Back up Confluent Platform to object storage
Confluent Platform is a self-managed Kafka distribution with a strong operational toolset. OSO Kafka Backup connects to it as an ordinary Kafka client — no Confluent-specific integration needed — and streams compressed topic records, consumer group offsets, and configuration into S3, Azure Blob, or GCS, then restores any of it to a precise moment in time.
Works with any Confluent Platform cluster
Confluent Platform speaks the same Kafka protocol as any other distribution, so OSO Kafka Backup needs nothing special to read from it. Point the backup at your broker listeners and it captures topic data the same way it does on Apache Kafka or MSK. That keeps a logical, point-in-time copy of your topics outside the cluster's failure domain — the gap replication between clusters does not close. See the disaster recovery use cases for the failure modes a backup covers.
Confluent Platform ships Schema Registry. Backing up the schemas alongside topic data is an OSO Enterprise capability; the open source tool backs up topic records, offsets, and configuration.
Connecting to Confluent Platform
Use whatever listener security your cluster is configured for. SASL_SSL with SCRAM or PLAIN is common on secured Confluent Platform deployments; mutual TLS is also supported. Every key below comes from the configuration reference.
- SASL/SCRAM
- Mutual TLS
- Run it
mode: backup
backup_id: cp-prod-daily
source:
bootstrap_servers:
- broker-1.cp.internal:9092
- broker-2.cp.internal:9092
security:
security_protocol: SASL_SSL
sasl_mechanism: SCRAM-SHA512
sasl_username: ${CP_SCRAM_USER}
sasl_password: ${CP_SCRAM_PASSWORD}
ssl_ca_location: /etc/kafka/ca.crt
storage:
backend: s3
bucket: my-kafka-backups
region: us-east-1
prefix: confluent-platform/production
backup:
compression: zstd
include_offset_headers: true
mode: backup
backup_id: cp-prod-daily
source:
bootstrap_servers:
- broker-1.cp.internal:9093
- broker-2.cp.internal:9093
security:
security_protocol: SSL
ssl_ca_location: /etc/kafka/ca.crt
ssl_certificate_location: /etc/kafka/client.crt
ssl_key_location: /etc/kafka/client.key
storage:
backend: s3
bucket: my-kafka-backups
region: us-east-1
prefix: confluent-platform/production
kafka-backup backup --config cp-backup.yaml
What gets backed up
Every backup captures topic records with their timestamps and headers, consumer group offsets, and topic configuration, compressed with Zstd or LZ4. Restores can target the original Confluent Platform cluster or a new one — including a cluster on a different distribution — with topic and partition remapping, so backup and restore doubles as a migration path off or onto Confluent Platform.
Frequently asked questions
Does OSO Kafka Backup work with Confluent Platform?
Yes. Confluent Platform speaks the standard Kafka protocol, so OSO Kafka Backup connects as an ordinary Kafka client over your broker listeners. No Confluent-specific plugin or integration is required.
How does it authenticate to a secured Confluent Platform cluster?
With standard Kafka security. Use SASL_SSL with the SCRAM-SHA512 or PLAIN mechanism, or mutual TLS with a client certificate — whichever your cluster listeners are configured for. Credentials resolve through environment variable substitution.
Does it back up the Confluent Schema Registry?
Backing up schemas alongside topic data is an OSO Enterprise capability. The open source tool captures topic records, consumer group offsets, and topic configuration; schema-aware backup is available in the Enterprise edition.
How is this different from Confluent Replicator?
Confluent Replicator copies data between clusters in real time, so it also replicates corrupted or deleted records. Point-in-time backup restores the state from before an incident. Many teams run both — see the Confluent Replicator comparison for details.
Ready to protect your Kafka data?
Take your first backup in minutes with the open source CLI, or talk to us about Enterprise features like encryption, RBAC, and audit logging.