diff --git a/kcl/lib/steps/k8s/install_helm.k b/kcl/lib/steps/k8s/install_helm.k
new file mode 100644
index 0000000000..10e7b009fa
--- /dev/null
+++ b/kcl/lib/steps/k8s/install_helm.k
@@ -0,0 +1,14 @@
+import azure_pipelines.ap.steps
+
+# Install Helm v3 on the pipeline agent.
+InstallHelm = lambda -> steps.Step {
+    steps.Bash {
+        bash = """\
+set -euo pipefail
+if ! command -v helm >/dev/null 2>&1; then
+  curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+fi
+helm version --short"""
+        displayName = "Install Helm"
+    }
+}
diff --git a/kcl/lib/steps/k8s/install_prometheus.k b/kcl/lib/steps/k8s/install_prometheus.k
new file mode 100644
index 0000000000..4fddcf70d5
--- /dev/null
+++ b/kcl/lib/steps/k8s/install_prometheus.k
@@ -0,0 +1,26 @@
+import azure_pipelines.ap.steps
+import lib.steps.azure
+
+# Install kube-prometheus-stack via Helm. Caller must run InstallHelm and azure.GetCredentials first, and check in a values.yaml.
+InstallPrometheus = lambda serviceConnection: str, valuesFile: str, namespace: str = "monitoring", releaseName: str = "prometheus", chartVersion: str = "", waitTimeout: str = "10m" -> steps.Step {
+    script = """
+set -euo pipefail
+
+helm repo add prometheus-community https://prometheus-community.github.io/helm-charts >/dev/null 2>&1 || true
+helm repo update prometheus-community
+
+VERSION_FLAG=""
+if [ -n "${chartVersion}" ]; then
+  VERSION_FLAG="--version ${chartVersion}"
+fi
+
+helm upgrade --install "${releaseName}" prometheus-community/kube-prometheus-stack \\
+  --namespace "${namespace}" --create-namespace \\
+  --values "$(Pipeline.Workspace)/s/${valuesFile}" \\
+  --wait --atomic --timeout "${waitTimeout}" \\
+  \${VERSION_FLAG}
+
+echo "==> Prometheus release '${releaseName}' is ready in namespace '${namespace}'"
+"""
+    azure.AzCli(serviceConnection, "Install Prometheus", script)
+}