Sharing & access

Workstations and secrets are personal: you own what you create, and peers can get/list your objects but not update, delete, SSH into, or read the values of them. To let someone else in, you create a Grant. The per-object share/unshare verbs are the everyday, self-service way to do that; the --admin flag is the elevated path for namespace admins acting on resources they don’t own.

rl workstation share <name>

Grant one or more subjects SSH access to a workstation you own. This creates a Grant object; the workstation’s authorized keys are recomputed to include the beneficiaries’ node keys.

rl workstation share my-box --with user:alice@acme.com
rl workstation share my-box --with user:alice@acme.com --with sa:dev/ci
rl workstation share --all --with user:alice@acme.com   # every workstation you own

rl secret share <name>

Grant subjects the access right on a secret you own: the right to read its values and to admit objects that consume it.

rl secret share db --with user:alice@acme.com
rl secret share --all --with sa:dev/builder

Flags are identical to workstation share (--with, --all, --admin, --allow-missing, --dry-run, -o, -n, --as, --home).

rl workstation unshare / rl secret unshare

Revoke a share you created: deletes the matching Grant. Name the same target and beneficiaries the share used. --admin deletes the admin-scope Grant.

rl workstation unshare my-box --with user:alice@acme.com
rl secret unshare db --with user:alice@acme.com

rl workstation access / rl secret access

Report effective access: who can reach the resource and through which grant (ownership vs. an explicit Grant). workstation access reports who can SSH to the workstation; secret access reports who can read the secret’s value.

rl workstation access my-box
rl secret access db

rl share show

List the shares in play: the ones you created (shared out) and the ones provided to you (where you are a beneficiary). Optionally narrow to a single kind (workstation or secret).

rl share show                 # everything: yours + provided to you
rl share show workstation     # only workstation shares
rl share show --mine          # only shares you created
rl share show --to-me         # only shares provided to you
rl share show --enabled       # only currently-enabled shares

rl share disable / enable

Pause a share without deleting it, then resume it later. This flips the Grant’s spec.enabled flag rather than removing it, so the beneficiary list and scope are preserved. A disabled share grants nothing until re-enabled.

rl share disable workstation my-box --with user:alice@acme.com
rl share enable  workstation my-box --with user:alice@acme.com
rl share disable secret db --with user:alice@acme.com

Each takes a workstation or secret subcommand and names the same target and beneficiaries the share used (--with, repeatable; --all for a matchName: * share), plus the usual -n, --as, and --home.