Edge case TLS disabled and rs scaled

Author: Julien-Ben

controllers/operator/mongodbreplicaset_controller.go

@@ -576,7 +576,7 @@ func (r *ReconcileMongoDbReplicaSet) updateOmDeploymentRs(ctx context.Context, c
 	caFilePath := fmt.Sprintf("%s/ca-pem", util.TLSCaMountPath)
 	// If current operation is to Disable TLS, then we should the current members of the Replica Set,
 	// this is, do not scale them up or down util TLS disabling has completed.
-	shouldLockMembers, err := updateOmDeploymentDisableTLSConfiguration(conn, r.imageUrls[mcoConstruct.MongodbImageEnv], r.forceEnterprise, membersNumberBefore, rs, log, caFilePath, tlsCertPath)
+	shouldLockMembers, err := updateOmDeploymentDisableTLSConfiguration(conn, r.imageUrls[mcoConstruct.MongodbImageEnv], r.forceEnterprise, replicasTarget, rs, log, caFilePath, tlsCertPath)
 	if err != nil && !isRecovering {
 		return workflow.Failed(err)
 	}
@@ -585,7 +585,12 @@ func (r *ReconcileMongoDbReplicaSet) updateOmDeploymentRs(ctx context.Context, c
 	if shouldLockMembers {
 		// We should not add or remove members during this run, we'll wait for
 		// TLS to be completely disabled first.
-		updatedMembers = membersNumberBefore
+		// However, on first reconciliation when membersNumberBefore=0, we need to use replicasTarget
+		if membersNumberBefore == 0 {
+			updatedMembers = replicasTarget
+		} else {
+			updatedMembers = membersNumberBefore
+		}
 	} else {
 		updatedMembers = replicasTarget
 	}
@@ -657,10 +662,18 @@ func (r *ReconcileMongoDbReplicaSet) updateOmDeploymentRs(ctx context.Context, c
 	return workflow.OK()
 }
 
-// updateOmDeploymentDisableTLSConfiguration checks if TLS configuration needs
-// to be disabled. In which case it will disable it and inform to the calling
-// function.
-func updateOmDeploymentDisableTLSConfiguration(conn om.Connection, mongoDBImage string, forceEnterprise bool, membersNumberBefore int, rs *mdbv1.MongoDB, log *zap.SugaredLogger, caFilePath, tlsCertPath string) (bool, error) {
+// updateOmDeploymentDisableTLSConfiguration handles the edge case where TLS is disabled while
+// simultaneously scaling the replica set. Without this safeguard, automation agents could fail during the
+// transition, or new pods might join with inconsistent TLS configuration.
+//
+// This function implements a two-phase reconciliation pattern:
+//  1. First reconciliation: Disable TLS on existing members (returns shouldLockMembers=true to prevent scaling)
+//  2. Second reconciliation: Once TLS is fully disabled, allow scaling operations to proceed
+//
+// Related ticket: CLOUDP-80768 (March 2021)
+// See also: e2e_tls_disable_and_scale_up.py test
+// See also: e2e_tls_disable_and_scale_down.py test
+func updateOmDeploymentDisableTLSConfiguration(conn om.Connection, mongoDBImage string, forceEnterprise bool, currentMemberCount int, rs *mdbv1.MongoDB, log *zap.SugaredLogger, caFilePath, tlsCertPath string) (bool, error) {
 	tlsConfigWasDisabled := false
 
 	err := conn.ReadUpdateDeployment(
@@ -674,7 +687,7 @@ func updateOmDeploymentDisableTLSConfiguration(conn om.Connection, mongoDBImage
 
 			// configure as many agents/Pods as we currently have, no more (in case
 			// there's a scale up change at the same time).
-			replicaSet := replicaset.BuildFromMongoDBWithReplicas(mongoDBImage, forceEnterprise, rs, membersNumberBefore, rs.CalculateFeatureCompatibilityVersion(), tlsCertPath)
+			replicaSet := replicaset.BuildFromMongoDBWithReplicas(mongoDBImage, forceEnterprise, rs, currentMemberCount, rs.CalculateFeatureCompatibilityVersion(), tlsCertPath)
 
 			lastConfig, err := rs.GetLastAdditionalMongodConfigByType(mdbv1.ReplicaSetConfig)
 			if err != nil {

docker/mongodb-kubernetes-tests/tests/tls/e2e_tls_disable_and_scale_up.py

@@ -37,19 +37,13 @@ def test_rs_is_running(replica_set: MongoDB):
 @pytest.mark.e2e_disable_tls_scale_up
 def test_tls_is_disabled_and_scaled_up(replica_set: MongoDB):
     replica_set.load()
+    # Parameters must be changed at the same time
     replica_set["spec"]["members"] = 5
-
-    replica_set.update()
-
-
-@pytest.mark.e2e_disable_tls_scale_up
-def test_tls_is_disabled_and_scaled_up(replica_set: MongoDB):
-    replica_set.load()
     replica_set["spec"]["security"]["tls"]["enabled"] = False
     del replica_set["spec"]["additionalMongodConfig"]
 
     replica_set.update()
 
     # timeout is longer because the operator first needs to
-    # disable TLS and then, scale down one by one.
+    # disable TLS on existing members, then scale up one by one.
     replica_set.assert_reaches_phase(Phase.Running, timeout=800)