Is exactly once delivery actually possible in Kafka, and how would you achieve it in practice?

Exactly once delivery over a network is not possible, but exactly once processing is, within limits. Kafka gives you an idempotent producer plus transactions, so a read process write cycle within Kafka commits offsets and output atomically. End to end, you still need the sink to cooperate, either through a transactional write or an idempotent upsert on a stable key. In practice most teams get at least once plus idempotent sinks.

Strictly, no. You cannot guarantee exactly once delivery across an unreliable network, because an acknowledgment can always be lost and the sender has to choose between resending or dropping. What Kafka does give you is exactly once processing semantics within Kafka. The idempotent producer adds a producer id and sequence number so a retried send does not create a duplicate on the partition, and transactions let you commit your output records and your consumer offsets atomically, so a read process write topology does not double count on failure. The limit is scope. The moment you write to Postgres or S3, that write is outside the transaction. So what I actually build is at least once delivery with an idempotent sink, usually a merge on an event id or a natural key. On one clickstream pipeline we deduplicated on event_id with a seven day window, which was cheaper and easier to reason about than trying to make every hop transactional.