100 Best Apps for Platform Engineers
Platform engineering spans infrastructure automation, delivery, observability, security, and developer experience. This first group covers foundational tools commonly used to standardize those responsibilities.
Kubernetes
Kubernetes orchestrates containerized workloads across clusters, handling scheduling, scaling, service discovery, and self-healing. It reduces the burden of manually placing containers and recovering workloads after infrastructure failures.
Terraform
Terraform defines and provisions cloud and infrastructure resources through declarative infrastructure-as-code configuration files. It helps teams replace inconsistent manual infrastructure changes with reviewable, repeatable provisioning workflows.
OpenTofu
OpenTofu is an open-source infrastructure-as-code tool for defining and managing infrastructure through configuration. It helps engineers manage infrastructure changes declaratively while retaining an open-source tooling option.
Pulumi
Pulumi provisions cloud infrastructure using general-purpose programming languages and reusable software development practices. It helps developers model complex infrastructure using familiar languages, testing approaches, and package ecosystems.
Helm
Helm packages Kubernetes application manifests into versioned charts that support configurable, repeatable deployments. It helps teams avoid duplicating Kubernetes YAML when deploying applications across different environments.
Argo CD
Argo CD continuously deploys Kubernetes applications by reconciling cluster state with declarative Git repositories. It helps teams prevent configuration drift by making version-controlled declarations the deployment source of truth.
Flux
Flux is a GitOps toolkit that synchronizes Kubernetes clusters with application and infrastructure configuration repositories. It helps operators automate cluster updates without relying on manual kubectl commands or ad hoc scripts.
Backstage
Backstage provides an extensible developer portal for software catalogs, documentation, templates, and integrations. It helps developers find services, ownership information, documentation, and approved workflows from one interface.
Crossplane
Crossplane extends Kubernetes to provision and manage external cloud resources through custom resource definitions. It helps platform teams offer cloud resources through Kubernetes-native APIs developers already understand.
Ansible
Ansible automates configuration management, application deployment, and infrastructure tasks using human-readable playbooks. It helps teams replace error-prone server setup steps with consistent automation across managed systems.
Packer
Packer builds identical machine images for multiple platforms from automated configuration templates. It helps infrastructure teams avoid configuration differences caused by manually prepared server images.
HashiCorp Vault
HashiCorp Vault centrally manages secrets, encryption services, and controlled access to sensitive credentials. It helps teams avoid storing long-lived credentials in source code, configuration files, and scripts.
HashiCorp Consul
HashiCorp Consul provides service discovery, service mesh capabilities, configuration storage, and health checking. It helps distributed services locate dependencies and apply network policies without hardcoded endpoints.
Prometheus
Prometheus collects time-series metrics, evaluates alerting rules, and supports monitoring through a query language. It helps operators detect resource saturation and application anomalies before they become larger incidents.
Grafana
Grafana visualizes metrics, logs, traces, and other data through dashboards, alerts, and explorations. It helps teams investigate operational signals without switching between separate data-source interfaces.
Grafana Loki
Grafana Loki aggregates logs using labels for indexing and integrates closely with Grafana dashboards. It helps teams search application logs efficiently while limiting the indexing complexity of full-text systems.
Grafana Tempo
Grafana Tempo stores distributed traces and connects trace data with related metrics and logs. It helps engineers follow requests across services when diagnosing latency and dependency failures.
OpenTelemetry
OpenTelemetry provides vendor-neutral APIs, SDKs, and collectors for generating and exporting telemetry data. It helps teams standardize instrumentation while retaining flexibility to send telemetry to different backends.
Datadog
Datadog is a cloud monitoring platform for infrastructure, applications, logs, security, and user experience. It helps teams correlate operational signals across cloud services from a centralized monitoring environment.
New Relic
New Relic provides observability tools for monitoring applications, infrastructure, logs, browser performance, and telemetry. It helps engineering teams investigate production behavior by connecting application and infrastructure performance data.
Sentry
Sentry captures application errors, performance traces, and release context to support software debugging. It helps developers prioritize recurring production errors by showing affected releases and diagnostic context.
PagerDuty
PagerDuty routes incident alerts, coordinates on-call response, and supports incident management workflows. It helps teams ensure urgent alerts reach accountable responders instead of disappearing in shared channels.
GitHub Actions
GitHub Actions automates build, test, deployment, and repository workflows through event-driven configuration files. It helps teams run repeatable automation alongside source code reviews and repository events.
GitLab CI/CD
GitLab CI/CD runs automated pipelines for building, testing, deploying, and managing software delivery workflows. It helps teams define delivery stages consistently within the same environment used for source collaboration.
Jenkins
Jenkins is an automation server that runs configurable pipelines for building, testing, and deploying software. It helps organizations automate custom delivery processes that require extensive plugin and pipeline flexibility.
CircleCI
CircleCI automates build, test, and deployment workflows using configurable pipelines triggered by code changes. It reduces manual release steps by running repeatable checks whenever developers push or merge code.
Buildkite
Buildkite orchestrates continuous integration pipelines while allowing teams to run jobs on their own agents. It helps teams meet specialized build requirements without surrendering control of build infrastructure.
Spinnaker
Spinnaker manages continuous delivery pipelines for deploying applications across Kubernetes and supported cloud environments. It gives teams a standardized release process when deployments span multiple environments and infrastructure providers.
Tekton
Tekton provides Kubernetes-native building blocks for defining and running continuous integration and delivery pipelines. It solves fragmented pipeline execution by running build and delivery tasks consistently inside Kubernetes.
Dagger
Dagger lets teams define portable CI pipelines as code using containerized execution environments. It addresses inconsistent CI environments by packaging pipeline steps and dependencies into reproducible containers.
Atlantis
Atlantis runs Terraform plans and applies through pull requests, integrating infrastructure changes with code review. It prevents unreviewed infrastructure changes by making plans visible and approvals part of repository workflows.
Terragrunt
Terragrunt extends Terraform and OpenTofu workflows with reusable configuration, dependency management, and orchestration. It reduces duplicated infrastructure code when teams manage similar modules across many accounts or environments.
Kustomize
Kustomize customizes Kubernetes manifests through overlays, patches, and reusable configuration without template languages. It helps teams maintain environment-specific manifests without copying and manually editing entire YAML files.
Kyverno
Kyverno is a Kubernetes-native policy engine that validates, mutates, and generates cluster resources. It enforces operational guardrails before unsafe or noncompliant Kubernetes resources reach shared clusters.
Open Policy Agent
Open Policy Agent evaluates declarative policies for authorization, admission control, and other software decisions. It centralizes policy logic so teams avoid embedding inconsistent access rules across multiple services.
Gatekeeper
Gatekeeper applies Open Policy Agent constraints to validate and audit Kubernetes resources. It helps platform teams detect and block cluster configurations that violate organizational requirements.
Falco
Falco detects suspicious runtime behavior in cloud-native workloads using rules and system event data. It surfaces unexpected container activity that is difficult to notice through logs and metrics alone.
Trivy
Trivy scans container images, filesystems, repositories, and infrastructure configuration for security issues. It finds known vulnerabilities and risky configurations before artifacts are promoted into production environments.
Snyk
Snyk identifies vulnerabilities in application dependencies, containers, infrastructure code, and cloud configurations. It helps developers address security findings within familiar development workflows rather than separate security queues.
Docker
Docker builds, packages, and runs applications in containers with defined images and runtime settings. It reduces environment drift by giving developers and operators a consistent application packaging format.
Podman
Podman builds and runs OCI containers using a daemonless architecture and command-line interface. It provides container management for environments where teams prefer rootless workflows and no central daemon.
Rancher
Rancher provides centralized management for Kubernetes clusters, access controls, and application deployment tools. It reduces operational overhead when teams must administer multiple Kubernetes clusters from different environments.
K9s
K9s provides a terminal-based interface for viewing, navigating, and managing Kubernetes cluster resources. It speeds up cluster troubleshooting by reducing repetitive kubectl commands during live operational investigations.
Lens
Lens offers a desktop interface for inspecting Kubernetes clusters, workloads, metrics, and resource configurations. It makes cluster exploration easier for engineers who need contextual views beyond command-line output.
Istio
Istio provides service mesh capabilities for traffic management, security, and observability across microservices. It standardizes service-to-service controls without requiring every application team to implement them independently.
Linkerd
Linkerd is a lightweight service mesh that adds reliability, security, and observability to Kubernetes services. It helps teams understand and improve internal service communication without changing application code.
Cilium
Cilium provides eBPF-based Kubernetes networking, security policies, load balancing, and network observability. It gives operators deeper network visibility and policy enforcement for complex containerized application traffic.
NGINX
NGINX serves web content and operates as a reverse proxy, load balancer, and HTTP cache. It helps teams route and scale application traffic through a widely used configurable edge component.
cert-manager
cert-manager automates certificate issuance, renewal, and lifecycle management for Kubernetes and related systems. It prevents expired certificates by continuously managing renewal workflows for encrypted application endpoints.
Kong Gateway
Kong Gateway manages API traffic with routing, authentication, rate limiting, and plugin-based extensions. It centralizes API governance so teams can apply consistent controls without modifying every service.
Argo Workflows
Argo Workflows orchestrates container-native workflows on Kubernetes through reusable steps, dependencies, and scheduled execution. It helps teams replace fragile scripts with observable workflow pipelines that run consistently in Kubernetes.
Argo Rollouts
Argo Rollouts manages Kubernetes progressive deliveries using canary, blue-green, and analysis-driven deployment strategies. It helps teams reduce release risk by gradually shifting traffic and evaluating deployment health.
Argo Events
Argo Events triggers Kubernetes workflows and services from event sources such as webhooks, queues, and schedules. It helps teams avoid custom event-handling glue by standardizing event-driven automation on Kubernetes.
Flagger
Flagger automates progressive delivery on Kubernetes by promoting or rolling back releases using metrics. It helps teams detect unhealthy releases earlier through automated metric checks during traffic shifts.
Skaffold
Skaffold automates local Kubernetes development workflows including building, deploying, syncing, and debugging application changes. It helps developers shorten repetitive build-and-deploy cycles while working against Kubernetes environments.
Tilt
Tilt provides a local development environment for building, deploying, and live-updating applications on Kubernetes. It helps developers see code changes faster without manually rebuilding and redeploying every service.
Telepresence
Telepresence connects a local development process to a remote Kubernetes cluster for testing service interactions. It helps developers debug distributed services locally without duplicating complex shared cluster environments.
DevSpace
DevSpace supports Kubernetes development with automated deployments, file synchronization, and remote debugging workflows. It helps teams reduce setup friction when iterating on applications deployed to Kubernetes.
vcluster
vcluster creates virtual Kubernetes clusters inside host clusters for isolated tenant and development environments. It helps platform teams provide cluster-like isolation without provisioning a separate physical cluster each time.
Loft
Loft manages Kubernetes access, virtual clusters, and self-service environments for development teams. It helps platform teams control multi-tenant cluster access while enabling faster environment provisioning.
Humanitec
Humanitec orchestrates platform resources and delivery workflows through an internal developer platform interface. It helps developers request standardized environments without learning every underlying infrastructure integration.
Porter
Porter provides a developer-facing platform for deploying applications and managing environments on Kubernetes. It helps teams simplify Kubernetes application delivery through a more accessible deployment workflow.
Kubecost
Kubecost analyzes Kubernetes spending and allocates infrastructure costs across clusters, namespaces, and workloads. It helps teams identify expensive workloads and assign shared cluster costs to responsible owners.
OpenCost
OpenCost provides open-source cost monitoring and allocation data for Kubernetes workloads and infrastructure. It helps platform teams expose Kubernetes cost data without building allocation logic from scratch.
Checkov
Checkov scans infrastructure-as-code and cloud configurations for security, compliance, and policy misconfigurations. It helps teams catch insecure infrastructure definitions before they reach cloud environments.
Semgrep
Semgrep performs customizable static analysis to find code patterns, bugs, and security issues. It helps engineering teams enforce secure coding rules without waiting for manual reviews.
SonarQube
SonarQube analyzes source code for reliability issues, security vulnerabilities, code smells, and coverage data. It helps teams maintain code quality by surfacing technical debt within development workflows.
Grype
Grype scans container images, filesystems, and software packages for known vulnerability records. It helps teams identify vulnerable dependencies before shipping images into production environments.
Syft
Syft generates software bills of materials from container images, directories, and filesystem archives. It helps teams inventory shipped dependencies when responding to vulnerability or compliance questions.
Cosign
Cosign signs, verifies, and attests container images and other OCI-compatible artifacts. It helps teams verify artifact provenance before allowing untrusted images into deployment pipelines.
SOPS
SOPS encrypts configuration files and secrets while preserving a format suitable for version control. It helps teams store encrypted secrets alongside infrastructure code without exposing plaintext values.
External Secrets Operator
External Secrets Operator synchronizes secrets from external secret managers into Kubernetes Secret resources. It helps teams avoid manually copying sensitive values between secret stores and Kubernetes clusters.
Sealed Secrets
Sealed Secrets encrypts Kubernetes Secrets so encrypted manifests can be safely stored in Git. It helps GitOps teams commit secret configuration without exposing usable credentials in repositories.
Doppler
Doppler centralizes application secrets and configuration values, with integrations for development and deployment workflows. It helps teams prevent configuration drift by managing environment-specific secrets from one location.
Tailscale
Tailscale creates encrypted mesh networks that connect devices and services using WireGuard-based networking. It helps distributed teams securely reach internal services without maintaining complex traditional VPN infrastructure.
Harbor
Harbor is a cloud-native registry that stores, scans, signs, and manages container images. It helps teams control image distribution and identify vulnerable artifacts before workloads reach production.
JFrog Artifactory
JFrog Artifactory manages binary artifacts and packages across container, language, and build-tool ecosystems. It reduces dependency sprawl by centralizing artifact storage, access controls, and repository proxying.
Sonatype Nexus Repository
Sonatype Nexus Repository stores, proxies, and distributes software packages and container images for development teams. It helps engineers avoid unreliable external dependency downloads by maintaining controlled internal repositories.
Amazon ECR
Amazon ECR is AWS's managed container registry for storing, managing, and deploying container images. It simplifies image distribution for AWS workloads by integrating registry access with AWS identity controls.
Google Artifact Registry
Google Artifact Registry stores container images and language packages for Google Cloud development workflows. It helps teams manage build outputs near their cloud workloads without operating registry infrastructure.
Azure Container Registry
Azure Container Registry stores and manages container images and related artifacts within Microsoft Azure. It gives Azure teams a centralized image source with integrated authentication and deployment access.
Amazon EKS
Amazon EKS provides managed Kubernetes clusters on AWS, including managed control plane operations. It reduces the operational burden of running Kubernetes control planes for teams building on AWS.
Google Kubernetes Engine
Google Kubernetes Engine provides managed Kubernetes clusters and operational tooling on Google Cloud. It helps platform teams run Kubernetes workloads without maintaining every cluster control-plane component themselves.
Azure Kubernetes Service
Azure Kubernetes Service provides managed Kubernetes clusters for deploying and operating containerized applications on Azure. It reduces Kubernetes administration work for organizations standardizing application infrastructure on Azure.
Teleport
Teleport provides secure access infrastructure for servers, Kubernetes clusters, databases, and internal applications. It helps replace scattered credentials and direct network access with auditable, identity-based sessions.
HashiCorp Boundary
HashiCorp Boundary provides identity-aware access to infrastructure targets without exposing long-lived network credentials. It helps teams grant temporary access to sensitive systems while reducing credential management overhead.
Keycloak
Keycloak is an open-source identity and access management server supporting authentication, authorization, and single sign-on. It helps platform teams centralize application identity rather than building authentication systems repeatedly.
Okta
Okta provides identity and access management services for workforce and customer-facing applications. It helps organizations manage user access consistently across many tools, applications, and cloud services.
Auth0
Auth0 provides customer identity services for adding authentication and authorization to applications. It helps developers avoid implementing login flows, password handling, and identity integrations from scratch.
Wiz
Wiz provides cloud security posture management and risk visibility across cloud environments and workloads. It helps security and platform teams prioritize interconnected cloud risks instead of reviewing alerts separately.
Aqua Security
Aqua Security provides cloud-native security for containers, Kubernetes workloads, and software supply chains. It helps teams detect and enforce security controls throughout container build and runtime processes.
Prisma Cloud
Prisma Cloud provides cloud security posture management, workload protection, and security monitoring across environments. It helps teams find configuration and workload risks across cloud accounts from one security platform.
ServiceNow
ServiceNow provides IT service management workflows for incidents, changes, requests, and service catalogs. It helps platform teams standardize operational requests and change processes across technical stakeholders.
incident.io
incident.io provides incident management workflows for coordinating response, communication, and post-incident follow-up. It helps responders organize ownership and updates during incidents without relying on ad hoc coordination.
Rootly
Rootly provides incident management tooling for declaring incidents, coordinating responders, and documenting follow-up work. It helps engineering teams run repeatable incident processes instead of manually assembling response channels.
FireHydrant
FireHydrant provides incident management workflows for response coordination, automation, and retrospective tracking. It helps teams reduce response confusion by defining consistent incident roles, tasks, and communication steps.
Atlassian Statuspage
Atlassian Statuspage lets organizations publish service status, incident updates, and maintenance notifications to customers. It helps support teams communicate outages transparently without answering the same availability questions repeatedly.
Honeycomb
Honeycomb provides observability for investigating distributed systems through high-cardinality events and traces. It helps engineers explore unexpected production behavior without requiring every diagnostic question to be preplanned.
Elastic Observability
Elastic Observability brings logs, metrics, traces, and application monitoring into Elastic's data platform. It helps teams correlate operational signals when investigating performance issues across distributed services.
Splunk Observability Cloud
Splunk Observability Cloud provides infrastructure monitoring, application performance monitoring, log investigation, and alerting. It helps operators detect and investigate service health problems across applications and infrastructure layers.
Together, these tools form a practical starting point for creating reliable, self-service platform foundations.