---
title: OADP CLI plugin
---

# OADP CLI plugin {#oadp-cli-plugin}

The OpenShift API for Data Protection (OADP) command-line interface (CLI) plugin for the OpenShift CLI (`oc`) provides a kubectl-native interface for managing backup and restore operations on an OpenShift Container Platform cluster.

The plugin is available as `oc oadp` and supports both cluster administrator and non-administrator workflows. The administrator perspective provides cluster-wide backup and restore operations by using Velero resources. These commands are available when the OADP CLI is configured in admin mode.

## Install the OADP CLI plugin {#oadp-cli-installing_oadp-cli-plugin}

The OADP command-line interface (CLI) plugin is available from the **Command-line tools** page in the OpenShift Container Platform web console when the OADP Operator is installed.

**Prerequisites**

- You have access to an OpenShift Container Platform cluster with the OADP Operator installed.

**Procedure**

1. Log in to the OpenShift Container Platform web console as a user with access to the cluster.
2. Click the **?** icon in the toolbar and select **Command-line tools**.
3. Download the `oc-oadp` binary for your operating system and architecture.
4. Extract the archive and place the `oc-oadp` binary in a directory on your `PATH`.
5. Verify the installation:

   ```terminal
   $ oc oadp version
   ```

## Set up the OADP CLI plugin {#oadp-cli-setup_oadp-cli-plugin}

After you install the OADP command-line interface (CLI) plugin, you must run the setup command to configure it for your user permissions.

The setup command automatically detects whether you have cluster-wide administrator permissions and configures the CLI accordingly. The CLI operates in one of the following two modes:

- **Admin mode**: Provides access to cluster-wide Velero backup and restore commands.
- **Non-administrator mode**: Provides access to namespace-scoped self-service backup and restore commands.

**Prerequisites**

- The OADP CLI plugin is installed.
- You are logged in to the OpenShift Container Platform cluster by using the `oc login` command.

**Procedure**

1. Run the setup command to auto-detect your permissions and configure the CLI:

   ```terminal
   $ oc oadp setup
   ```

   The CLI checks whether you can create `backups.velero.io` resources across all namespaces. If you can, admin mode is enabled. Otherwise, non-administrator mode is enabled. The configuration is saved to `~/.config/velero/config.json`.
2. To reconfigure the CLI after a change in permissions, run the setup command with the `--force` flag:

   ```terminal
   $ oc oadp setup --force
   ```

**Verification**

- Run the following command to confirm that the available commands match your configured mode:

  ```terminal
  $ oc oadp --help
  ```

  > [!NOTE]
  > OADP CLI commands support both noun-verb and verb-noun ordering. For example, `oc oadp backup create` and `oc oadp create backup` are equivalent.

## OADP CLI client configuration commands {#oadp-cli-client-config_oadp-cli-plugin}

You can use the OADP command-line interface (CLI) to view and modify client configuration settings. Configuration is stored in `~/.config/velero/config.json`.

### Prerequisites {#oadp-cli-client-config-prereqs_oadp-cli-plugin}

- The OADP CLI plugin is installed.

### Current configuration viewing command {#oadp-cli-client-config-get_oadp-cli-plugin}

To view the current client configuration, use the following command:

```terminal
$ oc oadp client config get
```

### Configuration value setting command {#oadp-cli-client-config-set_oadp-cli-plugin}

To set a configuration value, use the following command:

```terminal
$ oc oadp client config set <key>=<value>
```

where:

`<key>`
:   Specifies the configuration key to set.

`<value>`
:   Specifies the value for the configuration key.

```terminal {title="Example of setting the default namespace"}
$ oc oadp client config set namespace=openshift-adp
```

## Enable shell completion for the OADP CLI {#oadp-cli-completion_oadp-cli-plugin}

You can use the OADP command-line interface (CLI) to generate and install shell completion scripts for command auto-completion.

**Prerequisites**

- The OADP CLI plugin is installed.

**Procedure**

- Choose one of the following methods to enable shell completion:

  - To install shell completions automatically for your current shell, use the following command:

    ```terminal
    $ oc oadp completion install [flags]
    ```

    **Flags for the `oc oadp completion install` command**

    | Flag | Description |
    | --- | --- |
    | `--shell` | The shell type to install completions for. Supported values are `bash`, `zsh`, and `fish`. If this flag is not specified, the current shell is auto-detected. |

    ```terminal {title="Example of installing completions for zsh"}
    $ oc oadp completion install --shell zsh
    ```
  - To generate a completion script for your shell without installing it, use the following command:

    ```terminal
    $ oc oadp completion <shell_name>
    ```

    where:

    `<shell_name>`
    :   Specifies the name of your shell. Supported values are `bash`, `zsh`, `fish`, and `powershell`. You can redirect the output to a file or source it directly.

    ```terminal {title="Example of writing a bash completion script"}
    $ oc oadp completion bash > /etc/bash_completion.d/oc-oadp
    ```

## Backup management commands {#oadp-cli-admin-backups_oadp-cli-plugin}

You can use the OADP command-line interface (CLI) to create, view, describe, download, and delete backups.

### Prerequisites {#oadp-cli-admin-backups-prereqs_oadp-cli-plugin}

- The OADP CLI plugin is installed and configured in admin mode.
- You are logged in to the OpenShift Container Platform cluster as a user with `cluster-admin` privileges.

### Backup creation command {#oadp-cli-admin-backups-create_oadp-cli-plugin}

To create a backup of cluster resources, use the following command:

```terminal
$ oc oadp backup create <backup_name> [flags]
```

**Flags for the `oc oadp backup create` command**

| Flag | Description |
| --- | --- |
| `--include-namespaces` | The namespaces to include in the backup. The default value is `*` (all namespaces). |
| `--exclude-namespaces` | The namespaces to exclude from the backup. |
| `--include-resources` | The resources to include in the backup. You can specify simple kind names, for example, `deployments,services`, or you can use the `resource.group` format for disambiguation, for example, `deployments.apps`. The default value is `*` (all resources). |
| `--exclude-resources` | The resources to exclude from the backup. This flag uses the same format as the `--include-resources` flag. |
| `--storage-location` | The name of the backup storage location to use. |
| `--volume-snapshot-locations` | The volume snapshot location or locations to use. |
| `--selector`, `-l` | A label selector to filter resources. |
| `--or-selector` | An OR combination of label selectors. |
| `--snapshot-volumes` | Specifies whether to take persistent volume (PV) snapshots. The default value is `true`. |
| `--snapshot-move-data` | Specifies whether to move snapshot data to the backup storage location. |
| `--default-volumes-to-fs-backup` | Specifies whether to use a file system backup for all volumes. |
| `--include-cluster-resources` | Specifies whether to include cluster-scoped resources. |
| `--ttl` | The backup retention period. The default value is `720h`. |
| `--csi-snapshot-timeout` | The timeout for Container Storage Interface (CSI) snapshot creation. |
| `--item-operation-timeout` | The timeout for asynchronous plugin operations. |
| `--request-timeout` | The timeout for the request to the Kubernetes API server. |

```terminal {title="Example of the backup creation command"}
$ oc oadp backup create my-backup \
    --include-namespaces my-namespace \
    --snapshot-volumes \
    --ttl 720h
```

### Backup listing command {#oadp-cli-admin-backups-list_oadp-cli-plugin}

To list all backups, use the following command:

```terminal
$ oc oadp backup get [<backup_name>] [flags]
```

**Flags for the `oc oadp backup get` command**

| Flag | Description |
| --- | --- |
| `-o` | The output format. Supported values are `json` and `yaml`. |

### Backup description command {#oadp-cli-admin-backups-describe_oadp-cli-plugin}

To view the details of a backup, use the following command:

```terminal
$ oc oadp backup describe <backup_name> [flags]
```

**Flags for the `oc oadp backup describe` command**

| Flag | Description |
| --- | --- |
| `--details` | Specifies whether to display additional details in the output. |

### Backup logs command {#oadp-cli-admin-backups-logs_oadp-cli-plugin}

To view the logs for a backup, use the following command:

```terminal
$ oc oadp backup logs <backup_name>
```

### Backup download command {#oadp-cli-admin-backups-download_oadp-cli-plugin}

To download the contents of a backup, use the following command:

```terminal
$ oc oadp backup download <backup_name> [flags]
```

### Backup deletion command {#oadp-cli-admin-backups-delete_oadp-cli-plugin}

To delete a backup, use the following command:

```terminal
$ oc oadp backup delete <backup_name> [flags]
```

**Flags for the `oc oadp backup delete` command**

| Flag | Description |
| --- | --- |
| `--confirm` | Specifies whether to confirm the deletion without prompting. |

## Restore management commands {#oadp-cli-admin-restores_oadp-cli-plugin}

You can use the OADP command-line interface (CLI) to create, view, describe, and delete restores.

### Prerequisites {#oadp-cli-admin-restores-prereqs_oadp-cli-plugin}

- The OADP CLI plugin is installed and configured in admin mode.
- You are logged in to the OpenShift Container Platform cluster as a user with `cluster-admin` privileges.
- A completed backup exists to restore from.

### Restore creation command {#oadp-cli-admin-restores-create_oadp-cli-plugin}

To create a restore from an existing backup, use the following command:

```terminal
$ oc oadp restore create <restore_name> [flags]
```

**Flags for the `oc oadp restore create` command**

| Flag | Description |
| --- | --- |
| `--from-backup` | The name of the backup to restore from. |
| `--from-schedule` | The name of the schedule to restore from. This flag uses the most recent backup. |
| `--include-namespaces` | The namespaces to include in the restore. The default value is `*` (all namespaces). |
| `--exclude-namespaces` | The namespaces to exclude from the restore. |
| `--include-resources` | The resources to include in the restore. You can specify simple kind names, for example, `deployments,services`, or you can use the `resource.group` format for disambiguation, for example, `deployments.apps`. The default value is `*` (all resources). |
| `--exclude-resources` | The resources to exclude from the restore. This flag uses the same format as the `--include-resources` flag. |
| `--selector`, `-l` | A label selector to filter resources. |
| `--or-selector` | An OR combination of label selectors. |
| `--include-cluster-resources` | Specifies whether to include cluster-scoped resources. |
| `--restore-volumes` | Specifies whether to restore persistent volume (PV) data from snapshots. |
| `--preserve-nodeports` | Specifies whether to preserve NodePort service port assignments. |
| `--item-operation-timeout` | The timeout for asynchronous plugin operations. |
| `--request-timeout` | The timeout for the request to the Kubernetes API server. |

```terminal {title="Example of the restore creation command"}
$ oc oadp restore create my-restore \
    --from-backup my-backup \
    --include-namespaces my-namespace
```

### Restore listing command {#oadp-cli-admin-restores-list_oadp-cli-plugin}

To list all restores, use the following command:

```terminal
$ oc oadp restore get [<restore_name>] [flags]
```

**Flags for the `oc oadp restore get` command**

| Flag | Description |
| --- | --- |
| `-o` | The output format. Supported values are `json` and `yaml`. |

### Restore description command {#oadp-cli-admin-restores-describe_oadp-cli-plugin}

To view the details of a restore, use the following command:

```terminal
$ oc oadp restore describe <restore_name> [flags]
```

**Flags for the `oc oadp restore describe` command**

| Flag | Description |
| --- | --- |
| `--details` | Specifies whether to display additional details in the output. |

### Restore logs command {#oadp-cli-admin-restores-logs_oadp-cli-plugin}

To view the logs for a restore, use the following command:

```terminal
$ oc oadp restore logs <restore_name>
```

### Restore deletion command {#oadp-cli-admin-restores-delete_oadp-cli-plugin}

To delete a restore, use the following command:

```terminal
$ oc oadp restore delete <restore_name> [flags]
```

**Flags for the `oc oadp restore delete` command**

| Flag | Description |
| --- | --- |
| `--confirm` | Specifies whether to confirm the deletion without prompting. |

## Schedule management commands {#oadp-cli-admin-schedules_oadp-cli-plugin}

You can use the OADP command-line interface (CLI) to create, view, describe, and delete backup schedules. Schedules automate the creation of backups at specified intervals by using a cron expression.

### Prerequisites {#oadp-cli-admin-schedules-prereqs_oadp-cli-plugin}

- The OADP CLI plugin is installed and configured in admin mode.
- You are logged in to the OpenShift Container Platform cluster as a user with `cluster-admin` privileges.

### Schedule creation command {#oadp-cli-admin-schedules-create_oadp-cli-plugin}

To create a backup schedule, use the following command:

```terminal
$ oc oadp schedule create <schedule_name> [flags]
```

**Flags for the `oc oadp schedule create` command**

| Flag | Description |
| --- | --- |
| `--schedule` | The cron expression for the schedule, for example, `0 1 * * *` for daily at 1 AM. |
| `--include-namespaces` | The namespaces to include in scheduled backups. The default value is `*` (all namespaces). |
| `--exclude-namespaces` | The namespaces to exclude from scheduled backups. |
| `--include-resources` | The resources to include in scheduled backups. You can specify simple kind names, for example, `deployments,services`, or you can use the `resource.group` format for disambiguation, for example, `deployments.apps`. The default value is `*` (all resources). |
| `--exclude-resources` | The resources to exclude from scheduled backups. This flag uses the same format as the `--include-resources` flag. |
| `--storage-location` | The name of the backup storage location to use. |
| `--volume-snapshot-locations` | The volume snapshot location or locations to use. |
| `--selector`, `-l` | A label selector to filter resources. |
| `--snapshot-volumes` | Specifies whether to take persistent volume (PV) snapshots. The default value is `true`. |
| `--snapshot-move-data` | Specifies whether to move snapshot data to the backup storage location. |
| `--default-volumes-to-fs-backup` | Specifies whether to use a file system backup for all volumes. |
| `--include-cluster-resources` | Specifies whether to include cluster-scoped resources. |
| `--ttl` | The backup retention period. The default value is `720h`. |
| `--request-timeout` | The timeout for the request to the Kubernetes API server. |

```terminal {title="Example of the schedule creation command"}
$ oc oadp schedule create daily-backup \
    --schedule "0 1 * * *" \
    --include-namespaces my-namespace \
    --ttl 720h
```

### Schedule listing command {#oadp-cli-admin-schedules-list_oadp-cli-plugin}

To list all schedules, use the following command:

```terminal
$ oc oadp schedule get [<schedule_name>] [flags]
```

**Flags for the `oc oadp schedule get` command**

| Flag | Description |
| --- | --- |
| `-o` | The output format. Supported values are `json` and `yaml`. |

### Schedule description command {#oadp-cli-admin-schedules-describe_oadp-cli-plugin}

To view the details of a schedule, use the following command:

```terminal
$ oc oadp schedule describe <schedule_name>
```

### Schedule deletion command {#oadp-cli-admin-schedules-delete_oadp-cli-plugin}

To delete a schedule, use the following command:

```terminal
$ oc oadp schedule delete <schedule_name> [flags]
```

**Flags for the `oc oadp schedule delete` command**

| Flag | Description |
| --- | --- |
| `--confirm` | Specifies whether to confirm the deletion without prompting. |

## Backup storage location management commands {#oadp-cli-admin-bsl_oadp-cli-plugin}

You can use the OADP command-line interface (CLI) to create, view, set, and delete backup storage locations (BSLs). Backup storage locations define where backup data is stored, such as an object storage bucket.

### Prerequisites {#oadp-cli-admin-bsl-prereqs_oadp-cli-plugin}

- The OADP CLI plugin is installed and configured in admin mode.
- You are logged in to the OpenShift Container Platform cluster as a user with `cluster-admin` privileges.

### Backup storage location creation command {#oadp-cli-admin-bsl-create_oadp-cli-plugin}

To create a backup storage location, use the following command:

```terminal
$ oc oadp backup-location create <bsl_name> [flags]
```

**Flags for the `oc oadp backup-location create` command**

| Flag | Description |
| --- | --- |
| `--provider` | The name of the cloud provider, for example, `aws`, `gcp`, or `azure`. |
| `--bucket` | The name of the object storage bucket. |
| `--prefix` | The path prefix within the bucket. |
| `--credential` | The secret and key for the provider credentials in the format `SECRET_NAME=KEY`. |
| `--config` | The provider-specific configuration as `key=value` pairs. |
| `--backup-sync-period` | The frequency at which to synchronize the backup contents from object storage. |
| `--request-timeout` | The timeout for the request to the Kubernetes API server. |

```terminal {title="Example of the backup storage location creation command"}
$ oc oadp backup-location create my-bsl \
    --provider aws \
    --bucket my-velero-bucket \
    --prefix velero \
    --credential cloud-credentials=cloud
```

### Backup storage location listing command {#oadp-cli-admin-bsl-list_oadp-cli-plugin}

To list all backup storage locations, use the following command:

```terminal
$ oc oadp backup-location get [<bsl_name>] [flags]
```

**Flags for the `oc oadp backup-location get` command**

| Flag | Description |
| --- | --- |
| `-o` | The output format. Supported values are `json` and `yaml`. |

### Default backup storage location command {#oadp-cli-admin-bsl-set-default_oadp-cli-plugin}

To set the default backup storage location, use the following command:

```terminal
$ oc oadp backup-location set <bsl_name>
```

### Backup storage location deletion command {#oadp-cli-admin-bsl-delete_oadp-cli-plugin}

To delete a backup storage location, use the following command:

```terminal
$ oc oadp backup-location delete <bsl_name> [flags]
```

**Flags for the `oc oadp backup-location delete` command**

| Flag | Description |
| --- | --- |
| `--confirm` | Specifies whether to confirm the deletion without prompting. |

## Volume snapshot location management commands {#oadp-cli-admin-vsl_oadp-cli-plugin}

You can use the OADP command-line interface (CLI) to create, view, set, and delete volume snapshot locations (VSLs). Volume snapshot locations define where persistent volume (PV) snapshots are stored.

### Prerequisites {#oadp-cli-admin-vsl-prereqs_oadp-cli-plugin}

- The OADP CLI plugin is installed and configured in admin mode.
- You are logged in to the OpenShift Container Platform cluster as a user with `cluster-admin` privileges.

### Volume snapshot location creation command {#oadp-cli-admin-vsl-create_oadp-cli-plugin}

To create a volume snapshot location, use the following command:

```terminal
$ oc oadp snapshot-location create <vsl_name> [flags]
```

**Flags for the `oc oadp snapshot-location create` command**

| Flag | Description |
| --- | --- |
| `--provider` | The name of the cloud provider, for example, `aws`, `gcp`, or `azure`. |
| `--config` | The provider-specific configuration as `key=value` pairs. |
| `--request-timeout` | The timeout for the request to the Kubernetes API server. |

```terminal {title="Example of the volume snapshot location creation command"}
$ oc oadp snapshot-location create my-vsl \
    --provider aws \
    --config region=us-east-1
```

### Volume snapshot location listing command {#oadp-cli-admin-vsl-list_oadp-cli-plugin}

To list all volume snapshot locations, use the following command:

```terminal
$ oc oadp snapshot-location get [<vsl_name>] [flags]
```

**Flags for the `oc oadp snapshot-location get` command**

| Flag | Description |
| --- | --- |
| `-o` | The output format. Supported values are `json` and `yaml`. |

### Default volume snapshot location command {#oadp-cli-admin-vsl-set-default_oadp-cli-plugin}

To set the default volume snapshot location, use the following command:

```terminal
$ oc oadp snapshot-location set <vsl_name>
```

### Volume snapshot location deletion command {#oadp-cli-admin-vsl-delete_oadp-cli-plugin}

To delete a volume snapshot location, use the following command:

```terminal
$ oc oadp snapshot-location delete <vsl_name> [flags]
```

**Flags for the `oc oadp snapshot-location delete` command**

| Flag | Description |
| --- | --- |
| `--confirm` | Specifies whether to confirm the deletion without prompting. |

## NonAdminBackupStorageLocation approval request commands {#oadp-cli-admin-nabsl-requests_oadp-cli-plugin}

When the OADP Operator is configured with `nonAdmin.requireApprovalForBSL: true`, non-admin users who create a `NonAdminBackupStorageLocation` (NABSL) object trigger an approval request. You can use the OADP command-line interface (CLI) to view, describe, approve, and reject these requests.

### Prerequisites {#oadp-cli-admin-nabsl-prereqs_oadp-cli-plugin}

- The OADP CLI plugin is installed and configured in admin mode.
- You are logged in to the OpenShift Container Platform cluster as a user with `cluster-admin` privileges.
- The `DataProtectionApplication` custom resource (CR) is configured with `nonAdmin.enable: true` and `nonAdmin.requireApprovalForBSL: true`.

### NABSL approval request listing command {#oadp-cli-admin-nabsl-list_oadp-cli-plugin}

To list all pending NABSL approval requests, use the following command:

```terminal
$ oc oadp nabsl-request get [<request_name>] [flags]
```

**Flags for the `oc oadp nabsl-request get` command**

| Flag | Description |
| --- | --- |
| `-o` | The output format. Supported values are `json` and `yaml`. |

The output displays the request name, namespace, phase, requested NABSL name, requested namespace, and age.

### NABSL approval request description command {#oadp-cli-admin-nabsl-describe_oadp-cli-plugin}

To view the full details of an approval request, including the requested backup storage location specification, use the following command:

```terminal
$ oc oadp nabsl-request describe <request_name>
```

You can specify the request by using either the NABSL name or the full UUID.

### NABSL approval request approval command {#oadp-cli-admin-nabsl-approve_oadp-cli-plugin}

To approve a pending request and allow the controller to create the corresponding `BackupStorageLocation` object, use the following command:

```terminal
$ oc oadp nabsl-request approve <request_name> [flags]
```

**Flags for the `oc oadp nabsl-request approve` command**

| Flag | Description |
| --- | --- |
| `--reason` | The reason for the approval. This flag is optional. |

You can specify the request by using either the NABSL name or the full UUID.

```terminal {title="Example of the NABSL approval request approval command"}
$ oc oadp nabsl-request approve user-test-bsl --reason "Approved for production use"
```

### NABSL approval request rejection command {#oadp-cli-admin-nabsl-reject_oadp-cli-plugin}

To reject a pending request and deny the user’s request for a backup storage location, use the following command:

```terminal
$ oc oadp nabsl-request reject <request_name> [flags]
```

**Flags for the `oc oadp nabsl-request reject` command**

| Flag | Description |
| --- | --- |
| `--reason` | The reason for the rejection. This flag is recommended. |

You can specify the request by using either the NABSL name or the full UUID.

```terminal {title="Example of the NABSL approval request rejection command"}
$ oc oadp nabsl-request reject user-test-bsl --reason "Invalid configuration"
```

## Collect diagnostic data {#oadp-cli-must-gather_oadp-cli-plugin}

You can use the OADP command-line interface (CLI) to collect diagnostic information for OADP installations. The `must-gather` command runs the OADP must-gather tool to collect logs and cluster state information needed for troubleshooting and support cases.

**Prerequisites**

- The OADP CLI plugin is installed and configured in admin mode.
- You are logged in to the OpenShift Container Platform cluster as a user with `cluster-admin` privileges.
- The `oc` CLI is installed and available on your `PATH`.

**Procedure**

- Collect OADP diagnostic information:

  ```terminal
  $ oc oadp must-gather [flags]
  ```

  **Flags for the `oc oadp must-gather` command**

  | Flag | Description |
  | --- | --- |
  | `--dest-dir` | The directory where the must-gather output is stored. The default value is `./must-gather`. |
  | `--request-timeout` | The timeout for the gather script, for example, `30s` or `1m`. |
  | `--skip-tls` | Specifies whether to skip Transport Layer Security (TLS) verification. |

  ```terminal {title="Example of the must-gather command"}
  $ oc oadp must-gather --dest-dir=/tmp/oadp-diagnostics --request-timeout=1m
  ```

## OADP self-service {#oadp-cli-nonadmin-about_oadp-cli-plugin}

Non-administrator users can use OADP self-service to perform backup and restore operations in their authorized namespaces without requiring cluster-wide administrator privileges.

This feature provides secure, self-service data protection while maintaining administrator controls over backup and restore operations.

You can use OADP self-service to complete the following tasks:

- Create and manage namespace-scoped backups and restores.
- View backup and restore status and logs.
- Create dedicated backup storage locations with user-owned buckets and credentials.

### Limitations {#oadp-cli-nonadmin-about-limitations_oadp-cli-plugin}

- Cross-cluster operations and migrations are not supported for non-administrator users.
- Non-administrator volume snapshot locations (VSLs) are not supported. The VSL configured by the cluster administrator in the `DataProtectionApplication` custom resource (CR) is used.
- Backups and restores are scoped to the namespace from which the command is run. You cannot specify a different namespace.
- Cluster-scoped resources cannot be included in backups or restores.
- `ResourceModifiers` and volume policies are not supported for non-administrator backup and restore operations.
- Backup and restore logs by using a `NonAdminDownloadRequest` object are not supported for default backup storage locations (BSLs). To access logs, you must create a `NonAdminBackupStorageLocation` object.

### Prerequisites for non-administrator users {#oadp-cli-nonadmin-about-prereqs_oadp-cli-plugin}

Before you use OADP self-service, a cluster administrator must complete the following tasks:

- Install and configure the OADP Operator with `nonAdmin.enable: true` in the `DataProtectionApplication` CR specification.
- Create your user account, namespace, and namespace privileges, such as namespace administrator.
- Grant editor roles for the following resources in your namespace:

  - `nonadminbackups.oadp.openshift.io`
  - `nonadminrestores.oadp.openshift.io`
  - `nonadminbackupstoragelocations.oadp.openshift.io`
  - `nonadmindownloadrequests.oadp.openshift.io`
- Optionally, create a `NonAdminBackupStorageLocation` object for your namespace.

## Non-admin backup management commands {#oadp-cli-nonadmin-backups_oadp-cli-plugin}

You can use the OADP command-line interface (CLI) to create, view, describe, and delete non-admin backups in your namespace.

### Prerequisites {#oadp-cli-nonadmin-backups-prereqs_oadp-cli-plugin}

- The OADP CLI plugin is installed and configured in non-admin mode.
- You are logged in to the OpenShift Container Platform cluster and your current namespace context is set to the namespace you want to back up.
- You have editor roles for `nonadminbackups.oadp.openshift.io` in your namespace.
- A `NonAdminBackupStorageLocation` object exists in your namespace, or a default has been configured by running the `oc oadp client config set default-nabsl=<name>` command.

### Non-admin backup creation command {#oadp-cli-nonadmin-backups-create_oadp-cli-plugin}

To create a backup of resources in your current namespace, use the following command:

```terminal
$ oc oadp nonadmin backup create <backup_name> [flags]
```

**Flags for the `oc oadp nonadmin backup create` command**

| Flag | Description |
| --- | --- |
| `--storage-location` | The name of the `NonAdminBackupStorageLocation` object to use. This flag is required unless a default is configured. |
| `--include-resources` | The resources to include in the backup. You can specify simple kind names, for example, `deployments,services`, or you can use the `resource.group` format for disambiguation, for example, `deployments.apps`. The default value is `*` (all resources). |
| `--exclude-resources` | The resources to exclude from the backup. This flag uses the same format as the `--include-resources` flag. |
| `--selector`, `-l` | Specifies to back up only the resources that match this label selector. |
| `--or-selector` | Specifies to back up resources that match at least one of the label selectors, separated by `or`. |
| `--ttl` | The amount of time before the backup can be garbage collected. The default value is `720h`. |
| `--csi-snapshot-timeout` | The timeout for Container Storage Interface (CSI) snapshot creation. |
| `--item-operation-timeout` | The timeout for asynchronous plugin operations. |
| `--snapshot-volumes` | Specifies whether to take snapshots of persistent volumes (PVs) as part of the backup. |
| `--snapshot-move-data` | Specifies whether to move snapshot data to the backup storage location. |
| `--default-volumes-to-fs-backup` | Specifies whether to use pod volume file system backups by default for all volumes. |

```terminal {title="Example of the non-admin backup creation command"}
$ oc oadp nonadmin backup create my-backup \
    --storage-location my-nabsl \
    --include-resources deployments,services \
    --selector app=myapp \
    --snapshot-volumes \
    --ttl 720h
```

> [!TIP]
> To avoid specifying the storage location on each backup, run the following command to set a default:
>
> ```terminal
> $ oc oadp client config set default-nabsl=<nabsl_name>
> ```

### Non-admin backup listing command {#oadp-cli-nonadmin-backups-list_oadp-cli-plugin}

To list all backups in your current namespace, use the following command:

```terminal
$ oc oadp nonadmin backup get [<backup_name>] [flags]
```

**Flags for the `oc oadp nonadmin backup get` command**

| Flag | Description |
| --- | --- |
| `-o` | The output format. Supported values are `json` and `yaml`. |

### Non-admin backup description command {#oadp-cli-nonadmin-backups-describe_oadp-cli-plugin}

To view the details of a backup, use the following command:

```terminal
$ oc oadp nonadmin backup describe <backup_name> [flags]
```

**Flags for the `oc oadp nonadmin backup describe` command**

| Flag | Description |
| --- | --- |
| `--details` | Specifies whether to display additional backup details, including volume snapshots, resource lists, and item operations. |
| `--request-timeout` | The timeout for fetching backup details from the server. |

### Non-admin backup logs command {#oadp-cli-nonadmin-backups-logs_oadp-cli-plugin}

To view the logs for a backup, use the following command:

```terminal
$ oc oadp nonadmin backup logs <backup_name> [flags]
```

**Flags for the `oc oadp nonadmin backup logs` command**

| Flag | Description |
| --- | --- |
| `--request-timeout` | The timeout for fetching logs from the server. |

> [!NOTE]
> Backup logs are available only when you use a `NonAdminBackupStorageLocation` object. Logs are not available for backups that use the default cluster backup storage location.

### Non-admin backup deletion command {#oadp-cli-nonadmin-backups-delete_oadp-cli-plugin}

To delete one or more backups, use the following command:

```terminal
$ oc oadp nonadmin backup delete [<backup_name>...] [flags]
```

**Flags for the `oc oadp nonadmin backup delete` command**

| Flag | Description |
| --- | --- |
| `--confirm` | Specifies whether to skip the confirmation prompt and delete immediately. |
| `--all` | Specifies whether to delete all backups in the current namespace. |

Backup deletion is performed asynchronously by the OADP non-admin controller.

```terminal {title="Example of the non-admin backup deletion command"}
$ oc oadp nonadmin backup delete my-backup --confirm
```

## Non-administrator restore management commands {#oadp-cli-nonadmin-restores_oadp-cli-plugin}

You can use the OADP command-line interface (CLI) to create, view, describe, and delete non-administrator restores in your namespace.

### Prerequisites {#oadp-cli-nonadmin-restores-prereqs_oadp-cli-plugin}

- The OADP CLI plugin is installed and configured in non-administrator mode.
- You are logged in to the OpenShift Container Platform cluster and your current namespace context is set to the namespace you want to restore into.
- You have editor roles for `nonadminrestores.oadp.openshift.io` in your namespace.
- A completed non-administrator backup exists to restore from.

### Non-administrator restore creation command {#oadp-cli-nonadmin-restores-create_oadp-cli-plugin}

To create a restore from an existing non-administrator backup, use the following command:

```terminal
$ oc oadp nonadmin restore create [<restore_name>] [flags]
```

where:

`<restore_name>`
:   Specifies the name of the restore. This value is optional. If you do not provide a name, a name is automatically generated.

**Flags for the `oc oadp nonadmin restore create` command**

| Flag | Description |
| --- | --- |
| `--backup-name` | The name of the non-administrator backup to restore from. This flag is required. |
| `--include-resources` | The resources to include in the restore. You can specify simple kind names, for example, `deployments,services`, or you can use the `resource.group` format for disambiguation, for example, `deployments.apps`. The default value is `*` (all resources). |
| `--exclude-resources` | The resources to exclude from the restore. This flag uses the same format as the `--include-resources` flag. |
| `--selector`, `-l` | Specifies that only the resources that match this label selector are restored. |
| `--or-selector` | Specifies that resources that match at least one of the label selectors, separated by `or`, are restored. |
| `--item-operation-timeout` | The timeout for asynchronous plugin operations. |

```terminal {title="Example of the non-administrator restore creation command"}
$ oc oadp nonadmin restore create my-restore \
    --backup-name my-backup \
    --include-resources deployments,services \
    --selector app=myapp
```

### Non-administrator restore listing command {#oadp-cli-nonadmin-restores-list_oadp-cli-plugin}

To list all restores in your current namespace, use the following command:

```terminal
$ oc oadp nonadmin restore get [<restore_name>] [flags]
```

where:

`<restore_name>`
:   Specifies the name of the restore. This value is optional.

**Flags for the `oc oadp nonadmin restore get` command**

| Flag | Description |
| --- | --- |
| `-o` | The output format. Supported values are `json` and `yaml`. |

### Non-administrator restore description command {#oadp-cli-nonadmin-restores-describe_oadp-cli-plugin}

To view the details of a restore, use the following command:

```terminal
$ oc oadp nonadmin restore describe <restore_name> [flags]
```

where:

`<restore_name>`
:   Specifies the name of the restore.

**Flags for the `oc oadp nonadmin restore describe` command**

| Flag | Description |
| --- | --- |
| `--details` | Specifies whether to display additional restore details. |
| `--request-timeout` | The timeout for fetching restore details from the server. |

### Non-administrator restore logs command {#oadp-cli-nonadmin-restores-logs_oadp-cli-plugin}

To view the logs for a restore, use the following command:

```terminal
$ oc oadp nonadmin restore logs <restore_name> [flags]
```

where:

`<restore_name>`
:   Specifies the name of the restore.

**Flags for the `oc oadp nonadmin restore logs` command**

| Flag | Description |
| --- | --- |
| `--request-timeout` | The timeout for fetching logs from the server. |

> [!NOTE]
> Restore logs are available only when you use a `NonAdminBackupStorageLocation` object. Logs are not available for restores associated with backups that use the default cluster backup storage location.

### Non-administrator restore deletion command {#oadp-cli-nonadmin-restores-delete_oadp-cli-plugin}

To delete one or more restores, use the following command:

```terminal
$ oc oadp nonadmin restore delete [<restore_name>...] [flags]
```

where:

`<restore_name>`
:   Specifies the name of the restore. You can specify multiple restores.

**Flags for the `oc oadp nonadmin restore delete` command**

| Flag | Description |
| --- | --- |
| `--confirm` | Specifies whether to skip the confirmation prompt and delete immediately. |
| `--all` | Specifies whether to delete all restores in the current namespace. |

Restore deletion is performed asynchronously by the OADP non-administrator controller.

```terminal {title="Example of the non-administrator restore deletion command"}
$ oc oadp nonadmin restore delete my-restore --confirm
```

## NonAdminBackupStorageLocation management commands {#oadp-cli-nonadmin-bsl_oadp-cli-plugin}

You can use the OADP command-line interface (CLI) to create and view `NonAdminBackupStorageLocation` (NABSL) objects in your namespace. NABSLs define where your backup data is stored by using object storage that you own and manage.

> [!NOTE]
> Updating or deleting NABSLs after creation is not supported for non-administrator users.

### Prerequisites {#oadp-cli-nonadmin-bsl-prereqs_oadp-cli-plugin}

- The OADP CLI plugin is installed and configured in non-administrator mode.
- You are logged in to the OpenShift Container Platform cluster and your current namespace context is set to the target namespace.
- You have editor roles for `nonadminbackupstoragelocations.oadp.openshift.io` in your namespace.
- You have a Kubernetes `Secret` object in your namespace that contains the credentials for your object storage provider.

### NonAdminBackupStorageLocation creation command {#oadp-cli-nonadmin-bsl-create_oadp-cli-plugin}

To create a non-administrator backup storage location, use the following command:

```terminal
$ oc oadp nonadmin bsl create <bsl_name> [flags]
```

where:

`<bsl_name>`
:   Specifies the name of the backup storage location.

**Flags for the `oc oadp nonadmin bsl create` command**

| Flag | Description |
| --- | --- |
| `--provider` | The storage provider, for example, `aws`, `azure`, or `gcp`. This flag is required. |
| `--bucket` | The name of the object storage bucket. This flag is required. |
| `--credential` | The credential for this location in the format `SECRET_NAME=KEY`, where `SECRET_NAME` is the name of the Kubernetes `Secret` object and `KEY` is the data key within the secret. This flag is required. |
| `--prefix` | The prefix for backup objects in the bucket. |
| `--region` | The storage region. This flag is required for some providers, such as AWS. |
| `--config` | Additional provider-specific configuration as `key=value` pairs. |

If the cluster administrator has enabled the `requireApprovalForBSL` parameter, the NABSL remains in a pending state until an administrator approves the request.

```terminal {title="Example of the NABSL creation command"}
$ oc oadp nonadmin bsl create my-storage \
    --provider aws \
    --bucket my-velero-bucket \
    --prefix velero-backups \
    --credential cloud-credentials=cloud \
    --region us-east-1
```

> [!TIP]
> After you create a backup storage location (BSL), run the following command to set it as the default and avoid specifying the storage location on each backup:
>
> ```terminal
> $ oc oadp client config set default-nabsl=<bsl_name>
> ```
>
> where:
>
> `<bsl_name>`
> :   Specifies the name of the backup storage location.

### NonAdminBackupStorageLocation listing command {#oadp-cli-nonadmin-bsl-list_oadp-cli-plugin}

To list all non-administrator backup storage locations in your current namespace, use the following command:

```terminal
$ oc oadp nonadmin bsl get [<bsl_name>] [flags]
```

where:

`<bsl_name>`
:   Specifies the name of the backup storage location. This value is optional.

**Flags for the `oc oadp nonadmin bsl get` command**

| Flag | Description |
| --- | --- |
| `-o` | The output format. Supported values are `json` and `yaml`. |

**Additional resources**
{._additional-resources}

- [Backing up applications](/openshift-docs-markdown/backup_and_restore/application_backup_and_restore/backing_up_and_restoring/backing-up-applications#backing-up-applications)
- [Velero 1.16 documentation](https://velero.io/docs/v1.16/)