The OADP command-line interface (CLI) is a tool for managing backup and restore operations on an OpenShift Container Platform cluster. It is available as an oc plugin (oc oadp).

• You have access to an OpenShift Container Platform cluster with the OADP Operator installed.

The OADP CLI is available from the Command-line tools page in the OpenShift web console when the OADP Operator is installed.

1. Log in to the OpenShift web console as a user with access to the cluster.
2. Click the ? icon in the toolbar and select Command-line tools.
3. Download the oc-oadp binary for your operating system and architecture.
4. Extract the archive and place the oc-oadp binary in a directory on your PATH.
5. Verify the installation by running the following command:

$ oc oadp version

After installing the OADP CLI, you must run the setup command to configure it for your user permissions. The setup command automatically detects whether you have cluster-wide administrator permissions and configures the CLI accordingly.

The CLI operates in one of two modes:

• Admin mode: Provides access to cluster-wide Velero backup and restore commands.
• Non-admin mode: Provides access to namespace-scoped self-service backup and restore commands.

• You installed the OADP CLI.
• You are logged in to the OpenShift cluster with oc login.

1. Run the setup command to auto-detect your permissions and configure the CLI:

$ oc oadp setup

The CLI checks whether you can create backups.velero.io resources across all namespaces. If you can, admin mode is enabled. Otherwise, non-admin mode is enabled.

Configuration is saved to ~/.config/velero/config.json.

2. To reconfigure the CLI, for example after a change in permissions, run the setup command with the --force flag:

$ oc oadp setup --force

• Run oc oadp --help to confirm that the available commands match your configured mode.

Note: OADP CLI commands support both noun-verb and verb-noun ordering (e.g., oc oadp backup create and oc oadp create backup). Both forms are equivalent.

You can use the OADP CLI to view and modify client configuration settings. Configuration is stored in ~/.config/velero/config.json.

• The OADP CLI is installed.

You view the current client configuration by running the following command:

$ oc oadp client config get

You set a configuration value by running the following command:

$ oc oadp client config set <key>=<value>

Example:

$ oc oadp client config set namespace=openshift-adp

You can use the OADP CLI to generate and install shell completion scripts for command auto-completion.

• The OADP CLI is installed.

You install shell completions automatically by running the following command:

$ oc oadp completion install [flags]

The install subcommand writes completion scripts to the appropriate location for your shell and updates your shell profile if needed.

Example:

$ oc oadp completion install --shell zsh

You generate a shell completion script without installing it by running the following command:

$ oc oadp completion bash
$ oc oadp completion zsh
$ oc oadp completion fish
$ oc oadp completion powershell

You can redirect the output to a file or source it directly. For example:

$ oc oadp completion bash > /etc/bash_completion.d/oc-oadp

The administrator perspective provides cluster-wide backup and restore operations using Velero resources. These commands are available when the OADP CLI is configured in admin mode.

You can use the OADP CLI to create, view, describe, download, and delete backups.

• The OADP CLI is installed and configured in admin mode.
• You are logged in to the OpenShift cluster as a user with cluster-admin privileges.

You create a backup of cluster resources by running the following command:

$ oc oadp backup create <backup_name> [flags]

Example:

$ oc oadp backup create my-backup \
    --include-namespaces my-namespace \
    --snapshot-volumes \
    --ttl 720h

You list all backups by running the following command:

$ oc oadp backup get [<backup_name>] [flags]

You describe a backup to view its details by running the following command:

$ oc oadp backup describe <backup_name> [flags]

You view the logs for a backup by running the following command:

$ oc oadp backup logs <backup_name>

You download the contents of a backup by running the following command:

$ oc oadp backup download <backup_name> [flags]

You delete a backup by running the following command:

$ oc oadp backup delete <backup_name> [flags]

You can use the OADP CLI to create, view, describe, and delete restores.

• The OADP CLI is installed and configured in admin mode.
• You are logged in to the OpenShift cluster as a user with cluster-admin privileges.
• A completed backup exists to restore from.

You create a restore from an existing backup by running the following command:

$ oc oadp restore create <restore_name> [flags]

Example:

$ oc oadp restore create my-restore \
    --from-backup my-backup \
    --include-namespaces my-namespace

You list all restores by running the following command:

$ oc oadp restore get [<restore_name>] [flags]

You describe a restore to view its details by running the following command:

$ oc oadp restore describe <restore_name> [flags]

You view the logs for a restore by running the following command:

$ oc oadp restore logs <restore_name>

You delete a restore by running the following command:

$ oc oadp restore delete <restore_name> [flags]

You can use the OADP CLI to create, view, describe, and delete backup schedules. Schedules automate the creation of backups at specified intervals using a cron expression.

• The OADP CLI is installed and configured in admin mode.
• You are logged in to the OpenShift cluster as a user with cluster-admin privileges.

You create a backup schedule by running the following command:

$ oc oadp schedule create <schedule_name> [flags]

Example:

$ oc oadp schedule create daily-backup \
    --schedule "0 1 * * *" \
    --include-namespaces my-namespace \
    --ttl 720h

You list all schedules by running the following command:

$ oc oadp schedule get [<schedule_name>] [flags]

You describe a schedule to view its details by running the following command:

$ oc oadp schedule describe <schedule_name> [flags]

You delete a schedule by running the following command:

$ oc oadp schedule delete <schedule_name> [flags]

You can use the OADP CLI to create, view, set, and delete backup storage locations (BSLs). Backup storage locations define where backup data is stored, such as an object storage bucket.

• The OADP CLI is installed and configured in admin mode.
• You are logged in to the OpenShift cluster as a user with cluster-admin privileges.

You create a backup storage location by running the following command:

$ oc oadp backup-location create <bsl_name> [flags]

Example:

$ oc oadp backup-location create my-bsl \
    --provider aws \
    --bucket my-velero-bucket \
    --prefix velero \
    --credential cloud-credentials=cloud

You list all backup storage locations by running the following command:

$ oc oadp backup-location get [<bsl_name>] [flags]

You set the default backup storage location by running the following command:

$ oc oadp backup-location set <bsl_name> [flags]

You delete a backup storage location by running the following command:

$ oc oadp backup-location delete <bsl_name> [flags]

You can use the OADP CLI to create, view, set, and delete volume snapshot locations (VSLs). Volume snapshot locations define where PersistentVolume snapshots are stored.

• The OADP CLI is installed and configured in admin mode.
• You are logged in to the OpenShift cluster as a user with cluster-admin privileges.

You create a volume snapshot location by running the following command:

$ oc oadp snapshot-location create <vsl_name> [flags]

Example:

$ oc oadp snapshot-location create my-vsl \
    --provider aws \
    --config region=us-east-1

You list all volume snapshot locations by running the following command:

$ oc oadp snapshot-location get [<vsl_name>] [flags]

You set the default volume snapshot location by running the following command:

$ oc oadp snapshot-location set <vsl_name> [flags]

You delete a volume snapshot location by running the following command:

$ oc oadp snapshot-location delete <vsl_name> [flags]

When the OADP Operator is configured with nonAdmin.requireApprovalForBSL: true, non-admin users who create a NonAdminBackupStorageLocation (NABSL) trigger an approval request in the OADP namespace. You can use the OADP CLI to view, describe, approve, and reject these requests.

• The OADP CLI is installed and configured in admin mode.
• You are logged in to the OpenShift cluster as a user with cluster-admin privileges.
• The DPA is configured with nonAdmin.enable: true and nonAdmin.requireApprovalForBSL: true.

You list all pending approval requests by running the following command:

$ oc oadp nabsl-request get [<request_name>] [flags]

The output displays the request name, namespace, phase, requested NABSL name, requested namespace, and age.

Example:

$ oc oadp nabsl-request get

You describe an approval request to view its full details, including the requested backup storage location spec, by running the following command:

$ oc oadp nabsl-request describe <request_name>

You can specify the request by either the NABSL name or the full UUID.

Example:

$ oc oadp nabsl-request describe my-bsl-request

You approve a pending request to allow the controller to create the corresponding BackupStorageLocation by running the following command:

$ oc oadp nabsl-request approve <request_name> [flags]

You can specify the request by either the NABSL name or the full UUID.

Example:

$ oc oadp nabsl-request approve user-test-bsl --reason "Approved for production use"

You reject a pending request to deny the user's request for a backup storage location by running the following command:

$ oc oadp nabsl-request reject <request_name> [flags]

You can specify the request by either the NABSL name or the full UUID.

Example:

$ oc oadp nabsl-request reject user-test-bsl --reason "Invalid configuration"

You can use the OADP CLI to collect diagnostic information for OADP installations. The must-gather command runs the OADP must-gather tool to collect logs and cluster state information needed for troubleshooting and support cases.

• The OADP CLI is installed and configured in admin mode.
• You are logged in to the OpenShift cluster as a user with cluster-admin privileges.
• The oc CLI is installed and available on your PATH.

You collect OADP diagnostic information by running the following command:

$ oc oadp must-gather [flags]

The diagnostic bundle is saved to the specified directory.

Example:

$ oc oadp must-gather --dest-dir=/tmp/oadp-diagnostics --request-timeout=1m

OADP self-service enables non-administrator users to perform backup and restore operations in their authorized namespaces without requiring cluster-wide administrator privileges. This feature provides secure self-service data protection capabilities while maintaining proper administrator controls over backup and restore operations.

• Create and manage namespace-scoped backups and restores.
• View backup and restore status and logs.
• Create dedicated backup storage locations with user-owned buckets and credentials.

• Cross-cluster operations and migrations are not supported for non-admin users.
• Non-admin volume snapshot locations (VSLs) are not supported. The VSL created by the cluster administrator in the DPA is used.
• Backups and restores are scoped to the namespace from which the command is run. You cannot specify a different namespace.
• Cluster-scoped resources cannot be included in backups or restores.
• ResourceModifiers and volume policies are not supported for non-admin backup and restore operations.
• Backup and restore logs via NonAdminDownloadRequest are not supported for default BSLs. NonAdminBackupStorageLocations must be created to access logs.

Before using OADP self-service, the cluster administrator must have completed the following:

• Installed and configured the OADP Operator with nonAdmin.enable: true in the DPA spec.
• Created your user account, namespace, and namespace privileges (e.g., namespace admin).
• Granted editor roles for the following resources in your namespace:
  • nonadminbackups.oadp.openshift.io
  • nonadminrestores.oadp.openshift.io
  • nonadminbackupstoragelocations.oadp.openshift.io
  • nonadmindownloadrequests.oadp.openshift.io
• Optionally created a NonAdminBackupStorageLocation for your namespace.

You can use the OADP CLI to create, view, describe, and delete non-admin backups in your namespace.

• The OADP CLI is installed and configured in non-admin mode.
• You are logged in to the OpenShift cluster and your current namespace context is set to the namespace you want to back up.
• You have editor roles for nonadminbackups.oadp.openshift.io in your namespace.
• A NonAdminBackupStorageLocation exists in your namespace, or a default has been configured with oc oadp client config set default-nabsl=<name>.

You create a backup of resources in your current namespace by running the following command:

$ oc oadp nonadmin backup create <backup_name> [flags]

Example:

$ oc oadp nonadmin backup create my-backup \
    --storage-location my-nabsl \
    --include-resources deployments,services \
    --selector app=myapp \
    --snapshot-volumes \
    --ttl 720h

Tip: To avoid specifying the storage location each time, run oc oadp client config set default-nabsl=<NABSL_NAME> to set a default.

You list all backups in your current namespace by running the following command:

$ oc oadp nonadmin backup get [<backup_name>] [flags]

You describe a backup to view its details by running the following command:

$ oc oadp nonadmin backup describe <backup_name> [flags]

You view the logs for a backup by running the following command:

$ oc oadp nonadmin backup logs <backup_name> [flags]

Note: Backup logs are only available when using a NonAdminBackupStorageLocation. Logs are not available for backups that use the default cluster BSL. Using the default cluster BSL is not recommended.

You delete one or more backups by running the following command:

$ oc oadp nonadmin backup delete [<backup_name>...] | --all [flags]

The actual backup deletion is performed asynchronously by the OADP nonadmin controller.

Example:

$ oc oadp nonadmin backup delete my-backup --confirm

You can use the OADP CLI to create, view, describe, and delete non-admin restores in your namespace.

• The OADP CLI is installed and configured in non-admin mode.
• You are logged in to the OpenShift cluster and your current namespace context is set to the namespace you want to restore to.
• You have editor roles for nonadminrestores.oadp.openshift.io in your namespace.
• A completed non-admin backup exists to restore from.

You create a restore from an existing non-admin backup by running the following command:

$ oc oadp nonadmin restore create [<restore_name>] [flags]

The restore name is optional. If not provided, a name is automatically generated.

Example:

$ oc oadp nonadmin restore create my-restore \
    --backup-name my-backup \
    --include-resources deployments,services \
    --selector app=myapp

You list all restores in your current namespace by running the following command:

$ oc oadp nonadmin restore get [<restore_name>] [flags]

You describe a restore to view its details by running the following command:

$ oc oadp nonadmin restore describe <restore_name> [flags]

You view the logs for a restore by running the following command:

$ oc oadp nonadmin restore logs <restore_name> [flags]

Note: Restore logs are only available when using a NonAdminBackupStorageLocation. Logs are not available for restores associated with backups that use the default cluster BSL. Using the default cluster BSL is not recommended.

You delete one or more restores by running the following command:

$ oc oadp nonadmin restore delete [<restore_name>...] | --all [flags]

The actual restore deletion is performed asynchronously by the OADP nonadmin controller.

Example:

$ oc oadp nonadmin restore delete my-restore --confirm

You can use the OADP CLI to create and view NonAdminBackupStorageLocations (NABSLs) in your namespace. NABSLs define where your backup data is stored using object storage that you own.

Note: Updating or deleting NABSLs after creation is not supported for non-admin users.

• The OADP CLI is installed and configured in non-admin mode.
• You are logged in to the OpenShift cluster and your current namespace context is set to the target namespace.
• You have editor roles for nonadminbackupstoragelocations.oadp.openshift.io in your namespace.
• You have a Kubernetes Secret in your namespace containing the credentials for your object storage provider.

You create a backup storage location by running the following command:

$ oc oadp nonadmin bsl create <bsl_name> [flags]

If the cluster administrator has enabled requireApprovalForBSL, the NABSL will remain in a pending state until an administrator approves the request.

Example:

$ oc oadp nonadmin bsl create my-storage \
    --provider aws \
    --bucket my-velero-bucket \
    --prefix velero-backups \
    --credential cloud-credentials=cloud \
    --region us-east-1

Tip: After creating a BSL, run oc oadp client config set default-nabsl=<BSL_NAME> to set it as the default and avoid specifying the storage location on each backup.

You list all backup storage locations in your current namespace by running the following command:

$ oc oadp nonadmin bsl get [<bsl_name>] [flags]