Kafka Error INVALID_VOTER_KEY
Error code 125 · Non-retriable KRaft
The voter key doesn't match the receiving replica's key.
Common Causes
- During KRaft voter reconfiguration (KIP-853), a new voter's public key in the `AddRaftVoter` request doesn't match the key the receiving replica has associated with that voter's ID, indicating a misconfiguration or key rotation issue.
- The voter's keypair was regenerated (e.g., after a security rotation) but the voter set was not updated atomically — the old key is still registered in the quorum metadata while the new key is being presented.
- Misconfigured `controller.quorum.voters` or key material mismatch between what's configured in `server.properties` and what's stored in the KRaft metadata log.
Solutions
- Re-read the target controller's current on-disk identity and voter metadata (for example with kafka-storage.sh info -c /path/to/server.properties) and reissue AddRaftVoter using current values rather than cached registration material.
- If the controller was reformatted, replaced, or had its voter key rotated, remove the stale voter entry first and then add the controller back with its new identity; do not reuse metadata captured before the change.
- Use `kafka-metadata-quorum.sh --bootstrap-server localhost:9092 describe --replication` to inspect the current voter set, then compare the target controller's node ID, endpoints, and stored identity with what you are trying to register.
Diagnostic Commands
# Check KRaft metadata quorum status
kafka-metadata-quorum.sh --bootstrap-server localhost:9092 --command-config admin.properties describe --replication
# Look for voter events in controller logs
grep 'INVALID_VOTER_KEY\|voter key\|AddRaftVoter\|quorum' /var/log/kafka/controller.log | tail -50Related APIs
This error can be returned by: AddRaftVoter · UpdateRaftVoter · Vote
Debugging Kafka errors? Conduktor Console gives you real-time visibility into your cluster. Explore all errors in the Error Decoder.