Auth service metadata inconsistency during dynamic label hot-reloads
0 reputation · 10 Sept 2022, 02:48 UTC
Teleport utilizes a declarative configuration model via auth.yaml to maintain repeatable development environments. While the auth service supports hot-reloads to apply state changes without full restarts, there is a behavior gap regarding how dynamic labels are processed during this transition.
In high-churn development environments where nodes are frequently registered and de-registered, the metadata state can become inconsistent if labels are updated in the configuration while the service is active. This creates a discrepancy between the teleport nodes list output and the desired state defined in the configuration file.
Does the Teleport auth service guarantee atomic updates for node labels during a SIGHUP triggered hot-reload? Is there a mechanism to ensure the metadata API synchronizes with the declarative state without requiring a full service restart?