OpenShift CLI administrator command reference

This reference provides descriptions and example commands for OpenShift CLI (oc) administrator commands. You must have cluster-admin or equivalent permissions to use these commands.

For developer commands, see the OpenShift CLI developer command reference.

Run oc adm -h to list all administrator commands or run oc <command> --help to get additional details for a specific command.

OpenShift CLI (oc) administrator commands

oc adm build-chain

Output the inputs and dependencies of your builds

Example usage

  1.   # Build the dependency tree for the 'latest' tag in <image-stream>
  2.   oc adm build-chain <image-stream>
  4.   # Build the dependency tree for the 'v2' tag in dot format and visualize it via the dot utility
  5.   oc adm build-chain <image-stream>:v2 -o dot | dot -T svg -o deps.svg
  7.   # Build the dependency tree across all namespaces for the specified image stream tag found in the 'test' namespace
  8.   oc adm build-chain <image-stream> -n test --all

oc adm catalog mirror

Mirror an operator-registry catalog

Example usage

  1.   # Mirror an operator-registry image and its contents to a registry
  2.   oc adm catalog mirror quay.io/my/image:latest myregistry.com
  4.   # Mirror an operator-registry image and its contents to a particular namespace in a registry
  5.   oc adm catalog mirror quay.io/my/image:latest myregistry.com/my-namespace
  7.   # Mirror to an airgapped registry by first mirroring to files
  8.   oc adm catalog mirror quay.io/my/image:latest file:///local/index
  9.   oc adm catalog mirror file:///local/index/my/image:latest my-airgapped-registry.com
  11.   # Configure a cluster to use a mirrored registry
  12.   oc apply -f manifests/imageContentSourcePolicy.yaml
  14.   # Edit the mirroring mappings and mirror with "oc image mirror" manually
  15.   oc adm catalog mirror --manifests-only quay.io/my/image:latest myregistry.com
  16.   oc image mirror -f manifests/mapping.txt
  18.   # Delete all ImageContentSourcePolicies generated by oc adm catalog mirror
  19.   oc delete imagecontentsourcepolicy -l operators.openshift.org/catalog=true

oc adm certificate approve

Approve a certificate signing request

Example usage

  1.   # Approve CSR 'csr-sqgzp'
  2.   oc adm certificate approve csr-sqgzp

oc adm certificate deny

Deny a certificate signing request

Example usage

  1.   # Deny CSR 'csr-sqgzp'
  2.   oc adm certificate deny csr-sqgzp

oc adm cordon

Mark node as unschedulable

Example usage

  1.   # Mark node "foo" as unschedulable
  2.   oc adm cordon foo

oc adm create-bootstrap-project-template

Create a bootstrap project template

Example usage

  1.   # Output a bootstrap project template in YAML format to stdout
  2.   oc adm create-bootstrap-project-template -o yaml

oc adm create-error-template

Create an error page template

Example usage

  1.   # Output a template for the error page to stdout
  2.   oc adm create-error-template

oc adm create-login-template

Create a login template

Example usage

  1.   # Output a template for the login page to stdout
  2.   oc adm create-login-template

oc adm create-provider-selection-template

Create a provider selection template

Example usage

  1.   # Output a template for the provider selection page to stdout
  2.   oc adm create-provider-selection-template

oc adm drain

Drain node in preparation for maintenance

Example usage

  1.   # Drain node "foo", even if there are pods not managed by a replication controller, replica set, job, daemon set or stateful set on it
  2.   oc adm drain foo --force
  4.   # As above, but abort if there are pods not managed by a replication controller, replica set, job, daemon set or stateful set, and use a grace period of 15 minutes
  5.   oc adm drain foo --grace-period=900

oc adm groups add-users

Add users to a group

Example usage

  1.   # Add user1 and user2 to my-group
  2.   oc adm groups add-users my-group user1 user2

oc adm groups new

Create a new group

Example usage

  1.   # Add a group with no users
  2.   oc adm groups new my-group
  4.   # Add a group with two users
  5.   oc adm groups new my-group user1 user2
  7.   # Add a group with one user and shorter output
  8.   oc adm groups new my-group user1 -o name

oc adm groups prune

Remove old OpenShift groups referencing missing records from an external provider

Example usage

  1.   # Prune all orphaned groups
  2.   oc adm groups prune --sync-config=/path/to/ldap-sync-config.yaml --confirm
  4.   # Prune all orphaned groups except the ones from the blacklist file
  5.   oc adm groups prune --blacklist=/path/to/blacklist.txt --sync-config=/path/to/ldap-sync-config.yaml --confirm
  7.   # Prune all orphaned groups from a list of specific groups specified in a whitelist file
  8.   oc adm groups prune --whitelist=/path/to/whitelist.txt --sync-config=/path/to/ldap-sync-config.yaml --confirm
  10.   # Prune all orphaned groups from a list of specific groups specified in a whitelist
  11.   oc adm groups prune groups/group_name groups/other_name --sync-config=/path/to/ldap-sync-config.yaml --confirm

oc adm groups remove-users

Remove users from a group

Example usage

  1.   # Remove user1 and user2 from my-group
  2.   oc adm groups remove-users my-group user1 user2

oc adm groups sync

Sync OpenShift groups with records from an external provider

Example usage

  1.   # Sync all groups with an LDAP server
  2.   oc adm groups sync --sync-config=/path/to/ldap-sync-config.yaml --confirm
  4.   # Sync all groups except the ones from the blacklist file with an LDAP server
  5.   oc adm groups sync --blacklist=/path/to/blacklist.txt --sync-config=/path/to/ldap-sync-config.yaml --confirm
  7.   # Sync specific groups specified in a whitelist file with an LDAP server
  8.   oc adm groups sync --whitelist=/path/to/whitelist.txt --sync-config=/path/to/sync-config.yaml --confirm
  10.   # Sync all OpenShift groups that have been synced previously with an LDAP server
  11.   oc adm groups sync --type=openshift --sync-config=/path/to/ldap-sync-config.yaml --confirm
  13.   # Sync specific OpenShift groups if they have been synced previously with an LDAP server
  14.   oc adm groups sync groups/group1 groups/group2 groups/group3 --sync-config=/path/to/sync-config.yaml --confirm

oc adm inspect

Collect debugging data for a given resource

Example usage

  1.   # Collect debugging data for the "openshift-apiserver" clusteroperator
  2.   oc adm inspect clusteroperator/openshift-apiserver
  4.   # Collect debugging data for the "openshift-apiserver" and "kube-apiserver" clusteroperators
  5.   oc adm inspect clusteroperator/openshift-apiserver clusteroperator/kube-apiserver
  7.   # Collect debugging data for all clusteroperators
  8.   oc adm inspect clusteroperator
  10.   # Collect debugging data for all clusteroperators and clusterversions
  11.   oc adm inspect clusteroperators,clusterversions

oc adm migrate template-instances

Update template instances to point to the latest group-version-kinds

Example usage

  1.   # Perform a dry-run of updating all objects
  2.   oc adm migrate template-instances
  4.   # To actually perform the update, the confirm flag must be appended
  5.   oc adm migrate template-instances --confirm

oc adm must-gather

Launch a new instance of a pod for gathering debug information

Example usage

  1.   # Gather information using the default plug-in image and command, writing into ./must-gather.local.<rand>
  2.   oc adm must-gather
  4.   # Gather information with a specific local folder to copy to
  5.   oc adm must-gather --dest-dir=/local/directory
  7.   # Gather audit information
  8.   oc adm must-gather -- /usr/bin/gather_audit_logs
  10.   # Gather information using multiple plug-in images
  11.   oc adm must-gather --image=quay.io/kubevirt/must-gather --image=quay.io/openshift/origin-must-gather
  13.   # Gather information using a specific image stream plug-in
  14.   oc adm must-gather --image-stream=openshift/must-gather:latest
  16.   # Gather information using a specific image, command, and pod-dir
  17.   oc adm must-gather --image=my/image:tag --source-dir=/pod/directory -- myspecial-command.sh

oc adm new-project

Create a new project

Example usage

  1.   # Create a new project using a node selector
  2.   oc adm new-project myproject --node-selector='type=user-node,region=east'

oc adm node-logs

Display and filter node logs

Example usage

  1.   # Show kubelet logs from all masters
  2.   oc adm node-logs --role master -u kubelet
  4.   # See what logs are available in masters in /var/logs
  5.   oc adm node-logs --role master --path=/
  7.   # Display cron log file from all masters
  8.   oc adm node-logs --role master --path=cron

oc adm pod-network isolate-projects

Isolate project network

Example usage

  1.   # Provide isolation for project p1
  2.   oc adm pod-network isolate-projects <p1>
  4.   # Allow all projects with label name=top-secret to have their own isolated project network
  5.   oc adm pod-network isolate-projects --selector='name=top-secret'

oc adm pod-network join-projects

Join project network

Example usage

  1.   # Allow project p2 to use project p1 network
  2.   oc adm pod-network join-projects --to=<p1> <p2>
  4.   # Allow all projects with label name=top-secret to use project p1 network
  5.   oc adm pod-network join-projects --to=<p1> --selector='name=top-secret'

oc adm pod-network make-projects-global

Make project network global

Example usage

  1.   # Allow project p1 to access all pods in the cluster and vice versa
  2.   oc adm pod-network make-projects-global <p1>
  4.   # Allow all projects with label name=share to access all pods in the cluster and vice versa
  5.   oc adm pod-network make-projects-global --selector='name=share'

oc adm policy add-role-to-user

Add a role to users or service accounts for the current project

Example usage

  1.   # Add the 'view' role to user1 for the current project
  2.   oc adm policy add-role-to-user view user1
  4.   # Add the 'edit' role to serviceaccount1 for the current project
  5.   oc adm policy add-role-to-user edit -z serviceaccount1

oc adm policy add-scc-to-group

Add a security context constraint to groups

Example usage

  1.   # Add the 'restricted' security context constraint to group1 and group2
  2.   oc adm policy add-scc-to-group restricted group1 group2

oc adm policy add-scc-to-user

Add a security context constraint to users or a service account

Example usage

  1.   # Add the 'restricted' security context constraint to user1 and user2
  2.   oc adm policy add-scc-to-user restricted user1 user2
  4.   # Add the 'privileged' security context constraint to serviceaccount1 in the current namespace
  5.   oc adm policy add-scc-to-user privileged -z serviceaccount1

oc adm policy scc-review

Check which service account can create a pod

Example usage

  1.   # Check whether service accounts sa1 and sa2 can admit a pod with a template pod spec specified in my_resource.yaml
  2.   # Service Account specified in myresource.yaml file is ignored
  3.   oc adm policy scc-review -z sa1,sa2 -f my_resource.yaml
  5.   # Check whether service accounts system:serviceaccount:bob:default can admit a pod with a template pod spec specified in my_resource.yaml
  6.   oc adm policy scc-review -z system:serviceaccount:bob:default -f my_resource.yaml
  8.   # Check whether the service account specified in my_resource_with_sa.yaml can admit the pod
  9.   oc adm policy scc-review -f my_resource_with_sa.yaml
  11.   # Check whether the default service account can admit the pod; default is taken since no service account is defined in myresource_with_no_sa.yaml
  12.   oc adm policy scc-review -f myresource_with_no_sa.yaml

oc adm policy scc-subject-review

Check whether a user or a service account can create a pod

Example usage

  1.   # Check whether user bob can create a pod specified in myresource.yaml
  2.   oc adm policy scc-subject-review -u bob -f myresource.yaml
  4.   # Check whether user bob who belongs to projectAdmin group can create a pod specified in myresource.yaml
  5.   oc adm policy scc-subject-review -u bob -g projectAdmin -f myresource.yaml
  7.   # Check whether a service account specified in the pod template spec in myresourcewithsa.yaml can create the pod
  8.   oc adm policy scc-subject-review -f myresourcewithsa.yaml

oc adm prune builds

Remove old completed and failed builds

Example usage

  1.   # Dry run deleting older completed and failed builds and also including
  2.   # all builds whose associated build config no longer exists
  3.   oc adm prune builds --orphans
  5.   # To actually perform the prune operation, the confirm flag must be appended
  6.   oc adm prune builds --orphans --confirm

oc adm prune deployments

Remove old completed and failed deployment configs

Example usage

  1.   # Dry run deleting all but the last complete deployment for every deployment config
  2.   oc adm prune deployments --keep-complete=1
  4.   # To actually perform the prune operation, the confirm flag must be appended
  5.   oc adm prune deployments --keep-complete=1 --confirm

oc adm prune groups

Remove old OpenShift groups referencing missing records from an external provider

Example usage

  1.   # Prune all orphaned groups
  2.   oc adm prune groups --sync-config=/path/to/ldap-sync-config.yaml --confirm
  4.   # Prune all orphaned groups except the ones from the blacklist file
  5.   oc adm prune groups --blacklist=/path/to/blacklist.txt --sync-config=/path/to/ldap-sync-config.yaml --confirm
  7.   # Prune all orphaned groups from a list of specific groups specified in a whitelist file
  8.   oc adm prune groups --whitelist=/path/to/whitelist.txt --sync-config=/path/to/ldap-sync-config.yaml --confirm
  10.   # Prune all orphaned groups from a list of specific groups specified in a whitelist
  11.   oc adm prune groups groups/group_name groups/other_name --sync-config=/path/to/ldap-sync-config.yaml --confirm

oc adm prune images

Remove unreferenced images

Example usage

  1.   # See what the prune command would delete if only images and their referrers were more than an hour old
  2.   # and obsoleted by 3 newer revisions under the same tag were considered
  3.   oc adm prune images --keep-tag-revisions=3 --keep-younger-than=60m
  5.   # To actually perform the prune operation, the confirm flag must be appended
  6.   oc adm prune images --keep-tag-revisions=3 --keep-younger-than=60m --confirm
  8.   # See what the prune command would delete if we are interested in removing images
  9.   # exceeding currently set limit ranges ('openshift.io/Image')
  10.   oc adm prune images --prune-over-size-limit
  12.   # To actually perform the prune operation, the confirm flag must be appended
  13.   oc adm prune images --prune-over-size-limit --confirm
  15.   # Force the insecure http protocol with the particular registry host name
  16.   oc adm prune images --registry-url=http://registry.example.org --confirm
  18.   # Force a secure connection with a custom certificate authority to the particular registry host name
  19.   oc adm prune images --registry-url=registry.example.org --certificate-authority=/path/to/custom/ca.crt --confirm

oc adm release extract

Extract the contents of an update payload to disk

Example usage

  1.   # Use git to check out the source code for the current cluster release to DIR
  2.   oc adm release extract --git=DIR
  4.   # Extract cloud credential requests for AWS
  5.   oc adm release extract --credentials-requests --cloud=aws
  7.   # Use git to check out the source code for the current cluster release to DIR from linux/s390x image
  8.   # Note: Wildcard filter is not supported. Pass a single os/arch to extract
  9.   oc adm release extract --git=DIR quay.io/openshift-release-dev/ocp-release:4.2.2 --filter-by-os=linux/s390x

oc adm release info

Display information about a release

Example usage

  1.   # Show information about the cluster's current release
  2.   oc adm release info
  4.   # Show the source code that comprises a release
  5.   oc adm release info 4.2.2 --commit-urls
  7.   # Show the source code difference between two releases
  8.   oc adm release info 4.2.0 4.2.2 --commits
  10.   # Show where the images referenced by the release are located
  11.   oc adm release info quay.io/openshift-release-dev/ocp-release:4.2.2 --pullspecs
  13.   # Show information about linux/s390x image
  14.   # Note: Wildcard filter is not supported. Pass a single os/arch to extract
  15.   oc adm release info quay.io/openshift-release-dev/ocp-release:4.2.2 --filter-by-os=linux/s390x

oc adm release mirror

Mirror a release to a different image registry location

Example usage

  1.   # Perform a dry run showing what would be mirrored, including the mirror objects
  2.   oc adm release mirror 4.3.0 --to myregistry.local/openshift/release \
  3.   --release-image-signature-to-dir /tmp/releases --dry-run
  5.   # Mirror a release into the current directory
  6.   oc adm release mirror 4.3.0 --to file://openshift/release \
  7.   --release-image-signature-to-dir /tmp/releases
  9.   # Mirror a release to another directory in the default location
  10.   oc adm release mirror 4.3.0 --to-dir /tmp/releases
  12.   # Upload a release from the current directory to another server
  13.   oc adm release mirror --from file://openshift/release --to myregistry.com/openshift/release \
  14.   --release-image-signature-to-dir /tmp/releases
  16.   # Mirror the 4.3.0 release to repository registry.example.com and apply signatures to connected cluster
  17.   oc adm release mirror --from=quay.io/openshift-release-dev/ocp-release:4.3.0-x86_64 \
  18.   --to=registry.example.com/your/repository --apply-release-image-signature

oc adm release new

Create a new OpenShift release

Example usage

  1.   # Create a release from the latest origin images and push to a DockerHub repo
  2.   oc adm release new --from-image-stream=4.1 -n origin --to-image docker.io/mycompany/myrepo:latest
  4.   # Create a new release with updated metadata from a previous release
  5.   oc adm release new --from-release registry.svc.ci.openshift.org/origin/release:v4.1 --name 4.1.1 \
  6.   --previous 4.1.0 --metadata ... --to-image docker.io/mycompany/myrepo:latest
  8.   # Create a new release and override a single image
  9.   oc adm release new --from-release registry.svc.ci.openshift.org/origin/release:v4.1 \
  10.   cli=docker.io/mycompany/cli:latest --to-image docker.io/mycompany/myrepo:latest
  12.   # Run a verification pass to ensure the release can be reproduced
  13.   oc adm release new --from-release registry.svc.ci.openshift.org/origin/release:v4.1

oc adm taint

Update the taints on one or more nodes

Example usage

  1.   # Update node 'foo' with a taint with key 'dedicated' and value 'special-user' and effect 'NoSchedule'
  2.   # If a taint with that key and effect already exists, its value is replaced as specified
  3.   oc adm taint nodes foo dedicated=special-user:NoSchedule
  5.   # Remove from node 'foo' the taint with key 'dedicated' and effect 'NoSchedule' if one exists
  6.   oc adm taint nodes foo dedicated:NoSchedule-
  8.   # Remove from node 'foo' all the taints with key 'dedicated'
  9.   oc adm taint nodes foo dedicated-
  11.   # Add a taint with key 'dedicated' on nodes having label mylabel=X
  12.   oc adm taint node -l myLabel=X  dedicated=foo:PreferNoSchedule
  14.   # Add to node 'foo' a taint with key 'bar' and no value
  15.   oc adm taint nodes foo bar:NoSchedule

oc adm top images

Show usage statistics for images

Example usage

  1.   # Show usage statistics for images
  2.   oc adm top images

oc adm top imagestreams

Show usage statistics for image streams

Example usage

  1.   # Show usage statistics for image streams
  2.   oc adm top imagestreams

oc adm top node

Display resource (CPU/memory) usage of nodes

Example usage

  1.   # Show metrics for all nodes
  2.   oc adm top node
  4.   # Show metrics for a given node
  5.   oc adm top node NODE_NAME

oc adm top pod

Display resource (CPU/memory) usage of pods

Example usage

  1.   # Show metrics for all pods in the default namespace
  2.   oc adm top pod
  4.   # Show metrics for all pods in the given namespace
  5.   oc adm top pod --namespace=NAMESPACE
  7.   # Show metrics for a given pod and its containers
  8.   oc adm top pod POD_NAME --containers
  10.   # Show metrics for the pods defined by label name=myLabel
  11.   oc adm top pod -l name=myLabel

oc adm uncordon

Mark node as schedulable

Example usage

  1.   # Mark node "foo" as schedulable
  2.   oc adm uncordon foo

oc adm upgrade

Upgrade a cluster or adjust the upgrade channel

Example usage

  1.   # Review the available cluster updates
  2.   oc adm upgrade
  4.   # Update to the latest version
  5.   oc adm upgrade --to-latest=true

oc adm verify-image-signature

Verify the image identity contained in the image signature

Example usage

  1.   # Verify the image signature and identity using the local GPG keychain
  2.   oc adm verify-image-signature sha256:c841e9b64e4579bd56c794bdd7c36e1c257110fd2404bebbb8b613e4935228c4 \
  3.   --expected-identity=registry.local:5000/foo/bar:v1
  5.   # Verify the image signature and identity using the local GPG keychain and save the status
  6.   oc adm verify-image-signature sha256:c841e9b64e4579bd56c794bdd7c36e1c257110fd2404bebbb8b613e4935228c4 \
  7.   --expected-identity=registry.local:5000/foo/bar:v1 --save
  9.   # Verify the image signature and identity via exposed registry route
  10.   oc adm verify-image-signature sha256:c841e9b64e4579bd56c794bdd7c36e1c257110fd2404bebbb8b613e4935228c4 \
  11.   --expected-identity=registry.local:5000/foo/bar:v1 \
  12.   --registry-url=docker-registry.foo.com
  14.   # Remove all signature verifications from the image
  15.   oc adm verify-image-signature sha256:c841e9b64e4579bd56c794bdd7c36e1c257110fd2404bebbb8b613e4935228c4 --remove-all

Additional resources