If all 3 config servers crash, the entire cluster will become non-functional even all data or data servers are still functional. And restoration of whole cluster become the only way to recover the cluster. For some terabyte mongodb, the recovery may take a few days and it cannot be affordable for some production system.

The data server is easily protected by adding extra member to each replication set. However, we only have 3 config servers and don't have ways to store the delta change of config between each config server backup

Request :

Once we restore an outdated config server, we need a way / new feature / a tool to synchronize the data between the outdated config server and the existing data servers or recover the metadata loss of config from existing data servers

OR

We have a way to restore config server to point that the existing data server reaches to

• The possibility of failure of all config server should be minimal. However, for some new dbengine, SERVER-18316-like issue may occur again. If it happen during site loss or unsafe building power off. All config server failure may become possible ... As a highly available database solution, days of restoration should be avoided as much as possible