Skip to main content

Strimzi Backup Operator

The Strimzi Backup Operator is a Strimzi-native Kubernetes operator for backing up and restoring Kafka clusters managed by Strimzi. Instead of configuring bootstrap servers and TLS material by hand, it resolves connection details, cluster CA certificates, and KafkaUser credentials directly from your Strimzi custom resources.

The current release is v0.2.17. Its default backup/restore Job image is osodevops/kafka-backup:v0.15.11.

Which operator do I need?

This operator (kafkabackup.com/v1alpha1) is purpose-built for Strimzi-managed clusters and references Strimzi Kafka/KafkaUser resources. If you run Kafka outside Strimzi (MSK, Confluent, self-managed), use the OSO Kafka Backup Operator (kafka.oso.sh/v1alpha1) instead.

Custom Resource Definitions​

CRDAPI GroupDescription
KafkaBackupkafkabackup.com/v1alpha1Back up topics from a Strimzi cluster to S3, Azure Blob, GCS, or filesystem storage — one-shot or on a cron schedule
KafkaRestorekafkabackup.com/v1alpha1Restore a backup into a Strimzi cluster, with topic selection, renaming, and point-in-time recovery

The operator runs backups and restores as Kubernetes Jobs that execute the kafka-backup CLI, so every run is inspectable with standard tooling (kubectl get jobs,pods).

Encryption availability​

Enterprise-only capability

spec.backup.encryption was mistakenly exposed by the v0.2.16 KafkaBackup CRD. The open source kafka-backup CLI has never supported that setting, so an enabled value fails reconciliation instead of creating an encrypted backup. Do not use it. The field is removed from the public CRD in v0.2.17.

OSO Kafka Backup Enterprise can preserve metadata from an existing Confluent Client-Side Field-Level Encryption deployment. That capability backs up KEKs, encrypted DEKs, encrypted subjects, and schema encryption rules; it does not encrypt Kafka backup segment files. See Confluent CSFLE Metadata Backup for the supported scope and configuration.

Installation​

# Add the OSO DevOps Helm repository
helm repo add oso-devops https://osodevops.github.io/helm-charts/
helm repo update

# Install the operator
helm install strimzi-backup-operator oso-devops/strimzi-backup-operator \
  --namespace kafka \
  --create-namespace \
  --version 0.2.17

For an upgrade, apply the release CRDs before upgrading the chart. Helm installs CRDs from a chart's crds/ directory, but does not upgrade existing CRDs.

kubectl apply -f https://github.com/osodevops/strimzi-backup-operator/releases/download/v0.2.17/crds.yaml

helm upgrade strimzi-backup-operator oso-devops/strimzi-backup-operator \
  --namespace kafka \
  --version 0.2.17

A minimal backup and restore​

apiVersion: kafkabackup.com/v1alpha1
kind: KafkaBackup
metadata:
  name: daily-backup
  namespace: kafka
spec:
  strimziClusterRef:
    name: my-cluster        # your Strimzi Kafka CR
  schedule:
    cron: "0 2 * * *"
  storage:
    type: s3
    s3:
      bucket: my-kafka-backups
      region: eu-west-1
      accessKeySecret:
        name: aws-credentials
        key: access-key-id
      secretKeySecret:
        name: aws-credentials
        key: secret-access-key
  backup:
    stopAtCurrentOffsets: true
  logging:
    level: info
    format: json
  env:
    - name: RUST_LOG
      value: "kafka_backup=info,rdkafka=warn"
  metrics:
    enabled: true
    keepAliveSeconds: 60
    maxPartitionLabels: 100
---
apiVersion: kafkabackup.com/v1alpha1
kind: KafkaRestore
metadata:
  name: restore-orders
  namespace: kafka
spec:
  strimziClusterRef:
    name: my-cluster
  backupRef:
    name: daily-backup
    backupId: backup-20260610-020000
  topics:
    include:
      - orders-*

Next steps​