OpenShift OADP Command Guide for Backup and Restore

Below is a practical OpenShift oc command reference for OADP/Velero backup and restore troubleshooting.

OADP is the Red Hat-supported Operator that deploys and manages Velero components for backing up application Kubernetes objects, persistent volumes, internal images, and supported OpenShift Virtualization workloads. (Red Hat Customer Portal)

1. Check the OADP Operator installation

Find the Operator:

oc get csv -A | grep -i oadp

Check subscriptions:

oc get subscription -A | grep -i oadp

Typical OADP namespace:

openshift-adp

Check Operator objects:

oc get csv,subscription,installplan -n openshift-adp

Detailed ClusterServiceVersion status:

			
oc describe csv -n openshift-adp \
  $(oc get csv -n openshift-adp -o name | grep oadp | head -1)

Check the Operator deployment:

oc get deployment -n openshift-adp

Check Operator logs:

			
oc logs -n openshift-adp \
  deployment/openshift-adp-controller-manager \
  -c manager --tail=200

Follow logs:

			
oc logs -n openshift-adp \
  deployment/openshift-adp-controller-manager \
  -c manager -f

2. Check the DataProtectionApplication

The DataProtectionApplication, commonly abbreviated as DPA, is the main OADP configuration resource.

oc get dataprotectionapplication -n openshift-adp

Short form:

oc get dpa -n openshift-adp

View configuration:

oc get dpa -n openshift-adp -o yaml

Describe the DPA:

oc describe dpa <dpa-name> -n openshift-adp

Extract its conditions:

			
oc get dpa <dpa-name> -n openshift-adp \
  -o jsonpath='{range .status.conditions[*]}{.type}{"="}{.status}{"  "}{.reason}{"  "}{.message}{"\n"}{end}'

Look for:

Reconciled=True

Also inspect:

Backup storage configuration
Cloud provider plugin
Credential Secret
CSI configuration
Data mover configuration
Node agent settings

3. Check Velero and node-agent pods

oc get pods -n openshift-adp -o wide

Common components include:

			
velero
node-agent
openshift-adp-controller-manager

Depending on the OADP version and configuration, the filesystem backup component can appear as node-agent; older environments might refer to Restic.

Check Velero deployment:

oc get deployment velero -n openshift-adp

Check node-agent DaemonSet:

oc get daemonset -n openshift-adp

Verify that a node-agent pod is running on each applicable node:

			
oc get pods -n openshift-adp \
  -l name=node-agent -o wide

Inspect pod restarts:

			
oc get pods -n openshift-adp \
  -o custom-columns='POD:.metadata.name,STATUS:.status.phase,NODE:.spec.nodeName,RESTARTS:.status.containerStatuses[*].restartCount'

Describe a failing pod:

oc describe pod <pod-name> -n openshift-adp

4. Check Velero logs

Current Velero logs:

			
oc logs -n openshift-adp deployment/velero \
  --tail=300

Follow logs:

oc logs -n openshift-adp deployment/velero -f

Previous crashed container:

			
oc logs -n openshift-adp deployment/velero \
  --previous

Search for common failures:

			
oc logs -n openshift-adp deployment/velero \
  --since=1h |
grep -Ei 'error|failed|warning|timeout|credential|access denied|snapshot|repository'

Check node-agent logs:

			
oc logs -n openshift-adp <node-agent-pod> \
  --tail=300

Logs from every node-agent pod:

			
for pod in $(oc get pods -n openshift-adp \
  -l name=node-agent -o name); do
    echo "===== $pod ====="
    oc logs -n openshift-adp "$pod" \
      --since=1h 2>&1 |
      grep -Ei 'error|failed|timeout|repository|volume|snapshot'
done

		

5. Check BackupStorageLocation

A BackupStorageLocation, or BSL, defines the object-storage destination such as AWS S3, Azure Blob Storage, Google Cloud Storage, or an S3-compatible endpoint.

oc get backupstoragelocation -n openshift-adp

Short form:

oc get bsl -n openshift-adp

Detailed view:

oc describe bsl <bsl-name> -n openshift-adp

YAML:

oc get bsl <bsl-name> -n openshift-adp -o yaml

Check availability:

			
oc get bsl -n openshift-adp \
  -o custom-columns='NAME:.metadata.name,PHASE:.status.phase,LAST-VALIDATED:.status.lastValidationTime,MESSAGE:.status.message'

Expected phase:

Available

Common failure states include:

			
Unavailable
Unknown

Typical causes:

Invalid cloud credentials
Incorrect bucket name
Incorrect region
Invalid S3 endpoint
Missing object-storage permissions
Certificate trust problems
Network or proxy failures

6. Check VolumeSnapshotLocation

oc get volumesnapshotlocation -n openshift-adp

Short form:

oc get vsl -n openshift-adp

Describe it:

oc describe vsl <vsl-name> -n openshift-adp

View YAML:

oc get vsl <vsl-name> -n openshift-adp -o yaml

Check whether the configured provider and region match the persistent volumes being protected.

7. Check backup credentials

List Secrets:

oc get secrets -n openshift-adp

Check which Secret is referenced by the DPA:

			
oc get dpa <dpa-name> -n openshift-adp -o yaml |
grep -A5 credential

Inspect Secret metadata:

oc describe secret <credentials-secret> -n openshift-adp

Do not print credential values into shared terminals, tickets, or chat logs.

Check whether the key exists without displaying its contents:

			
oc get secret <credentials-secret> -n openshift-adp \
  -o jsonpath='{.data}' |
jq 'keys'

A common expected key is:

cloud

Verify that the Velero service account can read the Secret:

			
oc auth can-i get secret/<credentials-secret> \
  --as system:serviceaccount:openshift-adp:velero \
  -n openshift-adp

8. List backups

oc get backups.velero.io -n openshift-adp

Short form:

oc get backup -n openshift-adp

Detailed table:

			
oc get backup -n openshift-adp \
  -o custom-columns='NAME:.metadata.name,PHASE:.status.phase,START:.status.startTimestamp,COMPLETED:.status.completionTimestamp,ERRORS:.status.errors,WARNINGS:.status.warnings,EXPIRES:.status.expiration'

Watch backup progress:

oc get backup -n openshift-adp -w

Describe a backup:

oc describe backup <backup-name> -n openshift-adp

View the complete Backup CR:

			
oc get backup <backup-name> \
  -n openshift-adp -o yaml

Important phases:

			
New
InProgress
Completed
PartiallyFailed
Failed
Deleting

		

9. Create a simple namespace backup

Create a backup manifest:

			
cat <<'EOF' | oc apply -f -
apiVersion: velero.io/v1
kind: Backup
metadata:
  name: myapp-backup
  namespace: openshift-adp
spec:
  includedNamespaces:
    - myapp
  storageLocation: default
  ttl: 720h0m0s
EOF

		

Monitor it:

			
oc get backup myapp-backup \
  -n openshift-adp -w

Inspect the result:

			
oc describe backup myapp-backup \
  -n openshift-adp

10. Back up selected resource types

			
cat <<'EOF' | oc apply -f -
apiVersion: velero.io/v1
kind: Backup
metadata:
  name: myapp-resources
  namespace: openshift-adp
spec:
  includedNamespaces:
    - myapp
  includedResources:
    - deployments
    - services
    - configmaps
    - secrets
    - persistentvolumeclaims
  storageLocation: default
  ttl: 720h0m0s
EOF

		

Be careful when excluding cluster-scoped resources, because applications might depend on:

CustomResourceDefinitions
ClusterRoles
ClusterRoleBindings
StorageClasses
SecurityContextConstraints
Operators

11. Back up resources by label

			
cat <<'EOF' | oc apply -f -
apiVersion: velero.io/v1
kind: Backup
metadata:
  name: frontend-backup
  namespace: openshift-adp
spec:
  includedNamespaces:
    - myapp
  labelSelector:
    matchLabels:
      app: frontend
  storageLocation: default
EOF

		

Verify labels before starting:

			
oc get all,pvc,configmap,secret \
  -n myapp -l app=frontend

12. Check backup details using the Velero CLI

When the Velero CLI is installed:

velero backup get

Detailed backup information:

velero backup describe <backup-name> --details

Download backup logs:

velero backup logs <backup-name>

Save them:

			
velero backup logs <backup-name> \
  > <backup-name>.log

Velero supports both CLI commands and Kubernetes custom resources; in an OADP-managed environment, oc get backup and oc describe backup remain useful even when the Velero CLI is unavailable. (Velero)

13. Check pod volume backups

For filesystem-based persistent-volume backups:

oc get podvolumebackups -n openshift-adp

Short form, where supported:

oc get pvb -n openshift-adp

Detailed table:

			
oc get podvolumebackups -n openshift-adp \
  -o custom-columns='NAME:.metadata.name,PHASE:.status.phase,POD:.spec.pod.name,VOLUME:.spec.volume,START:.status.startTimestamp,COMPLETED:.status.completionTimestamp,MESSAGE:.status.message'

Describe a failed object:

			
oc describe podvolumebackup <name> \
  -n openshift-adp

List failed or partially failed items:

			
oc get podvolumebackups -n openshift-adp \
  --field-selector status.phase=Failed

14. Check CSI snapshots

List CSI snapshot classes:

oc get volumesnapshotclass

List snapshots across all namespaces:

oc get volumesnapshot -A

Check snapshot contents:

oc get volumesnapshotcontent

Describe the snapshot:

			
oc describe volumesnapshot <snapshot-name> \
  -n <application-namespace>

Check readiness:

			
oc get volumesnapshot -A \
  -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,READY:.status.readyToUse,SOURCE-PVC:.spec.source.persistentVolumeClaimName,ERROR:.status.error.message'

Verify the CSI driver:

			
oc get csidriver
oc get csinode

Check StorageClass and PVC:

			
oc get pvc -n <namespace>
oc describe pvc <pvc-name> -n <namespace>
oc get storageclass

15. Check DataUpload and DataDownload objects

For OADP data mover workflows:

			
oc get datauploads -n openshift-adp
oc get datadownloads -n openshift-adp

Detailed status:

			
oc get datauploads -n openshift-adp \
  -o custom-columns='NAME:.metadata.name,PHASE:.status.phase,START:.status.startTimestamp,COMPLETED:.status.completionTimestamp,MESSAGE:.status.message'

			
oc get datadownloads -n openshift-adp \
  -o custom-columns='NAME:.metadata.name,PHASE:.status.phase,START:.status.startTimestamp,COMPLETED:.status.completionTimestamp,MESSAGE:.status.message'

Describe failures:

			
oc describe dataupload <name> -n openshift-adp
oc describe datadownload <name> -n openshift-adp

The exact data-movement resources available depend on the OADP release and DPA configuration.

16. List restores

oc get restores.velero.io -n openshift-adp

Short form:

oc get restore -n openshift-adp

Detailed table:

			
oc get restore -n openshift-adp \
  -o custom-columns='NAME:.metadata.name,BACKUP:.spec.backupName,PHASE:.status.phase,START:.status.startTimestamp,COMPLETED:.status.completionTimestamp,ERRORS:.status.errors,WARNINGS:.status.warnings'

Watch restore progress:

oc get restore -n openshift-adp -w

Describe a restore:

			
oc describe restore <restore-name> \
  -n openshift-adp

17. Restore an entire backup

			
cat <<'EOF' | oc apply -f -
apiVersion: velero.io/v1
kind: Restore
metadata:
  name: myapp-restore
  namespace: openshift-adp
spec:
  backupName: myapp-backup
EOF

		

Monitor:

			
oc get restore myapp-restore \
  -n openshift-adp -w

Inspect:

			
oc describe restore myapp-restore \
  -n openshift-adp

Velero restore behavior is controlled by the Restore custom resource, including namespace mappings, resource filters, label selectors and existing-resource policies. (Velero)

18. Restore into a different namespace

			
cat <<'EOF' | oc apply -f -
apiVersion: velero.io/v1
kind: Restore
metadata:
  name: myapp-restore-test
  namespace: openshift-adp
spec:
  backupName: myapp-backup
  namespaceMapping:
    myapp: myapp-restore-test
EOF

		

Verify:

			
oc get all,pvc,configmap,secret \
  -n myapp-restore-test

Namespace mapping is useful for disaster-recovery testing, but hardcoded references to the original namespace may require application-specific changes.

19. Restore selected resources

			
cat <<'EOF' | oc apply -f -
apiVersion: velero.io/v1
kind: Restore
metadata:
  name: myapp-config-restore
  namespace: openshift-adp
spec:
  backupName: myapp-backup
  includedNamespaces:
    - myapp
  includedResources:
    - configmaps
    - secrets
EOF

		

20. Check pod volume restores

oc get podvolumerestores -n openshift-adp

Detailed status:

			
oc get podvolumerestores -n openshift-adp \
  -o custom-columns='NAME:.metadata.name,PHASE:.status.phase,POD:.spec.pod.name,VOLUME:.spec.volume,START:.status.startTimestamp,COMPLETED:.status.completionTimestamp,MESSAGE:.status.message'

Describe a failed restore:

			
oc describe podvolumerestore <name> \
  -n openshift-adp

21. Check restore logs with Velero CLI

velero restore get

Detailed status:

velero restore describe <restore-name> --details

Logs:

velero restore logs <restore-name>

Save the logs:

			
velero restore logs <restore-name> \
  > <restore-name>.log

22. Check backup schedules

oc get schedules.velero.io -n openshift-adp

Short form:

oc get schedule -n openshift-adp

Detailed view:

			
oc get schedule -n openshift-adp \
  -o custom-columns='NAME:.metadata.name,SCHEDULE:.spec.schedule,PAUSED:.spec.paused,LAST-BACKUP:.status.lastBackup,PHASE:.status.phase'

Describe:

			
oc describe schedule <schedule-name> \
  -n openshift-adp

A Velero Schedule is a repeating backup request based on cron notation. (Velero)

23. Create a daily schedule

Example: run every day at 02:00:

			
cat <<'EOF' | oc apply -f -
apiVersion: velero.io/v1
kind: Schedule
metadata:
  name: myapp-daily
  namespace: openshift-adp
spec:
  schedule: "0 2 * * *"
  template:
    includedNamespaces:
      - myapp
    storageLocation: default
    ttl: 720h0m0s
EOF

		

Check generated backups:

			
oc get backup -n openshift-adp \
  -l velero.io/schedule-name=myapp-daily

Trigger an immediate backup based on a schedule using the Velero CLI:

			
velero backup create \
  --from-schedule myapp-daily

Creating a manual backup from a schedule does not alter the recurring schedule. (Velero)

24. Pause and resume a schedule

Pause:

			
oc patch schedule myapp-daily \
  -n openshift-adp \
  --type merge \
  -p '{"spec":{"paused":true}}'

Resume:

			
oc patch schedule myapp-daily \
  -n openshift-adp \
  --type merge \
  -p '{"spec":{"paused":false}}'

Confirm:

			
oc get schedule myapp-daily \
  -n openshift-adp \
  -o jsonpath='{.spec.paused}{"\n"}'

25. Delete backups safely

Delete through the Velero request mechanism:

velero backup delete <backup-name> --confirm

Or create a deletion request:

			
cat <<EOF | oc apply -f -
apiVersion: velero.io/v1
kind: DeleteBackupRequest
metadata:
  generateName: <backup-name>-
  namespace: openshift-adp
spec:
  backupName: <backup-name>
EOF

		

Check deletion requests:

oc get deletebackuprequest -n openshift-adp

Avoid relying only on:

oc delete backup <backup-name> -n openshift-adp

Deleting only the Kubernetes Backup CR might not perform the intended cleanup of associated backup data in object storage.

26. Check backup repository health

oc get backuprepositories -n openshift-adp

Detailed status:

			
oc get backuprepositories -n openshift-adp \
  -o custom-columns='NAME:.metadata.name,PHASE:.status.phase,LAST-MAINTENANCE:.status.lastMaintenanceTime,MESSAGE:.status.message'

Describe:

			
oc describe backuprepository <name> \
  -n openshift-adp

Common repository issues include:

Repository not ready
Incorrect encryption password
Object-storage access failure
Stale repository lock
Node-agent connectivity problem
Repository maintenance failure

27. Check OADP-related events

Namespace events:

			
oc get events -n openshift-adp \
  --sort-by=.metadata.creationTimestamp

Warning events:

			
oc get events -n openshift-adp \
  --field-selector type=Warning \
  --sort-by=.metadata.creationTimestamp

Application namespace events:

			
oc get events -n <application-namespace> \
  --sort-by=.metadata.creationTimestamp

CSI snapshot events:

			
oc get events -A \
  --field-selector type=Warning |
grep -Ei 'snapshot|volume|velero|backup|restore'

28. Check RBAC and SCC

Check Velero service accounts:

oc get serviceaccount -n openshift-adp

Check cluster roles and bindings:

			
oc get clusterrole,clusterrolebinding |
grep -Ei 'velero|oadp'

Check whether Velero can read application resources:

			
oc auth can-i get pods \
  --as system:serviceaccount:openshift-adp:velero \
  -n myapp

Check PVC access:

			
oc auth can-i get persistentvolumeclaims \
  --as system:serviceaccount:openshift-adp:velero \
  -n myapp

Check SCC authorization for the node-agent:

			
oc auth can-i use scc/privileged \
  --as system:serviceaccount:openshift-adp:velero \
  -n openshift-adp

The exact service account used by node-agent should be confirmed from the pod:

			
oc get pod <node-agent-pod> -n openshift-adp \
  -o jsonpath='{.spec.serviceAccountName}{"\n"}'

29. Check whether application PVCs were included

List application PVCs:

oc get pvc -n myapp

Inspect the backup resource list:

velero backup describe myapp-backup --details

Check related volume backup objects:

			
oc get podvolumebackups -n openshift-adp
oc get volumesnapshot -A
oc get datauploads -n openshift-adp

A backup can report Completed while application consistency is still not guaranteed. Database applications may require backup hooks, quiescing, native database backups, or operator-specific procedures.

30. Check backup and restore hooks

Inspect hooks in a Backup:

			
oc get backup <backup-name> \
  -n openshift-adp \
  -o jsonpath='{.spec.hooks}' |
jq

Check pod annotations:

			
oc get pods -n <namespace> -o yaml |
grep -i -A5 -B5 backup.velero.io

Common annotations include volume backup selection and pre/post backup behavior, depending on the configured backup method.

31. Inventory all OADP resources

			
oc api-resources |
grep -Ei 'velero|oadp'

List the common resources:

			
for resource in \
  dataprotectionapplications \
  backupstoragelocations \
  volumesnapshotlocations \
  backups \
  restores \
  schedules \
  podvolumebackups \
  podvolumerestores \
  backuprepositories \
  datauploads \
  datadownloads; do
  echo
  echo "===== $resource ====="
  oc get "$resource" -n openshift-adp 2>/dev/null ||
    echo "Resource unavailable or none found"
done

		

32. Quick health-check script

			
#!/usr/bin/env bash
set -u
NS="${1:-openshift-adp}"
echo "===== OADP CSV ====="
oc get csv -n "$NS" 2>/dev/null | grep -i oadp || true
echo
echo "===== DPA ====="
oc get dpa -n "$NS" -o wide 2>/dev/null || true
echo
echo "===== OADP PODS ====="
oc get pods -n "$NS" -o wide
echo
echo "===== BACKUP STORAGE LOCATIONS ====="
oc get bsl -n "$NS" \
  -o custom-columns='NAME:.metadata.name,PHASE:.status.phase,MESSAGE:.status.message' \
  2>/dev/null || true
echo
echo "===== VOLUME SNAPSHOT LOCATIONS ====="
oc get vsl -n "$NS" 2>/dev/null || true
echo
echo "===== RECENT BACKUPS ====="
oc get backup -n "$NS" \
  --sort-by=.metadata.creationTimestamp \
  -o custom-columns='NAME:.metadata.name,PHASE:.status.phase,ERRORS:.status.errors,WARNINGS:.status.warnings,START:.status.startTimestamp' \
  2>/dev/null | tail -20
echo
echo "===== RECENT RESTORES ====="
oc get restore -n "$NS" \
  --sort-by=.metadata.creationTimestamp \
  -o custom-columns='NAME:.metadata.name,PHASE:.status.phase,ERRORS:.status.errors,WARNINGS:.status.warnings,START:.status.startTimestamp' \
  2>/dev/null | tail -20
echo
echo "===== SCHEDULES ====="
oc get schedule -n "$NS" 2>/dev/null || true
echo
echo "===== FAILED POD VOLUME BACKUPS ====="
oc get podvolumebackups -n "$NS" \
  -o custom-columns='NAME:.metadata.name,PHASE:.status.phase,MESSAGE:.status.message' \
  2>/dev/null | grep -E 'NAME|Failed|PartiallyFailed' || true
echo
echo "===== WARNING EVENTS ====="
oc get events -n "$NS" \
  --field-selector type=Warning \
  --sort-by=.metadata.creationTimestamp \
  2>/dev/null | tail -30
echo
echo "===== RECENT VELERO ERRORS ====="
oc logs -n "$NS" deployment/velero \
  --since=30m 2>/dev/null |
grep -Ei 'error|failed|timeout|denied|unavailable' |
tail -50 || true

		

Run it:

			
chmod +x oadp-health.sh
./oadp-health.sh

Fast troubleshooting workflow

			
Backup or restore fails
        |
        v
Check OADP Operator and DPA
        |
        v
Check Velero and node-agent pods
        |
        v
Validate BSL and VSL
        |
        v
Describe Backup or Restore CR
        |
        v
Read Velero and node-agent logs
        |
        v
Inspect PVB/PVR, snapshots or DataUpload/DataDownload
        |
        v
Check credentials, permissions and network access
        |
        v
Validate restored application and data

		

The most useful first commands are:

			
oc get dpa -n openshift-adp
oc get pods -n openshift-adp -o wide
oc get bsl,vsl -n openshift-adp
oc get backup,restore,schedule -n openshift-adp
oc describe backup <backup-name> -n openshift-adp
oc logs deployment/velero -n openshift-adp --since=1h
oc get events -n openshift-adp --sort-by=.metadata.creationTimestamp

		

Infra Cloud Solutions

OpenShift OADP Command Guide for Backup and Restore

1. Check the OADP Operator installation

2. Check the DataProtectionApplication

3. Check Velero and node-agent pods

4. Check Velero logs

5. Check BackupStorageLocation

6. Check VolumeSnapshotLocation

7. Check backup credentials

8. List backups

9. Create a simple namespace backup

10. Back up selected resource types

11. Back up resources by label

12. Check backup details using the Velero CLI

13. Check pod volume backups

14. Check CSI snapshots

15. Check DataUpload and DataDownload objects

16. List restores

17. Restore an entire backup

18. Restore into a different namespace

19. Restore selected resources

20. Check pod volume restores

21. Check restore logs with Velero CLI

22. Check backup schedules

23. Create a daily schedule

24. Pause and resume a schedule

25. Delete backups safely

26. Check backup repository health

27. Check OADP-related events

28. Check RBAC and SCC

29. Check whether application PVCs were included

30. Check backup and restore hooks

31. Inventory all OADP resources

32. Quick health-check script

Fast troubleshooting workflow

Like this:

Related

Leave a ReplyCancel reply

1. Check the OADP Operator installation

2. Check the DataProtectionApplication

3. Check Velero and node-agent pods

4. Check Velero logs

5. Check BackupStorageLocation

6. Check VolumeSnapshotLocation

7. Check backup credentials

8. List backups

9. Create a simple namespace backup

10. Back up selected resource types

11. Back up resources by label

12. Check backup details using the Velero CLI

13. Check pod volume backups

14. Check CSI snapshots

15. Check DataUpload and DataDownload objects

16. List restores

17. Restore an entire backup

18. Restore into a different namespace

19. Restore selected resources

20. Check pod volume restores

21. Check restore logs with Velero CLI

22. Check backup schedules

23. Create a daily schedule

24. Pause and resume a schedule

25. Delete backups safely

26. Check backup repository health

27. Check OADP-related events

28. Check RBAC and SCC

29. Check whether application PVCs were included

30. Check backup and restore hooks

31. Inventory all OADP resources

32. Quick health-check script

Fast troubleshooting workflow

Share this:

Like this:

Related

Leave a ReplyCancel reply

Discover more from Infra Cloud Solutions