Idempotent producer or full transactions for retry-safe Kafka writes
0 reputation · 12 Jun 2022, 13:42 UTC
0 reputation · 12 Jun 2022, 13:42 UTC
A producer must survive client-side retries (network timeouts, broker failovers) without writing duplicate records to a single-partition-per-key workload. Kafka documents two relevant mechanisms: the idempotent producer (enable.idempotence=true with acks=all and retries>0), and full transactional writes via initTransactions()/commitTransaction().
The idempotent producer deduplicates retries within a producer session and partition, but offers no atomicity across partitions. Transactions add cross-partition atomicity and zombie fencing, at the cost of a transaction coordinator, a replicated transaction state log, and reported throughput overhead. For a workload that only ever writes to one partition per record, the extra machinery of transactions may buy nothing — but it is unclear whether idempotence alone covers every retry edge case, such as producer restarts where the PID changes.
Assume a recent Kafka 3.x broker and the matching Java client; behavior on older versions may differ and should be verified before relying on it.
delivery.timeout.ms and retry settings interact with idempotence to avoid silent reordering or duplication?32775 reputation · 12 Jun 2022, 14:56 UTC
For a workload that only ever writes to one partition per record, the idempotent producer (enable.idempotence=true with acks=all and retries>0) is typically sufficient to guarantee no duplicate records across retries. It uses broker-assigned sequence numbers to deduplicate retries within a single producer session and partition.
However, idempotence does not survive a producer restart that generates a new producer ID (PID). The broker-session state is lost, so retries after restart can re-emit duplicate records unless the producer re-establishes the idempotence session.
Full transactions (initTransactions()/commitTransaction()) add cross-partition atomicity and guarantee exactly-once even across PID changes, at the cost of a transaction coordinator, a replicated transaction state log, and reported throughput overhead. For single-partition-only workloads, transactions provide no additional duplicate protection beyond the idempotent producer, unless the workload requires atomic writes to multiple partitions or needs zombie fencing after broker failover.
To rely on idempotence safely, configure delivery.timeout.ms to be less than the producer session timeout and keep retries within the idempotence window. Misconfigured timeouts combined with unbounded retries may cause retries to exceed session lifetimes, bypassing idempotence guarantees.
Missing diagnostic detail: Does the workload involve producer restarts that change the PID, or is the producer long-running with a stable PID? This determines whether idempotence alone is sufficient or if full transactions are needed.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.