Major - P3 Introduce a no_passthrough integration test & protection mechanism to ensure that the system can survive unexpected knob parsing/validation failures.
To induce the failure we need to define a new failpoint in QuerySettingsKnobOverrides::fromBSON() which when activated will throw some error for a given wire name.
diff --git a/src/mongo/db/query/query_settings/query_knob_overrides.cpp b/src/mongo/db/query/query_settings/query_knob_overrides.cpp
index 4bff5747223..ccf40fe99f1 100644
--- a/src/mongo/db/query/query_settings/query_knob_overrides.cpp
+++ b/src/mongo/db/query/query_settings/query_knob_overrides.cpp
@@ -38,11 +38,21 @@
#include <variant>
namespace mongo::query_settings {
+namespace {
+MONGO_FAIL_POINT_DEFINE(failQueryKnobOverridesParsing);
+} // namespace
QuerySettingsKnobOverrides QuerySettingsKnobOverrides::fromBSON(const BSONObj& obj) {
QuerySettingsKnobOverrides overrides;
const auto& reg = QueryKnobRegistry::instance();
for (auto&& elem : obj) {
+ if (MONGO_unlikely(failQueryKnobOverridesParsing.shouldFail())) {
+ auto wireName = failQueryKnobOverridesParsing.getData()["name"].String();
+ uassert(ErrorCodes::InternalError,
+ str::stream() << "query knob overrides parsing failpoint triggered for "
+ << elem.fieldNameStringData(),
+ wireName != elem.fieldNameStringData());
+ }
auto id = reg.getKnobIdForName(elem.fieldNameStringData());
uassert(12194500,
str::stream() << "query knob not settable via QuerySettings: "
Scenarios:
1. [good primary / bad secondary] setQuerySettings passes primary validation, but fails secondary start-up validation. Verify that the secondary outputs an error log & strips the offending knob. Verify that queries matching the configuration don't have the offending knob applied via explain, but has the valid knobs applied.
2. [good mongos / bad configsvr] setQuerySettings passes mongos validation fails on the configsvr. Verify the correct error is returned in the command reply.
3. [good mongos / bad shard] verify that a query with settings applied by mongos keeps executing on a shard with the failpoint enabled. Similar to (1) verify the log + strip behaviour. The offending knob should not be applied while the rest are.