ChatGPT
Perplexity
Claude
Kubernetes backup is not the same problem as VM backup. A Kubernetes cluster’s state lives in three places at once: the cluster itself (manifests, custom resources, RBAC, secrets), the persistent volumes attached to pods, and the external services that pods talk to (databases, message queues, object storage). Snapshotting a VM gets you one of these. Backing up Kubernetes properly means dealing with all three, ideally in an application-consistent way.
This post compares the nine Kubernetes backup tools that actually get used in production in 2026, with the trade-offs that matter when picking one. Use the comparison table to narrow down, then read the per-tool sections for the detail.
Last updated: June 2026
Quick comparison table
| Tool | Pricing | Best for | Application-aware | Multi-cluster | SaaS option |
|---|---|---|---|---|---|
| Velero | Free (open source) | OSS standard, multi-cloud, K8s-native teams | Via plugins (Kanister) | Yes (manual) | No |
| Kasten K10 (Veeam) | Free tier + commercial | Mid to large enterprise, GUI-driven ops | Yes | Yes | Available |
| Portworx PX-Backup | Commercial | Stateful apps, storage-agnostic ops | Yes | Yes | No |
| Trilio TVK | Commercial | Telco, EMEA / APAC enterprise | Yes | Yes | No |
| CloudCasa (Catalogic) | Free tier + SaaS | SaaS-first, lighter ops, multi-cluster | Yes | Yes | Yes (primary) |
| Rubrik Security Cloud | Enterprise | Ransomware-focused, existing Rubrik customers | Yes | Yes | Yes |
| Cohesity DataProtect | Enterprise | Large enterprise, hybrid VM + K8s | Yes | Yes | Yes |
| Commvault for Kubernetes | Enterprise | Regulated industries, existing Commvault customers | Yes | Yes | Yes |
| Kanister | Free (open source) | Programmatic, app-specific backup logic | Yes (by design) | No (per cluster) | No |
The rest of this post goes through each one in detail.
What Kubernetes backup actually needs to cover
Before the tool list, a quick scope check. A complete Kubernetes backup strategy covers four things:
- Cluster state - manifests, ConfigMaps, Secrets, RBAC, CRDs, operators
- Persistent volume data - whatever is on PVCs at the time of backup
- Application consistency - the data on the PV has to be in a state the application can actually start from (think: quiesce the database before snapshotting)
- External data sources - if your app talks to RDS, S3, or external Kafka, those have their own backup story
The tools below differ mostly in how well they handle #3 and how easy they make #4. The first two are table stakes for any tool worth using.
For the wider operational view of how backups fit into disaster recovery, see our Kubernetes disaster recovery production playbook.
1. Velero
What it is: The de facto open-source standard for Kubernetes backup. A CNCF Sandbox project originally from Heptio (later acquired by VMware, now community-led). Backs up Kubernetes resources and persistent volumes to object storage (S3, Azure Blob, GCS, MinIO).
Best for: Open source teams, multi-cloud K8s estates, teams that want to own their backup pipeline, anyone allergic to commercial backup vendor lock-in.
Strengths
- Free and open source under Apache 2.0
- Works across every major cloud and on-prem
- Plugin architecture lets you extend to almost any storage backend
- Backs up to standard object storage you already pay for
- Strong community, well-documented, widely deployed
Limitations
- Application-consistency requires hooks (pre/post-backup scripts) that you write per app
- PVC-level backups; not app-aware out of the box
- Restore experience is CLI-driven and can be fragile for complex apps
- Operations team owns everything, including monitoring and alerting
Pricing: Free. Hosted enterprise builds are available from various vendors (Veeam’s K10 is the most popular, see below).
Notable: OpenShift’s data protection product (OADP) is Velero under the hood with Red Hat-shaped defaults. If you’re on OpenShift, you’re probably using Velero whether you know it or not.
2. Kasten K10 (by Veeam)
What it is: Commercial Kubernetes data management platform from Kasten, owned by Veeam. The most polished commercial product in the K8s backup space, with a strong UI and broad source-target support.
Best for: Mid-market to enterprise customers who want a turnkey product with a GUI, multi-cluster visibility, and named support. Especially good fit for orgs already running Veeam for VM workloads.
Strengths
- Application-consistent backups via Kanister blueprints (more on Kanister below)
- Strong dashboard, role-based access, audit logging
- Multi-cluster management from a single pane
- Free Edition supports up to 5 worker nodes per cluster (genuinely useful for small clusters and homelabs)
- Multi-cloud and hybrid backup targets
- Integrates with security tooling for ransomware detection
Limitations
- Commercial pricing scales with cluster size, gets expensive at scale
- Heavier footprint than Velero (more pods, more CRDs)
- Some advanced features behind the higher-tier Enterprise license
Pricing: Free Edition for small clusters. Commercial pricing is node-based, typically annual subscription. Talk to Veeam sales for actual numbers.
Notable: Kasten contributed the Kanister project (item 9 below). If you’re evaluating K10, also understand Kanister - it’s the engine underneath.
3. Portworx PX-Backup (by Pure Storage)
What it is: Backup product within the Portworx Enterprise Storage Platform from Pure Storage. Storage-agnostic - backs up data from any persistent volume regardless of what’s underneath.
Best for: Stateful Kubernetes workloads, organizations running databases on Kubernetes, teams that need storage-level data services (replication, snapshots, encryption) alongside backup.
Strengths
- Application-aware backups with pre-defined rules for common databases (PostgreSQL, MySQL, MongoDB, Cassandra, Kafka)
- Works with any underlying storage - not tied to a specific CSI driver
- Strong multi-cluster, multi-cloud support
- Backup is one feature in a broader storage platform (Portworx Enterprise) - useful if you need the rest
- Granular RBAC for multi-tenant clusters
Limitations
- Commercial product, not cheap
- Strongest value comes when paired with the rest of Portworx, which is a bigger commitment
- Smaller community than Velero or Kasten
Pricing: Commercial subscription, typically per-node or per-cluster. Pure Storage sales-led pricing.
Notable: Pure Storage acquired Portworx in 2020. The product roadmap has accelerated since, and it’s now one of the most actively developed commercial K8s data products.
4. Trilio TVK (Trilio Vault for Kubernetes)
What it is: Application-centric backup product from Trilio. Strong in EMEA, APAC, and telco. Lower brand recognition in North America despite a solid product.
Best for: Telco workloads (operators, CNFs), regulated industries in EMEA, organizations that need fine-grained per-application backup policies.
Strengths
- Application-aware out of the box, with sensible defaults for most common stateful apps
- Strong support for telco-specific workloads (CNF backup, Helm-based app discovery)
- Multi-cluster and multi-tenancy native
- Backup targets include S3-compatible storage, NFS, and major cloud object stores
- Validated against major Kubernetes distributions including OpenShift and Rancher
Limitations
- Smaller ecosystem and community than Kasten or Velero
- Less common in the US market, which can affect partner availability
- Documentation can lag behind product updates
Pricing: Free Basic edition with limited capacity. Commercial tiers for production use.
Notable: Strong fit for European customers concerned about data residency. Trilio has been emphasizing sovereignty and ransomware features in 2025 and 2026 releases.
5. CloudCasa (by Catalogic)
What it is: SaaS-first backup and recovery for Kubernetes. The product runs as a managed service - the customer deploys a small agent in each cluster and manages backups from the CloudCasa control plane.
Best for: Teams that want minimal operational overhead, multi-cluster fleets where managing per-cluster backup software is a burden, mid-market customers.
Strengths
- True SaaS delivery model - you don’t run the backup control plane
- Free tier with genuinely useful limits (currently 1 cluster, 25 GB storage)
- Application-aware backups with a growing library of pre-built integrations
- Multi-cloud (AWS, Azure, GCP, Oracle, IBM) and on-prem support
- Lower learning curve than self-hosted alternatives
Limitations
- SaaS model means you depend on CloudCasa’s uptime and roadmap
- Data still flows to your own object storage (good), but metadata is in CloudCasa’s control plane (worth understanding for compliance)
- Smaller installed base than Velero or Kasten
- Some advanced policy features require paid tiers
Pricing: Free tier, then per-cluster monthly subscription. SaaS billing simplifies procurement.
Notable: Catalogic, the parent company, has been in the data protection space for decades. CloudCasa is their K8s-specific play, launched in 2021 and growing steadily.
6. Rubrik Security Cloud (Kubernetes Protection)
What it is: Kubernetes data protection as part of Rubrik’s broader security cloud platform. Backup with a security-first lens - immutable backups, ransomware detection, anomaly scanning.
Best for: Enterprises already on Rubrik for VM and SaaS data protection. Organizations with serious ransomware concerns. Highly regulated industries.
Strengths
- Application-consistent backups for common stateful workloads
- Immutable backups with strong ransomware controls
- Anomaly detection that flags unusual data changes (suspicious encryption patterns, mass deletion)
- Unified data protection across VMs, SaaS, and Kubernetes
- Strong audit and compliance reporting
Limitations
- Enterprise-only - not realistically priced for smaller deployments
- Best value when consolidating across data protection workloads, not as a standalone K8s backup tool
- Operational complexity matches the platform’s enterprise positioning
Pricing: Enterprise sales-led, typically annual subscription based on protected data volume. Not cheap.
Notable: Rubrik’s IPO and continued enterprise focus mean steady investment in the K8s product, but the value proposition is “K8s as part of the security platform”, not “K8s backup as a standalone purchase”.
7. Cohesity DataProtect for Kubernetes
What it is: Kubernetes backup within Cohesity’s broader data platform. Comparable in positioning to Rubrik - enterprise data protection that includes K8s rather than being focused on it.
Best for: Large enterprises with hybrid environments (VMs + K8s + SaaS), customers already invested in Cohesity, organizations that want one vendor for all data protection.
Strengths
- Unified data platform - same UI, policies, and storage for VMs, K8s, NAS, SaaS
- Application-consistent backups for major databases on K8s
- Strong ransomware detection and immutable backup options
- Granular RBAC and audit logging suitable for enterprise compliance
- Cohesity Helios cloud-based management plane
Limitations
- Heavy footprint, enterprise pricing, long sales cycle
- Not a standalone K8s product - the K8s capabilities are part of a larger investment
- Steepest learning curve of the commercial options
Pricing: Enterprise sales-led. Cohesity Cloud Services adds a managed-service tier.
Notable: Cohesity acquired Veritas’s data protection business in late 2024, expanding the customer base and product surface significantly. Worth understanding the post-acquisition product roadmap before committing.
8. Commvault for Kubernetes (Metallic K8s Backup)
What it is: Kubernetes protection within Commvault’s enterprise data platform. Also available as a SaaS offering (Metallic K8s Backup) for teams that prefer not to run the control plane.
Best for: Regulated industries (finance, healthcare, government), organizations already running Commvault for traditional workloads, teams that need formal data classification and compliance evidence.
Strengths
- Mature compliance and audit capabilities
- Application-aware backups for common stateful workloads
- Both self-hosted and SaaS delivery models
- Strong cross-cloud and hybrid support
- Recognized by major analyst rankings (Gartner Magic Quadrant leader in data protection)
Limitations
- Same pattern as Rubrik and Cohesity - K8s is part of a bigger platform, not a focused product
- Enterprise pricing and procurement
- The Metallic SaaS option simplifies operations but adds vendor dependency
Pricing: Enterprise sales-led. Metallic offers more transparent SaaS pricing tiers.
Notable: Commvault’s K8s strategy has matured significantly in 2025 and 2026. The acquisition of Appranix added ransomware-specific capabilities relevant to K8s.
9. Kanister
What it is: Open-source framework for application-specific data management on Kubernetes. Originally developed by Kasten, contributed to the community, now widely used as a building block by other backup tools (including Kasten K10 itself).
Best for: Teams that need programmatic, app-specific backup logic and don’t want to wait for a vendor to support their application. Platform teams building custom backup workflows.
Strengths
- Fully programmatic - define backup behavior as YAML “blueprints” per application
- Already supports many common databases out of the box (PostgreSQL, MySQL, MongoDB, Cassandra, Elasticsearch, Kafka)
- Free and open source under Apache 2.0
- Pairs naturally with Velero for the data plane (Velero backs up the K8s state, Kanister handles the app-specific data consistency)
Limitations
- Not a complete backup solution on its own - you still need something to schedule, store, and manage retention
- Steeper learning curve than turnkey products
- Smaller standalone community since most users encounter it through Kasten K10
Pricing: Free. The infrastructure to run Kanister (Kubernetes itself, object storage for backups) is what you actually pay for.
Notable: If you’re using Kasten K10, you’re already using Kanister. If you’re using Velero and have application-consistency challenges, Kanister is the building block worth knowing about.
Honorable mentions
A few tools that didn’t make the main list but are worth knowing exist:
- Stash by AppsCode - open source, app-aware, smaller community. Good fit for cost-conscious teams who want more than Velero but don’t want commercial pricing.
- Druva for Kubernetes - SaaS-first, lightweight, fits the smaller end of the enterprise market.
- Bacula Enterprise K8s Plugin - if you’re already a Bacula shop, the K8s plugin is workable. Few greenfield deployments pick Bacula for K8s.
- Veritas NetBackup for Kubernetes - now part of Cohesity post-acquisition, see Cohesity above.
- CSI volume snapshots - not a backup product, but worth mentioning. The CSI snapshot mechanism is the underlying primitive most of these tools use for PV data. You can build a primitive backup workflow on CSI snapshots alone, but you’ll re-invent most of what Velero gives you for free.
How to pick
A quick decision framework based on what we see across engagements:
Pick Velero if:
- You want open source, you have the in-house skills to operate it, and your applications are simple enough that PVC-level consistency is good enough (or you’re willing to write hooks)
- Your team prefers to own the backup pipeline end-to-end
Pick Kasten K10 if:
- You want a polished commercial product with strong UI and named support
- You’re already a Veeam customer or comfortable with their commercial model
- You have mid-to-large scale and the budget for it
Pick Portworx PX-Backup if:
- You run heavy stateful workloads (databases, message queues) on K8s
- You want storage and backup from one vendor
- You’re already in the Pure Storage ecosystem or evaluating the broader Portworx platform
Pick Trilio TVK if:
- You’re in EMEA, APAC, or telco
- You need application-aware backups without writing per-app logic
- Data sovereignty matters to your buyer
Pick CloudCasa if:
- You want SaaS delivery and minimal operational overhead
- You’re a mid-market customer where running the backup control plane yourself is a burden
- You want to start free and scale into paid
Pick Rubrik or Cohesity if:
- You’re an enterprise consolidating data protection across VMs, SaaS, and K8s
- Ransomware is a board-level concern and you want the security features
- You’re already a customer and adding K8s is a small step
Pick Commvault if:
- You’re in a regulated industry with mature compliance requirements
- You’re already on Commvault for traditional workloads
Pick Kanister if:
- You’re building custom backup workflows and need programmatic app-specific logic
- You’re already using Velero and need app-consistency, or you’re using Kasten K10 and want to extend it
Common Kubernetes backup pitfalls
Things that bite teams across every tool:
- Backing up the cluster state without testing restore. Untested backups are not backups. Schedule restore drills, at least quarterly.
- Forgetting external data. RDS, S3, external Kafka - the K8s backup tool doesn’t cover these. Each needs its own backup strategy that you can restore from in coordination with the K8s restore.
- Skipping app-consistency for databases. A volume snapshot of a database that wasn’t quiesced is a corrupt database in waiting. Use Kanister blueprints or vendor app-aware features.
- Storing backups in the same blast radius as production. Backups in the same AWS account, same region, same VPC, same KMS key as production are not real backups for ransomware recovery. Cross-account, cross-region, immutable storage.
- Not setting retention. Default retention is often “forever”. Object storage bills add up. Set policies before the bill arrives.
- Backing up Secrets in plaintext. Velero and others can encrypt backup objects, but the Secrets inside still need handling. See our Kubernetes secrets in 2026 post for the wider pattern.
- No multi-cluster strategy. If you have 5 clusters, you need backups for 5 clusters, plus the orchestration to recover any of them. Multi-cluster backup is a different problem from single-cluster.
- Ignoring the operator pattern. Many production K8s applications are managed by operators (Strimzi, Cluster API, custom CRDs). Backup must understand operator-managed resources and recreate them in the right order on restore.
For the wider security context around K8s data protection, our cloud-native security tools guide covers the adjacent tooling.
FAQ
What is the best free Kubernetes backup tool?
Velero is the default open-source choice and is in production at thousands of organizations. For application-consistent backups of common databases, Velero plus Kanister gives you most of what commercial products offer, at the cost of more operational effort. Kasten K10 Free Edition is also genuinely useful for small clusters and dev / test.
Can I use Velero for production Kubernetes backups?
Yes, and many teams do. The caveats: you need to invest in hooks for application consistency, operational tooling for monitoring and alerting, and restore testing. If those operational investments are a burden, a commercial tool will save you time at the cost of license fees.
Does Velero back up persistent volumes?
Yes, via the CSI snapshot mechanism for most modern storage drivers, or via Restic / Kopia file-level backup for unsupported volumes. The PV backup approach matters - CSI snapshots are storage-efficient but storage-driver dependent, while Restic and Kopia are storage-agnostic but slower.
What’s the difference between Velero and Kasten K10?
Velero is open source, lower-level, requires more operational work, and is multi-cloud out of the box. Kasten K10 is commercial, application-aware by default, has a strong UI, and includes multi-cluster management. Kasten K10 is built on top of Velero plus Kanister conceptually - you’re paying for the integration, UI, support, and additional capabilities.
How do I back up databases running on Kubernetes?
Three patterns. (1) Use a backup tool with application-aware support (Kasten K10, Portworx PX-Backup, Trilio, Kanister blueprints with Velero). (2) Run the database’s native backup tool (pg_dump, mysqldump, etc.) on a schedule and store the output in object storage. (3) For managed databases (RDS, Aurora, Cloud SQL), don’t back up via K8s at all - use the cloud provider’s snapshots. Most production setups combine approaches.
Are Kubernetes backups required for compliance?
For most regulated industries (HIPAA, PCI DSS, SOC 2), backups are required as part of business continuity and disaster recovery controls. The specific requirements vary, but the common pattern is: regular backups, off-site (or cross-region) storage, periodic restore testing, retention policy aligned to the regulation.
What is the difference between Kubernetes backup and disaster recovery?
Backup is point-in-time data protection. Disaster recovery is the broader practice of restoring the application to working order after an incident. Backup is a component of DR, but DR also covers infrastructure provisioning, network failover, dependency restoration, and the runbooks to execute under pressure. See our Kubernetes disaster recovery playbook for the wider scope.
Should I back up cluster state separately from data?
Yes, conceptually. The cluster state (manifests, CRDs, RBAC, secrets) can be re-created from GitOps if you have a clean GitOps pipeline. The data on PVs cannot. Some teams skip K8s cluster state backups entirely because GitOps recreates everything from Git, and only back up the persistent data. This works if your GitOps coverage is complete.
How often should Kubernetes backups run?
Depends on the data’s rate of change and the RPO (recovery point objective) you’ve agreed with the business. Typical patterns: hourly snapshots for high-change databases, daily backups for moderate workloads, weekly for archival data. Retention is the other lever - you might keep hourly for a day, daily for a month, weekly for a year.
What’s the right backup target for Kubernetes?
S3, Azure Blob, GCS, or S3-compatible storage (MinIO, Wasabi, Backblaze) for most cases. The decision factors: durability (all of these are 11 nines), cost, egress for restore, and whether immutable / object-lock support is needed for ransomware protection. For ransomware specifically, enable object lock and cross-account access controls.
Need help picking and operating Kubernetes backups?
Picking a Kubernetes backup tool is the easy part. Operating it - app-consistent policies, cross-region targets, restore drills, integration with your DR runbooks - is what determines whether the backup is real when you need it.
Tasrie IT Services provides hands-on Kubernetes consulting that covers:
- Backup tool selection and deployment - Velero with Kanister, Kasten K10, Portworx PX-Backup, and others, configured for your storage and compliance requirements
- Restore testing and runbooks - the part most teams skip, made into a quarterly operational practice
- Cross-region and cross-account DR - backups stored where they survive the failure mode they’re protecting against
- Multi-cluster backup orchestration - fleet-wide policies, centralized monitoring, audit-ready reporting