min.insync.replicas Floor by Tenant Tier

min.insync.replicas floor is tied to tenant-tier: free >= 1, paid >= 2, enterprise >= 2 with RF >= 3.

Rationale

Durability is a paid feature on shared infrastructure. Free tenants get best-effort (min.insync.replicas=1, which accepts writes during single-broker outage); paid and enterprise get the durability floor the starter's isr-alignment policy expects. Selling durability as a tier matches the standard tiered model for managed Kafka.

Pattern

min.insync.replicas >= floor(tenant-tier)

Examples

tenant-tier: free + RF=2 + min.insync.replicas=1

tenant-tier: enterprise + RF=3 + min.insync.replicas=2

tenant-tier: paid + RF=3 + min.insync.replicas=1

tenant-tier: enterprise + RF=2 + min.insync.replicas=2 (RF below enterprise floor)

Parameters

Name	Default	Description
`free_min_isr`	`1`	Floor for min.insync.replicas on tenant-tier=free.
`paid_min_isr`	`2`	Floor for min.insync.replicas on tenant-tier=paid.
`enterprise_min_isr`	`2`	Floor for min.insync.replicas on tenant-tier=enterprise.
`enterprise_min_rf`	`3`	Floor for replicationFactor on tenant-tier=enterprise.

Governs

This policy relates to the following Kafka configuration keys:

Implementation

Drop this YAML into Conduktor Console as a ResourcePolicy, then link it from an ApplicationInstance, Application, or KafkaCluster.

Conduktor ResourcePolicy

# Conduktor self-service ResourcePolicy
# Schema: https://docs.conduktor.io/platform/reference/resource-reference/self-service/#resourcepolicy
# Composes with the starter isr-alignment policy (RF-1 convention) — this policy
# adds a tier-aware FLOOR; isr-alignment adds the RF-relative CEILING.
---
apiVersion: self-serve/v1
kind: ResourcePolicy
metadata:
  name: tenant-min-insync-by-tier
spec:
  targetKind: Topic
  description: min.insync.replicas floor scales with tenant-tier (free 1, paid 2, enterprise 2 with RF >= 3)
  rules:
    - condition: '"tenant-tier" in metadata.labels && metadata.labels["tenant-tier"] in ["free", "paid", "enterprise"]'
      errorMessage: "metadata.labels.tenant-tier must be one of free, paid, enterprise"
    - condition: '"min.insync.replicas" in spec.configs && ((metadata.labels["tenant-tier"] == "free" && int(string(spec.configs["min.insync.replicas"])) >= 1) || (metadata.labels["tenant-tier"] == "paid" && int(string(spec.configs["min.insync.replicas"])) >= 2) || (metadata.labels["tenant-tier"] == "enterprise" && int(string(spec.configs["min.insync.replicas"])) >= 2 && spec.replicationFactor >= 3))'
      errorMessage: "min.insync.replicas (and RF for enterprise) below the tenant-tier floor (free>=1, paid>=2, enterprise>=2 with RF>=3)"

Related policies

Try Conduktor Console

Enforce policies like this across your team — central audit history, pre-commit guardrails, ApplicationInstance bindings. 5-min Docker install.

Get Started →