Chapter 5. Administrator CLI commands

Bulk collect data about the current state of your cluster to debug issues.

$ oc adm must-gather

oc adm must-gather

Show usage statistics of resources on the server.

$ oc adm top pods

oc adm top pods

$ oc adm top images

oc adm top images

Mark a node as unschedulable. Manually marking a node as unschedulable blocks any new pods from being scheduled on the node, but does not affect existing pods on the node.

$ oc adm cordon node1

oc adm cordon node1

Drain a node in preparation for maintenance.

$ oc adm drain node1

oc adm drain node1

Display and filter node logs.

$ oc adm node-logs --role master -u NetworkManager.service

oc adm node-logs --role master -u NetworkManager.service

Update the taints on one or more nodes.

$ oc adm taint nodes node1 dedicated=groupName:NoSchedule

oc adm taint nodes node1 dedicated=groupName:NoSchedule

$ oc adm taint nodes node1 dedicated-

oc adm taint nodes node1 dedicated-

Mark a node as schedulable.

$ oc adm uncordon node1

oc adm uncordon node1

Approve or reject certificate signing requests (CSRs).

$ oc adm certificate approve csr-sqgzp

oc adm certificate approve csr-sqgzp

Manage groups in your cluster.

$ oc adm groups new my-group

oc adm groups new my-group

Create a new project and specify administrative options.

$ oc adm new-project myproject --node-selector='type=user-node,region=east'

oc adm new-project myproject --node-selector='type=user-node,region=east'

Manage Pod networks in the cluster.

$ oc adm pod-network isolate-projects project1 project2

oc adm pod-network isolate-projects project1 project2

Manage roles and policies on the cluster.

$ oc adm policy add-cluster-role-to-user edit user1

oc adm policy add-cluster-role-to-user edit user1

$ oc adm policy add-scc-to-user privileged -z myserviceaccount

oc adm policy add-scc-to-user privileged -z myserviceaccount

Migrate resources on the cluster to a new version or format depending on the subcommand used.

$ oc adm migrate storage

oc adm migrate storage

$ oc adm migrate storage --include=pods

oc adm migrate storage --include=pods

Remove older versions of resources from the server.

$ oc adm prune builds --orphans

oc adm prune builds --orphans

Create a client configuration for connecting to the server. This creates a folder containing a client certificate, a client key, a server certificate authority, and a kubeconfig file for connecting to the master as the provided user.

$ oc adm create-api-client-config \
  --certificate-authority='/etc/origin/master/proxyca.crt' \
  --client-dir='/etc/origin/master/proxy' \
  --signer-cert='/etc/origin/master/proxyca.crt' \
  --signer-key='/etc/origin/master/proxyca.key' \
  --signer-serial='/etc/origin/master/proxyca.serial.txt' \
  --user='system:proxy'

oc adm create-api-client-config \
  --certificate-authority='/etc/origin/master/proxyca.crt' \
  --client-dir='/etc/origin/master/proxy' \
  --signer-cert='/etc/origin/master/proxyca.crt' \
  --signer-key='/etc/origin/master/proxyca.key' \
  --signer-serial='/etc/origin/master/proxyca.serial.txt' \
  --user='system:proxy'

Create the default bootstrap policy.

$ oc adm create-bootstrap-policy-file --filename=policy.json

oc adm create-bootstrap-policy-file --filename=policy.json

Create a bootstrap project template.

$ oc adm create-bootstrap-project-template -o yaml

oc adm create-bootstrap-project-template -o yaml

Create a template for customizing the error page.

$ oc adm create-error-template

oc adm create-error-template

Creates a basic .kubeconfig file from client certificates.

$ oc adm create-kubeconfig \
  --client-certificate=/path/to/client.crt \
  --client-key=/path/to/client.key \
  --certificate-authority=/path/to/ca.crt

oc adm create-kubeconfig \
  --client-certificate=/path/to/client.crt \
  --client-key=/path/to/client.key \
  --certificate-authority=/path/to/ca.crt

Create a template for customizing the login page.

$ oc adm create-login-template

oc adm create-login-template

Create a template for customizing the provider selection page.

$ oc adm create-provider-selection-template

oc adm create-provider-selection-template

Output the inputs and dependencies of any builds.

$ oc adm build-chain perl

oc adm build-chain perl

Output shell completion code for the oc adm commands for the specified shell.

$ oc adm completion bash

oc adm completion bash

Manage the client configuration files. This command has the same behavior as the oc config command.

$ oc adm config view

oc adm config view

$ oc adm config use-context test-context

oc adm config use-context test-context

Manage various aspects of the OpenShift Container Platform release process, such as viewing information about a release or inspecting the contents of a release.

$ oc adm release info --changelog=/tmp/git \
    quay.io/openshift-release-dev/ocp-release:4.1.0-rc.7 \
    quay.io/openshift-release-dev/ocp-release:4.1.0 \
    > changelog.md

oc adm release info --changelog=/tmp/git \
    quay.io/openshift-release-dev/ocp-release:4.1.0-rc.7 \
    quay.io/openshift-release-dev/ocp-release:4.1.0 \
    > changelog.md

Verify the image signature of an image imported to the internal registry using the local public GPG key.

$ oc adm verify-image-signature \
    sha256:2bba968aedb7dd2aafe5fa8c7453f5ac36a0b9639f1bf5b03f95de325238b288 \
    --expected-identity 172.30.1.1:5000/openshift/nodejs:latest \
    --public-key /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release \
    --save

oc adm verify-image-signature \
    sha256:2bba968aedb7dd2aafe5fa8c7453f5ac36a0b9639f1bf5b03f95de325238b288 \
    --expected-identity 172.30.1.1:5000/openshift/nodejs:latest \
    --public-key /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release \
    --save