On My Radar7 min read

DevOps in 2026: what changed this year

AI agents, platforms, new security laws. My look back at the year, and what's next.

Every year in DevOps feels busy. But looking back at 2026, a few shifts stand out as more than the usual churn of new tools. Some of them change how the job feels day to day. Here's my look at what changed, what's fading, and what I expect next.

The big shifts

1. AI agents moved into the workflow

The biggest change of the year. AI went from autocomplete and chat windows to agents that read a repository, run commands, fix failing builds and open pull requests. Tools like Claude Code, GitHub's coding agent and others became a normal part of many teams' workflows.

With that came new work for DevOps: deciding what agents may touch, sandboxing them, giving them narrow credentials, and making sure every change still goes through review and CI. The Model Context Protocol (MCP) became the standard way to connect AI to tools like Kubernetes, GitHub and observability platforms, along with a new class of security concerns, especially prompt injection.

2. Platform engineering became the default model

"Platform engineering" stopped being a buzzword and became how many organisations structure their teams: platform teams building golden paths and self-service tools, product teams owning their services. The conversation matured from "should we have a portal?" to "is our platform actually reducing cognitive load?"

3. Goodbye ingress-nginx, hello Gateway API

The retirement of ingress-nginx in March 2026 forced one of the biggest Kubernetes migrations in years. For many teams, it was the push to finally adopt Gateway API, which is now the default way to route traffic into clusters.

4. Supply chain security got serious, and regulated

After a run of high-profile supply chain attacks (compromised GitHub Actions, self-spreading npm worms, hijacked maintainer accounts), pinning, signing, SBOMs and provenance moved from "best practice" to "expected". In the EU, the Cyber Resilience Act's reporting obligations started applying in September 2026, with the full requirements coming in December 2027.

2026 was the year we stopped trusting our dependencies by default, including the AI ones.

5. Infrastructure as code split into two paths

Terraform and OpenTofu continued to diverge, each with features the other lacks. Teams now make a real choice rather than defaulting to one tool.

Related: Terraform or OpenTofu?

6. Cost and sovereignty became infrastructure topics

FinOps became a normal part of engineering work, helped by the FOCUS billing standard. In Europe, digital sovereignty moved from niche to boardroom, with hyperscalers launching sovereign offerings and European providers gaining attention. Some companies also continued moving steady workloads off the public cloud.

7. AI workloads changed infrastructure

GPUs, model serving and LLM observability became regular infrastructure concerns. Kubernetes features like Dynamic Resource Allocation matured, and projects for serving LLMs on Kubernetes grew quickly.

8. OpenTelemetry won

OpenTelemetry is now the default way to instrument systems, with Prometheus 3 speaking OTLP natively and profiling arriving as a fourth signal. The new focus is cost: collecting less, but better.

What's fading

Hand-written YAML from scratch. Generated, templated or AI-drafted, then reviewed.
Long-lived cloud keys in CI. OIDC has become the norm.
Sidecar-heavy service meshes. Sidecarless modes are taking over.
Manual certificate renewal. Shrinking certificate lifetimes make automation unavoidable.
"DevOps team" as a ticket queue. Replaced by platform teams and real ownership.
Jenkins for new projects. Still running a lot of pipelines, rarely chosen fresh.

What's rising

Agent guardrails as a discipline: permissions, sandboxes, audit logs for AI.
Policy as code everywhere, from Kubernetes admission to Terraform plans to AI tool calls.
eBPF-based tools for networking, security and zero-instrumentation observability.
Post-quantum readiness: crypto inventories and hybrid key exchange.
Green and efficient infrastructure, driven by both cost and reporting.
Reviewing as a core skill: reading diffs and plans critically, because so much is now generated.

My predictions for next year

Most routine pull requests in infrastructure repos will be opened by bots or agents, with humans reviewing.
An AI-agent-related security incident will become a widely discussed case study, and push the industry towards stricter agent sandboxing standards.
The CRA's full application in December 2027 will make SBOMs and vulnerability handling a standard part of every release process in Europe.
Gateway API will be the only routing API most new tutorials teach.
Platform teams will start measuring developer experience as seriously as uptime.

I'll check these next year, like I did with my AI predictions.

So, what does it mean for us?

The job keeps moving up a level. Less typing, more designing, reviewing and deciding. Fundamentals matter more than ever, because they're what let us judge everything that's generated for us. And the human side, collaboration, communication and calm under pressure, is still what makes the difference.

My take: 2026 changed the tools faster than any year I remember. What didn't change is the job underneath: make software easy to ship and hard to break.

— Desly