1. Red Hat Interactive Learning Portal
  2. OpenShift learning
  3. Migrating applications from Red Hat OpenShift classic clusters to hosted control plane clusters
  4. Move from Red Hat OpenShift Service on AWS to a version with hosted control planes

Migrating applications from Red Hat OpenShift classic clusters to hosted control plane clusters

Learning path | 8 resources | 1 hr and 20 mins | Published on September 11, 2026

Learn how you can migrate your applications from Red Hat OpenShift classic to a more modernized cluster.

  1. Overview: Migrating applications from Red Hat OpenShift classic clusters to hosted control plane clusters
  2. Prepare your bare metal cluster for migration Page | 15 mins
  3. Install OADP on your management cluster Page | 5 mins
  4. Create a backup from the initial cluster Page | 10 mins
  5. Add and configure OADP on your hosted cluster Page | 10 mins
  6. Restore and validate the application on HPC Page | 20 mins
  7. Move from Red Hat OpenShift Service on AWS to a version with hosted control planes Page | 15 mins
  8. Troubleshooting errors during migration Page | 5 mins

Page

Move from Red Hat OpenShift Service on AWS to a version with hosted control planes

September 11, 2026
Related topics:
Application modernization.NET
Related products:
Red Hat OpenShift Service on AWS
OpenShift platform card

After we have appropriately installed and configured OpenShift APIs for Data Protection (OADP) and DataProtectionApplication (DPA), we can now move forward with creating a backup of our cluster. 

Prerequisites:

  • DPA must be installed and reconciled.
  • BackupStorageLocation must be Available.

In this lesson, you will:

  • Back up your classic cluster.
  • Restore to a hosted cluster using Red Hat OpenShift on AWS.

Backing up from classic Red Hat OpenShift on AWS

The process of moving your application from a classic Red Hat OpenShift on AWS cluster to one on a hosted control plane can be done with OADP. OADP helps protect data through processes such as backups and migration. 

In our source cluster, we will install OADP from Operator Hub, as described in Lesson 2. 

  1. Create a secret for the OADP operator from your cloud credentials with the following command in the terminal: 

    cat > credentials-velero <<EOF
[your-aws-profile]
aws_access_key_id=
aws_secret_access_key=
EOF

oc get secret cloud-credentials -n openshift-adp

  2. If there hasn’t been an S3 bucket you would like to back up to, create one in the region you want via the following command:

    aws s3 mb s3://my-oadp-backup-bucket --region us-east-1

  3. Create a DataProtectionApplication object:

    cat <<EOF | oc apply -f -
apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
metadata:
  name: velero-sample
  namespace: openshift-adp
spec:
  configuration:
    velero:
      defaultPlugins:
        - openshift
        - aws
    nodeAgent:
      enable: true
      uploaderType: kopia
  backupLocations:
    - velero:
        provider: aws
        default: true
        objectStorage:
          bucket: my-oadp-backup-bucket
          prefix: velero
        config:
          region: us-east-1
          profile: "default"
        credential:
          name: cloud-credentials
          key: cloud
EOF

  4. Check that the DPA object Reconciled is True. 

    oc get dpa -n openshift-adp
NAME            RECONCILED   AGE
velero-sample   True         9s

  5. Check that all the operator pods are running with the following command:

    oc get pods -n openshift-adp
NAME                                                READY   STATUS    RESTARTS   AGE
node-agent-8k7jm                                    1/1     Running   0          51s
node-agent-g2x5h                                    1/1     Running   0          51s
node-agent-zxnm7                                    1/1     Running   0          51s
openshift-adp-controller-manager-849fdbb8df-frhgr   1/1     Running   0          7m21s
velero-6dd5fff689-h9xkh                             1/1     Running   0          52s

  6. Check that the backup storage location is available.

    oc get backupstoragelocation -n openshift-adp
NAME              PHASE       LAST VALIDATED   AGE   DEFAULT
velero-sample-1   Available   51s              62s   true

  7. Go to the project that you want to back up and make sure everything is running as it should with an oc get all command.

    oc get all
Warning: apps.openshift.io/v1 DeploymentConfig is deprecated in v4.14+, unavailable in v4.10000+
NAME                                   READY   STATUS      RESTARTS   AGE
pod/ruby-hello-world-1-build           0/1     Completed   0          11m
pod/ruby-hello-world-9cbcbb777-rjd8z   1/1     Running     0          11m

NAME                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
service/ruby-hello-world   ClusterIP   172.30.111.172   <none>        8080/TCP   11m

NAME                               READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/ruby-hello-world   1/1     1            1           11m

NAME                                          DESIRED   CURRENT   READY   AGE
replicaset.apps/ruby-hello-world-5b64cf7c98   0         0         0       11m
replicaset.apps/ruby-hello-world-9cbcbb777    1         1         1       11m

NAME                                              TYPE     FROM   LATEST
buildconfig.build.openshift.io/ruby-hello-world   Docker   Git    1

NAME                                          TYPE     FROM          STATUS     STARTED          DURATION
build.build.openshift.io/ruby-hello-world-1   Docker   Git@a23a3e1   Complete   11 minutes ago   48s

NAME                                              IMAGE REPOSITORY                                                                TAGS     UPDATED
imagestream.image.openshift.io/ruby-27            image-registry.openshift-image-registry.svc:5000/my-test-app/ruby-27            latest   11 minutes ago
imagestream.image.openshift.io/ruby-hello-world   image-registry.openshift-image-registry.svc:5000/my-test-app/ruby-hello-world   latest   11 minutes ago

NAME                                        HOST/PORT                                                             PATH   SERVICES           PORT       TERMINATION   WILDCARD
route.route.openshift.io/ruby-hello-world   ruby-hello-world-my-test-app.apps.linnguye.devcluster.openshift.com          ruby-hello-world   8080-tcp                 None

  8. When you input the supplied URL, you should see the Hello World app display in your browser of choice (Figure 1): 

    A welcome message for the OpenShift v3 Demo App, showing the user that it is working.
    Figure 1: A screenshot of the demonstration app live in a browser window, illustrating that it’s successfully running.

  9. Create a backup of this project using the following command:

    cat <<EOF | oc apply -f -
apiVersion: velero.io/v1
kind: Backup
metadata:
  name: my-app-backup
  namespace: openshift-adp
spec:
  includedNamespaces:
    - my-test-app
  storageLocation: velero-sample-1
  ttl: 720h0m0s
EOF
backup.velero.io/my-app-backup created

  10. Check that your backup is complete with this command:

    oc describe backup my-app-backup -n openshift-adp
----
Phase:  Completed
----

  11. Check that in the S3 bucket exists the directory that holds your backup.

    aws s3 ls s3://my-oadp-backup-bucket/velero/backups/
  PRE my-app-backup/

Now that we have successfully backed up our data, it’s time to restore it on the hosted control planes cluster. 

Restoring to a Red Hat OpenShift Service on AWS-hosted control planes cluster

Now that we have backed up the data we wish to move, we want to ensure that our destination Red Hat OpenShift Service on AWS-hosted control planes cluster is adequately prepared to handle everything before we move it over. This means we have to install OADP on the Red Hat OpenShift Service on AWS-hosted control planes cluster. Since the hosted control planes architecture is automatically set to use security token service (STS), you can’t install it from Operator Hub. Instead, you’ll have to proceed with the following steps in your target cluster on Terminal:

  1. Create the OADP namespace:

    oc create namespace openshift-adp
namespace/openshift-adp created

  2. Use the same credentials for the operator as in the source cluster, and create the secret:

    cat > credentials-velero <<EOF
[the-same-profile-like-source-cluster]                             
aws_access_key_id=
aws_secret_access_key=
EOF

oc create secret generic cloud-credentials \
  -n openshift-adp \
  --from-file cloud=credentials-velero

oc get secret cloud-credentials -n openshift-adp
NAME                TYPE     DATA   AGE
cloud-credentials   Opaque   1      9s

  3. Install the operator:

    cat <<EOF | oc create -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: redhat-oadp-operator
  namespace: openshift-adp
spec:
  channel: stable
  name: redhat-oadp-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace
  installPlanApproval: Automatic
EOF

  4. Check subscription, CSV, and operator pods to ensure they’re stable. 

    oc get subscription redhat-oadp-operator -n openshift-adp
NAME                   PACKAGE                SOURCE             CHANNEL
redhat-oadp-operator   redhat-oadp-operator   redhat-operators   stable

oc get csv -n openshift-adp
NAME                   DISPLAY         VERSION   REPLACES               PHASE
oadp-operator.v1.5.5   OADP Operator   1.5.5     oadp-operator.v1.5.4   Succeeded

oc get pods -n openshift-adp 
NAME                                                READY   STATUS    RESTARTS   AGE
openshift-adp-controller-manager-7f8d94df67-2qwlj   0/1     Running   0          11s

  5. Create the DataProtectionApplication object. This will activate the installed OADP operator:

    cat <<EOF | oc apply -f -
apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
metadata:
  name: velero-sample
  namespace: openshift-adp
spec:
  configuration:
    velero:
      defaultPlugins:
        - openshift
        - aws
    nodeAgent:
      enable: true
      uploaderType: kopia
  backupLocations:
    - velero:
        provider: aws
        default: true
        objectStorage:
          bucket: my-oadp-backup-bucket  # SAME bucket as first cluster
          prefix: velero
        config:
          region: us-east-1
          profile: "default"
        credential:
          name: cloud-credentials
          key: cloud
EOF
dataprotectionapplication.oadp.openshift.io/velero-sample created

  6. Check the backupstoragelocation, and wait until you can see the backups available. There may be a short wait of up to one minute.

    oc get backupstoragelocation -n openshift-adp
NAME              PHASE   LAST VALIDATED   AGE   DEFAULT
velero-sample-1                            9s    true

oc get backups -n openshift-adp
NAME            AGE
my-app-backup   39s

    If the backupstoragelocation never reaches Available (stuck on Unavailable or blank), it means Velero can't reach or authenticate to your storage bucket. Debug by using these commands:

    oc get bsl -n openshift-adp -o yaml # look at status.message / status.phase
    oc logs deploy/velero -n openshift-adp | grep -i backupstoragelocation

  7. Create a restore on this cluster:

    cat <<EOF | oc apply -f -
apiVersion: velero.io/v1
kind: Restore
metadata:
  name: my-app-restore-cluster2
  namespace: openshift-adp
spec:
  backupName: my-app-backup
  includedNamespaces:
    - my-test-app
  restorePVs: true
EOF
restore.velero.io/my-app-restore-cluster2 created

oc get restore -n openshift-adp
NAME                      AGE
my-app-restore-cluster2   11s

oc describe restore my-app-restore-cluster2 -n openshift-adp
------
Phase:  Completed
------

  8. Check that your project has been restored and is working as expected through the following command:

    oc get projects | grep my-test-app
my-test-app                                                               Active

oc project my-test-app
Now using project "my-test-app" on server "https://api.hosted control planes-linh.3ows.p3.openshiftapps.com:443".

oc get all
Warning: apps.openshift.io/v1 DeploymentConfig is deprecated in v4.14+, unavailable in v4.10000+
NAME                                   READY   STATUS    RESTARTS   AGE
pod/ruby-hello-world-1-build           1/1     Running   0          48s
pod/ruby-hello-world-9cbcbb777-5wkzm   1/1     Running   0          57s

NAME                       TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
service/ruby-hello-world   ClusterIP   172.30.153.89   <none>        8080/TCP   57s

NAME                               READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/ruby-hello-world   1/1     1            1           57s

NAME                                          DESIRED   CURRENT   READY   AGE
replicaset.apps/ruby-hello-world-5b64cf7c98   0         0         0       57s
replicaset.apps/ruby-hello-world-9cbcbb777    1         1         1       57s

NAME                                              TYPE     FROM   LATEST
buildconfig.build.openshift.io/ruby-hello-world   Docker   Git    1

NAME                                          TYPE     FROM          STATUS    STARTED          DURATION
build.build.openshift.io/ruby-hello-world-1   Docker   Git@a23a3e1   Running   48 seconds ago   

NAME                                              IMAGE REPOSITORY                                                                TAGS     UPDATED
imagestream.image.openshift.io/ruby-27            image-registry.openshift-image-registry.svc:5000/my-test-app/ruby-27            latest   48 seconds ago
imagestream.image.openshift.io/ruby-hello-world   image-registry.openshift-image-registry.svc:5000/my-test-app/ruby-hello-world   latest   49 seconds ago

NAME                                        HOST/PORT                                                                   PATH   SERVICES           PORT       TERMINATION   WILDCARD
route.route.openshift.io/ruby-hello-world   ruby-hello-world-my-test-app.apps.rosa.hosted control planes-linh.3ows.p3.openshiftapps.com          ruby-hello-world   8080-tcp                 None

  9. Access the route to check that the web app is running as expected (Figure 1).

    A welcome message for the OpenShift v3 Demo App, showing the user that it is working.
    Figure 1: A screenshot of the demonstration app live in a browser window, illustrating that it’s successfully running.

Congratulations! You have successfully moved your application and data from a classic Red Hat OpenShift Service on AWS cluster to one with hosted control planes.

Next, we’ll dive into some common troubleshooting techniques you can use if you run into problems during the migration process.

Previous resource
Restore and validate the application on HPC
Next resource
Troubleshooting errors during migration