0. First: audit your local oc
Run this first on your machine:
oc version
oc help
oc adm -h
oc api-resources
oc api-versions
For any command:
oc <command> --help
oc adm <command> --help
Code language: HTML, XML (xml)Use this style for labs:
oc get pods -n myproject
oc get pods -o wide
oc get pods -o yaml
oc get pods -o json
Code language: JavaScript (javascript)Most useful global patterns:
| Pattern | Why use it | Example |
|---|---|---|
-n <namespace> | Run command in a specific namespace/project | oc get pods -n myproject |
-A / --all-namespaces | Query across namespaces | oc get pods -A |
-o wide | Show extra columns | oc get pods -o wide |
-o yaml | Export full YAML | oc get deployment web -o yaml |
-o json | Export full JSON | oc get pod web -o json |
--dry-run=client -o yaml | Generate YAML without creating | oc create deployment web --image=nginx --dry-run=client -o yaml |
-l key=value | Select by label | oc get pods -l app=web |
--watch | Watch changes live | oc get pods --watch |
--as <user> | Test as another user, if permitted | oc auth can-i get pods --as alice |
1. Core OpenShift workflow
This is the daily flow for almost every lab:
oc login https://api.crc.testing:6443 -u developer -p developer
oc whoami
oc new-project demo
oc new-app python:3.9~https://github.com/openshift-instruqt/blog-django-py --name=blog
oc status
oc get all
oc logs -f deployment/blog
oc expose service/blog
oc get route
oc delete all -l app=blog
Code language: JavaScript (javascript)Expected output shape:
Login successful.
Now using project "demo" on server "https://api.crc.testing:6443".
deployment.apps/blog created
service/blog created
route.route.openshift.io/blog exposed
NAME HOST/PORT PATH SERVICES PORT
blog blog-demo.apps-crc.testing blog 8080
Code language: JavaScript (javascript)Red Hat’s official common-task examples include project creation, app creation, pod listing, log viewing, project switching, and status checking. (Red Hat Documentation)
OC Commands workflow – a complete one.
# ============================================================
# OpenShift oc Top 50 Commands - One Complete Hands-on Flow
# Sample app: Python/Django app from GitHub using OpenShift S2I
# Tested style: OpenShift 4.x / CRC / OpenShift Local friendly
# ============================================================
# ------------------------------------------------------------
# Phase 1: Verify oc client and cluster access
# ------------------------------------------------------------
# 1. Show oc client and OpenShift server version
oc version
# 2. Show all available oc commands
oc help
# 3. Show help for a specific command
oc new-app --help
# 4. List API resources available in the cluster
oc api-resources
# 5. List API versions available in the cluster
oc api-versions
# 6. Explain a Kubernetes/OpenShift resource field
oc explain deployment.spec.replicas
# ------------------------------------------------------------
# Phase 2: Login and identity
# For CRC/OpenShift Local, get credentials using:
# crc console --credentials
# ------------------------------------------------------------
# 7. Log in to OpenShift cluster
oc login https://api.crc.testing:6443 -u developer -p developer
# 8. Show the currently logged-in user
oc whoami
# 9. Show current authentication/session information
oc auth whoami
# 10. Check whether current user can create projects
oc auth can-i create project
# 11. Show current kubeconfig context
oc config current-context
# 12. Show kubeconfig details
oc config view
# ------------------------------------------------------------
# Phase 3: Create and enter a project
# ------------------------------------------------------------
# 13. Create a new project and switch into it
oc new-project oc-top50-demo
# 14. Show current project
oc project
# 15. List all projects you can access
oc projects
# 16. Check whether current user can create pods in this project
oc auth can-i create pods
# 17. Show all resources in the empty project
oc get all
# ------------------------------------------------------------
# Phase 4: Deploy one sample application from GitHub source code
# ------------------------------------------------------------
# 18. Create application from GitHub source using Python 3.9 S2I builder
oc new-app python:3.9~https://github.com/openshift-instruqt/blog-django-py --name=blog
# 19. Show high-level application status
oc status
# 20. List all main resources created by new-app
oc get all
# 21. Watch pods while build and deployment happen
oc get pods --watch
# Press Ctrl+C after the pod becomes Running
# ------------------------------------------------------------
# Phase 5: Inspect build, deployment, pods, service
# ------------------------------------------------------------
# 22. List builds
oc get builds
# 23. List build configs
oc get buildconfig
# 24. Follow logs from the latest build
oc logs -f bc/blog
# 25. List deployments
oc get deployment
# 26. List replica sets
oc get replicaset
# 27. List pods with node and IP details
oc get pods -o wide
# 28. Save the first blog pod name into a shell variable
POD=$(oc get pods -l app=blog -o jsonpath='{.items[0].metadata.name}')
# 29. Print selected pod name
echo $POD
# 30. Describe the selected pod for troubleshooting details
oc describe pod/$POD
# 31. Show logs from the selected pod
oc logs pod/$POD
# 32. Follow live logs from the deployment
oc logs -f deployment/blog
# 33. List services
oc get service
# 34. Describe the blog service
oc describe service/blog
# 35. List endpoints behind the service
oc get endpoints blog
# ------------------------------------------------------------
# Phase 6: Expose the application with an OpenShift Route
# ------------------------------------------------------------
# 36. Expose the service as an OpenShift route
oc expose service/blog
# 37. List routes
oc get route
# 38. Show only the route hostname
oc get route blog -o jsonpath='{.spec.host}{"\n"}'
# 39. Test the route from your local terminal
curl -I http://$(oc get route blog -o jsonpath='{.spec.host}')
# ------------------------------------------------------------
# Phase 7: Debug and interact with the running app
# ------------------------------------------------------------
# 40. Execute a simple command inside the pod
oc exec pod/$POD -- pwd
# 41. List files inside the pod
oc exec pod/$POD -- ls -la
# 42. Show environment variables inside the pod
oc exec pod/$POD -- env
# 43. Open an interactive remote shell inside the pod
oc rsh pod/$POD
# Type exit to leave the remote shell:
# exit
# 44. Port-forward local port 8080 to the pod port 8080
oc port-forward pod/$POD 8080:8080
# Open another terminal and test:
# curl -I http://localhost:8080
# Press Ctrl+C to stop port-forward
# ------------------------------------------------------------
# Phase 8: Modify application configuration
# ------------------------------------------------------------
# 45. Add an environment variable to the deployment
oc set env deployment/blog APP_MODE=demo
# 46. Verify the environment variable was added
oc set env deployment/blog --list
# 47. Restart the deployment so changes are applied cleanly
oc rollout restart deployment/blog
# 48. Watch rollout status
oc rollout status deployment/blog
# 49. Scale the application to 2 replicas
oc scale deployment/blog --replicas=2
# 50. Verify pods after scaling
oc get pods -o wide
# ============================================================
# Optional cleanup after finishing the lab
# ============================================================
# Delete all app resources with label app=blog
oc delete all -l app=blog
# Delete the route if it still exists
oc delete route blog
# Delete the project
oc delete project oc-top50-demoCode language: PHP (php)2. Developer command master table
This table covers the official OpenShift CLI developer command set from the Red Hat 4.22 reference. Red Hat describes this section as commands developers use to create, deploy, and manage applications. (Red Hat Documentation)
| Command | Why / When to Use | Example | Expected Output Shape |
|---|---|---|---|
oc annotate | Add/update/remove annotations on resources | oc annotate pod/foo description='my frontend' | pod/foo annotated |
oc api-resources | List supported API resources | oc api-resources -o wide | Table: NAME SHORTNAMES APIVERSION NAMESPACED KIND |
oc api-versions | List supported API groups/versions | oc api-versions | Lines like apps/v1, route.openshift.io/v1 |
oc apply | Apply declarative YAML/JSON | oc apply -f app.yaml | deployment.apps/web configured |
oc apply edit-last-applied | Edit last-applied config annotation | oc apply edit-last-applied deployment/web | Opens editor |
oc apply set-last-applied | Set last-applied config from file | oc apply set-last-applied -f app.yaml | deployment.apps/web configured |
oc apply view-last-applied | View last-applied config | oc apply view-last-applied deployment/web | YAML/JSON manifest |
oc attach | Attach to running container process | oc attach pod/web -c app | Streams process output |
oc auth can-i | Check RBAC permissions | oc auth can-i create pods | yes / no |
oc auth reconcile | Reconcile RBAC objects from file | oc auth reconcile -f rbac.yaml | RBAC objects reconciled |
oc auth whoami | Show current auth/session info | oc auth whoami | Current user/session details |
oc autoscale | Create/update HPA | oc autoscale deployment/web --min=1 --max=5 --cpu-percent=80 | horizontalpodautoscaler.autoscaling/web autoscaled |
oc cancel-build | Cancel running/pending build | oc cancel-build bc/web | build.build.openshift.io/web-1 cancelled |
oc cluster-info | Show cluster endpoints | oc cluster-info | API/control plane endpoint summary |
oc cluster-info dump | Dump cluster info for troubleshooting | oc cluster-info dump | Large diagnostic output/files |
oc completion | Generate shell completion | oc completion zsh | Shell completion script |
oc config current-context | Show active kubeconfig context | oc config current-context | Context name |
oc config delete-cluster | Remove cluster from kubeconfig | oc config delete-cluster mycluster | deleted cluster mycluster |
oc config delete-context | Remove context from kubeconfig | oc config delete-context mycontext | deleted context mycontext |
oc config delete-user | Remove user from kubeconfig | oc config delete-user developer | deleted user developer |
oc config get-clusters | List kubeconfig clusters | oc config get-clusters | Cluster names |
oc config get-contexts | List kubeconfig contexts | oc config get-contexts | Context table |
oc config get-users | List kubeconfig users | oc config get-users | User names |
oc config new-admin-kubeconfig | Create admin kubeconfig from certs | oc config new-admin-kubeconfig | Kubeconfig YAML |
oc config new-kubelet-bootstrap-kubeconfig | Create kubelet bootstrap kubeconfig | oc config new-kubelet-bootstrap-kubeconfig | Kubeconfig YAML |
oc config refresh-ca-bundle | Refresh CA bundle in kubeconfig | oc config refresh-ca-bundle | Updated kubeconfig |
oc config rename-context | Rename context | oc config rename-context old new | Context renamed |
oc config set | Set raw kubeconfig property | oc config set current-context mycontext | Property updated |
oc config set-cluster | Set cluster entry | oc config set-cluster crc --server=https://api.crc.testing:6443 | Cluster configured |
oc config set-context | Set context entry | oc config set-context demo --namespace=demo | Context configured |
oc config set-credentials | Set user credentials | oc config set-credentials dev --token=<token> | User configured |
oc config unset | Remove kubeconfig property | oc config unset users.dev.token | Property unset |
oc config use-context | Switch context | oc config use-context crc | Switched to context "crc" |
oc config view | View kubeconfig | oc config view | Kubeconfig YAML |
oc cp | Copy files to/from pod | oc cp pod/web:/tmp/log.txt ./log.txt | File copied |
oc create | Create resource from file/stdin | oc create -f app.yaml | resource/name created |
oc create build | Create build config | oc create build docker --name=web --binary | buildconfig.build.openshift.io/web created |
oc create clusterresourcequota | Create cluster-wide quota | oc create clusterresourcequota team-quota --project-label-selector=team=a | Quota created |
oc create clusterrole | Create ClusterRole | oc create clusterrole pod-reader --verb=get,list --resource=pods | ClusterRole created |
oc create clusterrolebinding | Bind ClusterRole cluster-wide | oc create clusterrolebinding read-pods --clusterrole=pod-reader --user=alice | Binding created |
oc create configmap | Create ConfigMap | oc create configmap app-config --from-literal=ENV=dev | ConfigMap created |
oc create cronjob | Create CronJob | oc create cronjob hello --image=busybox --schedule='*/5 * * * *' -- echo hi | CronJob created |
oc create deployment | Create Deployment | oc create deployment web --image=nginx | Deployment created |
oc create deploymentconfig | Create OpenShift DeploymentConfig | oc create deploymentconfig web --image=nginx | DeploymentConfig created |
oc create identity | Create identity object | oc create identity htpasswd:alice | Identity created |
oc create imagestream | Create ImageStream | oc create imagestream nginx | ImageStream created |
oc create imagestreamtag | Create ImageStreamTag | oc create imagestreamtag nginx:latest --from-image=nginx:latest | ImageStreamTag created |
oc create ingress | Create Ingress | oc create ingress web --rule='web.example.com/*=web:80' | Ingress created |
oc create job | Create Job | oc create job pi --image=perl -- perl -Mbignum=bpi -wle 'print bpi(20)' | Job created |
oc create namespace | Create namespace | oc create namespace demo | Namespace created |
oc create poddisruptionbudget | Create PDB | oc create poddisruptionbudget web-pdb --selector=app=web --min-available=1 | PDB created |
oc create priorityclass | Create PriorityClass | oc create priorityclass high --value=1000 | PriorityClass created |
oc create quota | Create ResourceQuota | oc create quota compute --hard=pods=10,cpu=4,memory=8Gi | Quota created |
oc create role | Create Role | oc create role pod-reader --verb=get,list --resource=pods | Role created |
oc create rolebinding | Bind Role | oc create rolebinding read-pods --role=pod-reader --user=alice | RoleBinding created |
oc create route edge | Create edge TLS route | oc create route edge web --service=web | Route created |
oc create route passthrough | Create passthrough TLS route | oc create route passthrough web --service=web | Route created |
oc create route reencrypt | Create re-encrypt TLS route | oc create route reencrypt web --service=web | Route created |
oc create secret docker-registry | Create registry pull secret | oc create secret docker-registry regcred --docker-server=quay.io --docker-username=u --docker-password=p | Secret created |
oc create secret generic | Create generic secret | oc create secret generic db --from-literal=password=secret | Secret created |
oc create secret tls | Create TLS secret | oc create secret tls web-tls --cert=tls.crt --key=tls.key | Secret created |
oc create service clusterip | Create ClusterIP Service | oc create service clusterip web --tcp=8080:8080 | Service created |
oc create service externalname | Create ExternalName Service | oc create service externalname ext --external-name=example.com | Service created |
oc create service loadbalancer | Create LoadBalancer Service | oc create service loadbalancer web --tcp=80:8080 | Service created |
oc create service nodeport | Create NodePort Service | oc create service nodeport web --tcp=80:8080 | Service created |
oc create serviceaccount | Create ServiceAccount | oc create serviceaccount builder-sa | ServiceAccount created |
oc create token | Request ServiceAccount token | oc create token builder-sa | Token string |
oc create user | Create User object | oc create user alice | User created |
oc create useridentitymapping | Map user to identity | oc create useridentitymapping htpasswd:alice alice | Mapping created |
oc debug | Debug pod/node/resource | oc debug deployment/web | Debug pod/session created |
oc delete | Delete resources | oc delete pod web-abc123 | pod "web-abc123" deleted |
oc describe | Detailed human-readable resource info | oc describe pod web-abc123 | Events, labels, containers, conditions |
oc diff | Preview server-side changes | oc diff -f app.yaml | Unix diff output |
oc edit | Edit live resource in editor | oc edit deployment/web | Resource updated or unchanged |
oc events | Show events | oc events | Event table |
oc exec | Run command in container | oc exec deploy/web -- ls /tmp | Command output |
oc explain | Explain API fields | oc explain deployment.spec.replicas | Field docs |
oc expose | Create Service or Route from existing object | oc expose deployment/web --port=8080 | Service created |
oc extract | Extract ConfigMap/Secret contents | oc extract secret/db --to=./secrets | Files written |
oc get | List/read resources | oc get pods -o wide | Resource table |
oc get-token | Start OIDC/auth-code token flow | oc get-token --client-id=client-id --issuer-url=test.issuer.url | Token/auth output |
oc idle | Scale idlable resources to zero | oc idle service/web | Resources idled |
oc image append | Add layers to images | oc image append --from mysql:latest --to registry/image:latest layer.tar.gz | Image pushed/written |
oc image extract | Copy files from image to filesystem | oc image extract docker.io/library/busybox:latest --path /:/tmp/busybox | Files extracted |
oc image info | Inspect image metadata | oc image info quay.io/openshift/cli:latest | Image metadata |
oc image mirror | Mirror images between registries | oc image mirror src/image:tag=dest/image:tag | Image copied |
oc import-image | Import image into ImageStream | oc import-image mystream --from=registry.io/repo/image:latest --confirm | ImageStreamTag imported |
oc kustomize | Build Kustomize output | oc kustomize ./overlays/dev | YAML output |
oc label | Add/update/remove labels | oc label pod/foo app=web | pod/foo labeled |
oc login | Authenticate to cluster | oc login https://api.crc.testing:6443 -u developer -p developer | Login successful |
oc logout | End current session | oc logout | Logged out |
oc logs | View container logs | oc logs -f deployment/web | Log stream |
oc new-app | Create app from source/image/template | oc new-app python:3.9~https://github.com/openshift-instruqt/blog-django-py --name=blog | BuildConfig/Deployment/Service created |
oc new-build | Create build config | oc new-build python:3.9~https://github.com/user/repo --name=app | BuildConfig created |
oc new-project | Create and switch project | oc new-project demo | Now using project "demo" |
oc observe | Watch resources and react with command | oc observe pods -- echo '{name}' | Repeated observed output |
oc patch | Patch resource fields | oc patch deployment web -p '{"spec":{"replicas":3}}' | Resource patched |
oc plugin | Manage/view plugins | oc plugin list | Compatible plugin list |
oc plugin list | List installed plugins | oc plugin list | Plugin paths |
oc policy add-role-to-user | Add role to user in project | oc policy add-role-to-user view alice | Role added |
oc policy scc-review | Review SCC admission for service accounts | oc policy scc-review -f pod.yaml | SCC review result |
oc policy scc-subject-review | Review SCC for user/SA | oc policy scc-subject-review -f pod.yaml | SCC subject review |
oc port-forward | Forward local port to pod/service | oc port-forward pod/web 8080:8080 | Forwarding from 127.0.0.1:8080 |
oc process | Process template | oc process -f template.yaml -p NAME=demo | YAML objects |
oc project | Switch/show current project | oc project demo | Now using project "demo" |
oc projects | List accessible projects | oc projects | Project list |
oc proxy | Run local API proxy | oc proxy --port=8001 | Starting to serve on 127.0.0.1:8001 |
oc registry login | Log local image tools into OpenShift registry | oc registry login | Registry auth configured |
oc replace | Replace resource from file | oc replace -f app.yaml | Resource replaced |
oc rollback | Roll back DeploymentConfig | oc rollback dc/web | Rollback created |
oc rollout | Manage rollout operations | oc rollout status deployment/web | Rollout status |
oc rollout cancel | Cancel rollout | oc rollout cancel dc/web | Rollout cancelled |
oc rollout history | View rollout history | oc rollout history deployment/web | Revision table |
oc rollout latest | Trigger latest DeploymentConfig rollout | oc rollout latest dc/web | Rollout started |
oc rollout pause | Pause rollout | oc rollout pause deployment/web | Deployment paused |
oc rollout restart | Restart rollout | oc rollout restart deployment/web | Deployment restarted |
oc rollout resume | Resume paused rollout | oc rollout resume deployment/web | Deployment resumed |
oc rollout retry | Retry failed DeploymentConfig rollout | oc rollout retry dc/web | Retry started |
oc rollout status | Watch rollout | oc rollout status deployment/web | successfully rolled out |
oc rollout undo | Roll back deployment revision | oc rollout undo deployment/web | Rolled back |
oc rsh | Remote shell into pod | oc rsh pod/web-abc123 | Interactive shell |
oc rsync | Sync files with pod | oc rsync ./static pod/web:/opt/app/static | Files synced |
oc run | Run pod/workload quickly | oc run test --image=busybox -- sleep 3600 | Pod created |
oc scale | Scale replicas | oc scale deployment/web --replicas=3 | Deployment scaled |
oc secrets link | Link secret to service account | oc secrets link default regcred --for=pull | Secret linked |
oc secrets unlink | Unlink secret from service account | oc secrets unlink default regcred | Secret unlinked |
oc set build-hook | Set build hooks | oc set build-hook bc/web --post-commit --command -- echo ok | BuildConfig updated |
oc set build-secret | Set build secrets | oc set build-secret --source bc/web mysecret | BuildConfig updated |
oc set data | Set data in ConfigMap/Secret | oc set data configmap/app KEY=value | ConfigMap updated |
oc set deployment-hook | Set DeploymentConfig hooks | oc set deployment-hook dc/web --pre -- echo pre | DeploymentConfig updated |
oc set env | Set env vars | oc set env deployment/web ENV=dev | Deployment updated |
oc set image | Update container image | oc set image deployment/web web=nginx:1.25 | Deployment updated |
oc set image-lookup | Configure ImageStream local lookup | oc set image-lookup nginx | Image lookup updated |
oc set probe | Set liveness/readiness/startup probes | oc set probe deployment/web --readiness --get-url=http://:8080/healthz | Deployment updated |
oc set resources | Set CPU/memory requests/limits | oc set resources deployment/web --limits=cpu=500m,memory=512Mi | Deployment updated |
oc set route-backends | Split route traffic | oc set route-backends web a=2 b=1 | Route updated |
oc set selector | Set selector on resource | oc set selector service/web app=web | Service updated |
oc set serviceaccount | Set workload service account | oc set serviceaccount deployment web builder-sa | Deployment updated |
oc set subject | Update RoleBinding/ClusterRoleBinding subjects | oc set subject rolebinding admin --user=alice | Binding updated |
oc set triggers | Configure build/deployment triggers | oc set triggers dc/web --manual | Triggers updated |
oc set volumes | Add/remove/list volumes | oc set volume deployment/web --add --name=data --emptydir | Deployment updated |
oc start-build | Start OpenShift build | oc start-build bc/web --follow | Build started + logs |
oc status | Summarize project status | oc status | App/service/route/build summary |
oc tag | Tag images/ImageStreams | oc tag nginx:latest myproject/nginx:prod | Tag updated |
oc version | Show client/server versions | oc version | Client + server version info |
oc wait | Wait for condition/create/delete | oc wait --for=condition=Ready pod/busybox1 --timeout=60s | condition met |
oc whoami | Show current user/session | oc whoami | Username |
The official reference confirms the image commands oc image append, extract, info, and mirror, and also shows the set serviceaccount, set subject, and set triggers commands that are easy to miss. (Red Hat Documentation)
3. Administrator command master table
Use these with care. Red Hat explicitly states the admin command reference requires cluster-admin or equivalent permissions. (Red Hat Documentation)
| Command | Why / When to Use | Example | Expected Output Shape |
|---|---|---|---|
oc adm build-chain | Show build image dependencies | oc adm build-chain <image-stream> | Dependency tree |
oc adm catalog mirror | Mirror Operator catalog | oc adm catalog mirror quay.io/my/image:latest myregistry.com | Mirror mapping/output |
oc adm certificate approve | Approve CSR | oc adm certificate approve csr-abc | CSR approved |
oc adm certificate deny | Deny CSR | oc adm certificate deny csr-abc | CSR denied |
oc adm copy-to-node | Copy files to node | oc adm copy-to-node node/worker-1 ./file /tmp/file | File copied |
oc adm cordon | Mark node unschedulable | oc adm cordon worker-1 | node/worker-1 cordoned |
oc adm create-bootstrap-project-template | Generate bootstrap project template | oc adm create-bootstrap-project-template -o yaml | Template YAML |
oc adm create-error-template | Generate error page template | oc adm create-error-template -o yaml | Template YAML |
oc adm create-login-template | Generate login page template | oc adm create-login-template -o yaml | Template YAML |
oc adm create-provider-selection-template | Generate provider selection template | oc adm create-provider-selection-template -o yaml | Template YAML |
oc adm drain | Evict pods before maintenance | oc adm drain worker-1 --ignore-daemonsets --delete-emptydir-data | Node drained |
oc adm groups add-users | Add users to group | oc adm groups add-users devs alice bob | Users added |
oc adm groups new | Create group | oc adm groups new devs alice bob | Group created |
oc adm groups prune | Remove old external groups | oc adm groups prune --sync-config=config.yaml --confirm | Groups pruned |
oc adm groups remove-users | Remove users from group | oc adm groups remove-users devs alice | User removed |
oc adm groups sync | Sync groups from external provider | oc adm groups sync --sync-config=config.yaml --confirm | Groups synced |
oc adm inspect | Collect resource debug data | oc adm inspect ns/demo | Local inspect directory |
oc adm migrate icsp | Migrate ImageContentSourcePolicy | oc adm migrate icsp | Migration output |
oc adm migrate template-instances | Migrate template instances | oc adm migrate template-instances | Migration output |
oc adm must-gather | Collect cluster diagnostics | oc adm must-gather | must-gather.local.<rand> directory |
oc adm new-project | Admin-created project with options | oc adm new-project myproject --node-selector='type=user-node' | Project created |
oc adm node-image create | Create ISO/PXE files for adding nodes | oc adm node-image create | ISO/PXE assets created |
oc adm node-image monitor | Monitor new nodes being added | oc adm node-image monitor --ip-addresses 192.168.111.83 | Node add progress |
oc adm node-logs | View node logs | oc adm node-logs worker-1 | Node log output |
oc adm ocp-certificates monitor-certificates | Monitor OCP certificates | oc adm ocp-certificates monitor-certificates | Certificate status |
oc adm ocp-certificates regenerate-leaf | Regenerate leaf certificates | oc adm ocp-certificates regenerate-leaf | Cert regeneration output |
oc adm ocp-certificates regenerate-machine-config-server-serving-cert | Regenerate MCS serving cert | oc adm ocp-certificates regenerate-machine-config-server-serving-cert | Cert regenerated |
oc adm ocp-certificates regenerate-top-level | Regenerate top-level certs | oc adm ocp-certificates regenerate-top-level | Cert regeneration output |
oc adm ocp-certificates remove-old-trust | Remove old trust bundles | oc adm ocp-certificates remove-old-trust | Old trust removed |
oc adm ocp-certificates update-ignition-ca-bundle-for-machine-config-server | Update ignition CA bundle | oc adm ocp-certificates update-ignition-ca-bundle-for-machine-config-server | Secrets updated |
oc adm policy add-cluster-role-to-group | Grant cluster role to group | oc adm policy add-cluster-role-to-group cluster-admin cluster-admins | Role added |
oc adm policy add-cluster-role-to-user | Grant cluster role to user | oc adm policy add-cluster-role-to-user system:build-strategy-docker devuser | Role added |
oc adm policy add-role-to-user | Grant project role | oc adm policy add-role-to-user view user1 | Role added |
oc adm policy add-scc-to-group | Grant SCC to group | oc adm policy add-scc-to-group restricted group1 | SCC added |
oc adm policy add-scc-to-user | Grant SCC to user/SA | oc adm policy add-scc-to-user privileged -z serviceaccount1 | SCC added |
oc adm policy remove-cluster-role-from-group | Remove cluster role from group | oc adm policy remove-cluster-role-from-group cluster-admin cluster-admins | Role removed |
oc adm policy remove-cluster-role-from-user | Remove cluster role from user | oc adm policy remove-cluster-role-from-user system:build-strategy-docker devuser | Role removed |
oc adm policy scc-review | Check which SA can create pod | oc adm policy scc-review -z sa1,sa2 -f pod.yaml | SCC review |
oc adm policy scc-subject-review | Check whether user/SA can create pod | oc adm policy scc-subject-review -f pod.yaml | SCC subject review |
oc adm prune builds | Remove old builds | oc adm prune builds --confirm | Builds pruned |
oc adm prune deployments | Remove old deployments | oc adm prune deployments --confirm | Deployments pruned |
oc adm prune groups | Remove old groups | oc adm prune groups --confirm | Groups pruned |
oc adm prune images | Remove unreferenced images | oc adm prune images --keep-tag-revisions=3 --keep-younger-than=60m --confirm | Images pruned |
oc adm prune renderedmachineconfigs | Prune rendered MachineConfigs | oc adm prune renderedmachineconfigs --confirm | MachineConfigs pruned |
oc adm prune renderedmachineconfigs list | List rendered MachineConfigs | oc adm prune renderedmachineconfigs list --pool-name=worker | MachineConfig list |
oc adm reboot-machine-config-pool | Reboot MachineConfigPools | oc adm reboot-machine-config-pool mcp/worker | Reboot initiated |
oc adm release extract | Extract release payload contents | oc adm release extract --git=DIR | Files extracted |
oc adm release info | Show release info | oc adm release info | Release metadata |
oc adm release mirror | Mirror release payload | oc adm release mirror --from=<release> --to=<registry> | Mirror output |
oc adm restart-kubelet | Restart kubelet on nodes | oc adm restart-kubelet nodes/worker-1 | Kubelet restart requested |
oc adm taint | Add/remove node taints | oc adm taint nodes foo dedicated=special-user:NoSchedule | Node tainted |
oc adm top images | Show image usage stats | oc adm top images | Usage table |
oc adm top imagestreams | Show ImageStream usage stats | oc adm top imagestreams | Usage table |
oc adm top node | Show node CPU/memory usage | oc adm top node | Node metrics table |
oc adm top persistentvolumeclaims | Show PVC usage stats | oc adm top persistentvolumeclaims -A | PVC usage table |
oc adm top pod | Show pod CPU/memory usage | oc adm top pod --containers | Pod metrics table |
oc adm uncordon | Mark node schedulable again | oc adm uncordon worker-1 | node/worker-1 uncordoned |
oc adm upgrade | View/change cluster update | oc adm upgrade | Upgrade status/available updates |
oc adm verify-image-signature | Verify image signature | oc adm verify-image-signature sha256:<digest> --expected-identity=registry/image:v1 | Verification result |
oc adm wait-for-node-reboot | Wait for node reboot completion | oc adm wait-for-node-reboot nodes --all | Wait progress/completion |
oc adm wait-for-stable-cluster | Wait for cluster operators to stabilize | oc adm wait-for-stable-cluster | Stable/timeout result |
The admin table includes the newer/easy-to-miss entries such as node-image create, node-image monitor, prune renderedmachineconfigs, wait-for-node-reboot, and wait-for-stable-cluster, all visible in the current 4.22 admin reference. (Red Hat Documentation)
4. Command families by real-world use case
Login and identity
| Task | Command |
|---|---|
| Log in | oc login <api-server> -u <user> -p <password> |
| Show user | oc whoami |
| Show auth details | oc auth whoami |
| Check permission | oc auth can-i create pods |
| Log out | oc logout |
| View config | oc config view |
| Switch context | oc config use-context <context> |
Projects and namespaces
| Task | Command |
|---|---|
| Create project | oc new-project demo |
| Switch project | oc project demo |
| List projects | oc projects |
| Create namespace | oc create namespace demo |
| Admin create project | oc adm new-project demo |
Application deployment
| Task | Command |
|---|---|
| Deploy from image/source | oc new-app |
| Create deployment | oc create deployment |
| Create service | oc expose deployment/web --port=8080 |
| Create route | oc expose service/web |
| Show app summary | oc status |
| Watch pods | oc get pods --watch |
Build and image workflow
| Task | Command |
|---|---|
| Create build | oc new-build |
| Start build | oc start-build bc/web --follow |
| Cancel build | oc cancel-build bc/web |
| Import image | oc import-image |
| Tag image | oc tag |
| Inspect image | oc image info |
| Mirror image | oc image mirror |
| Extract image files | oc image extract |
Troubleshooting
| Task | Command |
|---|---|
| Describe resource | oc describe pod/<pod> |
| Logs | oc logs -f deployment/web |
| Exec command | oc exec deploy/web -- env |
| Remote shell | oc rsh pod/<pod> |
| Debug pod/deployment/node | oc debug |
| Events | oc events |
| Cluster info dump | oc cluster-info dump |
| Must-gather | oc adm must-gather |
Scaling and rollout
| Task | Command |
|---|---|
| Scale manually | oc scale deployment/web --replicas=3 |
| Autoscale | oc autoscale deployment/web --min=1 --max=5 --cpu-percent=80 |
| Restart deployment | oc rollout restart deployment/web |
| Watch rollout | oc rollout status deployment/web |
| Undo rollout | oc rollout undo deployment/web |
| Pause/resume rollout | oc rollout pause deployment/web / oc rollout resume deployment/web |
Config, secrets, and environment
| Task | Command |
|---|---|
| Create ConfigMap | oc create configmap |
| Create Secret | oc create secret generic |
| Create TLS Secret | oc create secret tls |
| Set environment vars | oc set env |
| Link pull secret | oc secrets link |
| Extract secret/configmap | oc extract |
RBAC and security
| Task | Command |
|---|---|
| Create Role | oc create role |
| Create RoleBinding | oc create rolebinding |
| Check permission | oc auth can-i |
| Add role to user | oc policy add-role-to-user |
| Admin add cluster role | oc adm policy add-cluster-role-to-user |
| SCC review | oc adm policy scc-review |
| Add SCC | oc adm policy add-scc-to-user |
Node and cluster administration
| Task | Command |
|---|---|
| Cordon node | oc adm cordon |
| Drain node | oc adm drain |
| Uncordon node | oc adm uncordon |
| Taint node | oc adm taint |
| Node metrics | oc adm top node |
| Pod metrics | oc adm top pod |
| Cluster upgrade status | oc adm upgrade |
| Wait for stable cluster | oc adm wait-for-stable-cluster |
5. Expected output patterns
Use these as mental models.
| Command Type | Example | Typical Output |
|---|---|---|
| Create | oc create configmap app | configmap/app created |
| Apply | oc apply -f app.yaml | created, configured, or unchanged |
| Delete | oc delete pod web | pod "web" deleted |
| Get | oc get pods | Table with NAME READY STATUS RESTARTS AGE |
| Describe | oc describe pod web | Long human-readable detail |
| Logs | oc logs -f deployment/web | Application log stream |
| Patch | oc patch deployment web -p ... | deployment.apps/web patched |
| Set | oc set env deployment/web A=B | deployment.apps/web updated |
| Rollout status | oc rollout status deployment/web | deployment "web" successfully rolled out |
| Wait | oc wait --for=condition=Ready pod/web | pod/web condition met |
| Auth check | oc auth can-i get pods | yes or no |
| Admin metrics | oc adm top pod | CPU/memory usage table |
6. Recommended learning order for labs
Use this sequence for students:
| Lab Stage | Commands |
|---|---|
| Access cluster | oc login, oc whoami, oc version |
| Explore APIs | oc api-resources, oc api-versions, oc explain |
| Work with projects | oc new-project, oc project, oc projects |
| Deploy app | oc new-app, oc status, oc get all |
| Expose app | oc expose, oc get route |
| Debug app | oc logs, oc describe, oc events, oc exec, oc rsh |
| Modify app | oc set env, oc set image, oc scale, oc rollout status |
| Config/secrets | oc create configmap, oc create secret, oc set env |
| Builds/images | oc new-build, oc start-build, oc import-image, oc tag |
| RBAC | oc auth can-i, oc create role, oc create rolebinding |
| Cleanup | oc delete, oc delete all -l app=<app> |
| Admin | oc adm top, oc adm must-gather, oc adm cordon/drain/uncordon |
7. My safest “do not hallucinate” rule for your course material
For every lab page, include this box:
# Verify exact syntax on your installed client
oc <command> --help
# Verify available resources on your cluster
oc api-resources
# Verify your permissions
oc auth can-i <verb> <resource>
Code language: PHP (php)This protects the tutorial from version drift, Operator-installed APIs, and permission differences between CRC/OpenShift Local, Developer Sandbox, and full production OpenShift.
I’m a DevOps/SRE/DevSecOps/Cloud Expert passionate about sharing knowledge and experiences. I have worked at Cotocus. I share tech blog at DevOps School, travel stories at Holiday Landmark, stock market tips at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow , and SEO strategies at Wizbrand.
Do you want to learn Quantum Computing?
Please find my social handles as below;
Rajesh Kumar Personal Website
Rajesh Kumar at YOUTUBE
Rajesh Kumar at INSTAGRAM
Rajesh Kumar at X
Rajesh Kumar at FACEBOOK
Rajesh Kumar at LINKEDIN
Rajesh Kumar at WIZBRAND
Find Trusted Cardiac Hospitals
Compare heart hospitals by city and services — all in one place.
Explore Hospitals
The article provides a useful collection of commonly used
occommands, but it could be strengthened by covering how these commands fit into day-to-day operational workflows. In production environments, engineers often rely on scripting, aliases, and service accounts to automate repetitive tasks and reduce manual errors. Including examples of troubleshooting techniques, auditing changes, and safely executing administrative commands across multiple clusters would make the guide more valuable for teams managing OpenShift at scale.