---
title: "Install marketplace apps on a cluster"
description: "Install a monitoring stack, cert-manager, or the NGINX Ingress Controller on an E2E Kubernetes cluster from its Marketplace tab."
content_type: "how-to"
product: "kubernetes"
platform: "MyAccount"
url: "/myaccount/kubernetes/how-to/install-marketplace-apps/"
topic: ["operate"]
relationships: {"requires":["/myaccount/kubernetes/how-to/create-a-cluster/"]}
---

# Install marketplace apps on a cluster

A cluster's **Marketplace** tab installs common add-on tools on the cluster for you, without Helm
charts or manifests of your own.

## Before you begin

- Your cluster reads **Running**.
- For the **NGINX Ingress Controller**, the cluster's **LB IP Pool** has a free IP; otherwise its
  external IP stays on `<pending>`. See
  [Expose a service with a load balancer](/myaccount/kubernetes/how-to/expose-a-service-with-a-load-balancer/#attach-a-public-service-ip-to-the-pool).
- (Optional) To remove a tool later, install Helm on your computer and point it at the cluster's
  kubeconfig.

## Choose a tool

The tab, headed **Market Place**, offers:

- **Monitoring Stack**, under **Monitoring Tools**: Prometheus and Grafana, for metrics and
  dashboards of your pods, containers, and nodes.
- **Cert-Manager**, under **Network Tools**: gets TLS certificates for your host names and renews
  them before they expire.
- **NGINX Ingress Controller**, under **Network Tools**: routes HTTP and HTTPS traffic to several
  applications by host name, through one LoadBalancer service.

## Install a tool

1. In MyAccount, under **Compute**, click **Kubernetes**, click your cluster's name, and open the
   **Marketplace** tab.
2. Click **Install** on the tool you want.

The tool reads **Installing...**, then **Installed**. If the install fails, the tool shows **Retry**
with the error; read the error, and click **Retry** to try again.

To check the tool, list the pods in its namespace, given in the tool's section:

```bash
kubectl get pods --namespace <namespace>
```

Every pod reads `Running`.

Each tool installs as a Helm release, and you remove it with `helm uninstall`; each tool's section
gives the command.

## Use the Monitoring Stack

**Monitoring Stack** installs the kube-prometheus-stack chart as the Helm release `prometheus`, in
the namespace `kube-prometheus-stack`: Prometheus, Grafana, Alertmanager, kube-state-metrics, and a
node exporter. They are reached from inside the cluster.

1. Read Grafana's sign-in details from the secret `prometheus-grafana`:

   ```bash
   kubectl get secret prometheus-grafana --namespace kube-prometheus-stack -o jsonpath="{.data.admin-user}" | base64 --decode
   kubectl get secret prometheus-grafana --namespace kube-prometheus-stack -o jsonpath="{.data.admin-password}" | base64 --decode
   ```

   The first command prints the user name, and the second the password.

2. Forward a local port to Grafana, and leave the command running:

   ```bash
   kubectl port-forward --namespace kube-prometheus-stack svc/prometheus-grafana 3000:80
   ```

   kubectl prints lines such as:

   ```text
   Forwarding from 127.0.0.1:3000 -> 3000
   Forwarding from [::1]:3000 -> 3000
   ```

3. In a browser, open `http://localhost:3000`. Grafana's sign-in page opens; sign in with the user
   name and password.

To remove it, run:

```bash
helm uninstall prometheus --namespace kube-prometheus-stack
```

## Use Cert-Manager

**Cert-Manager** installs cert-manager version 1.12 as the Helm release `cert-manager`, in the
namespace `cert-manager`. To get certificates, create an issuer and certificates as the
[cert-manager documentation](https://cert-manager.io/docs/) describes.

To remove it, run:

```bash
helm uninstall cert-manager --namespace cert-manager
```

## Use the NGINX Ingress Controller

**NGINX Ingress Controller** installs as the Helm release `ingress-nginx`, in the namespace
`ingress-nginx`, with the IngressClass `nginx`, which your Ingress resources name. Its controller is
a LoadBalancer service, so it takes a free IP from the cluster's **LB IP Pool**, private LB IPs
included; to make sure it gets a public address, free a public service IP, or name one in its
MetalLB annotation as
[Route several applications through one IP](/myaccount/kubernetes/how-to/expose-a-service-with-a-load-balancer/#optional-route-several-applications-through-one-ip)
shows. Check that it has one:

```bash
kubectl get service --namespace ingress-nginx
```

The controller's row shows the IP it took from the pool:

```text
NAME                       TYPE           CLUSTER-IP     EXTERNAL-IP     PORT(S)                      AGE
ingress-nginx-controller   LoadBalancer   <cluster-ip>   <external-ip>   80:<port>/TCP,443:<port>/TCP 1m
```

To route requests to your applications through it, see
[Route several applications through one IP](/myaccount/kubernetes/how-to/expose-a-service-with-a-load-balancer/#optional-route-several-applications-through-one-ip).

To remove it, run:

```bash
helm uninstall ingress-nginx --namespace ingress-nginx
```

The tools you installed run in your cluster, and each can be removed with one Helm command. If a
tool's pods do not reach `Running`, see
[A pod stays Pending](/myaccount/kubernetes/troubleshooting/kubernetes/#a-pod-stays-pending) and
[Troubleshooting Kubernetes](/myaccount/kubernetes/troubleshooting/kubernetes/).