Imperative create

Every kind carries a minimal rl <kind> create <name>. A few also have a rich generator, where rl <kind> create builds a complete object from flags and applies it, so you do not have to write the manifest by hand for the common case. There is no bespoke server endpoint behind this; the CLI generates an ordinary object and applies it like any other.

Print the object instead of creating it

Add --dry-run, -o, or both to any rl <kind> create to print the object as YAML and create nothing. -o yaml is the default, and -o json prints JSON. Any other -o value is a usage error, and the command exits 2.

The printed object is what the command would create, in the namespace it would use. Save it to a file and rl apply -f creates the same object later:

rl ns create dev -l team=platform -o yaml > dev.yaml
rl apply -f dev.yaml

-o on a create command never writes anything. That differs from rl apply -o yaml, which applies the file first and then prints the stored object. An older rl created the object when you passed -o json, so a script that relied on that now needs to drop the flag.

rl namespace create <name>

Create a Namespace. Alias: ns.

rl namespace create dev
rl ns create dev -l team=platform
rl ns create dev --dry-run -o yaml

rl secret create <name>

Create a Secret. A Secret is broadcast to every origin of its namespace, and its values are masked wherever Ringleader shows them. That includes a preview, which prints *** for each value and says on stderr that the values are masked.

rl secret create db \
  --from-string password=s3cret \
  --from-file ca.crt=./ca.pem \
  -n dev
rl secret create db --from-string password=s3cret --dry-run            # values print as ***
rl secret create db --from-string password=s3cret --dry-run --reveal   # values print as typed

A masked preview shows what you typed without exposing it, and applying it would store ***. To keep a Secret as a file you can apply, add --reveal. The file then holds the values in clear text, so keep it out of version control.

rl workstation create <name>

Create a Workstation. Alias: ws. The flags below are enough to make a workstation that comes up, on your machine or in a cloud.

rl workstation create my-box
rl ws create my-box --image debian-13 --cpus 4 --memory 8 --disk 60
rl ws create my-box --provider gcp --machine-type e2-standard-4 -l cloud=gcp --wait
rl ws create my-box --config ide -l tier=dev --dry-run -o yaml   # print, don't apply

Image

A workstation’s own image replaces the whole image block of its configs. If a WorkstationConfig also names an image, give both halves, as in --image debian-13, or the version from the config is dropped. A local provider picks a version when you give only a distribution. A cloud provider needs both halves, unless you name neither: a cloud workstation with no image at all boots Debian 13.

Size

--cpus, --memory and --disk take whole numbers greater than zero. What they set depends on the provider you name, with --provider or a provider: requirement:

A cloud provider is sized by its machine type, so the error for --cpus or --memory points you at --machine-type. The qemu, lima, vz and hcs providers read the local keys, which the providers reference describes for each of them. wsl2 ignores them. A CloudIdentity’s defaultProviderConfig gives way to these flags, and its overrideProviderConfig wins over them.

Waiting

Without --wait, the command returns as soon as the workstation is written, and a workstation that later fails says so only in its status. With --wait, the command waits for Ready, or for a failure. It exits 1 on a failure and prints what to change. It waits the way rl workstation wait does. --wait with --dry-run or -o exits 2, because nothing is written to wait for.

A cloud workstation in the local namespace is refused unless this device runs that provider, because the local namespace stays on this device. Pick another namespace with -n, or log in to a control plane that runs the provider. A preview is never refused.

rl configmap create <name>

Create a ConfigMap: text that a config’s scripts and files can reference. Alias: cm.

rl configmap create bootstrap --from-file setup.sh=./setup.sh

It takes --from-file, --from-string and -l the way secret create does, and its values are not masked. The flags are listed in the ConfigMap reference.

rl sshkey create <name>

Create an SSHKey, which forwards a local private key into matching workstations.

rl sshkey create github --path ~/.ssh/id_ed25519

The flags are listed in the SSHKey reference.