Deployment architecture — multi-region DR

RPO is the maximum tolerable data loss, measured in time. An RPO of 5 minutes means that you may lose up to the last 5 minutes of events. RTO is different. RTO is the tolerable downtime.

Source: https://kafka.apache.org/documentation/#georeplication

Async replication copies data after the source has written it, so there is always some lag. You lose whatever has not replicated when the source dies. That lag is the RPO. RPO ≈ 0 needs a synchronous (stretched) design.

Source: https://kafka.apache.org/documentation/#georeplication

The passive region is kept warm, so the recovery time is mostly the cutover. You redirect producers and consumers to the target, translate consumer offsets, and resume. More automation ⇒ lower RTO.

Source: https://kafka.apache.org/documentation/#georeplication-mirrormaker

The DefaultReplicationPolicy adds the source alias as a prefix to mirrored topics (us-east.orders). In active/active setups especially, this stops data from looping back and forth between clusters.

Source: https://kafka.apache.org/documentation/#georeplication-mirrormaker

A stretched cluster replicates synchronously across regions (acks=all). A committed write is therefore already in both regions, so RPO ≈ 0. The price is a higher write latency and the need for an odd number (>=3) of failure domains to keep quorum.

Source: https://kafka.apache.org/documentation/#basic_ops_racks

Offsets are different in each cluster. The offset-sync and checkpoint topics of MM2 (or the preserved offsets of Cluster Linking) let a failed-over consumer resume where it stopped. Without translation, it would read records again or skip records.

Source: https://kafka.apache.org/documentation/#georeplication-mirrormaker

KRaft (and replication) quorum needs a majority. With two regions, the loss of one leaves half of the nodes. This is not a majority, so the cluster cannot elect a controller. Use >=3 failure domains.

Source: https://kafka.apache.org/documentation/#basic_ops_racks

MM2 is a mirror based on Connect that consumes and then produces. The target offsets are different, so they need translation. Cluster Linking preserves offsets byte-for-byte and needs no separate Connect cluster. Both are asynchronous.

Source: https://kafka.apache.org/documentation/#georeplication