  We present a novel dynamic reconfiguration protocol for the MongoDB
replication system that extends and generalizes the single server
reconfiguration protocol of the Raft consensus algorithm. Our protocol
decouples the processing of configuration changes from the main database
operation log, which allows reconfigurations to proceed in cases when the main
log is prevented from processing new operations. Additionally, this decoupling
allows for configuration state to be managed by a logless replicated state
machine, by optimizing away the explicit log and storing only the latest
version of the configuration, avoiding the complexities of a log-based
protocol. We provide a formal specification of the protocol along with results
from automated verification of its safety properties. We also provide an
experimental evaluation of the protocol benefits, showing how reconfigurations
are able to quickly restore a system to healthy operation in scenarios where
node failures have stalled the main operation log.
