oc cheat sheet: everyday OpenShift CLI commands

oc contains all of kubectl, so get, describe, apply, logs, exec and the rest behave as you know them. This sheet focuses on the commands and flags that are specific to OpenShift or most useful there. Add -n PROJECT to any project-scoped command to run it somewhere other than the current project.

Session and projects

oc login https://api.cluster.example.com:6443 -u developer
oc login https://api.cluster.example.com:6443 --web
oc whoami
oc logout
oc projects
oc project shop-dev
oc new-project shop-dev --display-name="Shop (dev)"
oc status --suggest

Create applications

oc new-app registry.access.redhat.com/ubi9/httpd-24 --name=web
oc new-app registry.access.redhat.com/ubi9/python-311~https://github.com/example/api.git --name=api
oc new-app https://github.com/example/app.git --strategy=docker
oc new-app --list
oc new-app -f template.yaml -p PARAM=value

Builds and image streams

oc get bc,builds,is
oc start-build api --follow
oc start-build api --from-dir=.
oc logs -f bc/api
oc cancel-build bc/api
oc tag api:latest api:prod
oc import-image api --all

Deployments

oc get deploy,rs,pods -o wide
oc rollout status deployment/web
oc rollout restart deployment/web
oc rollout undo deployment/web
oc scale deployment/web --replicas=3
oc set image deployment/web web=registry.example.com/web:1.2
oc set resources deployment/web --limits=cpu=500m,memory=512Mi
oc set probe deployment/web --readiness --get-url=http://:8080/healthz

Routes and services

oc expose service/web
oc create route edge web --service=web --insecure-policy=Redirect
oc create route passthrough web-tls --service=web --port=8443
oc create route reencrypt web-secure --service=web
oc get route web -o jsonpath='{.spec.host}'

Configuration and storage

oc create configmap web-config --from-file=app.properties
oc create secret generic db-cred --from-env-file=db.env
oc set env deployment/web --from=secret/db-cred --prefix=DB_
oc set env deployment/web --list
oc set data secret/db-cred password=CHANGE_ME
oc set volume deployment/web --add --name=data --type=persistentVolumeClaim --claim-name=web-data --mount-path=/data
oc set volume deployment/web
oc extract secret/db-cred --to=-

Debugging

oc get events --sort-by=.lastTimestamp
oc describe pod POD
oc logs POD --previous
oc logs -f deployment/web --all-containers
oc rsh POD
oc exec POD -- env
oc debug deployment/web
oc port-forward svc/web 8080:8080
oc rsync POD:/var/log/app ./logs

oc debug starts a copy of the pod with a shell instead of the normal command, which is ideal for a container that crashes on start.

Permissions

oc auth can-i create deployments -n shop-dev
oc auth can-i list pods -n shop-dev --as=system:serviceaccount:shop-dev:builder
oc adm policy add-role-to-user edit alice -n shop-dev
oc adm policy who-can delete pods -n shop-dev
oc get rolebindings -n shop-dev
oc get pod POD -o jsonpath='{.metadata.annotations.openshift\.io/scc}'

Cluster administration (cluster-admin)

oc get clusterversion
oc adm upgrade
oc get clusteroperators
oc get nodes -o wide
oc adm top nodes
oc get machineconfigpools
oc get csr
oc adm cordon NODE
oc adm drain NODE --ignore-daemonsets --delete-emptydir-data
oc adm uncordon NODE
oc debug node/NODE
oc adm must-gather

Warning: oc adm drain evicts every pod from a node and --delete-emptydir-data discards their emptyDir data. Check what runs there first with oc get pods -A -o wide --field-selector spec.nodeName=NODE.

Output tricks

oc get pods -o wide
oc get deployment web -o yaml
oc get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.phase}{"\n"}{end}'
oc get pods -l app=web --show-labels
oc explain route.spec.tls
oc api-resources | grep openshift.io

Official documentation

• OpenShift CLI developer command reference
• OpenShift CLI administrator command reference
• Getting started with the OpenShift CLI