Sharing & access

Workstations and secrets are personal: you own what you create, and peers can get/list your objects but not update, delete, SSH into, or read the values of them. To let someone else in, you create a Grant. The per-object share/unshare verbs are the everyday, self-service way to do that; the --admin flag is the elevated path for namespace admins acting on workstations they don’t own. It does not extend to secrets you do not own; see the note below.

rl workstation share <name>

Grant one or more subjects SSH access to a workstation you own. This creates a Grant object; the workstation’s authorized keys are recomputed to include the beneficiaries’ node keys.

rl workstation share my-box --with user:alice@acme.com
rl workstation share my-box --with user:alice@acme.com --with sa:dev/ci
rl workstation share --all --with user:alice@acme.com   # every workstation you own

A share gives the person SSH access, which covers rl shell, rl tmux and plain ssh. It does not forward their own SSH keys into the workstation.

The workstation’s ports reach their device only if you set defaultLocalBinding.scope: accessors in its configuration. Even then, the LocalBinding their device creates for it starts disabled, and nothing is forwarded until they enable it. They run rl binding enable <workstation> -n <namespace> or press a on the Bindings tab of the TUI. Until you set the scope, a LocalBinding on their device that matches only shared workstations reports the reason SharedWorkstation.

A service on their device is never forwarded into a workstation shared with them.

rl secret share <name>

Grant subjects the access right on a secret you own: the right to read its values and to admit objects that consume it.

rl secret share db --with user:alice@acme.com
rl secret share --all --with sa:dev/builder

Flags are identical to workstation share (--with, --all, --admin, --allow-missing, --dry-run, -o, -n, --as, --home), with one difference that matters: --admin does not let you share a secret you do not own. Naming a teammate’s is refused; --all is accepted and then covers only your own, as is --allow-missing for a secret that does not exist yet.

rl workstation unshare / rl secret unshare

Revoke a share you created: deletes the matching Grant. Name the same target and beneficiaries the share used. --admin deletes the admin-scope Grant.

rl workstation unshare my-box --with user:alice@acme.com
rl secret unshare db --with user:alice@acme.com

rl workstation access / rl secret access

Report effective access: who can reach the resource and through which grant (ownership vs. an explicit Grant). workstation access reports who can SSH to the workstation; secret access reports who can read the secret’s value.

rl workstation access my-box
rl secret access db

rl share show

List the shares in play: the ones you created (shared out) and the ones provided to you (where you are a beneficiary). Optionally narrow to a single kind (workstation or secret).

rl share show                 # everything: yours + provided to you
rl share show workstation     # only workstation shares
rl share show --mine          # only shares you created
rl share show --to-me         # only shares provided to you
rl share show --enabled       # only currently-enabled shares

rl share disable / enable

Pause a share without deleting it, then resume it later. This flips the Grant’s spec.enabled flag rather than removing it, so the beneficiary list and scope are preserved. A disabled share grants nothing until re-enabled.

rl share disable workstation my-box --with user:alice@acme.com
rl share enable  workstation my-box --with user:alice@acme.com
rl share disable secret db --with user:alice@acme.com

Each takes a workstation or secret subcommand and names the same target and beneficiaries the share used (--with, repeatable; --all for a matchName: * share), plus the usual -n, --as, and --home.