OpenShift CLI administrator commands

Cluster management CLI commands

inspect

Gather debugging information for a particular resource.

This command is experimental and might change without notice.

Example: Collect debugging data for the OpenShift API server cluster Operator

  1. $ oc adm inspect clusteroperator/openshift-apiserver

must-gather

Bulk collect data about the current state of your cluster to debug issues.

This command is experimental and might change without notice.

Example: Gather debugging information

  1. $ oc adm must-gather

top

Show usage statistics of resources on the server.

Example: Show CPU and memory usage for pods

  1. $ oc adm top pods

Example: Show usage statistics for images

  1. $ oc adm top images

Node management CLI commands

cordon

Mark a node as unschedulable. Manually marking a node as unschedulable blocks any new pods from being scheduled on the node, but does not affect existing pods on the node.

Example: Mark node1 as unschedulable

  1. $ oc adm cordon node1

drain

Drain a node in preparation for maintenance.

Example: Drain node1

  1. $ oc adm drain node1

node-logs

Display and filter node logs.

Example: Get logs for NetworkManager

  1. $ oc adm node-logs --role master -u NetworkManager.service

taint

Update the taints on one or more nodes.

Example: Add a taint to dedicate a node for a set of users

  1. $ oc adm taint nodes node1 dedicated=groupName:NoSchedule

Example: Remove the taints with key dedicated from node node1

  1. $ oc adm taint nodes node1 dedicated-

uncordon

Mark a node as schedulable.

Example: Mark node1 as schedulable

  1. $ oc adm uncordon node1

Security and policy CLI commands

certificate

Approve or reject certificate signing requests (CSRs).

Example: Approve a CSR

  1. $ oc adm certificate approve csr-sqgzp

groups

Manage groups in your cluster.

Example: Create a new group

  1. $ oc adm groups new my-group

new-project

Create a new project and specify administrative options.

Example: Create a new project using a node selector

  1. $ oc adm new-project myproject --node-selector='type=user-node,region=east'

pod-network

Manage pod networks in the cluster.

Example: Isolate project1 and project2 from other non-global projects

  1. $ oc adm pod-network isolate-projects project1 project2

policy

Manage roles and policies on the cluster.

Example: Add the edit role to user1 for all projects

  1. $ oc adm policy add-cluster-role-to-user edit user1

Example: Add the privileged security context constraint to a service account

  1. $ oc adm policy add-scc-to-user privileged -z myserviceaccount

Maintenance CLI commands

migrate

Migrate resources on the cluster to a new version or format depending on the subcommand used.

Example: Perform an update of all stored objects

  1. $ oc adm migrate storage

Example: Perform an update of only pods

  1. $ oc adm migrate storage --include=pods

prune

Remove older versions of resources from the server.

Example: Prune older builds including those whose build configs no longer exist

  1. $ oc adm prune builds --orphans

Configuration CLI commands

create-bootstrap-project-template

Create a bootstrap project template.

Example: Output a bootstrap project template in YAML format to stdout

  1. $ oc adm create-bootstrap-project-template -o yaml

create-error-template

Create a template for customizing the error page.

Example: Output a template for the error page to stdout

  1. $ oc adm create-error-template

create-kubeconfig

Creates a basic .kubeconfig file from client certificates.

Example: Create a .kubeconfig file with the provided client certificates

  1. $ oc adm create-kubeconfig \
  2. --client-certificate=/path/to/client.crt \
  3. --client-key=/path/to/client.key \
  4. --certificate-authority=/path/to/ca.crt

create-login-template

Create a template for customizing the login page.

Example: Output a template for the login page to stdout

  1. $ oc adm create-login-template

create-provider-selection-template

Create a template for customizing the provider selection page.

Example: Output a template for the provider selection page to stdout

  1. $ oc adm create-provider-selection-template

Other Administrator CLI commands

build-chain

Output the inputs and dependencies of any builds.

Example: Output dependencies for the perl imagestream

  1. $ oc adm build-chain perl

completion

Output shell completion code for the oc adm commands for the specified shell.

Example: Display oc adm completion code for Bash

  1. $ oc adm completion bash

config

Manage the client configuration files. This command has the same behavior as the oc config command.

Example: Display the current configuration

  1. $ oc adm config view

Example: Switch to a different context

  1. $ oc adm config use-context test-context

release

Manage various aspects of the OKD release process, such as viewing information about a release or inspecting the contents of a release.

Example: Generate a changelog between two releases and save to changelog.md

  1. $ oc adm release info --changelog=/tmp/git \
  2. quay.io/openshift-release-dev/ocp-release:4.7.0-x86_64 \
  3. quay.io/openshift-release-dev/ocp-release:4.7.1-x86_64 \
  4. > changelog.md

verify-image-signature

Verify the image signature of an image imported to the internal registry using the local public GPG key.

Example: Verify the nodejs image signature

  1. $ oc adm verify-image-signature \
  2. sha256:2bba968aedb7dd2aafe5fa8c7453f5ac36a0b9639f1bf5b03f95de325238b288 \
  3. --expected-identity 172.30.1.1:5000/openshift/nodejs:latest \
  4. --public-key /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release \
  5. --save