Build1 publisher2 min readPublished
Kafka share groups swap partition ownership for a 2,000-record lock budget
KIP-932 lets a group run more consumers than a topic has partitions by locking each record for 30 seconds and counting its deliveries. The idempotence, the retries and the lock sizing become the application's job.
The Engineer · Build desk

What happened
- KIP-932 share groups let a group run more consumers than the topic has partitions, with the broker feeding records from every partition to whichever member polls next.
- Each record is acknowledged individually with ACCEPT, RELEASE or REJECT, and the broker holds a lock on it and counts its deliveries until an answer comes back.
- Apache Kafka took the feature from early access in 4.0 in March 2025 to production ready in 4.2 in February 2026, with 4.2.1 fixing a critical deadlock.
- On Amazon MSK in September 2026 share groups are preview on Kafka 4.1.x Standard brokers, while the Kafka 4.2 line runs on Express brokers, which do not support KIP-932.
- Consuming from a share group needs the new protocol and the KafkaShareConsumer class, which today means a Java client at 4.1 or later or Spring for Apache Kafka at 4.0 or later.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Redelivery is automatic and consumers see no ordering between them, so the destination has to be idempotent and has to deduplicate work that a consumer group's committed offset handled for you.
- cost After five deliveries the broker archives the record, and any dead-letter queue is yours to build, so the failure path is application code you write and operate, or the record is gone.
- decision Consumers built on Kafka Connect or Kafka Streams cannot move, so the queue-like model is available only for the hops your own team wrote.
- capability Adding consumers no longer means repartitioning the topic, which removes the reason to size partition counts for peak consumption.
A share-partition does not track a committed offset. It keeps a window of records, each carrying its own state, and no partition rebalance happens when a member joins or leaves [6]. The broker locks a record for 30 seconds by default while a consumer works on it [10].
The budget is 2,000 unacknowledged records per share-partition, set by `group.share.partition.max.record.locks` and raised from 200 in Kafka 4.0 [8]. Divide that budget by the average time a record spends delivered and you have the group's throughput ceiling [9]. At 10 milliseconds of processing, one share-partition tops out near 200,000 records a second [1]. If the handler stalls until the lock expires, the same budget yields about 67 [2]. One default produces a factor of roughly 3,000 between the two answers. The only input that transfers from someone else's cluster is your own in-flight time [5]. A record that expires on every attempt holds its slot for up to 150 seconds across five deliveries [4].
The dev.to study lists what the application has to bring: an idempotent destination, per-record error handling, lock sizing, new metrics and new autoscaling rules, and it reports extra cost on the brokers as well [12]. A group takes 200 members by default and can be configured up to 1,000 [11]. The member cap is the ceiling on decoupling consumer count from partition count, and on a four-partition topic under a consumer group the fifth and sixth consumers receive nothing at all [19].
The study works from KIP-932 and the Apache Kafka 4.0-to-4.2 source, so it holds for any distribution that implements the protocol. For metrics, limits and availability it uses Amazon MSK as its managed reference [17]. Consumer groups are unchanged by any of this; a share group is a second model, chosen per group [18]. Where per-partition order is required, the study keeps the consumer group and its committed offset [7][21].
What to watch
- Whether Amazon MSK adds KIP-932 support to Express brokers, which is where its Kafka 4.2 line runs today.
- Progress on KIP-1302, the proposal that would let sink connectors consume from a share group.
- Whether managed distributions move off 4.1.x preview now that 4.2.1 has fixed the critical deadlock.