The tools I build platforms with

There are more DevOps tools than anyone can evaluate. This is the set I keep coming back to when building a platform: tools that are well made, do one job well, and fit together.

Everything here assumes Kubernetes. It isn't the only way to run software, but its ecosystem is the reason most of these tools exist.

The list starts at the bottom of the stack and works up: provisioning, networking, development, delivery, operations, and finally cost.

Provisioning

Terraform

Terraform provisions the foundation: networks, clusters, and managed services. It's predictable, works across clouds, and most teams already know it.

Crossplane

Crossplane lets developers request cloud resources, like a database or a bucket, as Kubernetes objects. Terraform owns the foundation; Crossplane handles self-service on top of it.

Networking

Cilium

Cilium uses eBPF for cluster networking, network policies, and observability. It's the default network layer in several managed Kubernetes offerings, and a common choice for self-managed clusters.

Hubble

Hubble runs on top of Cilium and shows the network flows between services, including which traffic a policy allowed or dropped. It's often the fastest way to debug a connection problem.

Local development

Tilt

Tilt automates builds and live reloads during development, so a code change reaches a running environment in seconds. It's mostly used with Kubernetes, but also works with docker-compose.

In the early stages of a product, Tilt with docker-compose keeps the setup light. Once the product grows, Tilt with kind runs a real cluster on a laptop that behaves like production.

Task

Task is a simpler, cross-platform replacement for Make, with dependencies between tasks and support for environment variables. It works well for local commands, CI scripts, and project scaffolding.

Configuration and packaging

ytt

ytt, from VMware's Carvel suite, templates YAML with a real programming language instead of text substitution. It works best for internal services, where the team controls the whole configuration.

It can also patch the output of a Helm chart, which lets you change a third-party app without forking its chart.

Helm

Most third-party software ships as a Helm chart, so Helm is hard to avoid. For internal services, though, it's heavier and more opinionated than it needs to be.

With a GitOps tool like Argo CD (below), Helm often serves only as a template engine (helm template), while Argo CD handles the rest of the release.

kapp, also from Carvel, can apply rendered Helm output cleanly, though a GitOps setup usually makes it unnecessary.

Delivery

Argo CD

Argo CD keeps the cluster in sync with Git. Git becomes the single source of truth for every deployment, and Argo CD reports when the two drift apart.

  • Permissions: who can deploy what is controlled through Git.
  • History: every change is tracked, and rolling back is a revert.
  • UI: compare Git with the live cluster, and roll back by hand when needed.

Secrets

Vault and External Secrets Operator

Vault stores secrets centrally, controls who can read them, and can issue short-lived credentials on demand.

The External Secrets Operator syncs those secrets into Kubernetes, so pods receive them without anyone copying values around.

Messaging and autoscaling

NATS

NATS is a lightweight, fast messaging system for event-driven services. Services publish and subscribe to messages without needing to know about each other.

KEDA

KEDA scales workloads on events, such as queue length, rather than on CPU alone. Paired with NATS, services scale with the actual backlog of work, down to zero when there is none.

Observability

The Grafana stack

Prometheus, Mimir, Loki, Tempo, Grafana, and Alloy cover the whole job with open-source tools:

  • Prometheus and Mimir: metrics, with Mimir for long-term, scalable storage
  • Loki: logs
  • Tempo: distributed traces
  • Grafana: dashboards and alerting across all three
  • Alloy: the collector that ships everything to them

Security

SBOMs and vulnerability scanning

  • Syft generates a Software Bill of Materials (SBOM) for each image.
  • Grype scans SBOMs or images for known vulnerabilities.

Trivy can do both jobs and is a solid tool. The value is in storing the SBOM as its own artifact: it gives auditors a record, and new CVEs can be checked without rescanning images.

Runtime security and policy

  • Falco watches system calls for suspicious behavior at runtime, and Falcosidekick routes its alerts to tools like Slack.
  • Kubescape checks manifests and clusters against the NSA, MITRE ATT&CK, and CIS benchmarks.
  • Kyverno enforces cluster policies written as YAML, such as blocking privileged containers.

Cost

Kubecost and OpenCost

Both break Kubernetes spend down by namespace, team, or workload. OpenCost is the open-source project at Kubecost's core. Knowing where the money goes is the first step to spending less of it.

Infracost

Infracost adds cost estimates to Terraform pull requests, so a change that doubles the bill is caught in review rather than on the invoice.

Where to start

None of these tools matters much on its own. What matters is how they fit together: Git as the source of truth, everything declarative, and visibility from the network up to the invoice.

Starting from scratch, there's no need to adopt all of it at once. Kubernetes, Terraform, Argo CD, and basic observability go a long way. Add the rest when a real problem calls for it.