SERVER-34414 Create system indexes using the normal index creation and replication process.

             Do not create them directly on secondaries.
             Do create oplog entries for index creation.

1 files changed, 23 insertions, 7 deletions

diff --git a/src/mongo/db/system_index.cpp b/src/mongo/db/system_index.cpp
index f1e2992ec70..d662a718e10 100644
--- a/src/mongo/db/system_index.cpp
+++ b/src/mongo/db/system_index.cpp
@@ -105,6 +105,15 @@ void generateSystemIndexForExistingCollection(OperationContext* opCtx,
         return;
     }
 
+    // Do not try to generate any system indexes on a secondary.
+    auto replCoord = repl::ReplicationCoordinator::get(opCtx);
+    uassert(ErrorCodes::NotMaster,
+            "Not primary while creating authorization index",
+            replCoord->getReplicationMode() != repl::ReplicationCoordinator::modeReplSet ||
+                replCoord->canAcceptWritesForDatabase(opCtx, ns.db()));
+
+    invariant(!opCtx->lockState()->inAWriteUnitOfWork());
+
     try {
         auto indexSpecStatus = index_key_validate::validateIndexSpec(
             opCtx, spec.toBSON(), ns, serverGlobalParams.featureCompatibility);
@@ -124,7 +133,10 @@ void generateSystemIndexForExistingCollection(OperationContext* opCtx,
         writeConflictRetry(opCtx, "authorization index regeneration", ns.ns(), [&] {
             WriteUnitOfWork wunit(opCtx);
 
-            indexer.commit();
+            indexer.commit([opCtx, &ns, collection](const BSONObj& spec) {
+                opCtx->getServiceContext()->getOpObserver()->onCreateIndex(
+                    opCtx, ns, collection->uuid(), spec, false /* fromMigrate */);
+            });
 
             wunit.commit();
         });
@@ -203,25 +215,29 @@ Status verifySystemIndexes(OperationContext* opCtx) {
 void createSystemIndexes(OperationContext* opCtx, Collection* collection) {
     invariant(collection);
     const NamespaceString& ns = collection->ns();
+    BSONObj indexSpec;
     if (ns == AuthorizationManager::usersCollectionNamespace) {
-        auto indexSpec =
+        indexSpec =
             fassert(40455,
                     index_key_validate::validateIndexSpec(opCtx,
                                                           v3SystemUsersIndexSpec.toBSON(),
                                                           ns,
                                                           serverGlobalParams.featureCompatibility));
 
-        fassert(40456,
-                collection->getIndexCatalog()->createIndexOnEmptyCollection(opCtx, indexSpec));
     } else if (ns == AuthorizationManager::rolesCollectionNamespace) {
-        auto indexSpec =
+        indexSpec =
             fassert(40457,
                     index_key_validate::validateIndexSpec(opCtx,
                                                           v3SystemRolesIndexSpec.toBSON(),
                                                           ns,
                                                           serverGlobalParams.featureCompatibility));
-
-        fassert(40458,
+    }
+    if (!indexSpec.isEmpty()) {
+        opCtx->getServiceContext()->getOpObserver()->onCreateIndex(
+            opCtx, ns, collection->uuid(), indexSpec, false /* fromMigrate */);
+        // Note that the opObserver is called prior to creating the index.  This ensures the index
+        // write gets the same storage timestamp as the oplog entry.
+        fassert(40456,
                 collection->getIndexCatalog()->createIndexOnEmptyCollection(opCtx, indexSpec));
     }
 }