Because check of the authentication token depends on the time we need to make sure it is synced on the praefect machine and all gitaly machines that belong to the cluster. That is why a new check point is added to the 'check' sub-command of the praefect binary. The task should be run on the praefect node and doesn't require praefect to be up and running. It is possible to configure the URL of the NTP service and acceptable time offset via env variables NTP_HOST and DRIFT_THRESHOLD. The check has fatal severity because the cluster won't work correctly if auth checks fail continuously for each request.
Closes: gitlab#342574 (closed)