Most Kubernetes backup evaluations I see in 2026 start the same way: a team installs Velero because it’s free, runs its first test restore, hits a CSI VolumeSnapshot error, and only then starts pricing commercial tools. That sequence wastes a quarter. The market has consolidated to three real options — Veeam Kasten, Portworx PX-Backup, and Velero — and the right answer depends on your storage, your staffing, and increasingly on whether you’re running virtual machines on Kubernetes at all.
This guide gives you the verdict up front, an honest look at where each tool falls down, the KubeVirt VM wrinkle that VMware refugees keep tripping over, and the one prerequisite check that derails more first deployments than anything else.
The short version
Kasten is the default. Buy Portworx if you’re a Pure Storage shop already running Portworx Enterprise. Run Velero only if you have platform engineers with time to own it. As of mid-2026, practitioner surveys put Kasten’s mindshare at roughly a third of the Kubernetes backup market — about triple PX-Backup’s — and that gap shows up in hiring pools, community answers, and integration coverage.
| Veeam Kasten | Portworx PX-Backup | Velero | |
|---|---|---|---|
| Cost model | Commercial, per-node licensing; free tier for small clusters | Commercial, strongest value bundled with Portworx Enterprise | Free and open source; you pay in engineering hours |
| KubeVirt VM backup | First-class: VM discovery, label-based policies, CBT work with Red Hat | Strong when VMs sit on Portworx storage; live migration support | Possible via OADP on OpenShift, but assembly required |
| Storage dependency | Storage-agnostic (any CSI driver with snapshots) | Best on Portworx storage; works elsewhere with caveats | Storage-agnostic via CSI or plugins |
| Ops burden | Low — policy engine, UI, RBAC built in | Low-to-moderate | High — CLI-driven, you build the guardrails |
| Fits | Most enterprises, especially Veeam and OpenShift shops | Pure Storage / Portworx storage customers | Small estates, non-prod, strong platform teams |
Veeam Kasten: the default for a reason
Kasten K10 became Veeam Kasten for Kubernetes after the acquisition, and it has spent the years since compounding its lead. The policy engine is genuinely application-aware — it captures namespaces, secrets, CRDs, and volume data as a unit, and its blueprint system handles databases that need quiescing before a snapshot. On the VM side it discovers KubeVirt virtual machines automatically and treats them as workloads, and label-based VM policies mean a new VM tagged into a protection group is covered the moment it’s created. Kasten and Red Hat have also co-developed a storage-agnostic changed-block-tracking approach for KubeVirt, which addresses the ugliest problem in VM-on-Kubernetes backup: full-volume reads on every backup pass.
The honest downsides: per-node licensing gets expensive at scale, and pricing conversations at renewal reflect Kasten’s market position. It also remains a separate product with a separate console from Veeam Data Platform — convergence is coming, with native OpenShift Virtualization support signaled for the v13-era roadmap, but today you run two panes of glass. If you’re weighing Kasten against Rubrik’s Kubernetes protection specifically, we’ve done that comparison in depth in our Kasten vs Rubrik brief.
Portworx PX-Backup: strongest inside a Pure shop
Pure Storage owns Portworx, and that ownership defines the buying logic. If your clusters already run Portworx Enterprise as the storage layer, PX-Backup is the path of least resistance: container-granular, application-consistent backups that understand the storage underneath them, plus live migration for KubeVirt VMs on RWX block volumes. For OpenShift Virtualization on Portworx storage, the combined story — storage, VM mobility, and backup from one vendor — is coherent in a way few competitors match.
Outside that context, the case weakens. PX-Backup standalone against Kasten on third-party storage is a harder sell, and its roughly 10% mindshare means fewer engineers arrive knowing it. The rule of thumb: Portworx storage in production makes PX-Backup a finalist; no Portworx storage means it rarely wins the bake-off.
Velero: free, with an operational tax
Velero is everywhere, and for good reason — it’s free, it’s GitOps-friendly, and it underpins Red Hat’s own OADP operator. For a handful of clusters, or for non-production estates, it’s a defensible choice. The tax comes due at scale: no real multi-tenant RBAC, a plugin compatibility matrix you own, restores you must test yourself because nobody else will, and upgrades that occasionally break snapshot workflows. There is no vendor to call at 2 a.m.
My threshold: above roughly ten production clusters, or any compliance regime that requires demonstrable restore testing, the engineering hours spent babysitting Velero exceed the cost of a commercial license. Below that line, Velero plus disciplined restore drills is fine. A VP can defend either position — but only if the line was drawn deliberately.
The VMware refugee problem: VMs on Kubernetes
Here’s what makes 2026 different. Teams leaving VMware — and there are many; see our guide to VMware alternatives in 2026 — are landing on OpenShift Virtualization in real numbers, which means the backup tool now has to protect KubeVirt VMs, not just containers. A VM is not a stateless pod. It needs crash-consistent or better snapshots, incremental capture so you’re not re-reading a 2 TB disk nightly, and restore workflows an ops team can actually run.
Kasten currently has the most mature answer, as covered above. But it’s not alone. Rubrik has added OpenShift Virtualization protection to its platform — a meaningful move for shops that already standardized on Rubrik for ransomware resilience and want one policy plane across VMs old and new (our Veeam vs Rubrik comparison covers how the two philosophies differ). Trilio deserves a look too: it’s a smaller vendor whose entire business is cloud-native data protection, with application-centric backups spanning namespaces, labels, and VMs, and an OpenShift and OpenStack heritage that plays well in telco and Red Hat-heavy environments. Trilio’s risk profile is the inverse of its focus — you’re betting on a specialist. And Veeam’s signaled v13-era native OpenShift Virtualization support means VBR shops may eventually get VM-on-Kubernetes backup inside the console they already run.
The CSI snapshot prerequisite that derails deployments
Every tool in this guide — commercial or free — depends on CSI VolumeSnapshots for persistent volume capture, and this is where most first deployments die. The failure is silent: backups appear to succeed, then the first restore returns empty volumes. Before you install anything, verify four things:
- Your CSI driver actually supports snapshots — not all do, and hostPath or in-tree drivers never will.
- The external-snapshotter CRDs and snapshot controller are installed. Several managed distributions still ship without them.
- A VolumeSnapshotClass exists and is annotated as default for the driver.
- A manual VolumeSnapshot on a test PVC completes and is restorable — prove the plumbing before you buy the appliance.
Plan the backup target at the same time. All three tools export to S3-compatible object storage, and on-prem teams should size that tier deliberately — our on-prem S3 object storage guide walks through the options.
What to do about it
- Running Portworx Enterprise storage? Shortlist PX-Backup first, Kasten second.
- OpenShift Virtualization in the migration plan? Weight KubeVirt maturity heavily — Kasten leads today, with Rubrik and Trilio as credible alternatives depending on your incumbent stack.
- Fewer than ten production clusters and a capable platform team? Velero is defensible — budget the engineering hours honestly and schedule quarterly restore drills.
- Everyone else: start with Kasten, negotiate the node count, and run the CSI snapshot checklist before the proof of concept, not during it.
Frequently asked questions
Is Velero good enough for production Kubernetes backup?
For small estates with a strong platform team, yes — provided you test restores on a schedule. Past roughly ten production clusters, or under audit regimes requiring documented recovery evidence, the operational cost usually exceeds a commercial license.
What happened to Kasten K10?
It still exists — Veeam renamed it Veeam Kasten for Kubernetes. Same product line, now positioned inside the broader Veeam portfolio, with a free tier remaining for small clusters.
How do I back up VMs running on OpenShift Virtualization?
Use a tool that treats KubeVirt VMs as first-class workloads. Veeam Kasten discovers VMs automatically and supports label-based policies and changed-block tracking; Rubrik and Trilio both protect OpenShift Virtualization as well. Plain Velero via OADP works but requires significant assembly.
Why do my Kubernetes backups succeed but restores come back empty?
Almost always a CSI snapshot problem: the snapshot controller or CRDs are missing, or no default VolumeSnapshotClass exists, so the tool captured manifests but no volume data. Verify a manual VolumeSnapshot works before trusting any backup job.
Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.