Step CA HA with PostgreSQL: Provisioner changes not propagated across replicas

[tomflenner-dg]

Hello,

We are running a self-hosted Step CA deployment in HA mode, with multiple step-ca replicas sharing a PostgreSQL database.

We are using the Admin API / Remote Provisioner Management to add provisioners.

My understanding was that provisioner changes stored in the shared database should be automatically picked up by all Step CA replicas, without requiring a restart or SIGHUP.

However, in our testing, we are observing the following behavior:

A new provisioner is added through the API.
The replica that handles the request immediately recognizes the new provisioner.
Other replicas do not seem to recognize it.
Sending SIGHUP to those replicas makes the new provisioner available.

Is this expected behavior?

Specifically:

Should provisioner changes made through Remote Provisioner Management be automatically propagated/reloaded across all HA replicas?
Is there a cache or refresh interval involved?
Is an explicit SIGHUP or restart expected for replicas that did not process the Admin API request?
Are we missing any configuration required for automatic propagation when using PostgreSQL?

Thanks!

[tashian]

Hi Tom,

Good question. Yes, that's the expected behavior. step-ca running in HA requires a restart to pick up provisioner updates.

Our commercial Step CA Pro adds clustering support. With clustering enabled, HA instances can automatically update their provisioners and admins without a restart.

Step CA Pro is a drop-in replacement for step-ca. It's just a different binary.

If you're interested in learning more, reach out to sales and we'd be happy to chat with you about your needs.

Best,
Carl