Teleport node join token mismatch error during zero‑downtime migration: reuse vs new token

The goal is to perform a zero‑downtime migration of a small application managed by Teleport, choosing a join‑token strategy that maintains security and operational simplicity.

Reusing the existing join token avoids redistributing new credentials but increases the chance of token leakage if the token is exposed. Generating a fresh token for the replacement nodes reduces leakage risk but requires updating the auth service and possibly existing nodes, which could introduce brief authentication gaps if not coordinated with the etcd rolling member replacement that backs the auth service.

What are the security trade‑offs of reusing versus rotating the join token during migration? How does a fresh token affect the coordination with etcd rolling upgrades and auth service availability? Is there a recommended procedure to update tokens without breaking zero‑downtime guarantees?