Scenario 09.1.4 · 2-DC freeze

Kafka in two DCs without a witness: KRaft quorum is lost

Disaster recovery · Advanced · about 3 min · Apache Kafka 4.3

No witness: an even 2-voter split loses quorum, so leader election freezes until the network heals.

What you start with

Two data centres, one controller voter each, and no third-site witness. When the link between them fails, the voters split 1-1 - neither side holds a majority of the 2-voter quorum - so no controller can be elected. We partition the DCs and then hard-kill a broker to show leader election stays frozen until the network heals.

Step by step

1. 2-DC cluster ready - 2 voters, no witness t+0.000s Open at this step: step 1, 2-DC cluster ready - 2 voters, no witness
2. Record committed across DC-A + DC-B t+3.050s Open at this step: step 2, Record committed across DC-A + DC-B
3. DCs split - even 2-voter split, NO majority → quorum LOST t+8.050s With only c-a and c-b, an even split has no voter majority: activeController becomes undefined and the control plane freezes. Open at this step: step 3, DCs split - even 2-voter split, NO majority → quorum LOST
4. broker-1 (DC-A) killed - partition leaderless, election FROZEN t+12.000s No active controller can elect a new leader; the partition stays leaderless. Open at this step: step 4, broker-1 (DC-A) killed - partition leaderless, election FROZEN
5. Network healed - quorum returns, leader moves to broker-2 (DC-B) t+15.000s Contrast with the 2.5-DC scenario, whose witness keeps a majority through the same split. Open at this step: step 5, Network healed - quorum returns, leader moves to broker-2 (DC-B)

The takeaway

An even number of voters across two sites has no tiebreaker: a clean split loses quorum and freezes elections. A third-site witness (the 2.5-DC pattern) is what keeps a two-DC deployment available.

Embed this scenario

Paste this into a blog post, a course page or your team's docs. The scenario plays inside your page, and the link under it points readers to this walkthrough.

<iframe src="https://monedula.dev/kafka-simulator/embed/?scenario=09.1.4" title="Kafka Simulator: 2-DC freeze" width="100%" height="520" style="border:1px solid #d0d0d0;border-radius:8px" loading="lazy"></iframe>
<p><a href="https://monedula.dev/kafka-simulator/scenarios/2dc-freeze/">Kafka in two DCs without a witness: KRaft quorum is lost</a></p>

Further reading

Apache Kafka documentation

More in Disaster recovery

• Kafka stretched cluster across two data centers
• 2.5-DC Kafka stretched cluster with a witness site
• 3-DC Kafka cluster: the KRaft quorum survives losing a site
• Kafka data center failure: leader failover to the other DC
• Kafka network split inside one DC: ISR drops to the floor
• Kafka MirrorMaker 2 active-passive DR and replication lag
• Kafka DR failover with MirrorMaker 2: measuring RPO
• Active-active Kafka with MirrorMaker 2 and region topics
• MirrorMaker 2 offset translation for Kafka consumer failover
• Kafka failback after a MirrorMaker 2 DR failover
• Active-active Kafka DR drill: move clients to the survivor
• Confluent MRC observers: Kafka replicas outside the ISR
• Kafka observer lag in Confluent Multi-Region Clusters
• Kafka observer promotion in Confluent Multi-Region Clusters
• Confluent MRC observer promotion: losing the Kafka leader DC
• Kafka replica placement: durability vs latency across DCs
• Confluent Cluster Linking: offset-preserving Kafka mirroring
• Kafka mirror topics (Confluent): read-only until promoted
• Cluster Linking vs MirrorMaker 2 for Kafka replication
• Kafka consumer offset sync: Cluster Linking vs MirrorMaker 2
• Kafka failover and failback with Confluent Cluster Linking

All scenarios