pub fn decode_committed_value(
value: &[u8],
image: &MetadataImage,
offset: i64,
) -> Result<Option<MetadataRecord>, MetadataReplayError>Expand description
Decodes the committed metadata value at offset against image.
Every controller replay path reads it so: live apply, restart recovery, the downgrade-snapshot rebuild and the leader’s walk of an earlier epoch’s tail.
Bytes that are not a metadata record this build reads are a
MetadataReplayError::UndecodableRecord, and the caller stops the
controller. Kafka’s controller cannot replay such a record either:
MetadataRecordSerde throws on it, and QuorumController and the
controller-role MetadataLoader hand the throw to a fatal fault handler
(SharedServer.fatalQuorumControllerFaultHandler and
SharedServer.metadataLoaderFaultHandler, whose fatal is
processRoles.contains(ProcessRole.ControllerRole)). The snapshot reader
refuses the same bytes, so a snapshot and the log it replaces agree.
An empty KIP-835 NoOpRecord is Ok(None): it changes nothing.
A record that decodes but names a topic, partition or ACL the image does
not hold is Ok(None): the caller skips it, as it skips a record that fails
MetadataImage::validate. Kafka never commits such a record, because its
active controller replays each record before it appends it. A krabka leader
checks a write against its committed image, so a write can lose a race to an
earlier one still in flight (a partition change behind the deletion of its
topic). Every replica then decodes the same bytes against the same image
and skips the same record, so the replicas agree. Stopping on it instead
would stop every controller on a race a client can cause.
TranslateError::InvalidReference is one of those image lookups (an
unknown partition, a directory list measured against the image’s replicas)
and is skipped too. TranslateError::InvalidValue is decided by the bytes
alone (an unknown fenced or leader_recovery_state value, an integer out
of range) and is undecodable, as are the krabka-private record errors
(UnknownPrivateTag, UnknownPrivateRecordVersion, PrivateTagMismatch,
TrailingPrivateRecordBytes): only the image-resolution errors below are
skips.
§Errors
MetadataReplayError::UndecodableRecord as above.