A workspace is the top-level boundary for access management. It contains members, teams, service accounts, targets, daemons, principals, certificate authorities, domains, and workspace settings.
Resources and access assignments are scoped to a workspace. A user can belong to more than one workspace, and nk synchronizes the workspaces available to the current identity.
Workspace creation
Create a workspace through the account management flow. Workspace creation initializes a default SSH certificate authority.
Additional X.509 authorities can be created separately when a TLS workload needs them.
Members and roles
Workspace members have one of these roles:
| Role | Meaning |
|---|---|
owner | Full control over the workspace |
editor | Can manage workspace resources and access assignments |
viewer | Read-only workspace member |
Invite existing users and manage membership through the workspace management flow. Keep the owner and editor roles limited to the people who need them.
Domains and SSO
Workspace domains can be verified and used with the configured SSO provider. The core supports OIDC and SAML authentication flows. Configure provider details only after confirming the issuer, callback, claims, and domain requirements for your identity provider.
Authentication configuration is separate from SSH certificate issuance. A successful login still needs an access assignment to a target principal before SSH access is granted.
Enrollment
Enrollment tokens allow a daemon to join a workspace. The daemon may be accepted automatically or require manual approval, depending on workspace configuration.
Treat enrollment tokens as credentials. Generate them only when needed and do not put them in source control.