Choosing a Cutover Model

The cutover model is chosen on a selector bar at the top of the cutover cockpit (the Monitor tab). It is a two-axis choice: a granularity and an order. Together they determine how applications move and what downtime or data-loss tradeoff you accept. The default is Coordinated stop, Rolling. Changing the cutover model requires the JobCutover permission.

Tip

The model is advisory — the gates and step strip re-derive from live signals — so it stays editable live throughout cutover. It locks only once the switchover finishes (Completed); the server rejects a model change on any terminal job (Completed or Failed) with a conflict. Note that Failed here is the provisioning-failure state, which occurs before cutover begins — so a provisioning-Failed job never reaches the cockpit and has no model selector to lock. A mid-cutover model change is recorded in the audit trail. The one unsafe change is guarded: see the drain gate caution below.

Granularity

How many applications you switch at once.

Granularity	Behaviour
Big bang	Switch all applications at once. The topic selection is locked to the whole set; the sidebar cannot deselect topics.
Rolling	Switch in waves, per topic or per application. You choose which topics to include in each wave from the sidebar.

Order

The sequence in which producers and consumers move.

Order	Behaviour	Tradeoff
Coordinated stop	Pause source producers, drain source consumers to zero lag, seed destination offsets, then start producers and consumers on the destination.	Brief producer downtime for zero data loss.
Producers first	Cut producers to the destination first, let existing consumers drain the source tail, and once source consumer lag is zero, cut consumers to the destination.	Zero producer downtime, with transient consumer lag while draining.

Tip

The dangerous replication orderings (consumers-first) are intentionally not offered for switchover, because moving consumers before the source has drained abandons unconsumed records. Gateway-assisted cutover is shown as a disabled, future option.

The Producers-First Drain Gate

When you choose Producers first, the cockpit enforces a drain gate: the consumer-cutover step stays locked until source consumer lag reaches zero. This guarantees existing consumers finish reading the source tail before they move, so no records are abandoned.

Caution

Switching away from Producers first to Coordinated stop mid-cutover, while the source still has unconsumed messages, removes the drain gate. Consumer groups moved before they finish draining abandon those messages — a switchover copies no data, so they cannot be read on the destination. The cockpit warns and asks you to confirm before allowing this change.

With the model chosen, proceed to Beginning Cutover.