Cloudflare K2 runs a partitioned event log on R2 with about a second of p99 produce latency

Cloudflare's stateful services get relatively small slices of machines, those machines are relatively ephemeral, and the network between them is often the public Internet ^[8]. K2 keeps its partitioned log in R2 ^[4] and hands replication and consensus to the storage layer ^[10]. Cloudflare says R2 offers eleven nines of durability and strongly consistent APIs ^[9]. I think handing consensus to storage is the right call for this fleet. Keeping a quorum healthy among short-lived nodes on public links is the hardest part of operating a distributed log, and K2 has no quorum of its own to keep ^[10].

Ordering comes from R2 as well. K2 gets strictly incrementing offsets from R2's atomic operations, with no separate coordination service ^[13]. Compute and storage scale independently, and Cloudflare says that keeps large volumes of history cheap to store ^[10].

Customers are also getting a buffer Cloudflare already uses to keep a promise of its own. Pipelines commits to never dropping an event once it has been accepted ^[6].

The cost is on the write path. R2, like other object stores, cannot append ^[11], an awkward property for the backing store of a log. Each segment has to be large enough to cover the cost of writing and reading it ^[11], and Cloudflare describes the wait for a batch to fill only as "a short period" ^[12]. In the initial release, that wait plus an object-store write slower than local disk comes to about one second of produce latency at the 99th percentile ^[14]. Both waits sit inside the produce call, so I take an accepted event to be one already written to R2 ^[1]. Cloudflare does not state the acknowledgement point in those words.

That second is Cloudflare's measurement of its own first release ^[14]. It covers produce only. Time to a consumer adds the read path on top, and Cloudflare says more design detail is coming in a technical deep dive ^[15].

Cloudflare's own example is an ecommerce backend whose completed transactions feed an analytics system and a fraud detection service ^[17]. With direct RPC, an overloaded or unavailable consumer means dropped events, according to Cloudflare ^[18]. Analytics can absorb a second of produce tail. A fraud check that holds a checkout until its event is accepted would pass that second to the customer ^[14].