Ex-on-call lead who has rolled back more deploys than she has shipped. Writes from the pager: crisp, sourced, allergic to hype.
By Maya
104 articlesGoogle named Leader in Gartner's inaugural Enterprise AI Assistants Magic Quadrant
Google Cloud says Gartner has named it a Leader in the inaugural 2026 Magic Quadrant for Enterprise AI Assistants, on both axes. Google ties the placement to Gemini Enterprise, an assistant product it frames as driving multi-step, end-to-end workflows through AI agents, the same class of workflow a pipeline already runs.
Sep 14, 2026Platform engineeringGitLab's Co-Create recap lands W3C trace context and merge-train limits in CI/CD
GitLab's half-year Co-Create program recap flags three shipped CI/CD changes: new W3C Trace Context variables in pipeline jobs, configurable merge-train pipeline limits, and a REST API for Terraform state protection rules.
Sep 13, 2026Runners & infrastructureKubernetes 1.37 turns native histograms on by default for its own metrics
The Prometheus native-histogram format graduates to beta in Kubernetes 1.37 and ships enabled by default, promising smaller time-series and sharper latency percentiles for the metrics the control plane already emits.
Sep 12, 2026Runners & infrastructureKubernetes 1.37 promotes gang scheduling to a first-class Workload API in beta
Kubernetes v1.37 graduates the Workload and PodGroup APIs, Workload-Aware Preemption, and shared DRA ResourceClaims to beta, moving all-or-nothing scheduling out of third-party operators. A new CompositePodGroup API lands in alpha for hierarchical training topologies.
Sep 12, 2026Runners & infrastructureXcode 27 runner image on GitHub-hosted macOS moves to macOS 27
GitHub bumped the operating system underneath its public-preview Xcode 27 runner image from macOS 26 to macOS 27, per the September 10 changelog. The runner labels stay the same, so the OS shift lands on the next job that requests them, with no workflow edit.
Sep 11, 2026Platform engineeringAlloyDB Omni's RPM orchestrator goes GA, alongside Omni 18.3.0
Google Cloud's Red Hat RPM orchestrator for AlloyDB Omni is now generally available and ships alongside AlloyDB Omni 18.3.0. It moves PostgreSQL installation and lifecycle on RHEL-family hosts out of hand-rolled scripts and into a package-managed workflow.
Sep 10, 2026CI observabilityCodeQL 2.27.0 ships a native Linux ARM64 build
GitHub's static analysis engine now ships a native linux-arm64 CLI and bundle in 2.27.0, alongside a new Rust security query and expanded Java, Kotlin and C# framework coverage. Teams that already moved their runners to ARM stop paying an emulation tax on code scans.
Sep 10, 2026Platform engineeringApica bolts a natural-language agent and MCP server onto Ascent 3.0
Ascent 3.0 lets operators reshape telemetry pipelines in English via an agent called Venn, and opens the platform's own AI to outside tools through an MCP server. Destructive edits still gate on admin approval.
Sep 9, 2026KubernetesKubernetes v1.37 Garhwal ships with 67 enhancements
Kubernetes v1.37, code-named Garhwal, is out with 67 enhancements: 16 GA, 23 Beta, 27 Alpha and one deprecation. The headline items land in scheduling, storage, autoscaling and cluster identity.
Sep 9, 2026KubernetesKubernetes 1.37 turns Storage Version Migration on by default
Storage Version Migration graduated to GA in Kubernetes v1.37, and the built-in StorageVersionMigration API and controller are enabled on every v1.37 cluster. Rewriting stored objects to a new schema version is now a first-class control loop that ships with core.
Sep 8, 2026Code quality & testingGitHub splits Code Quality off the Actions billing meter
GitHub Code Quality CodeQL workflows now run on a dedicated Actions path, per an August 20 changelog. Their runs no longer count against a repo's regular Actions usage, and no longer sit in the same workflow-run history as the rest of its CI.
Aug 24, 2026Runners & infrastructureWindows 11 arm64 with VS2026 goes GA on GitHub-hosted runners
GitHub Actions promoted its Windows 11 arm64 image with Visual Studio 2026 to general availability on both standard and larger GitHub-hosted runners. For teams shipping native ARM Windows binaries out of CI, the self-hosted detour stops being the only option.
Aug 24, 2026SecurityCodeQL 2.26.3 retunes its Actions queries and drops the self-hosted module
CodeQL 2.26.3 reworks how the engine reasons about GitHub Actions workflows, tightening output-clobbering, cache-poisoning and env-var injection queries and removing the self-hosted runner module. Hosted code scanning is already on the new pack, so the next full run may move alert counts in both directions.
Aug 23, 2026Incident responseGitHub carves credential revocation into per-token-type actions
GitHub's incident-response tooling now lets enterprise owners and org admins deauthorize or revoke user credentials one token type at a time, in the UI and via API. The blast radius of a bad revoke shrinks, and every action lands in the audit log.
Aug 23, 2026AI in CI/CDVS Code 1.133 pulls agent sessions out of the editor process
VS Code 1.133 moved AI agent sessions into a standalone Agent Host that outlives the window and can be reached over SSH or a dev tunnel, per DevOps.com. Microsoft published the wire format as the Agent Host Protocol under an MIT license.
Aug 23, 2026GovernanceGitHub takes rule insights up a level: bypass counts across the whole org
GitHub's rule insights dashboard is in public preview at the organization level, adding aggregated ruleset evaluation metrics, a top-repos-by-bypass view, filters and a CSV export. Platform teams that already run rulesets as a gating primitive get a single pane for who is actually going around them.
Aug 22, 2026Runners & infrastructureGitHub says 2.9 billion commits a month, and CI is the downstream tenant
The New Stack puts GitHub's monthly load at 2.9 billion commits, 130 million merged pull requests and 24 million new repositories, and reports the platform is straining under it. For teams running on Actions, that is a queue-depth story more than a growth story.
Aug 21, 2026Identity and accessEKS clusters lag on an AWS auth deprecation, per The New Stack
The New Stack reports that 81% of Amazon EKS clusters still run an AWS EKS authentication method the vendor has deprecated. For platform teams whose deploy pipelines target EKS, the number reads as a migration flag against the auth path baked into kubeconfigs, CI service accounts and IaC modules.
Aug 20, 2026Runners & infrastructureAzure Pipelines opens an arm64 macOS preview with Xcode 27 in the pay-as-you-go pool
Microsoft added Apple Silicon macOS agents carrying Xcode 27 to Azure DevOps as a public preview, delivered through the pay-as-you-go GitHub-hosted Agents pool. For iOS and macOS pipelines that have been running Xcode on Rosetta-under-Intel agents, the native arm64 path is finally in reach on a Microsoft-hosted fleet.
Aug 19, 2026Runners & infrastructureDocker VMM goes public beta with Docker Desktop's virtualizer rewritten in-house
Docker Desktop v4.86 ships a rewritten first-party virtualizer as a public beta on Mac and Windows, with Linux deferred to a GA targeted for the end of October.
Aug 19, 2026Incident responseAWS wires DevOps Agent into CodePipeline failures via CloudWatch and Lambda
AWS published an integration pattern that routes CodePipeline failures to its DevOps Agent through a CloudWatch alarm and a small Lambda webhook, aimed at trimming the manual sweep across services, logs and pipeline stages when a GitHub-hosted deploy breaks.
Aug 18, 2026Security & supply chainA devops.com walkthrough stacks four open-source security gates into GitHub Actions
devops.com published a build-it-yourself piece that stitches npm audit, Snyk, Trivy, CodeQL and OWASP ZAP into a single GitHub Actions pipeline. It is a decent map of what teams can gate on without an enterprise SKU, but stacking five scanners has an operational cost the article does not spend on.
Aug 16, 2026Identity and accessAzure DevOps opens a Service Connection off-ramp from PATs and build session tokens
A preview from Microsoft DevOps lets Azure Pipelines authenticate against Azure DevOps with an Entra-backed Service Connection instead of a Personal Access Token or Build Session token. The coverage is scoped: repo resources, YAML template checkouts, NuGetAuthenticate, InvokeRESTAPI and the AzureCLI task.
Aug 15, 2026Platform engineeringKairos pipeline runs a Kubernetes control-plane upgrade in eleven minutes, no operator
A CNCF case study documents a fully automated Kubernetes control-plane upgrade on immutable Kairos nodes that finished in about eleven minutes with zero human touch, using A/B partitions and GitOps to keep etcd quorum intact.
Aug 15, 2026Security & supply chainGitLab's mid-month patch train fixes a CI/CD pipeline authorization bypass
GitLab shipped 19.2.2, 19.1.4 and 19.0.6 with 13 CVEs, including an authorization bypass that let developer-role users run CI pipelines against protected branches. Self-managed operators should upgrade immediately.
Aug 13, 2026Runners & infrastructureMulti-gigabyte image pulls are now the EKS cold-start problem
The New Stack walks through why container image pull time has become a first-class bottleneck on Amazon EKS, driven by machine-learning workloads that ship in much larger images than a typical application. Pull latency is now something CI/CD and platform teams have to design for, not wait out.
Aug 12, 2026AI in CI/CDAWS releases Dogwood, an open-source policy language for the tool-call sequences agents run
AWS has published Dogwood, an open-source policy language and reference interpreter that governs sequences of AI-agent tool calls. The pitch is catching actions that are individually valid but wrong in context, and for pipelines that hand agents commit or deploy rights that is a new place to hang guardrails.
Aug 11, 2026AI in CI/CDGoogle opens Gemini Enterprise Agent Ready as a free training path for agents in production
Google Cloud has announced Gemini Enterprise Agent Ready, a no-cost training bundle of twelve skill badges on skills.google paired with a month-long hackathon on Devpost. The angle for CI/CD teams is that the courses aim at operating agents, not demoing them.
Aug 10, 2026Supply-chain securityRapidFort points its hardened open-source business at what actually runs in production
At Black Hat USA, RapidFort announced RapidFort Runtime, a read-only monitor for the production environments that consume its curated open-source packages. For CI/CD teams the pitch targets the long-standing measurement gap between what a pipeline shipped and what is executing in the cluster.
Aug 10, 2026Platform engineeringWhere the controller-runtime cache bites you: stale reads, missing indexes, unbounded watches
A revised kubernetes.io deep dive walks through the local cache every kubebuilder-based controller depends on. The operational read: r.Get and r.List never touch the API server, and that is where a class of quiet controller bugs actually lives.
Aug 8, 2026Cloud securityGoogle Cloud spells out its abuse-response ladder: throttle, isolate, suspend
A Google Cloud security-team post consolidates how the platform reacts when a tenant workload starts leaking credentials, mining crypto, or burning a stolen API key. For pipeline owners the operational read is the escalation path, and how easily a shared project can end up on it.
Aug 8, 2026Incident responseAWS DevOps Agent talks to ServiceNow over MCP, reads incidents and writes findings back
AWS published a walkthrough showing its DevOps Agent connecting to ServiceNow as an MCP client and using the ServiceNow MCP Server to pull incident, CMDB and change context, then writing correlated analysis back into the incident record. The same wire lets the agent open change requests through ServiceNow's Action Fabric under OAuth 2.0.
Aug 7, 2026Incident responseGitHub pauses the Kimi K3 rollout in Copilot while it works a GitHub Actions incident
GitHub says the general-availability rollout of Kimi K3 in Copilot is temporarily paused while it mitigates an incident with GitHub Actions, per an editor's note added to the August 6 changelog. Pricing has been published; the resume time has not.
Aug 7, 2026Infrastructure as codeHashiCorp reframes HCP Terraform as the accountability layer for AI agents
An August 5 HashiCorp post maps five existing HCP Terraform capabilities (provenance, policy, identity, isolation, audit) onto the workflow of AI agents that author and apply Terraform. Nothing in the post is a new launch: the pitch is that the wiring is already there.
Aug 6, 2026Platform engineeringOpenCost 1.121.0 pins a dollar figure to every model and token on Kubernetes
OpenCost 1.121.0, announced on the CNCF blog on August 5, adds per-model and per-token cost attribution for AI inference workloads. The release aims at platform teams that have been reading GPU bills and token counters in separate windows with no way to connect them.
Aug 6, 2026Platform engineeringGateway API v1.6 promotes TCPRoute and UDPRoute to Standard, and puts a clock on the v1alpha2 shapes
The June 30 release of Kubernetes Gateway API v1.6 graduates raw L4 TCPRoute and UDPRoute to the Standard channel under v1, deprecates their v1alpha2 counterparts, and moves remaining experimental resources into a separate API group so the boundary between stable and unstable shapes stops being a naming convention.
Aug 5, 2026AI in CI/CDGitHub Copilot retires six models on September 1, and every Copilot surface is in scope
GitHub is deprecating Gemini 3.1 Pro, Claude Opus 4.5, Claude Opus 4.6, Claude Sonnet 4.5, Claude Sonnet 4.6 and Raptor Mini across all Copilot experiences on September 1, 2026, per its July 31 changelog. Individual annual subscribers keep Sonnet 4.6; everyone else has about four weeks to point workflows and integrations at replacements.
Aug 4, 2026Security & supply chainOmdia's 2026 supply-chain survey puts the annual-incident rate at 77 percent
A Docker-sponsored Omdia report pegs the twelve-month software supply-chain incident rate at 77 percent of surveyed organizations, with AI technology now ranked as the top supply-chain risk. The tool-effectiveness table rewards the sponsor's product category.
Aug 4, 2026Incident responseBuilding your own AI SRE moves the toil; it does not remove it
Chronosphere leaders argued in The New Stack that engineering teams should build their own AI SRE to map systems, investigate incidents and support reliable delivery at scale. The operational read is narrower: an in-house AI SRE is a second production system with its own on-call, its own change-management story and its own place in the audit trail.
Aug 2, 2026Security & supply chainCISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS
The 2026 Minimum Elements guidance from CISA replaces the 2021 NTIA baseline, adds required hash, license and generation-context fields to every SBOM, renames Supplier Name to Component Producer, and extends the floor to open-source software, AI systems and software-as-a-service. For platform teams the practical consequence is that SBOM work stops living inside the build step and starts spilling into vendor contracts and runtime re-validation.
Aug 2, 2026Infrastructure as codeTerraform workspaces and Stacks get a 30-day restore in HCP Terraform and Terraform Enterprise 2.0.0
The July 23 release lands a Recoverable Items page for deleted workspaces and Stacks with a 30-day window, promotes monorepo support for Stacks to GA, and adds project- and workspace-scoped policy override permissions. A guided CLI migration from workspaces to Stacks ships in public beta.
Aug 2, 2026Security & supply chainDocker Hub gets OIDC federation for GitHub Actions, retiring the PAT-in-a-secret pattern
Docker has added OpenID Connect authentication for GitHub Actions on Team, Business and Docker Hardened Images plans, so workflows push and pull images with a short-lived per-run token instead of a stored Personal Access Token. It closes off one of the last static credentials still sitting in most Actions repos.
Aug 1, 2026Platform engineeringKubernetes 1.37 beta lands a StatefulSet Recreate strategy and CRI pod checkpoint RPCs
The 1.37.0-beta.0 release adds a Recreate update strategy for StatefulSets, promotes PLEGOnDemandRelist and metrics.k8s.io to v1, and pushes pod checkpoint and restore into the CRI interface. A 1.36.3 patch shipping in the same window catches a kubelet memory-leak regression that first landed in 1.36.
Jul 31, 2026Security & supply chainDocker returns to its coding-agent series with an argument shaped like a CI problem: no layer between the agent and the host
The second entry in Docker's Coding Agent Horror Stories, published on July 20, argues that a coding agent runs under the developer's filesystem permissions and credentials with nothing isolating it from the host by default. For CI teams, that is the runner sandboxing question moved one hop to the left, into the inner loop.
Jul 29, 2026Runners & infrastructureLinkerd federation keeps the app running when a whole Kubernetes cluster dies
A CNCF walk-through by Dominik Táskai wires three GKE clusters into a full-mesh Linkerd multicluster and kills one. The nine-pod frontend rebalances across the surviving six with no application changes, but the setup pays a real price at the VPC, node-count and controller layers.
Jul 28, 2026Security & supply chainPyPI stops accepting late file uploads to releases older than 14 days
PyPI will no longer accept new files uploaded to a release once that release is more than 14 days old, closing a stealth path a compromised publishing token could otherwise use to graft malicious code onto an established package. PyPI has said it is not yet aware of the technique being used in a real attack.
Jul 28, 2026Platform engineeringCloud Run moves regional failover out of the runbook and into the load balancer
Google Cloud has added readiness probes and an aggregated service-health signal that lets Cloud Run automatically shift traffic away from an unhealthy region within seconds, per a July 20 post. For teams carrying a manual regional failover runbook, the operational read is which step leaves the on-call rotation.
Jul 27, 2026Platform engineeringMCP's next release candidate drops sessions and the handshake, pushes state into handles
The next Model Context Protocol release candidate removes sessions and the initialization handshake and shifts state into handles, moving remote MCP servers toward a stateless HTTP shape. Lead maintainers froze the release ahead of the rewrite, and it invalidates assumptions many existing server implementations were built on.
Jul 27, 2026Platform engineeringGoogle's pitch: put Agent Substrate on top of GKE Agent Sandbox, and call it the AI-agent runtime
Two months after GKE Agent Sandbox went GA in May 2026, Google introduced a follow-up called Agent Substrate in the same post. The New Stack's read is that Google now wants Kubernetes to be the runtime for AI agents on the primitives GKE already uses for production services.
Jul 26, 2026Platform engineeringFour hyperscaler agent sandboxes, four different isolation primitives
A New Stack survey argues AWS, Google Cloud, Microsoft Azure and Cloudflare have each shipped an agent-sandbox service, built on four different isolation foundations. Google Cloud's Cloud Run sandboxes public preview, announced at the WeAreDevelopers World Congress, is the news peg.
Jul 25, 2026Security & supply chainFakeGit floods GitHub with malicious repos aimed at coding agents
Island researchers say a campaign called FakeGit spun up about 7,600 malicious GitHub repositories, many posing as AI skills or MCP servers, to hand SmartLoader and StealC to developers and to the agents fetching capabilities on their behalf.
Jul 24, 2026Platform engineeringGitHub's MCP Server tracks the stateless MCP spec, and the Redis session drops out
Ahead of a 28 July 2026 move to a stateless MCP core, GitHub says its MCP Server has been updated to run without per-session Redis state. For teams wiring coding agents into CI, that changes what the server has to remember between calls.
Jul 24, 2026Runners & infrastructureThe 60% idle GPU that turned out to be a network policy
A CNCF write-up walks through a distributed Kubeflow training job whose GPUs sat around 60% idle while every pod reported healthy. The failure lived one layer down, in a Cilium policy enforcing zone boundaries that gradient sync had to cross.
Jul 23, 2026Security & supply chainPillar research says the AI coding agent sandbox leaks through trusted files
Pillar Security researchers demonstrated multiple sandbox-bypass techniques against AI coding agents, plus prompt-injection attacks hidden in READMEs, code comments and dependencies. OpenAI, Google and Cursor have patched several of the reported flaws.
Jul 23, 2026Runners & infrastructureGPUs keep falling off the PCIe bus, and standard node health does not notice
AWS engineers write up what running Kubernetes at Amazon EKS scale taught them about GPU node failure, and why the default node health model has nothing to say when the GPU just vanishes from the bus.
Jul 20, 2026Platform engineeringHashiCorp's tfpolicy pulls policy-as-code back inside Terraform
HashiCorp introduced tfpolicy, a policy-as-code framework built into Terraform with rules written in HCL, now in public beta on HCP Terraform. For platform teams currently running Sentinel, OPA or Conftest alongside every plan, the change collapses one language and one runtime out of the pipeline.
Jul 20, 2026Deployment strategiesProgressive rollouts are solved. The validation gate isn't.
A New Stack opinion argues that progressive rollouts are a solved problem while the validation step that actually gates them is still hand-built. From an on-call chair, that reframing is overdue.
Jul 18, 2026Platform engineeringGitLab packages Duo Agent Flows so multi-step runs share the platform's controls
GitLab is naming a shape for multi-step agent work, Duo Agent Flows, that inherits the same access controls, triggers and review gates as any other pipeline object. The pitch is a middle ground between chat that only answers and homegrown scripts that go stale the moment the platform changes.
Jul 17, 2026KubernetesVault Kubernetes KMS enters public beta, aiming at the etcd key sprawl
HashiCorp put a Kubernetes KMS v2 plugin for Vault Enterprise into public beta, letting the API server encrypt etcd through the same Vault install that already holds pipeline secrets. It collapses one more custody trail; it does not lower the operational burden on the API server side.
Jul 16, 2026Security & supply chainDatadog says months-long GitHub recon out of dormant 'ghost' accounts is prep for supply-chain attacks
Datadog security researchers say overlapping months-long campaigns have been abusing GitHub's public API and reactivating more than 50 long-dormant accounts to map organizations and their engineers. The setup looks a lot like the reconnaissance phase of a supply-chain intrusion.
Jul 14, 2026Runners & infrastructureAWS puts gray zone failures into the EKS control loop
The New Stack details how AWS treats non-obvious availability zone degradation as its own category on EKS, with zonal shift moving traffic away from an impaired zone before the traditional alarms fire. For CI/CD teams, it reframes what a regional resilience test needs to cover.
Jul 12, 2026Platform engineeringGitHub lets enterprises pin Copilot's OpenTelemetry endpoint
A new enterprise-managed setting mandates where the Copilot Chat extension in VS Code and Copilot CLI send OpenTelemetry data. The managed value overrides environment variables and user settings.
Jul 12, 2026Platform engineeringEntire opens preview of regional Git mirrors aimed at AI-agent clone traffic
Ex-GitHub CEO Thomas Dohmke's new company Entire launched a preview of a distributed Git network that mirrors GitHub repositories across the US, Europe and Australia. The pitch is per-region clone throughput for AI coding agents; the mechanism today is read replicas, not a new protocol.
Jul 12, 2026Platform engineeringAfter the ingress-NGINX retirement, what your migration plan owes production
The Kubernetes SIG Network retired ingress-nginx in March 2026, leaving clusters still on it exposed to unpatched CVEs and stalled feature work. A CNCF post lays out the two migration paths operators are picking between and the tooling to make the move.
Jul 11, 2026Platform engineeringGoogle puts Cloud Run sandboxes into preview for AI-generated code
Google Cloud has moved Cloud Run sandboxes to public preview, positioning them as a runtime for AI-generated code and untrusted binaries that a pipeline would otherwise be asked to trust with host access and cloud credentials.
Jul 10, 2026Platform engineeringetcd v3.7 adds a streaming range API and drops the legacy v2 store
SIG etcd shipped v3.7.0 with a RangeStream API that chunks large read responses instead of buffering them, plus faster lease handling under load and the removal of the legacy v2 backing store. Kubernetes will expose the feature in v1.37 behind a gate.
Jul 9, 2026Identity and accessVercel buys Better Auth on the pitch that agents need their own login
Vercel has acquired Better Auth, framed as a bet that AI agents opening PRs, reviewing code and creating deployments should hold first-class identity of their own. For CI/CD platforms, that reopens the question of what the merge and deploy gates are actually verifying.
Jul 8, 2026Identity and accessBoundary 1.0 adds RDP session recording, previews AI-agent access controls
HashiCorp shipped Boundary 1.0 with RDP session recording and a preview of work aimed at securing AI-agent access. For teams that route Windows targets through the proxy, session recording lands as an audit point that used to live in ad-hoc tooling.
Jul 7, 2026Platform engineeringGitHub streams Copilot agent sessions to the SIEM, in preview
GitHub put Copilot agent session streaming into public preview on July 2, exposing prompts, responses and tool calls from cloud agents and IDE clients to enterprise event collectors. For CI-adjacent workflows it turns Copilot from a black box into something an on-call can reconstruct after the fact.
Jul 7, 2026Platform engineeringGitHub Copilot's enterprise managed-settings.json is now GA
GitHub Enterprise Cloud can now pin five Copilot behaviours from a single managed-settings.json in a .github-private repository. The file overrides local user config, is fetched on every auth, and refreshes hourly.
Jul 5, 2026Platform engineeringGitHub sets July 30 as the hard shutdown for GitHub Models
GitHub published a July 1 changelog entry confirming GitHub Models will be fully retired on July 30, 2026. The earlier closure to new customers now has a matching end date, and any pipeline still calling into the service has a fixed migration window of roughly four weeks.
Jul 5, 2026Infrastructure as codeCloudFormation Express mode ships, returning success before resources are ready
AWS added an Express deployment mode to CloudFormation that reports stack operations complete as soon as resource configuration is applied, with resources continuing to become available in the background. Rollback is disabled by default.
Jul 4, 2026Security & supply chainCopilot CLI drops the PAT requirement inside GitHub Actions
GitHub says Copilot CLI, when invoked from a GitHub Actions workflow, will now accept the built-in GITHUB_TOKEN. That retires one of the last long-lived personal tokens teams were carrying just to script Copilot from CI.
Jul 4, 2026Security & supply chainlibcurl drops NTLM in September 2026, and on-prem Azure DevOps Git over HTTPS goes with it
Microsoft has warned Azure DevOps Server customers that Git operations over HTTPS will break for anyone still authenticating with NTLM once libcurl removes the protocol in September 2026. Build agents, workgroup boxes and service accounts are the ones most likely to hit the wall.
Jul 3, 2026Platform engineeringAWS reworks the EKS control plane and starts selling it in sized tiers
Amazon EKS engineers detail a set of architectural changes to how the service runs the Kubernetes control plane, including a purpose-built journal that replaces etcd's Raft consensus, and a new tier-priced product, EKS Provisioned Control Plane, that lets customers reserve API and scheduling capacity ahead of bursty workloads.
Jul 1, 2026Image distributionDragonfly 2.5 ships Kubernetes webhook injection, drops V1 preheat
The CNCF P2P file distribution project adds an admission webhook that wires pods into the mesh without rebuilding images, plus a download blocklist, an hf:// scheme for model repositories, and a new dfctl CLI. The V1 preheat endpoints are removed.
Jun 30, 2026Incident responseSurvey: 93% of large North-American IT shops have hit an AI-coding incident
A poll of 406 IT decision makers at North American organizations with more than 250 employees finds nearly all of them have logged at least one infrastructure incident attributable to AI coding tools, a number CI/CD owners can quote when arguing for tighter merge gates on agent-generated changes.
Jun 29, 2026Runners & infrastructureGitHub-hosted larger runners pick up RHEL 9 and RHEL 10 in public preview
GitHub's larger hosted runners now offer Red Hat Enterprise Linux 9 and 10 images in public preview, a partnership with Red Hat aimed at shops that have been self-hosting Actions just to keep production-like CI on Red Hat.
Jun 29, 2026Security & supply chainAgent identity is the new wall between functional dev and security review
A New Stack analysis argues agentic systems pass functional review and then stall at the security gate because no one scoped identity, permissions or audit at the platform layer first. For CI/CD owners, it pushes a familiar workload-identity problem onto a much larger fleet of callers.
Jun 28, 2026Runners & infrastructureGitHub lets org admins switch off the default hosted runner labels
Organizations on Actions can now disable standard hosted runner labels such as `ubuntu-latest` at the org level, per the June 25 changelog. The toggle turns the default runner pool from an implicit allowlist into a catalogue platform teams have to maintain.
Jun 28, 2026Incident responseHCP Vault Dedicated opens cluster DR drills, by support ticket only
HashiCorp put cluster disaster recovery for HCP Vault Dedicated into public preview, giving teams a way to simulate cluster-level failures and prove their failover path. The drill is gated through HashiCorp support, not the customer's own runbook.
Jun 28, 2026Security & supply chainSecurity Profiles Operator hits v1 with stable APIs and a hardening pass
The CNCF's Security Profiles Operator graduated to v1.0.0 on June 26, freezing eight CRD APIs and clearing a third-party audit. The kubelet-side follow-up, KEP 6061 for OCI artifact distribution, is the piece still in flight.
Jun 27, 2026Platform engineeringA self-hosted Kubernetes diagnostic agent shipped by GitOps: the CNCF walkthrough
A CNCF blog post lays out a read-only, in-cluster AI agent whose CI/CD chain runs entirely on GitHub Actions and Argo CD Image Updater, with no data leaving the cluster and no cloud AI provider in the loop.
Jun 25, 2026Platform engineeringCursor acquires Continue and gives its users a July 15 export deadline
Cursor has bought the open-source AI coding assistant Continue in a quiet acqui-hire that disables recurring billing and sets a July 15 data-deletion date. The Apache 2.0 code stays forkable; the hosted product does not.
Jun 24, 2026Security & supply chainAzure DevOps issuer in WIF service connections heads for July 2027 retirement
Microsoft has set July 1, 2027 as the retirement date for the Azure DevOps issuer in workload identity federation service connections, pushing Azure Pipelines that already moved to secretless auth onto the shared Microsoft Entra issuer over the next year.
Jun 22, 2026Platform engineeringCursor unveils Origin, an agent-first Git host; GitLab and Zed take other paths
Graphite co-founder Tomas Reimers unveiled Origin, a Git-compatible code host built from the ground up for AI agents, at an invite-only Cursor conference. GitLab and Zed are pursuing different rebuilds of the same model.
Jun 22, 2026Incident responseAWS wires its DevOps Agent into PagerDuty incidents
AWS has paired its DevOps Agent with PagerDuty so that the moment an incident is created, the agent runs a root-cause investigation across AWS telemetry, deployment history and a short list of third-party observability tools, posting its findings back onto the incident record.
Jun 21, 2026Infrastructure as codeAI-generated IaC isn't burying Infrastructure as Code. It is stress-testing it.
A DevOps.com opinion piece argues the newest wave of 'IaC is dead' takes has the news backwards: AI-written infrastructure code is arriving faster than most teams can review, and the platforms that absorbed the volume safely are the ones that bought the boring controls first.
Jun 20, 2026Incident responseAWS DevOps Agent reaches GA with the Datadog MCP Server in tow
AWS has moved its DevOps Agent from preview to general availability, shipping it alongside the Datadog MCP Server so the agent can correlate monitoring signals with AWS-deployed infrastructure during an incident. The badge change is the smaller story; the bigger one is what SRE teams now have to write down before the agent touches production.
Jun 20, 2026Platform engineeringGitLab 19.1 makes the AI Catalog event-driven and gives admins the off switch
Duo Flows in the AI Catalog can now fire on merge-request and pipeline events instead of waiting for a human click, and the same release ships admin controls to disable custom agents, scope the catalog to a group hierarchy, and validate flow config at save time.
Jun 20, 2026Runners & infrastructureGitHub Actions lets custom runner images stack on other custom images
Custom images for GitHub-hosted runners can now be built on top of other custom images, per the June 18 changelog. The shift turns runner provisioning into a layered chain that platform teams can govern the same way they manage container base images.
Jun 19, 2026Platform engineeringGitHub closes its Models playground to new customers and routes new work to Azure AI Foundry
GitHub is retiring GitHub Models, its in-platform AI playground. Per DevOps.com, the feature is closed to new customers as of June 16; existing users keep playground and API access, and GitHub directs new projects to Azure AI Foundry.
Jun 19, 2026Security & supply chainGitLab 19.1 makes AI secret triage GA, and lets admins lock Duo on across an instance
GitLab 19.1 ships with two changes platform teams have to plan a rollout around: a generally available AI pass that scores secret-detection findings, and an always-on availability mode that lets administrators force Duo on for an entire instance or top-level group.
Jun 19, 2026Security & supply chainGoogle, Microsoft and OpenAI route their AI 'trust layer' work through the Linux Foundation
Three of the largest AI vendors are aligning on a Linux Foundation–housed effort to build a shared trust layer for AI systems. For platform teams the read is operational: artefact provenance for models and agents is about to ride the same plumbing that already carries binary attestation.
Jun 18, 2026Platform engineeringFlipkart's chaos platform runs 90% of fault injection in staging, ships five fixes back to LitmusChaos
Flipkart's central reliability engineering team won the CNCF End User Case Study contest for a multi-tenant chaos engineering platform on Kubernetes that runs roughly 90% of its experiments in staging clusters and contributed five fixes upstream to LitmusChaos. The next step on the roadmap is to wire chaos testing into the CI/CD pipeline as a mandatory phase.
Jun 18, 2026ComplianceDigital sovereignty pulls CI/CD architecture inside the compliance perimeter
A new CNCF write-up reframes the regulatory shift from data residency to digital sovereignty as a set of architectural patterns for cloud-native platforms, and once sovereignty is a platform property, runner location, pipeline placement and artifact storage move with it.
Jun 18, 2026Incident responseAWS pushes its DevOps Agent's diagnostic reach down to the EKS node via a custom MCP server
AWS has published a pattern for extending its autonomous DevOps Agent into EKS node OS and runtime data through a custom Model Context Protocol server, addressing incidents that live outside the agent's native cluster-control-plane visibility. The post is explicit that the implementation is a proof of concept, not a production replacement for monitoring or log shipping.
Jun 17, 2026Release managementAWS pushes its DevOps Agent across the release boundary, in preview
AWS used the AWS New York Summit to preview a release-management capability for its DevOps Agent, extending the agent from incident-diagnostics work into the merge-and-deploy phase of CI/CD pipelines.
Jun 17, 2026Code quality & testingGitHub Code Quality gets a GA date, and a seat inside the merge gate
GitHub has set July 20, 2026 as the general-availability date for Code Quality, a native engine that wires maintainability and reliability checks, code-coverage tracking and merge-blocking quality gates into the pull-request flow. For pipelines, the change shifts a class of checks from third-party SaaS into the same place where the merge decision lives.
Jun 17, 2026Platform engineeringHashiCorp ships tfctl, a first-party CLI for HCP Terraform and TFE
HashiCorp has released tfctl, the first dedicated CLI for HCP Terraform and Terraform Enterprise platform operations. Every command supports --dry-run, deletes require interactive confirmation, and the binary is built on the HCP Terraform OpenAPI spec.
Jun 17, 2026Security & supply chainTenet's 'Agentjacking' research turns Sentry error data into a prompt-injection vector for AI coding agents
Security firm Tenet has demonstrated an indirect prompt-injection technique it calls Agentjacking, malicious instructions hidden inside Sentry error data that get executed by an AI coding agent with shell access. The operational read is that any third-party telemetry an agent ingests is now untrusted input.
Jun 16, 2026Security & supply chainDocker Engine 29.4.3 moves the 'Copy Fail' mitigation off seccomp after the first fix broke 32-bit containers
Docker's default profile now uses AppArmor and SELinux to block the AF_ALG socket path that CVE-2026-31431 exploits, after a seccomp-only fix in 29.4.2 broke i386 binaries, Go 386 builds and Wine. The kernel patch is still the real fix; on Ubuntu it has not landed yet.
Jun 16, 2026Runners & infrastructureGitHub Actions resumes self-hosted runner version enforcement
Self-hosted runners must register on 2.329.0 or later and install each new release within 30 days, with full enforcement landing September 25, 2026 on github.com. The change moves runner version management from a hygiene task into a fleet-inventory problem.
Jun 15, 2026Runners & infrastructureARM-based CI runners go mainstream, what it means for build costs
Hosted ARM64 runners are now generally available across the major CI clouds. For many builds they cut minutes-billing meaningfully, but only if your toolchain is already multi-arch.
Jun 14, 2026