Enterprise overview
Kafka Backup Enterprise extends the open-source backup and restore engine with schema recovery, enterprise authentication, erasure suppression and permission recovery. You run the CLI or container in your infrastructure and choose the backup storage.
Enterprise 0.8.0 adds mapped permission recovery and durable evaluation-state controls to the 0.7 feature set. A licence entitlement does not make an unfinished feature available. Use the released version's configuration reference and rehearse recovery against a disposable destination.
What is included
| Capability | Open source | Enterprise |
|---|---|---|
| Kafka records, topic configuration and consumer-offset recovery | Yes | Yes |
| S3, Azure, GCS and filesystem storage | Yes | Yes |
| Point-in-time and three-phase restore | Yes | Yes |
| Kafka SASL/TLS authentication | Yes | Yes |
| Confluent Schema Registry backup and restore | — | Released, with documented strategy and framing limits |
| Apicurio Registry v2/v3 backup and restore | — | Released, with documented API-generation and format limits |
| OAuth for Kafka and Schema Registry | — | Released |
| Restore-time erasure suppression | — | Released |
| Confluent Platform MDS role-binding capture | — | Released; legacy exports are not complete recovery inputs |
| Confluent CSFLE/DEK metadata backup | — | Released; does not encrypt plaintext records or backup segments |
| MSK ZooKeeper-to-KRaft migration tooling | — | Released |
| Mapped RBAC and Kafka ACL recovery | — | Released in 0.8.0; explicit mappings, additive apply and verification |
| Data masking, general audit logging and WASM transformations | — | Planned |
| Commercial support | Community | Priority support |
Recover schemas alongside records
Capture schemas, versions, references and registry settings. Restore Confluent schemas before Kafka records, either preserving IDs where supported or allocating destination IDs and rewriting supported record framing. Apicurio archive preservation requires a complete archive, an empty target and a compatible API generation.
Registry recovery has explicit constraints. Rule-bearing Kafka replay, including CSFLE ENCRYPT replay, is unsupported. A metadata backup does not prove that an application can decrypt recovered records. Review the exact provider, version, serializer and destination strategy in the Schema Registry restore guide.
Use enterprise authentication
Enterprise 0.7 adds OAuth for Kafka and Schema Registry, including OIDC client credentials, Azure managed identities and workload identity. Configure source and destination identities explicitly. See the Confluent Cloud and Azure OAuth guide.
Respect erasure during recovery
Apply an erasure list when restoring records. Matching keys can be dropped or tombstoned; reports record suppression counts and the applied list's checksum. An unavailable configured list refuses the restore. This is restore-time suppression, not rewriting retained backup files or crypto-shredding.
Configure erasure suppression.
Preserve permission and encryption metadata
Legacy MDS capture exports Confluent Platform role bindings. Its unversioned exports cannot establish completeness and require fresh capture for recovery. Keep externally provisioned bootstrap administration and a separate record of required access. Read the capture boundaries.
The 0.8.0 authorization workflow captures versioned permission snapshots, maps existing destination identities and scopes, applies additive assignments, and verifies destination state. It is qualified on Platform 7.6.0 and 8.3.1 and within one Cloud organisation for service-account principals; see the guide for scope and transport limits. Follow the recovery rehearsal guide.
CSFLE metadata backup captures KEK references, encrypted DEKs, subjects and schema encryption rules. It does not export KMS master keys or add field encryption to records. See encryption metadata backup.
Migration remains included
MSK migration tooling provides a journalled source-to-destination workflow, consumer-offset translation, controlled cutover and signed migration evidence. It is one capability within Enterprise. Review your provider's native migration options and compare them with your topology and continuity requirements.
Evaluate before purchasing
The binary includes a fourteen-day evaluation of all shipped Enterprise features with no signup or credit card. Start with one topic, schema and application; independently check the recovered data and expected access. Keep trial state and backup storage durable across process and container restarts.
- Install a pinned public release.
- Follow the evaluation guide.
- Review current subscription terms at the Enterprise portal.
- Apply a commercial licence file to continue after evaluation.
Commercial licences cover your Kafka clusters without per-cluster licence charges and verify offline. Requested licensed operations can refuse when their entitlement is unavailable; do not assume a backup silently completes every configured Enterprise component. See licensing.