Page History

...

...

An operator can grant ClusterMirror:*:CREATE,ALTER,DESCRIBE for full mirror management, or scope it to specific mirrors like ClusterMirror:prod-dr:DESCRIBE for read-only monitoring of a single mirror, without granting any broker-level privileges.

Inter-broker coordinator RPCs (WriteMirrorStates, ReadMirrorStates, LastMirroredEpochs, BumpLeaderEpochs, and FindCoordinator) require CLUSTER_ACTION on the Cluster resource, as they are only issued by the broker service account.

CreatePartitions, OffsetCommit, IncrementalAlterConfigs, CreateAcls, and DeleteAcls are issued internally by MMM through the inter-broker channel or direct coordinator calls, bypassing normal ACL checks. No explicit ACL grants are needed for these operations.

Idempotent Producer

The approach is to proactively expire the stale producer state on failover. The key insight is that, during mirroring, the destination partition is read-only: no local producers exist, so all ProducerStateManager (PSM) entries originate from mirrored data. When mirroring stops, all PSM entries are stale and can be safely expired. Records from the source are stored as-is on the destination, with no PID modification, which otherwise would require a checksum recalculation. A MIRROR_PID_RESET control record (type 7) is written to each destination partition's log during the STOPPING state transition, after the fetcher has been removed and truncation to LSO is completed, but before the partition becomes writable.

...

...