Why should you configure min.insync.replicas alongside acks=all?

acks=all on its own only says the producer waits for acknowledgment from whatever the current in-sync replica (ISR) set happens to be — it doesn't set a floor on how large that set needs to be. If the ISR has shrunk down to just the leader (every follower has fallen behind or failed), acks=all with no further constraint is satisfied by that single replica acknowledging, which offers no more durability than acks=1 in that degraded state.

# topic config
min.insync.replicas=2

# producer config
acks=all

min.insync.replicas sets the actual floor: if the ISR set is smaller than this number when a produce request with acks=all arrives, the broker rejects the write with a NotEnoughReplicasException instead of silently accepting it with weaker durability than intended. The combination — acks=all plus min.insync.replicas=2 on a replication-factor-3 topic, for example — is the standard pattern for guaranteeing a write survives the loss of any single broker, at the cost of the producer getting explicit failures during a broader outage rather than silently accepting weaker guarantees.