This page is meant as a template for writing a KIP. To create a KIP choose Tools->Copy on this page and modify with your content and replace the heading with the next KIP number and a description of your issue. Replace anything in italics with your own description.
Current state: Under Discussion
Discussion thread: here
JIRA: [KAFKA-19883]()
Please keep the discussion on the mailing list rather than commenting on the wiki (wiki discussions get unwieldy fast).
Ensure atomicity between share‑group acknowledgments and downstream side effects (e.g., Kafka transactions) so a record is either both processed and acknowledged or neither.
ACQUIRED.ACKNOWLEDGED (not redelivered) -> data loss.RecordStateSharePartition.acknowledge()Goal: Enable exactly-once read semantics via transactional acknowledgements.
We will be following the similar existing pattern we have in Kafka Producer Transactions.
- Apache Flink: Exactly-once checkpointing with Share Group sources
- Apache Spark: Structured Streaming with Share Group consumers
- Any coordinator-worker streaming framework requiring atomic acknowledgements
```
// When you have a producer and want atomic output + acks
producer.beginTransaction();
producer.send(output);
producer.sendShareAcksToTransaction(acks, groupId);
producer.commitTransaction();
```
```
// When there's no producer (Flink source, Spark source, pure consumer)
public class TransactionalShareAcknowledger implements Closeable {
public TransactionalShareAcknowledger(Map<String, Object> config);
public void initTransactions();
public void commitAcknowledgements(
Map<TopicPartition, List<ShareAcknowledgement>> acks, String groupId);
public void abortAcknowledgements();
public void close();
}
```
Internally, TransactionalShareAcknowledger is a thin wrapper around a KafkaProducer (or its TransactionManager). It use the exact same RPCs - InitProducerId, AddShareAcksToTxn, TxnShareAcknowledge, EndTxn.
No new server-side infrastructure needed.
```
// TransactionalShareAcknowledger — internally just wraps a KafkaProducer
TransactionalShareAcknowledger acknowledger =
new TransactionalShareAcknowledger(config); // config has transactional.id
acknowledger.initTransactions();
acknowledger.commitAcknowledgements(acks, shareGroupId); // begin+ack+commit in one call
```
Metric Type Description
share-transaction-active Gauge Active transactions
share-transaction-prepare-time-ms Histogram Prepare latency
share-transaction-commit-time-ms Histogram Commit latency
share-transaction-abort-total Counter Aborted transactions
share-transaction-timeout-total Counter Timed-out transactions
existing Kafka 2PC (TransactionState: ONGOING→PREPARE_COMMIT→COMPLETE_COMMIT)
- EMPTY -> ONGOING -> PREPARE -> ABORTED (abort after prepare)
- EMPTY -> ONGOING -> ABORTED (early abort)
Abort case:
This KIP reuses Kafka's existing two-phase commit protocol:
Transaction metadata stays in __transaction_state.
Share acks are written transactionally to __share_group_state using CoordinatorRuntime.scheduleTransactionalWriteOperation().
Failure Handling
existing TransactionCoordinator recovery
```
ShareAcknowledgeTransactionalRequest => GroupId TransactionId [Topics]
GroupId => STRING
TransactionId => STRING
Topics => TopicId [Partitions]
Partitions => Partition [AcknowledgementBatches]
AcknowledgementBatches => FirstOffset LastOffset AcknowledgeType
```
Use existing InitProducerIdRequest
Use existing EndTxnRequest
Handled by existing WriteTxnMarkersRequest (inter-broker) and EndTxnRequest(ABORT)
```
AddShareAcksToTxnRequest => TransactionalId ProducerId ProducerEpoch GroupId [Topics]
TransactionalId => STRING
ProducerId => INT64
ProducerEpoch => INT16
GroupId => STRING
Topics => TopicName [Partitions]
Partitions => INT32
```
This is the exactly-once guarantee: either both output AND acks commit, or neither does:
```
KafkaShareConsumer<K, V> consumer = new KafkaShareConsumer<>(props); // NOT transactional
KafkaProducer<K, V> producer = new KafkaProducer<>(props); // transactional.id
producer.initTransactions();
while (true) {
ConsumerRecords<K, V> records = consumer.poll(...); // ← just reads, not transactional
producer.beginTransaction();
for (var record : records) {
producer.send(new ProducerRecord<>("output", transform(record)));
}
producer.sendShareAcksToTransaction(buildAcks(records), "my-share-group"); // transactional write
producer.commitTransaction();
// Atomically: output records committed + share acks committed
// If abort: output rolled back + acks discarded → records return to AVAILABLE
}
```
In the existing consumer group CTP pattern, the same thing happens (in the above code instead of KafkaShareConsumer, use KafkaConsumer and Consumer offsets to __consumer_offsets).
If abortTransaction() is called (or the transaction times out):
```
// Flink ShareGroupSource connector — on checkpoint complete
class FlinkShareGroupSourceReader implements SourceReader<...> {
private TransactionalShareAcknowledger acknowledger;
private List<ShareAcknowledgement> pendingAcks;
void open() {
acknowledger = new TransactionalShareAcknowledger(config);
acknowledger.initTransactions();
}
void snapshotState(long checkpointId) {
// Save pending acks to checkpoint state
}
void notifyCheckpointComplete(long checkpointId) {
// Atomically commit acks for this checkpoint
acknowledger.commitAcknowledgements(pendingAcks, shareGroupId);
}
}
```
- No breaking changes for existing Share Group users
- `transactional` mode is opt-in via `share.acknowledgement.mode` config
- Existing `implicit` and `explicit` modes continue to work unchanged
1. Phase 1: Add `transactional` acknowledgement mode (backward compatible)
2. Phase 2: Streaming frameworks (Flink, Spark) implement transactional sources
3. Phase 3: Documentation and best practices for exactly-once semantics
- No deprecation of existing modes planned
- `transactional` mode recommended for exactly-once use cases
- Transaction state machine transitions
- Idempotency of all transaction operations
- Timeout handling and auto-abort
- Record state transitions (ACQUIRED → ACKNOWLEDGED on commit, ACQUIRED → AVAILABLE on abort/timeout)
- End-to-end transaction commit/abort flows
- Multi-consumer transactions within same group
- Coordinator failure and recovery
- Network partition scenarios
- Flink checkpoint integration with transactional Share Groups
- Exactly-once delivery verification under failures
- Performance benchmarks comparing transactional vs non-transactional modes
- Stress testing with concurrent transactions
- Broker failure during PREPARE state
- Coordinator crash before/after prepare
- Consumer crash during transaction
- Network partitions between coordinator and brokers
If there are alternative ways of accomplishing the same thing, what were they? The purpose of this section is to motivate why the design is the way it is and not some other way.