KIP-903 — Replicas with stale broker epoch should not be allowed to join the ISR

Accepted Kafka 3.5 BrokerKRaft

Enforces in KRaft mode that an AlterPartition request is rejected (INELIGIBLE_REPLICA) if any proposed ISR member has a broker epoch older than the epoch tracked by the leader at the time of the Fetch request. A race where a broker reboots with a new empty disk, gets re-registered, and is then added to the ISR by a stale AlterPartition from before the fence was lifted could allow that broker to become leader with an empty log, causing data loss.

Protocol Impact

Fetch v15 · AlterPartition v3

Details