SSHKey | Ringleader Docs

An SSHKey makes one of your local private keys available inside selected workstations, as a forwarded ssh-agent, never as a file on the workstation. It is how a git clone from a private repo, a service, or an interactive shell running on the workstation authenticates outbound using a key that stays on your machine.

apiVersion: workstations.ringleader.dev/v1
kind: SSHKey

Not the same as SSH access to the workstation

SSHKey is about keys the workstation uses to reach other systems (GitHub, a package registry). Who may SSH into the workstation is a separate model: ownership plus Grants. Don’t confuse the two.

How it works

An SSHKey names a local private key path and an optional label selector. The daemon forwards every matching key into the workstation as an in-process ssh-agent keyring, exposed over its persistent connection at a canonical socket on the workstation and wired into an ambient SSH_AUTH_SOCK (via /etc/profile.d/). Any process on the workstation (an interactive rl shell, a git in a cron job, a managed service) sees the same forwarded keys.

The private keys live only in the daemon’s memory; they are never written to the workstation’s disk, and the agent socket is live only while your daemon holds the connection. Selection uses Kubernetes-style label matching: an SSHKey attaches to a workstation when its selector.matchLabels are a subset of the workstation’s labels, and an empty or absent selector matches every workstation (an unconditional key).

Because keys are device-local, an SSHKey is a device-local kind: it never mirrors or routes to another origin, and it only ever forwards from the device that declares it.

Example

Forward your GitHub key into every tier: dev workstation:

apiVersion: workstations.ringleader.dev/v1
kind: SSHKey
metadata:
  name: github
  namespace: dev
spec:
  path: ~/.ssh/id_ed25519
  selector:
    matchLabels:
      tier: dev

An unconditional key (forwarded into every workstation) simply omits the selector:

spec:
  path: ~/.ssh/id_ed25519

Spec fields

Field	Type	Description
`path`	`string`	Required. Path to the local private key on this device. A leading `~` expands to your home directory.
`selector.matchLabels`	`map`	Which workstations receive the forwarded key. Empty/absent matches every workstation.
`enabled`	`bool`	Master on/off switch (default `true`; an absent field reads as enabled). When `false`, the key is not forwarded into any workstation, even one its selector matches. Selection still records the match, but forwarding is paused.

Enabling and disabling a key

Flip the enabled toggle from the command line without editing the manifest, by name, or across every matching key with a label selector:

rl sshkey enable github
rl sshkey disable github
rl sshkey disable -l tier=dev     # every matching key

Flag	Description
`-l, --selector <k=v>`	Label selector (`key=value[,key=value]`) instead of a name.
`-n, --namespace <ns>`	Namespace.
`--as <subject>`	Impersonate a subject.
`--home <dir>`	Data directory.

Status

None. An SSHKey has no status: it is a device-local selection rule the daemon acts on directly.