Why is RF=3 with min.insync.replicas=2 the standard durable configuration, rather than RF=3/min.isr=3 or RF=2/min.isr=2?

## The design goal A production Kafka cluster wants three things simultaneously: (1) **no data loss** when a single broker fails, (2) **continued write availability** during that single failure or a routine rolling restart, and (3) reasonable cost (replicas consume disk and network). The standard answer that balances all three is **RF=3, min.insync.replicas=2, acks=all**. ## Definitions - **Replication factor (RF)**: total copies of each partition. RF=3 means three brokers each hold a full copy. - **min.insync.replicas (floor)**: minimum in-sync copies required for an `acks=all` write to be accepted. - A write is **committed** (durable, visible to consumers) only once it is on every member of the current ISR, and the ISR must be at least the floor. ## Comparing the configurations **RF=3 / min.isr=2 (the standard):** - Healthy ISR = 3. - One broker fails or is restarted -> ISR = 2 = floor -> writes continue, every committed record is on >= 2 brokers. - Two brokers fail -> ISR = 1 < floor -> writes block (durability preserved by refusing), reads continue. - Tolerates **one** failure for writes, **two** failures without data loss for already-committed records (they survive on the one remaining copy, but new writes are blocked). **RF=3 / min.isr=3:** - Same 3 copies, but the floor equals RF. The ISR has **no headroom**. - Any single replica leaving the ISR (a crash, GC pause, or even a planned rolling restart) drops ISR to 2 < 3 -> all `acks=all` writes block. - Maximum durability per committed write, but operationally fragile: you cannot patch or restart a broker without write downtime. Generally over-strict. **RF=2 / min.isr=2:** - Only 2 copies, floor = RF, again no headroom. - One broker down -> ISR = 1 < 2 -> writes block. So you've paid for replication but still lose write availability on a single failure. - And because there are only two copies total, you're one bad disk away from a single-copy situation. **RF=2 / min.isr=1** is sometimes seen but is weak: it's effectively `acks=1` durability since the floor allows the ISR to be just the leader. ## The N / N-1 principle The rule of thumb is **floor = RF - 1**. With RF=3 that's a floor of 2. This gives you exactly one unit of slack: one replica can be absent (failure or maintenance) while writes continue with the durability guarantee intact. Going to RF=5/min.isr=3 follows the same spirit with more slack (tolerate two failures) at higher cost — common for the most critical clusters and for internal topics like the consumer-offsets topic. ## Interaction with unclean leader election For this contract to actually hold, **`unclean.leader.election.enable=false`** (the modern default) must be set. If unclean election were enabled, an out-of-sync replica could become leader and silently truncate committed records, defeating the whole point of the floor. RF=3/min.isr=2 assumes clean elections only. ## Summary table - RF=3/min.isr=2: 1 failure tolerated for writes, dual-copy durability, supports rolling restarts. Standard. - RF=3/min.isr=3: 0 failures tolerated for writes, fragile, over-strict. - RF=2/min.isr=2: 0 failures tolerated, no spare copy. Wasteful.