DevOps tools 2026: what changed this year and what to fix

DevOps tools 2026 have changed in ways that reach into running clusters and pipelines, not only into release notes. In the last twelve months the most common Kubernetes ingress controller stopped receiving security fixes, Helm moved to version 4 and gave Helm 3 a fixed end date, Terraform gained a way to query and import what already exists, and Kubernetes set dates to retire old networking defaults. If you run this stack, two of these need work this quarter. If you are learning it, they change which version of each tool you should practise on.

The changes, by date

Date	Tool	What changed	What it means at work
Nov 2025	Ingress NGINX	Retirement announced; best-effort maintenance only until March 2026 ¹	Plan a move to Gateway API or another controller
Nov 2025	Helm	Helm 4.0 released, the first major version in six years ⁹	New CLI flags and plugin system; charts largely carry over
Nov 2025	Terraform	1.14 adds list resources, `terraform query` and actions ⁶	Imports and day-two tasks move into code
Dec 2025	GitHub Actions	Hosted runner charges cut by up to 39% from January 2026; planned self-hosted runner charge postponed ⁷	Re-check which runners you use and why
Dec 2025	Docker	Docker Hardened Images made free under Apache 2.0 ⁸	Hardened base images without a paid licence
Mar 2026	Kubernetes	Ingress2Gateway 1.0 released for migrations ³	A converter for Ingress manifests
Jun 2026	Helm	Helm 3 end of life fixed: security support until February 2027 ⁵	Upgrade pipelines before then
Aug 2026	Kubernetes	v1.37 released with 67 enhancements and new deprecation timelines ⁴	kube-dns and ipvs mode are on their way out

Ingress NGINX is retired: move to Gateway API

Kubernetes SIG Network and the Security Response Committee announced in November 2025 that Ingress NGINX would get best-effort maintenance only until March 2026, and after that no releases, no bug fixes and no patches for security holes ¹. Existing installs keep working. That is the trap: nothing breaks on the day, so it is easy to leave alone.

In January 2026 the Kubernetes Steering and Security Response Committees issued a blunter statement. It said about half of cloud native environments rely on Ingress NGINX, a figure it credits to Datadog's research, and that the project had been kept going by one or two unpaid volunteers ². Datadog sells monitoring, so treat that share as one vendor's view of its own customers, not a census.

The statement gives a quick check: kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx ². If that returns pods, you have work to do.

The recommended route is Gateway API ¹. In March 2026 the project released Ingress2Gateway 1.0, which converts Ingress resources into Gateway and HTTPRoute manifests and now handles more than 30 common Ingress NGINX annotations, up from 3 ³. It does not do everything. The release post warns that configuration-snippet needs manual work, that regex matching defaults differ, and that proxy-body-size has no Gateway API equivalent ³. Its advice: review the generated manifests, test in a development cluster, and shift traffic gradually before deleting the old Ingress ³.

This is the change I would put first. An internet-facing component with no security patches is the kind of finding an audit raises, and the migration is good work to talk through in an interview because it touches networking, TLS and rollout planning at once.

Helm 4 is here and Helm 3 has a hard stop

Helm 4.0 shipped at KubeCon in November 2025. The CNCF announcement lists WebAssembly plugins, a reworked SDK and support for server-side apply, and says the core interface stays familiar ⁹.

The date that matters is in Helm's June 2026 post. Helm 3's last, limited feature release came in September 2026, and security support runs until February 2027; after that, no updates of any kind ⁵. The original plan stopped security support in November 2026, so the maintainers have already extended it once ⁵.

Charts that deploy with Helm 3 should deploy with Helm 4, and releases managed by Helm 3 should generally upgrade ⁵. What breaks is usually the pipeline around them. Two flags were renamed: --atomic is now --rollback-on-failure and --force is now --force-replace ⁵. Post-renderers move to the new plugin system ⁵. Search your Jenkinsfiles and workflow files for those flags now. It is a small change that fails loudly at the worst time.

Terraform 1.14: query what exists, run one-off actions

Terraform 1.14.0 was released in November 2025 ⁶. Two additions change daily work.

List resources and terraform query. You define list resources in *.tfquery.hcl files to query existing infrastructure, and the command can generate configuration to import what it finds ⁶. Bringing hand-built resources under code used to mean writing import blocks one by one.
Actions. A new top-level block lets providers define operations outside create, read, update and delete, such as aws_lambda_invoke or aws_cloudfront_create_invalidation. You trigger them from a resource's lifecycle or with terraform apply -invoke ⁶.

Kubernetes 1.37: the deprecations to plan for

Kubernetes v1.37 arrived in August 2026 with 67 enhancements: 16 graduating to stable, 23 to beta and 27 entering alpha ⁴. The deprecation section is what changes runbooks ⁴:

kube-dns is deprecated. No new packages will be built after v1.40; plan to use CoreDNS.
kube-proxy's ipvs mode is deprecated. It is expected to be off by default by v1.40 and removed by v1.43.
cgroup v1 is being phased out. Since v1.35 the kubelet refuses to initialise on cgroup v1 nodes unless you override it, and the release calls that override a short-term fix.

If you look after older self-hosted clusters, check the cgroup and ipvs items first.

Billing and licensing: GitHub Actions and Docker images

GitHub cut what it charges for hosted runners by up to 39% from January 2026 ⁷. It also announced a per-minute platform charge for self-hosted runners from March 2026, then postponed it after pushback, saying it would re-evaluate the approach ⁷. Public repositories stay free ⁷. The charge is shelved, not cancelled, so if your team chose self-hosted runners mainly to save money, watch the changelog.

Docker made its Hardened Images free and open source in December 2025: more than 1,000 images and Helm charts under Apache 2.0, built on Debian and Alpine, with SBOMs and SLSA Build Level 3 provenance ⁸. Docker says the images are up to 95% smaller; that is the vendor's own claim ⁸. Paid tiers remain for compliance needs and a remediation SLA on critical CVEs ⁸. For most teams it is now simpler to begin a Dockerfile from a minimal, non-root base image.

DevOps tools 2026: what to learn first

The pattern across these changes is retirement and consolidation, not new tools. For someone learning, that means:

Learn Gateway API alongside Ingress. Most clusters you join will have both for a while.
Practise on Helm 4 and the current Terraform release, and know the renamed flags.
Read release notes as part of the job. Each item above was announced months before it bit.

TTFA's DevOps Engineer course teaches traffic routing with Gateway API in its Kubernetes module, which is where the first section of this note lands in practice.

What to do with this

Run the ingress-nginx check above on every cluster you look after.
Search pipelines for --atomic and --force in Helm commands well before Helm 3 support stops.
Record the Terraform, Helm and Kubernetes versions your team runs, so the next deprecation is a calendar item.

What we don't know: how many Indian teams still run Ingress NGINX or Helm 3. I found no India-specific data, and the only usage figure is the Datadog estimate quoted by Kubernetes ².

Frequently asked questions

Does Ingress NGINX stop working after March 2026?

No. Existing installs keep running and the install files stay available ¹. What stops is maintenance, including security fixes, so the risk grows over time.

Do I need to rewrite my Helm charts for Helm 4?

Usually not. Helm says charts deployable with Helm 3 should deploy with Helm 4 ⁵. The work is in CI scripts that use renamed flags and in post-renderer plugins.

Is Gateway API built into Kubernetes?

It is the Kubernetes project's recommended replacement for Ingress ¹, but you still install a controller that implements it. Test the one your platform supports.