Introduce exit-on-cluster-config-file-save-error to prevent the process from existing when saving fails

src/cluster_legacy.c

@@ -864,7 +864,7 @@ int clusterSaveConfig(int do_fsync) {
 }
 
 void clusterSaveConfigOrDie(int do_fsync) {
-    if (clusterSaveConfig(do_fsync) == C_ERR) {
+    if (clusterSaveConfig(do_fsync) == C_ERR && server.cluster_configfile_exit) {
         serverLog(LL_WARNING, "Fatal: can't update cluster config file.");
         exit(1);
     }

src/config.c

@@ -3107,6 +3107,7 @@ standardConfig static_configs[] = {
     createBoolConfig("enable-debug-assert", NULL, IMMUTABLE_CONFIG | HIDDEN_CONFIG, server.enable_debug_assert, 0, NULL, NULL),
     createBoolConfig("cluster-slot-stats-enabled", NULL, MODIFIABLE_CONFIG, server.cluster_slot_stats_enabled, 0, NULL, NULL),
     createBoolConfig("hide-user-data-from-log", NULL, MODIFIABLE_CONFIG, server.hide_user_data_from_log, 1, NULL, NULL),
+    createBoolConfig("exit-on-cluster-config-file-save-error", NULL, MODIFIABLE_CONFIG, server.cluster_configfile_exit, 1, NULL, NULL),
 
     /* String Configs */
     createStringConfig("aclfile", NULL, IMMUTABLE_CONFIG, ALLOW_EMPTY_STRING, server.acl_filename, "", NULL, NULL),

src/server.h

@@ -2158,6 +2158,7 @@ struct valkeyServer {
     mstime_t cluster_node_timeout;  /* Cluster node timeout. */
     mstime_t cluster_ping_interval; /* A debug configuration for setting how often cluster nodes send ping messages. */
     char *cluster_configfile;       /* Cluster auto-generated config file name. */
+    int cluster_configfile_exit;    /* Exit if there is an error saving the cluster config file. */
     struct clusterState *cluster;   /* State of the cluster */
     int cluster_migration_barrier;  /* Cluster replicas migration barrier. */
     int cluster_allow_replica_migration; /* Automatic replica migrations to orphaned primaries and from empty primaries */

valkey.conf

@@ -1634,6 +1634,15 @@ aof-timestamp-enabled no
 #
 # cluster-config-file nodes-6379.conf
 
+# The cluster configuration file is the metadata "database" for the
+# cluster. By default, if the cluster configuration file fails to be
+# saved, the process will exit immediately. Passive exit of a process
+# may have unexpected effects so you can change it with the following
+# directive, but be aware that the cluster metadata may be inconsistent
+# in this case.
+#
+# exit-on-cluster-config-file-save-error yes
+
 # Cluster node timeout is the amount of milliseconds a node must be unreachable
 # for it to be considered in failure state.
 # Most other internal time limits are a multiple of the node timeout.