Platform Tools Basics

This page is a hands-on tour of the tools most platform teams install on a fresh Kubernetes cluster.

Each example is a minimal, real command or manifest you can adapt for your own environment.

Prerequisites

• kubectl matching your cluster (Kubernetes 1.36.2 here; keep kubectl within one minor of the API server).
• Helm 3 for chart-based installs of add-ons.
• A cluster with an ingress or Gateway controller already running for the TLS and DNS examples.
• containerd as the node runtime (via CRI); Docker Engine 29.6.1 is for building images, not running pods.

Quick install on macOS with Homebrew:

brew install kubectl helm k9s stern
brew install derailed/k9s/k9s   # if not in core

Basic Examples

1. Confirm your context and cluster health

Before installing anything, know which cluster you are pointed at.

kubectl config current-context
kubectl get nodes -o wide
kubectl get pods -A --field-selector=status.phase!=Running

• current-context prevents the classic mistake of installing into prod by accident.
• get nodes -o wide shows node versions and the container runtime (containerd).
• The last command surfaces any pods not Running across all namespaces.
• Run this as a sanity check before every platform change.

2. Add a Helm repo and install an add-on

Most platform tools ship as Helm charts you install into a dedicated namespace.

helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace \
  --set crds.enabled=true --version v1.16.2

• --create-namespace keeps each tool isolated in its own namespace.
• Pin --version so upgrades are deliberate, not accidental.
• crds.enabled=true installs the CRDs this chart needs.
• Verify a chart's exact values with helm show values <chart> before installing.

3. Inspect what a tool installed

After any install, look at what actually landed in the cluster.

kubectl get all -n cert-manager
kubectl get crd | grep cert-manager

• get all shows Deployments, Pods, and Services for the tool.
• Listing CRDs confirms the new API types are registered.
• CRDs are cluster-scoped, so they show up regardless of namespace.
• If pods are CrashLoopBackOff, jump to logs (example 5).

4. Watch cluster state live with k9s

k9s is a terminal UI that replaces dozens of kubectl get commands.

k9s -n cert-manager

• Type :pods or :deploy to switch resource views.
• Press l on a pod to stream logs, d to describe, s to shell in.
• Press :ctx to switch clusters without leaving the UI.
• It is read-friendly for triage but still respects your RBAC permissions.

5. Tail logs across many pods with stern

When a Deployment has several replicas, stern tails them all at once.

stern -n cert-manager cert-manager --since 10m
stern -n prod 'checkout-.*' --container app

• The first argument is a pod-name regex, not a single pod.
• --since limits noise to recent lines.
• --container narrows to one container in multi-container pods.
• Each pod's lines are color-coded so you can tell them apart.

6. Issue a TLS certificate declaratively

With cert-manager installed, a ClusterIssuer plus an annotation gets you HTTPS.

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: platform@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
      - http01:
          ingress:
            ingressClassName: nginx

• The ClusterIssuer is cluster-wide, usable by any namespace.
• HTTP-01 solves the ACME challenge through your ingress controller.
• Annotate an Ingress with cert-manager.io/cluster-issuer: letsencrypt-prod to trigger issuance.
• cert-manager writes the signed cert into a Secret automatically.

7. Publish DNS records from Kubernetes

external-dns turns Service and Ingress objects into DNS records.

apiVersion: v1
kind: Service
metadata:
  name: web
  annotations:
    external-dns.alpha.kubernetes.io/hostname: web.example.com
spec:
  type: LoadBalancer
  selector:
    app: web
  ports:
    - port: 443
      targetPort: 8443

• external-dns reads the annotation and the assigned load-balancer address.
• It creates a record (for example an A or CNAME) in your DNS provider.
• Removing the Service can also remove the record, depending on policy.
• Combine with cert-manager so the hostname resolves before ACME validates it.

Intermediate Examples

8. Back up a namespace with Velero

Velero snapshots API objects and can trigger CSI volume snapshots.

velero backup create checkout-daily \
  --include-namespaces checkout \
  --snapshot-volumes
velero backup describe checkout-daily

• --include-namespaces scopes the backup to one app.
• --snapshot-volumes uses the CSI driver to snapshot PVs.
• describe shows phase, item counts, and any warnings.
• Restore with velero restore create --from-backup checkout-daily.

9. Pin and audit installed tool versions

Treat the platform as versioned software, not one-off installs.

helm list -A
kubectl get deploy -A -o custom-columns=\
'NS:.metadata.namespace,NAME:.metadata.name,IMAGE:.spec.template.spec.containers[0].image'

• helm list -A shows every release and its chart version.
• The custom-columns query surfaces exact image tags in use.
• Pinned, visible versions make CVE response and rollbacks predictable.
• Record these in Git so the platform is reproducible.

10. Extend kubectl with krew plugins

krew is the plugin manager for kubectl and installs handy diagnostics.

kubectl krew install ctx ns neat
kubectl ctx            # switch contexts
kubectl ns platform    # switch default namespace
kubectl get deploy web -o yaml | kubectl neat

• krew install adds plugins that run as kubectl <plugin>.
• ctx and ns speed up context and namespace switching.
• neat strips managed fields and defaults for readable YAML.
• Keep the plugin set small and documented so teammates share the same tooling.

Stack versions: This page was written for Kubernetes 1.36.2, Docker Engine 29.6.1 (BuildKit default), containerd (CRI runtime on nodes), Helm 3, Compose v2, Argo CD (latest - verify at build), and Gateway API (GA - verify controller support at build).