krishvishal opened a new issue, #4416: URL: https://github.com/apache/iggy/issues/4416
### Description #4392 adds the consumer kind `ExternalGroup` (wire value 3). During a rolling upgrade from `server-0.9.0`, a new primary admits kind 3 (`fence_group_offset` in `core/server/src/namespace.rs`). A `server-0.9.0` backup fails `WireConsumer::decode` on it before it appends the prepare. That backup never sends `PrepareOk`, and journal repair fails on the op in the same way. With 2 of 3 replicas still on `server-0.9.0`, the partition stops committing. `core/server/README.md` tells operators to upgrade every server before any external group store, but nothing enforces it. The Kafka gateway stores kind 3 on every consumer offset commit, so one commit during an upgrade can stop a partition. Raised in the review of #4392. ### Affected area / component Iggy server ### Proposed solution Make each replica send its release, and let the primary refuse kind 3 until every replica runs a release that decodes it. The consensus headers have a `release` field, but nothing fills it yet. ### Alternatives considered Keep the rule in `core/server/README.md` as the only guard. Or add a cluster setting that allows kind 3 stores, and let the operator turn it on after the upgrade. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
