Current state: APPROVED
Please keep the discussion on the mailing list rather than commenting on the wiki (wiki discussions get unwieldy fast).
The producer should enable the strongest message delivery guarantee by default.
- Exactly Once Delivery. In KIP-98, the community introduces Exactly Once Delivery, which guarantees that every message will be persisted exactly once without data loss or duplication. However, in order to give the community time for upgrading, by default, the producer will still use at-least-once delivery and set "enable.idempotence=false".
- N-1 failure toleration. If the brokers are flushing records to disks asynchronously, the strongest concurrent failure Kafka can tolerate is N-1. (i.e. N-1 brokers shut down before the memory messages flush to disk). However, for some performance reasons, by default, the producer config will set "ack=1", where the data loss can happen if the partition leader shutdown.
Having these guarantee won't impact the performance in a significant way, as stated here:
- Producer config defaults will change in release version 3.0
|Producer config name||From||To|
2. Producer ACL required for enabling idempotence will change from `IDEMPOTENT_WRITE` to `WRITE` in release version 2.8
A. In `ProduceRequest` handler, we remove the `IDEMPOTENT_WRITE` access check since it already has the `WRITE` access check on topics.
B. In `InitProduceIdRequest` handler, if the producer will get authorized if it has `WRITE` access on ANY topic.
C. `kafka-acls` will show deprecation warnings if users are trying to grant the `IDEMPOTENT_WRITE` access.
3. `org.apache.kafka.server.authorizer.Authorizer` will have a new interface for checking if the caller is authorized to perform the given ACL operation on at least one resource satisfying the filter. It will have a default implementation assuming `allow.everyone.if.no.acl.found=false`.
AclAuthorizer and SimpleAclAuthorizer
AclAuthorizer and AuthorizerWrapper will override the new interface `org.apache.kafka.server.authorizer.Authorizer#authorizeAny` to
- improve the performance
- implement the `allow.everyone.if.no.acl.found` logic
Besides the public interface changes above, we will deprecate `IDEMPOTENT_WRITE` in release version 3.0 because it's kind of trivial by practice.
We are relaxing the ACL restriction from `IDEMPOTENT_WRITE` to `WRITE` earlier (release version 2.8) and changing the producer defaults later (release version 3.0) in order to give the community users enough time to upgrade their broker first. So their later client-side upgrading, which enables idempotence by default, won't get blocked by the `IDEMPOTENT_WRITE` ACL required by the old version brokers.
`IDEMPOTENT_WRITE` will be deprecated in 3.0 but won't be removed in a short term, in order to give the community enough time to upgrade their `authorizer` implementation.
`request-required-acks` option in kafka-console-producer.sh will change default to -1
In kafka-console-producer.sh, we have a option: `request-required-acks` that can configure the
acks setting in Producer. It was originally default to 1. But after this KIP, we set the default
enable.idempotence to true, so we have to also set the default
acks config here to -1 for this change.
Compatibility, Deprecation, and Migration Plan
For changing the default of `acks`, there won't be any compatibility issues. But several compatibility issues may occur for changing the default of `enable.idempotence`:
- In the scenario below, people will need to either a) grant the producers the `IDEMPOTENT_WRITE` access or b) change their producer config to explicitly disable the idempotence (set `enable.idempotence = false`).
- use producers with release version >= 3.0
- use brokers with release version < 2.8
- In the scenario below, people will need to either a) upgrade their topic format version >= V2 or b) change their producer config to explicitly disable the idempotence (set `enable.idempotence = false`).
- use producers with release version >= 3.0
- have any topic using the message format < V2 while producers with release version >= 3.0 will produce to this topic
- In the scenario below, people will need to implement the new `Authorizer#authorizeAny` interface
- use their own authorizer implementation other than `AclAuthorizer` and `SimpleAclAuthorizer`
- the customized authorizer support the configuration `allow.everyone.if.no.acl.found`
There's an alternative way to implement a fallback semantics on `enable.idempotence` to mitigate the compatibility issue. Specifically, by default, the producer will set `enable.idempotence` as `suggested`, a new option, to let the producer and brokers decide if idempotence can be enabled or not. However, since the fallback
- adds more complexity to the client and broker side logic
- may cause confusions and thus unexpected behavior
We decide to propose the simplest approach at the cost of the small compatibility issues.