{ "id": "manage-workspace", "title": "Manage workspaces", "url": "https://redis.io/docs/latest/develop/ai/featureform/manage-workspace/", "summary": "Create, verify access to, monitor, and delete Redis Feature Form workspaces with the ff CLI.", "tags": [], "last_updated": "2026-07-30T11:11:54+01:00", "page_type": "content", "content_hash": "65145e49130244a5b36506fa76696261d80f25a5b308515208aac9459de372fc", "sections": [ { "id": "overview", "title": "Overview", "role": "overview", "text": "A workspace is a self-contained environment in Redis Feature Form. Each workspace owns its own resource graph, providers, secret references, catalog entries, and serving metadata—nothing is shared between workspaces. Use workspaces to keep environments such as dev, staging, and prod separate, or to give independent teams their own isolated area on a shared deployment.\n\nEach workspace has:\n\n- A unique name and an optional description.\n- A `last_applied_version` that tracks the most recently applied resource graph.\n- A built-in `env` secret provider, created automatically.\n\nThe tasks on this page require one of two roles:\n\n- A global admin (`global_admin`) creates workspaces and grants access.\n- A workspace admin (`workspace_admin`) verifies their access, runs health checks, and updates or deletes the workspace.\n\nFor the full list of built-in roles and the scope model, see [Authentication and RBAC](https://redis.io/docs/latest/operate/featureform/configure-auth).\n\nThis page covers the `ff` CLI. The Feature Form dashboard supports the same workspace operations with a UI when you prefer.\n\nMost commands on this page identify a workspace by its UUID, either as a positional argument or via the `--workspace` flag. Find the UUID with `ff workspace create` or `ff workspace list`. The examples below use ``, substitute the actual UUID." }, { "id": "create-a-workspace-and-grant-access", "title": "Create a workspace and grant access", "role": "content", "text": "A global admin creates a workspace and hands it off to the workspace admin who will manage it." }, { "id": "1-create-the-workspace", "title": "1. Create the workspace", "role": "content", "text": "[code example]\n\nThe command returns a table with the new workspace's ID, name, description, version, and timestamps:\n\n[code example]\n\nSave the ID—you'll need it for the RBAC commands below." }, { "id": "2-grant-workspace-admin-access", "title": "2. Grant workspace-admin access", "role": "content", "text": "[code example]\n\nTo bind a group or service account instead, use `--group ` or `--service-account `. Exactly one of `--user`, `--group`, or `--service-account` is required." }, { "id": "3-verify-the-binding", "title": "3. Verify the binding", "role": "content", "text": "[code example]\n\nYou should see the new role bound to the user, group, or service account you specified. For an alternate view that groups bindings by user, group, or service account instead of one row per binding, use `ff rbac subjects --workspace `.\n\nCreating a workspace does not automatically grant other users access—each member needs their own binding." }, { "id": "confirm-access-to-a-workspace", "title": "Confirm access to a workspace", "role": "content", "text": "Use these checks when a workspace already exists and you need to confirm you can register providers, apply resources, or serve features.\n\n[code example]\n\nYou should see your user, group, or service-account binding listed. If you don't, ask a global admin to grant access using the steps above." }, { "id": "check-workspace-health", "title": "Check workspace health", "role": "content", "text": "Run these commands routinely, or whenever something looks wrong, to confirm a workspace is healthy:\n\n[code example]\n\nAlso confirm that your serving and dataframe clients point at the expected transport and state backend." }, { "id": "update-a-workspace", "title": "Update a workspace", "role": "content", "text": "Change a workspace's name or description:\n\n[code example]\n\nUpdate affects metadata only—it doesn't touch providers, the resource graph, or catalog entries." }, { "id": "delete-a-workspace", "title": "Delete a workspace", "role": "content", "text": "Deleting a workspace permanently removes all workspace-scoped data: providers, secret references, the resource graph, catalog entries, and serving metadata. This cannot be undone.\n\n\n[code example]\n\n`--force` skips the interactive confirmation prompt. Omit it for a safer, interactive delete." }, { "id": "troubleshooting", "title": "Troubleshooting", "role": "errors", "text": "- **`permission denied` on provider or apply commands.** Your account is missing workspace write access. Run `ff rbac list --workspace ` to confirm the binding, and ask a global admin to grant the appropriate role if it's missing.\n- **`workspace not found`.** Usually means the wrong deployment, the wrong transport, or a typo in the workspace name. Try `ff workspace list` to see what's actually visible.\n- **Missing workspaces, providers, or resources after apply.** With memory-backed state, gRPC and REST can behave like separate state domains. Check for transport mismatches first, and use durable PostgreSQL-backed state for shared environments." }, { "id": "next-steps", "title": "Next steps", "role": "content", "text": "- [Register providers](https://redis.io/docs/latest/develop/ai/featureform/register-providers) to connect a workspace to its storage, compute, and catalog systems.\n- See [Authentication and RBAC](https://redis.io/docs/latest/operate/featureform/configure-auth) for the deployment-wide role and scope model.\n- See [Concepts](https://redis.io/docs/latest/develop/ai/featureform/concepts) for the workspace, resource graph, and serving model." } ], "examples": [ { "id": "1-create-the-workspace-ex0", "language": "bash", "code": "ff workspace create demo-workspace \\\n --description \"Workspace for the feature workflow docs path\"", "section_id": "1-create-the-workspace" }, { "id": "1-create-the-workspace-ex1", "language": "text", "code": "ID NAME DESCRIPTION VERSION CREATED UPDATED\n7f2e4d8c-3a91-4b6d-9f0a-5e8c1b2d3f4a demo-workspace Workspace for the feature workflow ... 0 2026-05-12 14:03:21 2026-05-12 14:03:21", "section_id": "1-create-the-workspace" }, { "id": "2-grant-workspace-admin-access-ex0", "language": "bash", "code": "ff rbac grant workspace_admin \\\n --workspace \\\n --user alice@example.com", "section_id": "2-grant-workspace-admin-access" }, { "id": "3-verify-the-binding-ex0", "language": "bash", "code": "ff rbac list --workspace ", "section_id": "3-verify-the-binding" }, { "id": "confirm-access-to-a-workspace-ex0", "language": "bash", "code": "# Verify your identity.\nff auth whoami\nff rbac whoami\n\n# Confirm the workspace is visible to you.\nff workspace list\nff workspace get --name demo-workspace\n\n# Confirm your binding.\nff rbac list --workspace ", "section_id": "confirm-access-to-a-workspace" }, { "id": "check-workspace-health-ex0", "language": "bash", "code": "# Confirm the CLI can reach the deployment.\nff ping\n\n# Inspect workspace metadata, including last_applied_version.\nff workspace get \n\n# List configured providers and secret providers.\nff provider list --workspace \nff secret-provider list --workspace \n\n# Inspect graph overview and stats.\nff graph workspace stats --workspace \n\n# List catalog locations for materialized resources.\nff catalog list --workspace ", "section_id": "check-workspace-health" }, { "id": "update-a-workspace-ex0", "language": "bash", "code": "ff workspace update \\\n --name demo-workspace \\\n --description \"Updated description\"", "section_id": "update-a-workspace" }, { "id": "delete-a-workspace-ex0", "language": "bash", "code": "ff workspace delete --force", "section_id": "delete-a-workspace" } ] }