Management
Posit Team includes a Posit Workbench management page for an administrator to perform post-installation operations.
To manage Workbench, click the menu icon (vertical dots) on the Workbench card and click Manage.
Stop, start, restart
The Workbench service can be managed in several ways:
- Manually triggered operations
- Automatic suspension upon idle
- Programmatic operations
- Scheduled operations
If there are times when Workbench is not used, such as on weekends and holidays, stopping (suspending) the service can help reduce your Snowflake compute costs. By default, a suspended service resumes when a user visits it.
Manual operations
You can manually stop, start, and restart the Workbench service from the Manage page.
Automatic suspension
Posit Team can automatically suspend your Workbench instance after it has had no active sessions for 15 minutes, provided that Workbench has been running for at least an hour.
Idle sessions keep Workbench running. Configure a session timeout so idle sessions stop and auto-suspend can take effect.
Programmatic operations
You can start, stop, and restart the Workbench service using SQL commands.
Start service
Starts the named product service.
Syntax
START_SERVICE(product VARCHAR)Start Workbench within the POSIT_TEAM Native App:
Snowsight UI
SELECT POSIT_TEAM.app.START_SERVICE('workbench');Stop service
Stops the named product service.
Syntax
STOP_SERVICE(product VARCHAR, allow_resume BOOLEAN DEFAULT TRUE)The optional allow_resume argument indicates whether or not user activity is allowed to resume the service. With allow_resume = TRUE (the default), a user visiting the product resumes the service. With allow_resume = FALSE, the service does not resume on user activity. This setting persists until an administrator starts the service from the management page or a SQL call.
The Posit Team management page for Workbench shows a badge indicating when auto-resume is disabled. Users visiting the product through Posit Team see that the service is stopped.
Stop Workbench within the POSIT_TEAM Native App, allowing the service to resume on user activity:
Snowsight UI
SELECT POSIT_TEAM.app.STOP_SERVICE('workbench');Stop Workbench within the POSIT_TEAM Native App, preventing automatic resume on user activity:
Snowsight UI
SELECT POSIT_TEAM.app.STOP_SERVICE('workbench', FALSE);Restart service
Restarts the named product service.
Syntax
RESTART_SERVICE(product VARCHAR)Restart Workbench within the POSIT_TEAM Native App:
Snowsight UI
SELECT POSIT_TEAM.app.RESTART_SERVICE('workbench');Scheduled operations
Schedule the start and stop of Workbench with Snowflake tasks. This example stops Workbench with allow_resume = FALSE so user activity does not resume the service.
Snowsight UI
-- Create a task to stop Workbench at 6 PM daily.
CREATE OR REPLACE TASK task_workbench_stop
SCHEDULE = 'USING CRON 0 18 * * * America/New_York'
AS
SELECT POSIT_TEAM.app.STOP_SERVICE('workbench', FALSE);
-- Enable the stop task.
ALTER TASK task_workbench_stop RESUME;
-- Create a task to start Workbench at 8 AM daily
CREATE OR REPLACE TASK task_workbench_start
SCHEDULE = 'USING CRON 0 8 * * * America/New_York'
AS
SELECT POSIT_TEAM.app.START_SERVICE('workbench');
-- Enable the start task.
ALTER TASK task_workbench_start RESUME;Upgrade
Posit frequently upgrades the Posit Team Native App and its associated version of Workbench. When the Posit Team Native App is updated, Posit Team automatically upgrades Workbench.
Some configuration changes require a service upgrade before they take effect. The management page indicates when configuration changes require an upgrade. Click Upgrade to upgrade Workbench.
Change configuration
In the management page you can change the license, modify the compute pool instance family, increase storage, configure session controls, update user roles and access, and update the OAuth integration. Some changes require a service upgrade. Follow the upgrade section instructions.
Modify compute pool
The Manage page lets you change the instance family of the compute pool that runs Workbench. Choose an instance family appropriate to your workload requirements.
Click Upgrade to apply an instance family change and restart Workbench.
Memory pressure
Workbench and all of its sessions run on a single node in the compute pool. The instance family determines how much memory the node has. Workbench reserves 2 GiB for itself. All sessions share the rest.
A session has a configurable memory limit, capped at 80% of the memory available to all sessions.
When sessions have used nearly all of the shared memory and Workbench slows down as a result, Workbench ends one session at a time until the service recovers. Workbench chooses a session in this order:
- Sessions that are over their memory limit, ordered by the size of their overage.
- Sessions ordered by memory use.
Workbench ends a session immediately and without warning, so unsaved work in that session is lost. Other sessions and the Workbench user interface keep running. If sessions are ended often, choose a larger instance family.
Increase storage
The Manage page lets you increase the storage for user home directories. Enter a larger size and click Set.
Storage can only grow. Click Upgrade to apply the change. The upgrade backs up Workbench, recreates it with the larger storage, and restores the backup. This can take some time, and the Workbench URL changes. The upgrade removes the Workbench OAuth integrations. Add them again with the new URL, as described in Update the Snowflake OAuth integration and External OAuth integrations, and update any saved links.
Automatic upgrades also apply a pending storage increase.
Session controls
The Session Controls card on the Manage page holds settings for Workbench sessions. Click Upgrade after changing a setting to apply the change.
Session timeout
Configure a Session Timeout so Workbench stops idle sessions on your behalf:
- RStudio sessions are suspended.
- Positron and VS Code sessions are terminated. Both editors are configured to auto-save by default, which makes termination less likely to lose unsaved edits.
- Jupyter sessions are culled after one hour of idle time and terminated five minutes later.
Workbench periodically checks for idle sessions and stops those past the configured session timeout. Workbench does not stop idle sessions when the session timeout is set to zero.
See the Workbench documentation for per-editor details about idle session handling:
IDEs
Choose the IDEs users can start sessions in: RStudio Pro, Positron, VS Code, JupyterLab, and Jupyter Notebook. All IDEs are enabled by default. At least one IDE must stay enabled.
Posit Assistant
Turn off Allow Posit Assistant to prevent users from using Posit Assistant in RStudio Pro and Positron sessions. Posit Assistant is allowed by default.
File downloads
Turn off Allow file downloads to prevent users from downloading files from RStudio Pro, Positron, and VS Code sessions. File downloads are allowed by default. This setting does not apply to JupyterLab or Jupyter Notebook sessions.
See the Workbench documentation for each IDE’s file download setting:
Enable Restricted Caller’s Rights
This feature is in private preview. To enroll, request access from Posit support.
Restricted Caller’s Rights (RCR) routes Workbench Snowflake queries directly through the Snowflake internal network. On the Manage page, turn on Enable RCR under Restricted Caller’s Rights, then click Upgrade to apply the change.
RCR also requires a network rule and a caller grant in your Snowflake account. See Restricted Caller’s Rights for the full configuration.
Manage OAuth integrations
The OAuth Integrations page lists every OAuth integration configured for Workbench and lets you add, edit, and delete them. Open the Manage page and click OAuth Integrations.
The Configured Integrations table shows each integration with its type, account or connection, display name, and client ID.
Click Add Integration and select the type of integration to configure:
- Snowflake: Native App Account: Snowflake managed credentials for the account where the Posit Team Native App is installed. See Update the Snowflake OAuth integration.
- Databricks: External OAuth: Managed credentials for a Databricks workspace. See External OAuth integrations.
Changes to OAuth integrations take effect after a Workbench upgrade. When a change is waiting, the OAuth Integrations page shows Pending changes detected. Click Upgrade on the Workbench management page to apply the changes and restart Workbench.
Update the Snowflake OAuth integration
You can update the Workbench Snowflake OAuth integration after its initial setup.
- On the OAuth Integrations page, click Add Integration and select Snowflake: Native App Account. If the integration exists, you can click the edit icon on its row instead.
- Copy the SQL shown and run it in a Snowflake Worksheet as an
ACCOUNTADMINto create and activate the integration. - Click I’ve run the SQL. Posit Team checks for the registration and adds the integration to the Configured Integrations table. If Posit Team does not find the registration, confirm that the SQL ran without errors and click I’ve run the SQL again.
- Click Upgrade on the Workbench management page to apply the changes and restart Workbench.
Delete an OAuth integration
On the OAuth Integrations page, click the delete icon on the integration row and confirm.
You cannot undo deleting an OAuth integration. Deleting the Snowflake Native App Account integration clears the Snowflake OAuth registration, the same as POSIT_TEAM.APP.CLEAR_OAUTH(). To register it again, repeat the steps in Update the Snowflake OAuth integration.
Click Upgrade on the Workbench management page to apply the change.
Backup and restore
Posit Team automatically creates a Workbench backup roughly once per week and retains the most recent four, about one month of backups. Posit Team removes older automatic backups.
You can also create a backup manually, which is useful when you want one taken at a specific point in time, such as before an upgrade or a configuration change. Posit Team does not manage manual backups; delete them when they are no longer needed.
To create a manual backup, specify a backup name or leave it blank for a randomly assigned name and click Save New Backup.
Next, wait several minutes for the backup to be created.
Restoring from a backup takes about 10 minutes. You cannot restore a backup that is larger than the configured storage. Increase storage first. You can delete backups that are no longer needed.
Logs
You can view logs of the Workbench installation.
User access
Snowflake users can access Workbench after you grant the appropriate application role to their user roles. We recommend you grant the application role POSIT_TEAM_USER to most users.
Snowsight UI
GRANT APPLICATION ROLE POSIT_TEAM.POSIT_TEAM_USER TO ROLE YOUR_USER_ROLE;To give users access to Workbench but not the other products in the Posit Team Native App, grant the POSIT_WORKBENCH_USER application role. See Managing Application Roles to learn more.
Snowsight UI
GRANT APPLICATION ROLE POSIT_TEAM.POSIT_WORKBENCH_USER TO ROLE YOUR_USER_ROLE;Change the egress
To ensure full product functionality, key endpoints must be accessible, such as those for Snowflake OAuth and the Online Certificate Status Protocol (OCSP). For more information, see the security egress traffic documentation.
Editing the default egress policy requires the ACCOUNTADMIN role. You can modify the default egress policy for Workbench by:
- Using the Snowsight UI (recommended) or
- Writing your own SQL
To edit network rules via Snowsight UI:
Visit Governance & security > Network policies > Network Rules.
Edit the Workbench egress network rule and remember to include the required endpoints detailed in the security egress documentation.
Snowflake generates the egress network rule and external access integration from the application egress references at install time. Each of these names begins with your application name, so substitute your application name for POSIT_TEAM below. For an application installed as POSIT_TEAM, the Workbench network rule is POSIT_TEAM_APP_DATA.CONFIGURATION.POSIT_TEAM_WORKBENCH_EGRESS_NETWORK_RULE.
To edit network rules via SQL:
Find the network rule bound to the Workbench external access integration, then modify it.
Snowsight UI
-- The ALLOWED_NETWORK_RULES property lists the fully qualified network rule
DESCRIBE EXTERNAL ACCESS INTEGRATION POSIT_TEAM_WORKBENCH_EGRESS_EXTERNAL_ACCESS;
-- Inspect the current network rule
DESCRIBE NETWORK RULE posit_team_app_data.configuration.posit_team_workbench_egress_network_rule;
--- include custom <host>:<port>
--- host names are allowed
--- this example policy allows all ips on port 80 and 443
ALTER NETWORK RULE posit_team_app_data.configuration.posit_team_workbench_egress_network_rule SET VALUE_LIST('0.0.0.0:80', '0.0.0.0:443');Modify the egress rules only after a successful installation, and only change one rule at a time, allowing two to three minutes for each rule to take effect.
Troubleshooting and support
Visit the troubleshooting page for known issues and troubleshooting steps. If none of the troubleshooting steps help, please submit a request through the Posit support form or click Support in the navigation header.
