Administration

Workbench | Advanced

Interacting with your app

After activating your application an WORKBENCH_ADMIN can engage with it in several ways.

Administer Workbench interactive user-interface

After installation, your Native App will be located under Data Products > Apps within the Snowflake Snowsight UI.

Click on your App and located in the top-left corner of the screen, the Administer Workbench link opens a interactive interface that you can use to administer, backup, and debug your application.

Snowsight user interface Access section

Manage Access: Grants access to the application for specific Snowflake roles.
Warehouse: Displays the warehouse your application uses, separate from the compute resources for your container.

Snowsight user interface application section

About the app: Provides additional documentation and links.
Privileges: Displays the privileges granted to the application.
Events and logs: Currently disabled.
Connections: Displays configured connections and credentials. OAuth integration and licensing is managed here.
Compute: Shows the compute pool configured for the application.
Cost management: Create budgets to monitor app costs (ACCOUNTADMIN required)

Write your own Native App SQL

Users with the WORKBENCH_ADMIN or ACCOUNTADMIN role can engage with it programmatically using SQL in a Snowsight worksheet.

USE application posit_workbench;
USE schema app;

CALL workbench_state();
CALL workbench_logs();

For more information on ways to engage with your application using SQL, see the troubleshooting section.

Warning

Executing arbitrary SQL can be destructive and may make your Workbench Native App unusable. We do not recommend executing any statements that alter, replace, or drop resources.

Only execute SHOW, SELECT, and DESCRIBE commands.

Automated releases

Snowflake enables Native Applications to be automatically upgraded as detailed in the Snowflake Native App Automated upgrades documentation. Posit regularly updates and pushes the Posit Workbench Native App to customers, to ensure all accounts use the latest stable Workbench release. During an upgrade there will be approximately 10 minutes of downtime for the Workbench service.

Updates include:

New Posit Workbench releases.
Additional system, Python, and R packages in the base environment.
Improvements to the Native App experience.

Release notes are included with every release. We understand the trust that customers are giving us and are open to feedback on this process. Snowflake enforces a security scan on releases.

Update your Posit license

Updating your Posit License through the Snowsight UI requires ACCOUNTADMIN permissions.

Navigate to the Native App Snowsight Connections page

Click the trashcan icon for Posit Workbench License and then Revoke.

Add the new license by following the steps under Activate the native app in the Installation documentation. The Workbench Native App will restart within 2-3 minutes.

Backup Workbench

You can back up and restore the Workbench Native App using the Administer Workbench UI and stored procedures.

In general, backups of Workbench are rarely required. All administrative operations which need backup and restore are encapsulated within the stored procedures themselves.

To create a backup:

Open Administer Workbench and select the backup tab in the sidebar.

Create a name for your backup and click Create Backup. The backup enters the INITIALIZED state. The first block volume backup takes three to four minutes; subsequent backups are faster.

Wait for the snapshot to enter the CREATED state.

Restore Workbench from Backup

To restore the Workbench Native App, ensure that you have already created a backup.

Select the backup you want to use.
Click Restore from Backup. The restoration process takes about five minutes.

Resize Compute Pool

Posit Workbench supports resizing the compute pool that Workbench runs on. The Native App is currently limited to single-node deployments due to pending Snowflake feature requests. Snowflake has a wide variety of instance sizes ranging from 1 CPU, 6 GB to 124 CPU, 984 GB. For more information, see the Snowflake Create Compute Pool documentation.

Select the compute pool you want to use.
Click Resize Compute Pool. The resizing process takes about 2-3 minutes and will create a new endpoint for your Native App.
Updating OAuth for the new endpoint is required.

Suspend and resume Workbench

To suspend the application run CALL posit_workbench.app.workbench_stop();app.workbench_stop() using the ACCOUNTADMIN role or the POSIT_ADMIN role.

To resume the application run CALL posit_workbench.app.workbench_start(); using the ACCOUNTADMIN role or the POSIT_ADMIN role.

See stored procedures for more available procedures.

Change the egress policy

To ensure full Native App functionality, key endpoints must be accessible, such as those for Snowflake OAuth and OCSP. For more information, see the security egress traffic documentation.

Editing the default egress policy requires the ACCOUNTADMIN role. You can modify the default egress policy for Workbench by:

Using the Snowsight UI (Recommended) or
Writing your own SQL

To edit network rules via Snowsight UI:

Visit Admin -> Security -> Network Rules.

Edit the given network rule named POSIT_WORKBENCH_APP_DATA.DATA.ALLOW_ALL_RULE and remember to include the required endpoints detailed in the security egress documentation.

To edit network rules via SQL:

Modify the existing network rule POSIT_WORKBENCH_APP_DATA.DATA.ALLOW_ALL_RULE.

DESCRIBE NETWORK RULE posit_workbench_app_data.data.allow_all_rule

--- include custom <host>:<port>
--- host names are allowed
--- this example policy allows all ips on port 80 and 443
ALTER NETWORK RULE posit_workbench_app_data.data.allow_all_rule SET VALUE_LIST('0.0.0.0:80', '0.0.0.0:443');

Modify the egress rules only after a successful installation, and only change one rule at a time, allowing two to three minutes for each rule to take effect.
Consult the Workbench logs if you encounter issues with egress. The most common signs of issues with your egress policy are request timeouts and 403 errors when connecting to or using Workbench.

call posit_workbench.app.workbench_logs();
call posit_workbench.app.workbench_state();

For more information see the:

Administer multiple application instances

Caution

It is strongly recommended to configure multiple instances of the Posit Workbench app so that users only have access to a single instance of the app. Each app instance is independent, so there are no shared data mounts or directories across applications. Users accessing multiple instances of the Posit Workbench application would have different data, settings, and configurations in each instance.

Snowflake supports installing the same Native App multiple times within a single account, up to 10 unique instances. This functionality allows administrators to horizontally scale their Workbench Native app to meet the demands of more users. The following can be accomplished by installing multiple instances of the Native App:

Compute cost allocation per application. See Monitor credit usage with budgets.
Configure different compute resources per application.
Configure unique databases and schema access patterns per application.
Configure application access by team or department.

Recommendations for multi-app installations

Limit each Workbench Native App to teams with fewer than 25 concurrent users.
As mentioned above, users should only have access to a single instance of the application - home directories cannot be shared or moved across applications.
Snowflake enforces unique application names.
Be cautious when creating role hierarchies (e.g granting a role to another role) as that may inadvertently give access to an application that is not intended. See Grant access to users.
During installation, allocate compute pool resources mindfully since each application incurs a minimal fixed overhead. Begin with minimal resources for each application, then scale up incrementally as demand increases.

Uninstall an application

Warning

Uninstalling an application will delete all of its data including user home directories. Make sure to backup any data that you would like to retain.

Find the Workbench App that you would like to delete under Data Products > Apps within the Snowflake Snowsight UI. Click the three dots on the left hand side of your application and click uninstall.