Skip embedding processor on Cloud Non-Team plan

lib/service/service.go

@@ -1697,7 +1697,6 @@ func (process *TeleportProcess) initAuthService() error {
 	authServer.SetLockWatcher(lockWatcher)
 
 	if cfg.Auth.AssistAPIKey != "" {
-		log.Debugf("Starting embedding watcher")
 		openAIClient := ai.NewClient(cfg.Auth.AssistAPIKey)
 		embeddingProcessor := ai.NewEmbeddingProcessor(&ai.EmbeddingProcessorConfig{
 			AIClient:     openAIClient,
@@ -1708,6 +1707,24 @@ func (process *TeleportProcess) initAuthService() error {
 		})
 
 		process.RegisterFunc("ai.embedding-processor", func() error {
+			// We check the Assist feature flag here rather than on creation of TeleportProcess,
+			// as when running Enterprise and the feature source is Cloud,
+			// features may be loaded at two different times:
+			// 1. When Cloud is reachable, features will be fetched from Cloud
+			//    before constructing TeleportProcess
+			// 2. When Cloud is not reachable, we will attempt to load cached features
+			//    from the Teleport backend.
+			// In the second case, we don't know the final value of Features().Assist
+			// when constructing the process.
+			// Services in the supervisor will only start after either 1 or 2 has succeeded,
+			// so we can make the decision here.
+			//
+			// Ref: e/tool/teleport/process/process.go
+			if !modules.GetModules().Features().Assist {
+				log.Debug("Skipping start of embedding processor: Assist feature not enabled for license")
+				return nil
+			}
+			log.Debugf("Starting embedding processor")
 			return embeddingProcessor.Run(process.ExitContext(), ai.EmbeddingPeriod)
 		})
 	}