🐛 ensure mongodb secondaries always get votes:1 and priority:1

Issue: ZENKO-5302

Author: DarkIsDude

solution-base/images/mongodb-sharded/debian-12/rootfs/opt/bitnami/scripts/libmongodb.sh

@@ -934,21 +934,40 @@ mongodb_configure_secondary_node_voting() {
     local -r node="${1:?node is required}"
     local -r port="${2:?port is required}"
 
-    debug "Granting voting rights to the node"
+    debug "Ensuring the node has full voting rights (votes: 1, priority: 1)"
     local reconfig_cmd="rs.reconfigForPSASet(member, cfg)"
     [[ "$(mongodb_get_version)" =~ ^4\.(0|2)\. ]] && reconfig_cmd="rs.reconfig(cfg)"
-    result=$(
-        mongodb_execute_print_output "$MONGODB_INITIAL_PRIMARY_ROOT_USER" "$MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD" "admin" "$MONGODB_INITIAL_PRIMARY_HOST" "$MONGODB_INITIAL_PRIMARY_PORT_NUMBER" <<EOF
+    # Idempotent: skip the reconfig when the node already has full voting rights.
+    # rs.reconfigForPSASet applies the change in two internal steps (first
+    # votes: 1 / priority: 0, then priority: 1); if a previous run was
+    # interrupted between the two steps the member can be left at
+    # votes: 1 / priority: 0, so we must be able to re-run and finish the job.
+    mongodb_execute_print_output "$MONGODB_INITIAL_PRIMARY_ROOT_USER" "$MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD" "admin" "$MONGODB_INITIAL_PRIMARY_HOST" "$MONGODB_INITIAL_PRIMARY_PORT_NUMBER" <<EOF
 cfg = rs.conf()
 member = cfg.members.findIndex(m => m.host === '$node:$port')
-cfg.members[member].priority = 1
-cfg.members[member].votes = 1
-$reconfig_cmd
+if (member === -1) {
+    print('node-not-in-replicaset')
+} else if (cfg.members[member].votes === 1 && cfg.members[member].priority === 1) {
+    print('voting-already-configured')
+} else {
+    cfg.members[member].priority = 1
+    cfg.members[member].votes = 1
+    $reconfig_cmd
+}
+EOF
+
+    # Verify the node actually ended up as a full voting member. The retry_while
+    # wrapper around this function re-runs it until this check passes, so a
+    # partially applied reconfig converges to votes: 1 / priority: 1.
+    result=$(
+        mongodb_execute_print_output "$MONGODB_INITIAL_PRIMARY_ROOT_USER" "$MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD" "admin" "$MONGODB_INITIAL_PRIMARY_HOST" "$MONGODB_INITIAL_PRIMARY_PORT_NUMBER" <<EOF
+m = rs.conf().members.find(m => m.host === '$node:$port')
+print(m && m.votes === 1 && m.priority === 1 ? 'voting-ok' : 'voting-pending')
 EOF
     )
     debug "$result"
 
-    grep -q "ok: 1" <<<"$result"
+    grep -q "voting-ok" <<<"$result"
 }
 
 ########################
@@ -1194,21 +1213,22 @@ mongodb_configure_secondary() {
             error "Secondary node did not get marked as secondary"
             exit 1
         fi
+    fi
 
-        # Grant voting rights to node
-        # https://docs.mongodb.com/manual/tutorial/modify-psa-replica-set-safely/
-        if ! retry_while "mongodb_configure_secondary_node_voting $node $port" "$MONGODB_INIT_RETRY_ATTEMPTS" "$MONGODB_INIT_RETRY_DELAY"; then
-            error "Secondary node did not get marked as secondary"
-            exit 1
-        fi
+    # Always grant voting rights, whether the node was just added or was already
+    # a member. This guarantees the replica set converges to votes: 1 / priority: 1
+    # for every secondary, even if a previous run was interrupted before this step.
+    # https://docs.mongodb.com/manual/tutorial/modify-psa-replica-set-safely/
+    if ! retry_while "mongodb_configure_secondary_node_voting $node $port" "$MONGODB_INIT_RETRY_ATTEMPTS" "$MONGODB_INIT_RETRY_DELAY"; then
+        error "Secondary node did not get full voting rights (votes: 1, priority: 1)"
+        exit 1
+    fi
 
-        # Mark node as readable. This is necessary in cases where the PVC is lost
-        if is_boolean_yes "$MONGODB_SET_SECONDARY_OK"; then
-            mongodb_execute_print_output "$MONGODB_INITIAL_PRIMARY_ROOT_USER" "$MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD" "admin" <<EOF
+    # Mark node as readable. This is necessary in cases where the PVC is lost
+    if is_boolean_yes "$MONGODB_SET_SECONDARY_OK"; then
+        mongodb_execute_print_output "$MONGODB_INITIAL_PRIMARY_ROOT_USER" "$MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD" "admin" <<EOF
 rs.secondaryOk()
 EOF
-        fi
-
     fi
 }
 
@@ -1324,8 +1344,12 @@ mongodb_node_currently_in_cluster() {
     local -r port="${2:?port is required}"
     local result
 
+    # Use mongodb_execute_print_output (not mongodb_execute): mongodb_execute
+    # wraps the call in debug_execute, which discards stdout unless BITNAMI_DEBUG
+    # is enabled. We need to capture rs.status() output to inspect the members,
+    # otherwise this check always sees an empty string and returns false.
     result=$(
-        mongodb_execute "$MONGODB_INITIAL_PRIMARY_ROOT_USER" "$MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD" "admin" "$MONGODB_INITIAL_PRIMARY_HOST" "$MONGODB_INITIAL_PRIMARY_PORT_NUMBER" <<EOF
+        mongodb_execute_print_output "$MONGODB_INITIAL_PRIMARY_ROOT_USER" "$MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD" "admin" "$MONGODB_INITIAL_PRIMARY_HOST" "$MONGODB_INITIAL_PRIMARY_PORT_NUMBER" <<EOF
 rs.status().members
 EOF
     )