FeatureFlag checks must be performed while holding the global lock in IX / X if data can be written in a new format

ExportXMLWordPrintableJSON

    • Replication
    • Fully Compatible
    • v8.0
    • Repl 2024-04-29, Repl 2024-05-13, Repl 2024-05-27, Repl 2024-06-10
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      As mentioned in the FCV README, it's only safe to check a featureFlag while holding the global lock in IX / X to ensure that the FCV doesn't transition all the way from upgraded -> downgraded or downgraded -> upgraded in the lifetime of an operation.

      This rule isn't enforced / well-known. And so we have a few cases in the code where we check a featureFlag without holding the global lock in IX / X:

      This means that a node may potentially be in the fully downgraded but allow a command only executable in the upgraded state to run.

      Also note that the latter two examples don't seem harmful because the commands don't persist data in a new format. So we might want a way to differentiate between when a command causes data to get persisted in a new format and when a command is cosmetic (like bulkWrite).

      It's also worth thinking about what may happen on a sharded cluster if some shards process the command while others reject it.

            Assignee:
            Samyukta Lanka (Inactive)
            Reporter:
            Vishnu Kaushik
            Votes:
            0 Vote for this issue
            Watchers:
            13 Start watching this issue

              Created:
              Updated:
              Resolved: