Suppose I have a role that uses "create_host_user_mode: keep".

kind: role
metadata:
  name: role-1
spec:
  allow:
    host_groups:
    - group-1
    logins:
    - '{{external.username}}'
    node_labels:
      hostname:
      - proxy-*
  deny: {}
  options:
    create_host_user_mode: keep
version: v7

When I use this role to tsh ssh to a server on the first time, Teleport agent creates the user, and add it to the pre-existing group "group-1".

Then, I edit the role, and add another entry to "host_groups":

host_groups:
  - group-1
  - group-2

I logout from the server, and tsh ssh again to it (also tried full-blown Teleport logout/login).

Teleport does not create the group group-2, and user is not in that group.