Extending Kubernetes
Kubernetes is a powerful container orchestrator. However, the real power of Kubernetes is the ability to expand it's core functionality. One such extension point lies in the kubectl command line tool. Kubectl can be extended by the use of various plugins made available by the open source community.
This blog post will serve as an introduction to the five most popular kubectl plugins, where most popularity is measured by the most stars on Github. There will also be one additional honorable mention from our editor.
Before we jump into the kubectl plugins list, lets first explain what plugins are.
What’s a kubectl plugin?
Kubectl plugins are extensions of the kubectl client. Depending on which plugins you install, you will be able to take advantage of new commands and new complex functionality, which isn’t possible with the default install of kubectl.
Let’s take a look at the list.
Top 5 kubectl plugins
- kubectx
- Ingress-nginx
- Cert-manager
- Popeye
- Kyverno
- kubectl-explore
Getting started with kubectl plugins
krew - a plugin manager for kubectl
Krew helps you find and install kubectl plugins made available in the community. Once plugins are installed with Krew, they’re automatically kept up to date by the plugin manager, making operating and managing your plugins that much easier.
1. kubectx and kubens
Control your context with kubebtx
A context in Kubernetes is a group of access parameters. Each context contains a Kubernetes cluster, user and a namespace.
Whether you’re a complete beginner or a more advanced user of kubectl - we all know the struggle of working in the correct context. Kubectx is a tool to switch between contexts (clusters) via kubectl faster. It even supports shell completion.
The plugin also provides the ability to switch between namespaces with kubens (and configuring them for kubectl) easily.
Not convinced? See it for yourself. Here’s a quick demo of kubectx in action.
Source (https://github.com/ahmetb/kubectx/blob/master/img/kubectx-demo.gif)
Still not convinced? Well, here’s a quick demo of kubens as well.
Source (https://github.com/ahmetb/kubectx/blob/master/img/kubens-demo.gif)
Here’s an example of how you could use kubectx to switch from your default context to production.
kubectx production # That's it!
You can even switch back to the previous context using the - character like so: kubectx -
The plugins can be installed with krew by running the following command:
kubectl krew install ctx
kubectl krew install ns
Learn more here: https://github.com/ahmetb/kubectx
2. Ingress-nginx
Nginx Ingress Controller
The second most popular kubectl plugin is the ingress-nginx plugin. The NGINX Ingress controller has gained a lot of popularity within the Kubernetes environment and here is why.
Ingress controllers abstract away the complexity of Kubernetes application traffic routing and provide a bridge between Kubernetes services and external services. The ingress controller accepts traffic from outside the Kubernetes cluster and load balances it to available pods running inside the cluster.
The ingress-nginx plugin lets you interact with and inspect your ingress-nginx deployments within your kubernetes cluster. This simplifies the management of your ingress controller by a LOT.
Let’s say you’re trying to deploy a new ingress resource in your cluster but it’s not working even though everything looks right. You can use the ingress-nginx plugin to validate your configuration. Here’s a sample command of how you would proceed to debug your resource.
kubectl ingress-nginx lint --all-namespaces --verbose
The plugin can be installed with krew by running the following command:
kubectl krew install ingress-nginx
Learn more here: https://kubernetes.github.io/ingress-nginx/kubectl-plugin/
3. Cert-manager
Control and maintain your certificates
First, a few words about cert-manager itself: When you’re working with Kubernetes, you’re almost guaranteed to face the impending issue of certificate maintenance. Cert-manager is a powerful and extensible certificate controller for Kubernetes and it takes care of all of this for you. It makes sure that the certificates in your cluster are valid, up-to-date, and renewed.
Cert-manager works by using CRDs - or custom resource definitions. Each cert-manager crd controls a specific resource like a Certificate or Issuer. Note that cloud providers like AWS have even added support to cert-manager for their own clouds.
The important of cert-manager itself means that the cert-manager plugin for Kubernetes is an extremely powerful utility as it lets you manage your cert-manager CRDs within your cluster.
The plugin can be used in multiple ways, either by issuing commands as a kubectl subcommand or with a standalone cmctl command. Here’s how you can check your cert-manager components in your kubernetes cluster with one simple command.
kubectl cert-manager check # Simple!
The plugin can be installed with krew by running the following command:
kubectl krew install cert-manager
Learn more about the plugin here: https://github.com/cert-manager/cert-manager
4. Popeye
Prevent misconfigurations
The kubectl popeye plugin is a utility that scans your cluster(s) live and reports back on any potential issues with deployed resources and configurations. This is extremely relevant in today's environment. Many common security issues are caused by bad configuration, making popeye a very convenient plugin. If you feel Kubernetes is too complicated and has too many configurations to keep track of, then popeye is a must!
Popeye aims to reduce the cognitive overload of engineers and developers in the face of operating Kubernetes clusters in the wild. By scanning your cluster, it detects misconfigurations and helps you ensure that best practices are in place, thus preventing a lot of potential problems.
Popeye can be installed with krew by running the following command:
kubectl krew install popeye
Learn more here: https://popeyecli.io/
5. Kyverno
Police your cluster with policies
Kubernetes is in continuous growth as more and more people and organizations adopt it. This also means that new attackers are shifting their focus from older traditional IT environments to Kubernetes environments with bad security. That’s where policies come into the picture.
Kyverno is a policy engine designed specifically for Kubernetes. It validates, mutates and generates configurations using admission controllers and background scans. Kyverno policies are Kubernetes resources and do not require learning a new language, making it extremely powerful.
Kyverno ships with a set of policies made available out of the box. Check out the list of Kyverno policies here: https://kyverno.io/policies/
Kvyrno itself is installed with a helm chart. The kyverno kubectl plugin can be installed with krew by running the following command:
kubectl krew install kyverno
Learn more here: https://kyverno.io/docs/introduction/#quick-start
6. Kubectl-explore
Kubectl explain on steroids
Kubernetes itself is extremely well documented and the documentation is easily accessible on the official page (https://kubernetes.io). Since its release into the open source community in 2014, it keeps on growing and there’s no visible end to the graduated CNCF project.
Due to the size of the Kubernetes project, when you’re working the kubectl command line you’re almost certainly going to have to look something up. Usually, one would refer to either the official documentation or kubectl explain, which is a built-in feature of Kubernetes that explains the resource of your choosing.
Introducing kubectl-explore, another extremely useful kubectl plugin. It’s essentially the enhanced version of kubectl explain with fuzzy search.
Here's a quick demo of kubectl-explore in action.
You can install the kubectl-explore plugin with krew by running the following command:
kubectl krew install explore
Learn more here: https://github.com/keisku/kubectl-explore
Summary
These are the five most popular kubectl plugins right now. However, the open source community is growing and new plugins are developed and released on the daily.
If you want to create your own custom kubectl plugin then take a look at the developer guide.
If you're looking to extend Kubernetes in other ways, now is a good time to mention Robusta.dev. Check it out!
