Back up Kafka on OpenShift with custom resources

OpenShift Kafka backup for Red Hat Streams​

Red Hat Streams for Apache Kafka is based on Strimzi. Older releases used the AMQ Streams name. Its Kafka and KafkaUser resources use the same Strimzi API model.

The Strimzi Backup Operator references those resources directly. It resolves bootstrap addresses, cluster CA certificates, and user credentials from the OpenShift namespace. You do not duplicate connection secrets inside every backup resource.

Each KafkaBackup or KafkaRestore becomes a Kubernetes Job. Platform teams can review status, events, and logs with oc. The resources also fit Argo CD or another GitOps controller.

Install the operator and schedule a backup​

Install the OSO operator with Helm in the namespace containing your Red Hat Streams cluster. Then reference the existing Kafka resource by name. The example writes a daily snapshot to Amazon S3 and preserves selected topic data outside the OpenShift cluster.

helm repo add oso-devops https://osodevops.github.io/helm-charts/
helm repo update

helm install strimzi-backup-operator oso-devops/strimzi-backup-operator \
--namespace kafka \
--create-namespace

apiVersion: kafkabackup.com/v1alpha1
kind: KafkaBackup
metadata:
name: openshift-daily-backup
namespace: kafka
spec:
strimziClusterRef:
  name: my-cluster
schedule:
  cron: "0 2 * * *"
backoffLimit: 3
storage:
  type: s3
  s3:
    bucket: my-kafka-backups
    region: us-east-1

oc apply -f openshift-daily-backup.yaml
oc get kafkabackup -n kafka
oc get jobs,pods -n kafka
oc describe kafkabackup openshift-daily-backup -n kafka

Keep the backup outside the failure boundary​

Persistent volumes help Kafka brokers survive pod and node replacement. They remain part of the same platform failure boundary. An independent backup stores logical topic data in S3, Azure Blob, GCS, or filesystem storage.

That separation supports recovery from accidental topic deletion, corrupt writes, and cluster loss. A restore can target the original Red Hat Streams cluster or another reachable Kafka cluster. Point-in-time controls stop the restore at a millisecond timestamp.

Use the generic Kafka Backup Operator when Kafka is not managed through Strimzi resources. The Strimzi-specific operator is the direct path for Red Hat Streams because it understands the existing Kafka and KafkaUser objects.

Operate backups with OpenShift tooling​

The backup resource stays declarative, while each execution remains visible as a Job. Use OpenShift RBAC to control who can create backup and restore resources. Keep storage credentials in Secrets within the watched namespace.

Backup Jobs allow retries because repeated backup work is safe. Restore Jobs default to one attempt because replaying a partial restore can duplicate records. The Job behavior guide explains status conditions, retries, and cleanup.