{"record":{"id":"a9e72212432ed92f","repo":"nats-io/nats-server","slug":"config-reload-not-supported-for-s-old-v-new-v","errorCode":null,"errorMessage":"config reload not supported for %s: old=%v, new=%v","messagePattern":"config reload not supported for (.+?): old=(.+?), new=(.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/reload.go","lineNumber":1782,"sourceCode":"\t\t\ttmpNew.TLSConfig = nil\n\t\t\ttmpOld.tlsConfigOpts = nil\n\t\t\ttmpNew.tlsConfigOpts = nil\n\n\t\t\t// Allow TLSPinnedCerts through reload, existing connections\n\t\t\t// are checked in recheckPinnedCerts\n\t\t\ttmpOld.TLSPinnedCerts = nil\n\t\t\ttmpNew.TLSPinnedCerts = nil\n\n\t\t\t// Need to do the same for remote gateways' TLS configs.\n\t\t\t// But we can't just set remotes' TLSConfig to nil otherwise this\n\t\t\t// would lose the real TLS configuration.\n\t\t\ttmpOld.Gateways = copyRemoteGWConfigsWithoutTLSConfig(tmpOld.Gateways)\n\t\t\ttmpNew.Gateways = copyRemoteGWConfigsWithoutTLSConfig(tmpNew.Gateways)\n\n\t\t\t// If there is really a change prevents reload.\n\t\t\tif !reflect.DeepEqual(tmpOld, tmpNew) {\n\t\t\t\t// See TODO(ik) note below about printing old/new values.\n\t\t\t\treturn nil, fmt.Errorf(\"config reload not supported for %s: old=%v, new=%v\",\n\t\t\t\t\tfield.Name, oldValue, newValue)\n\t\t\t}\n\t\tcase \"leafnode\":\n\t\t\ttmpOld := oldValue.(LeafNodeOpts)\n\t\t\ttmpNew := newValue.(LeafNodeOpts)\n\n\t\t\tlno, err := getLeafNodeOptionsChanges(s, &tmpOld, &tmpNew)\n\t\t\t// If there was an unsupported change, we will get an error with the name\n\t\t\t// of the (first) field and its old and new value.\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"config reload not supported for %s: %v\", field.Name, err)\n\t\t\t}\n\t\t\t// If there was an actual change...\n\t\t\tif lno != nil {\n\t\t\t\tdiffOpts = append(diffOpts, lno)\n\t\t\t}\n\t\tcase \"jetstream\":\n\t\t\tnew := newValue.(bool)","sourceCodeStart":1764,"sourceCodeEnd":1800,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/reload.go#L1764-L1800","documentation":"The `gateway` block of a nats-server config is only partially reloadable. ProcessReload copies old and new GatewayOpts, strips remote-gateway TLS configs, and if any remaining field still differs (addresses, ports, names, remotes, etc.) it rejects the reload with this error, including the field name and both values in the message.","triggerScenarios":"Signaling reload after changing any gateway option that is not TLS-certificate related — e.g. `gateways.name`, `gateways.port`, `gateways.urls`, `gateways.advertise`, the list of remote gateways, or adding/removing the whole gateways block.","commonSituations":"Fleet config tools rewriting the gateways section (adding a new remote cluster) and triggering SIGHUP; fixing a mistyped gateway URL or port at runtime; rotating gateway credentials other than the TLS cert/key pair.","solutions":["Restrict gateway config changes to TLS certificate/key paths, which reload does support","Restart the server for any other gateway topology change","Fix the config so old and new gateway blocks are identical, then reload"],"exampleFix":"// before\nserver # nats-server -sl reload=pid  (after changing gateways: remotes)\n// after\nserver # systemctl restart nats-server  (topology changes need restart)","handlingStrategy":"validation","validationCode":"// Only TLS cert/key paths may differ for gateways on reload:\nfunc gatewayReloadSafe(old, new GatewayOpts) bool {\n\to, n := old, new\n\to.TLSConfig, o.tlsConfigOpts = nil, nil\n\tn.TLSConfig, n.tlsConfigOpts = nil, nil\n\tfor i := range o.Gateways { o.Gateways[i].TLSConfig = nil }\n\tfor i := range n.Gateways { n.Gateways[i].TLSConfig = nil }\n\treturn reflect.DeepEqual(o, n)\n}","typeGuard":null,"tryCatchPattern":"if err := s.Reload(); err != nil {\n\tif strings.Contains(err.Error(), \"config reload not supported for gateway\") {\n\t\tlog.Fatalf(\"gateway change requires restart: %v\", err)\n\t}\n\tpanic(err)\n}","preventionTips":["Treat gateway topology (remotes, urls, port, name) as restart-only","Only rotate gateway TLS certificates via reload","Diff generated configs against running options before signaling reload"],"tags":["nats-server","config-reload","gateways"],"backgroundTag":"unsupported-hot-reload","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}