How to Install and Use Krew on Linux to Manage kubectl Plugins for Kubernetes

As Kubernetes clusters scale in complexity, cloud engineers and DevOps practitioners require specialized tools to inspect network policies, debug pods, audit RBAC permissions, and streamline cluster management. While kubectl is the standard command-line interface for the Kubernetes API, installing third-party CLI extensions manually across development machines leads to disparate shell scripts, version drift, and path confusion. Krew is the official plugin manager for kubectl, functioning similarly to apt, dnf, or brew specifically for Kubernetes CLI utilities.

Why Use Krew for Kubernetes Administration?

Maintained under the Kubernetes SIGs (Special Interest Groups), Krew provides an ecosystem of over 200 vetted open-source plugins:

• Centralized Plugin Index: Discover, download, and update plugins from an officially curated repository with a single command.
• Seamless kubectl Integration: Installed plugins automatically register as native subcommands under kubectl (e.g. kubectl ctx or kubectl who-can).
• Isolated Installation Path: All binaries, dependencies, and index manifests reside safely inside ~/.krew/bin without requiring root or sudo privileges.
• Automated Upgrades: Run kubectl krew upgrade to keep all your diagnostic and security plugins up to date simultaneously.

Step 1: Install Krew on Linux

Installing Krew requires git and tar installed on your machine. Execute the official installation script:

# Set temporary workspace and download krew
(
  set -x; cd "$(mktemp -d)" &&
  OS="$(uname | tr '[:upper:]' '[:lower:]')" &&
  ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" &&
  KREW="krew-${OS}_${ARCH}" &&
  curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/${KREW}.tar.gz" &&
  tar zxvf "${KREW}.tar.gz" &&
  ./"${KREW}" install krew
)

Step 2: Add Krew to Your System PATH

To ensure that kubectl detects installed plugins, add the Krew binary path to your shell configuration:

For Bash (~/.bashrc)

echo 'export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

For Zsh (~/.zshrc)

echo 'export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

Verify Krew Installation

Confirm that Krew is accessible via kubectl:

kubectl krew version

Step 3: Update the Krew Plugin Index

Before installing plugins, update your local index to fetch the latest catalogue listings:

kubectl krew update

Step 4: Discover and Install Essential kubectl Plugins

To view all available plugins in the repository:

# Search for all plugins
kubectl krew search

# Search for specific tools (e.g. security or networking)
kubectl krew search rbac
kubectl krew search ingress

Top Essential Plugins for DevOps Engineers

Here are several indispensable plugins you should install immediately:

1. who-can (RBAC Permission Auditing)

Audits who holds rights to perform specific actions across your cluster:

kubectl krew install who-can
# Usage:
kubectl who-can create pods --namespace default

2. neat (Clean Manifests for GitOps)

Strips redundant metadata, status fields, and cluster timestamps when exporting live Kubernetes resources:

kubectl krew install neat
# Usage:
kubectl get deployment web -o yaml | kubectl neat > clean_deployment.yaml

3. ctx and ns (Cluster and Namespace Switching)

Installs the command-line wrappers for instantaneous context and namespace toggling:

kubectl krew install ctx
kubectl krew install ns

4. view-secret (Decode Kubernetes Secrets)

Decodes base64 secret values directly in your terminal without piping through base64 -d:

kubectl krew install view-secret
# Usage:
kubectl view-secret db-credentials password

Step 5: Managing, Upgrading, and Uninstalling Plugins

Maintaining your plugin ecosystem is straightforward with native Krew commands:

List Installed Plugins

kubectl krew list

Upgrade All Plugins

kubectl krew upgrade

Uninstall a Plugin

kubectl krew uninstall neat

Security Considerations When Using Third-Party Plugins

Because plugins execute with your active kubectl authentication token and cluster credentials, always inspect plugin source repositories and permissions before installing tools on production workstations. You can view the manifest and upstream homepage for any plugin using kubectl krew info <plugin-name>.