An option to lock a teleport kube agent registered to teleport enterprise cloud server

[namudomino]

1. we have dozens of kube agent registered on teleport enterprise cloud server.
2. Teleport enterprise cloud undergoes major upgrade quartely. If for some reason , if any the k8s deployment is not able to upgrade the agent, is there an option to lock at that agent to that version and proceed with the server upgrade ? Is there an impact to the server upgrade. we understand the outdated agent might loose access.

[zmb3]

Yes, you can place a lock on any agent with tctl lock --server-id=<UUID>, which will cause the agent to lose connection to the auth server.

With the agent no longer able to heartbeat, it will eventually disappear from the cluster inventory and if you are a Teleport Cloud customer it will not be able to impact future upgrades.