---
title: "How to manage the OPCP configuration with opcp-cli"
description: "Find out how to edit the deployment and hardware configuration of your OPCP with opcp-cli, then apply your changes to the control plane"
url: https://docs.ovhcloud.com/pl/guides/hosted-private-cloud/opcp/how-to-manage-configuration
lang: en
lastUpdated: 2026-11-03
---
> For AI agents: the complete documentation index is available at https://docs.ovhcloud.com/pl/llms.txt, the full documentation bundle is available at https://docs.ovhcloud.com/pl/llms-full.txt.

# How to manage the OPCP configuration with opcp-cli

**Warning:** If your OPCP is managed by OVHcloud, contact OVHcloud before you apply a change to the control plane.

## Objective

On an **OVHcloud On-Prem Cloud Platform (OPCP)**, the `opcp-cli` tool installed on your controllers manages the configuration of the control plane.

**This guide explains how to edit the configuration of your OPCP with `opcp-cli` and apply your changes.**

## Requirements

- An active [OPCP](https://www.ovhcloud.com/en-ie/hosted-private-cloud/onprem-cloud-platform/) service.
- SSH access to your OPCP controller with your `opcp-admin` account, which can run `opcp-cli` with `sudo` whether your OPCP is managed by OVHcloud or not (see [IAM rights management](https://docs.ovhcloud.com/pl/guides/hosted-private-cloud/opcp/iam-rights-management.md)).

## Instructions

Run each `opcp-cli` command with `sudo`. All the commands and options are described in `opcp-cli --help`.

The configuration is stored on the controller in two files, which you edit only with `opcp-cli`:

| File                                           | Content                                                                     | Command                           |
| ---------------------------------------------- | --------------------------------------------------------------------------- | --------------------------------- |
| `/opt/opcp/config/opcp-deployment-config.yaml` | Platform settings: environment, OPCP version, backups, NTP servers, etc.    | `opcp-cli config edit`            |
| `/opt/opcp/config/opcp-hardware-config.yaml`   | Hardware: controllers, OOB virtual IP, racks and devices declared in NetBox | `opcp-cli config edit --hardware` |

A change has no effect until you apply it (step 2).

### 1. Editing the configuration

```bash
sudo opcp-cli config edit
```

The file opens in `vi`. Write only the keys you change: the other settings keep their default values. A list that replaces its default is the exception: write all its entries, not only the ones you change. If a key already exists in the file, modify it rather than adding it a second time.

When you save and close it, `opcp-cli` checks that the YAML is valid and that the mandatory fields are filled in. If the check fails, your changes are saved anyway: run the command again to fix the file before you apply it.

**Warning:** A YAML syntax error blocks every `opcp-cli` command, including `config edit`. If your OPCP is not managed by OVHcloud, fix the file with `sudo vi` or restore a previous copy from `/opt/opcp/backup/opcp-cli/config/`. Otherwise, contact OVHcloud support.

**Warning:** Some settings cannot be modified after installation, such as `env`, `region`, `stage`, `org`, `site`, `location` or `base_dns_name`. Before you change a value, check the _Summary_ section of the guide [Technical prerequisites for deployment](https://docs.ovhcloud.com/pl/guides/hosted-private-cloud/opcp/opcp-prerequisites.md).

To change the OPCP version, follow the guide [How to upgrade OPCP](https://docs.ovhcloud.com/pl/guides/hosted-private-cloud/opcp/how-to-upgrade-opcp.md).

### 2. Applying your changes

Check that the configured and deployed versions of your OPCP match. If they differ, follow the guide [How to upgrade OPCP](https://docs.ovhcloud.com/pl/guides/hosted-private-cloud/opcp/how-to-upgrade-opcp.md) instead.

```bash
sudo opcp-cli version
```

Then apply your changes:

```bash
sudo opcp-cli deploy --system
```

The deployment can take more than 10 minutes. It copies the configuration to the other controllers and saves a dated copy of it in `/opt/opcp/backup/opcp-cli/config/`. The detailed logs are in `/var/log/opcp-cli/opcp-cli.log`. Do not delete the installation files from `/opt/opcp/artifacts`: the deployment needs them.

The platform then takes a few more minutes to converge. Check that it is healthy with `opcp-diag`:

```bash
sudo opcp-diag run
```

If the output contains the warning `Following kustomizations are unready`, followed by the list of the components concerned, a deployment is still in progress. If so, wait a few minutes, then run `opcp-diag` again.

## Configuration examples

Unless stated otherwise, make the changes below in the deployment configuration with `sudo opcp-cli config edit` (step 1). Then apply each of them with `sudo opcp-cli deploy --system` (step 2). The network flows to open are listed in the guide [Technical prerequisites for deployment](https://docs.ovhcloud.com/pl/guides/hosted-private-cloud/opcp/opcp-prerequisites.md).

### Hardware configuration

**Warning:** Never modify the hardware configuration, except to extend your platform to several racks or to add network devices.

```bash
sudo opcp-cli config edit --hardware
```

### Trusted certificate authority

If the platform must connect to a service whose certificate is signed by your own certificate authority (CA), for example an LDAP directory over LDAPS, copy the CA certificate (PEM format, `.crt` extension) to the controller, then run:

```bash
sudo opcp-cli secrets certificates trust-ca --ca-crt-path <path-to-your-ca>.crt --name <ca-name>
```

The name accepts only lowercase letters, digits and hyphens. The controller trusts the CA immediately, Keycloak within a few minutes, and the other platform components the next time they restart. Apply the change (step 2) to add the CA to the other controllers.

### S3 backups

Follow the guide [How to update the backup S3<sup>1</sup> buckets](https://docs.ovhcloud.com/pl/guides/hosted-private-cloud/opcp/how-to-update-backup-s3-buckets.md).

### NTP servers

```yaml
ntp:
  servers:
    - "<your-ntp-server-1>"
    - "<your-ntp-server-2>"

```

Give IP addresses or DNS names. For a DNS name that points to several servers, use the `pools` key instead of `servers`.

### DNS resolvers

```yaml
public_forward_resolvers:
  - "<your-dns-resolver-ip-1>"
  - "<your-dns-resolver-ip-2>"

```

This list replaces the default resolver: list all the resolvers to use.

### Log forwarding to a syslog server

```yaml
monitoring:
  logs:
    forwarder:
      enabled: true
      syslog:
        enabled: true
        endpoints:
          - host: "<your-syslog-server>"
            port: "514"
            mode: tcp
```

Write the port in quotes. The `mode` is `tcp` (default), `tls` or `udp`. Add one entry per syslog server.

### Keycloak allowed endpoints

Keycloak can only reach the external services listed in `keycloak.allowedEndpoints`, such as your LDAP directory.

```yaml
keycloak:
  allowedEndpoints:
    - host: "<your-ldap-server>"
      port: 636
```

Add one entry per host and TCP port. Network ranges are not supported.

## Go further

For training or technical assistance implementing our solutions, contact your sales representative or visit our [Professional Services](https://www.ovhcloud.com/pl/professional-services/) page to request a quote and have your project analysed by our experts.

Join our [community of users](https://community.ovhcloud.com/).

1
: S3 is a trademark of Amazon Technologies, Inc. OVHcloud's service is not sponsored by, endorsed by, or otherwise affiliated with Amazon Technologies, Inc.