Add support for broker demotion - #191
Conversation
bbb1dc1 to
7fc8acd
Compare
Signed-off-by: Kyle Liberti <kliberti.us@gmail.com>
7fc8acd to
abb52f1
Compare
see-quick
left a comment
There was a problem hiding this comment.
Thanks for the proposal, I think it looks good, just a few nits/questions...
Out of curiosity, I didn't find it in the proposal but what happens when demotion is in progress but target broker fails in the middle of operation?
Signed-off-by: Kyle Liberti <kliberti.us@gmail.com>
|
Thanks for the review @see-quick
I just added this note to the Validation and constraints section of the proposal: "If a target broker fails while leadership is being transferred to it, all demotion operations involving that broker are aborted, and the source brokers remain the leaders for the affected partitions. |
d308e3a to
07cf465
Compare
Signed-off-by: Kyle Liberti <kliberti.us@gmail.com>
7d66426 to
f2f77b9
Compare
tinaselenge
left a comment
There was a problem hiding this comment.
Thanks for the proposal. Overall, it looks good to me. I left a few comments to clarify.
| | brokers | integer array | List of ids of broker to be demoted in the cluster. | | ||
| | concurrentLeaderMovements | integer | Upper bound of ongoing leadership swaps. Default is 1000. | | ||
| | skipUrpDemotion | boolean | Whether to skip demoting leader replicas for under-replicated partitions. | | ||
| | excludeFollowerDemotion | boolean | Whether to skip demoting follower replicas on the broker to be demoted. | |
There was a problem hiding this comment.
what does demoting follower replicas mean?
There was a problem hiding this comment.
It moves the ids of the demoted brokers to the end of the replica lists.
| # Broker demotion support via KafkaRebalance resource | ||
|
|
||
| This proposal extends the `KafkaRebalance` custom resource to support broker demotion by integrating with Cruise Control's `/demote_broker` endpoint. | ||
| This would allow users to demote brokers, removing them from partition leadership eligibility, in preparation for maintenance, decommissioning, or other operational needs. |
There was a problem hiding this comment.
How does this work? I get it that it removes them from partition leadership. But how does it ensure they are not eligible to become leaders again?
There was a problem hiding this comment.
Cruise Control has the broker ids marked as ineligible in memory and moves the broker ids to the end of the replica lists, then triggers a leadership election. Since leadership election prioritizes choosing the first broker id of the replica list (the preferred leader) as the leader, the demoted brokers are less likely to be elected as leaders.
But how does it ensure they are not eligible to become leaders again?
If a rebalance or demotion request is made the broker ids marked as ineligible in memory are excluded from having partitions moved to them or being listed first in the replica lists.
There was a problem hiding this comment.
What happens when CC pod is restarted (upgrade, migration to different node, etc).? User will have to trigger "rebalance" proposal and approval to refresh in-memory data?
There was a problem hiding this comment.
At this time yes, to refresh the in-memory demotion data after Cruise Control pod restart, a user would have to trigger another KafkaRebalance demotion request.
| **NOTE**: As part of this proposal, we will also add a `excludeRecentlyDemotedBrokers` field for the `full`, `add-brokers`, and `remove-brokers` KafkaRebalance modes to give users the ability to prevent to leader replicas to be moved to recently demoted brokers. | ||
| When `excludeRecentlyDemotedBrokers` is set to `true`, a broker is considered demoted for the duration specified by the Cruise Control `demotion.history.retention.time.ms` server configuration. | ||
| By default, this value is 1209600000 milleseconds (14 days) but is configurable in the `spec.cruiseControl.config` section of the `Kafka` custom resource. |
There was a problem hiding this comment.
How does this work? Where is the information about the demotion work?
There was a problem hiding this comment.
Cruise Control stores the demotion information in memory (yes this is far from ideal). Cruise Control will make sure the ids of the demoted brokers are in the end of the replica lists and will exclude the brokers from being considered for partition movement when generating optimization proposals.
|
|
||
| The implementation includes the following validation: | ||
|
|
||
| * When `demote-brokers` mode is specified, the `brokers` field must be provided. |
There was a problem hiding this comment.
Will it be validated only in the broker code or also with CEL?
There was a problem hiding this comment.
Was originally planning on validating the field in the operator code but this may change depending on the proposal surrounding the API changes discussed #191 (comment).
I'll link the separate proposal here when I have a draft ready and we can pick this up once that proposal and its implementation is sorted.
Signed-off-by: Kyle Liberti <kliberti.us@gmail.com>
Signed-off-by: Kyle Liberti <kliberti.us@gmail.com>
|
Thanks everyone for the reviews! I am putting this proposal on hold temporarily as we address some of the API concerns raised in the thread here: #191 (comment). We need devise a better path forward for the parameters that are used in conjunction with I am going to draft a separate proposal for those API changes and link it here. Once that proposal and its implementation is complete, we can continue this broker demotion proposal with a cleaner, more maintainable foundation. |
Signed-off-by: Kyle Liberti <kliberti.us@gmail.com>
Opened a draft proposal for the |
b059881 to
146e85f
Compare
Signed-off-by: Kyle Liberti <kliberti.us@gmail.com>
146e85f to
cf20628
Compare
|
This proposal has been updated with the new KafkaRebalance API design as specified in the accepted proposal: #216), is unblocked, and ready for review! |
Related problem
When preparing to remove or decommission brokers from a Kafka cluster there is currently no built-in way to ensure those brokers are first demoted (no longer eligible to act as partition leaders). This can result in partitions becoming temporarily unavailable or degraded when those brokers are taken offline, especially in clusters with uneven leadership distribution. Having a mechanism to programmatically demote brokers would allow for safer, more predictable operations during maintenance or scaling events.
Suggested solution
This feature would extend the KafkaRebalance resource to leverage Cruise Control’s
/kafkacruisecontrol/demote_brokerendpoint [1], allowing users to specify a list of brokers to be demoted. This would trigger the migration of partition leadership away from those brokers in preparation for decommissioning or maintenance.Addresses issue discussed here [2]
[1] https://github.com/linkedin/cruise-control/wiki/REST-APIs#demote-a-list-of-brokers-from-the-kafka-cluster
[2] strimzi/strimzi-kafka-operator#11907