Managed Credentials in Workbench Jobs

Advanced | Preview

WarningPreview feature

This feature is in preview. Preview features are unsupported and may face breaking changes in a future release. Any issues found in the feature will be addressed during the regular release schedule; they will not result in immediate patches or hotfixes.

We encourage customers to try these features and we welcome any feedback via Posit Support, but we recommend that the feature not be used in production until it is in general availability (i.e., officially released as a full feature). To provide feedback, please email your Posit Customer Success representative or and specify that you are trialing this feature.

Overview

Posit Workbench can share a user’s Workbench-managed credentials with Workbench Jobs. This lets a script running as a job access the same credentials available to the session that launched it, or to a VS Code or Positron Pro session more generally.

This applies only to Advanced integrations (AWS, Databricks, and Snowflake), which need environment variables and configuration files set up before the script starts running. Azure delegated credentials and Custom OAuth integrations are not covered by this feature at all. See Using Azure credentials in Workbench Jobs and Using credentials in Workbench Jobs for how those work instead.

Enabling managed credentials in jobs

This feature is disabled by default and must be enabled separately for RStudio Pro and for VS Code and Positron Pro sessions.

RStudio Pro

Set the following option in rsession.conf:

/etc/rstudio/rsession.conf
managed-credentials-in-jobs-enabled=1

Once enabled, a Managed Credentials section is added to the Start a Workbench Job dialog, letting users select the Share Workbench-managed credentials with this job checkbox. This checkbox is disabled if the user does not have an active AWS, Databricks, or Snowflake credential to share.

VS Code and Positron Pro

Users can enable the following Workbench extension setting themselves, in their own settings.json:

settings.json
{
  "posit.workbench.jobs.enableManagedCredentials": true
}

To turn this on by default for all users, add it to the default settings file for the IDE: vscode-user-settings.json for VS Code, or positron-user-settings.json for Positron Pro.

Positron Pro also supports enforced settings, which prevent users from changing the value themselves. VS Code does not support enforced settings.

Requirement: pwb-supervisor

When a user shares managed credentials with a job, Workbench runs the job using the pwb-supervisor binary instead of launching the script’s interpreter directly. pwb-supervisor sets up the environment variables, configuration files, and other mechanisms that each provider uses to expose credentials to a script.

For a job to start successfully with managed credentials enabled, pwb-supervisor must be present at /usr/lib/rstudio-server/bin/pwb-supervisor in the environment where the job runs. The user running the job must also be able to execute it:

  • Local cluster jobs: pwb-supervisor is bundled with Workbench, so no additional configuration is required.
  • Slurm cluster jobs: Install the Workbench session components, which include pwb-supervisor, on the compute nodes where jobs run, or include them in the Apptainer/Singularity image used to run jobs. See Install Workbench session components on Slurm compute nodes.
  • Kubernetes cluster jobs: The session components must be available on the Pod where the job runs, either through the session init container or built into the image used to run jobs. When the session init container is enabled (launcher-sessions-auto-update=1), Workbench automatically attaches it to jobs that require pwb-supervisor.

This is the same requirement described for Audited Workbench jobs, which also relies on pwb-supervisor.

Back to top