A controller failure occurs when a Kafka controller becomes unavailable or stops participating in controller coordination. Because controllers manage metadata, leadership elections, partition assignments, ACLs, consumer groups, and transaction states, failure can halt cluster coordination even while brokers continue storing and serving data. section 9.1.3 section 9.5
When the leader controller fails, follower controllers stop receiving fetch responses within controller.quorum.fetch.timeout.ms and enter the candidate state. Candidates exchange vote requests containing replicated metadata-log information; the candidate with a majority becomes leader. Before serving, the new leader verifies and completes its committed metadata state. section 9.1.3
The failure has several operational consequences:
- Brokers use their configured controller.quorum.voters list to locate the newly elected controller and refresh their metadata state. section 9.1.3
- Quorum sizing determines tolerance: tolerating N controller failures requires 2N + 1 controllers, preserving a majority of N + 1. section 9.5
- Without a majority quorum, leader elections and metadata changes halt, making controller availability a high-availability and incident-playbook concern. section 9.5
Leader-controller failover
A follower stops receiving the leader's fetch response within the configured timeout, begins an election, and wins a majority vote. It synchronizes missing committed metadata entries before accepting broker metadata requests. section 9.1.3
