UI): Not available for custom scopes in all tiers — CLI is standard for Databricks-backed scopes
    • Verify: databricks secrets list-scopes shows workshop-scope
    • Doc: Secret scopes

    • Where: Terminal (one command per secret):

      databricks secrets put-secret --scope workshop-scope --key aiven-bootstrap-servers --string-value "<SERVICE_URI>"
databricks secrets put-secret --scope workshop-scope --key aiven-ca-cert --string-value "$(cat ca.pem)"
databricks secrets put-secret --scope workshop-scope --key aiven-client-cert --string-value "$(cat service.cert)"
databricks secrets put-secret --scope workshop-scope --key aiven-client-key --string-value "$(cat service.key)"
databricks secrets put-secret --scope workshop-scope --key aiven-topic --string-value "user-activity"

    • Verify: databricks secrets list-secrets --scope workshop-scope lists all five keys

    • Doc: Manage secrets

    • Where: Terminal:

      databricks secrets put-acl --scope workshop-scope --principal workshop_trainees_2026 --permission READ
databricks secrets put-acl --scope workshop-scope --principal workshop_trainer_2026 --permission READ

    • Verify: databricks secrets list-acls --scope workshop-scope shows both groups with READ

    • Doc: Secret ACLs

Next 6 — Materials & credentials 1 week before — cards, prints, repo verification