TLDR DevOps 2026-11-11

18% of teams had an AI agent send a wrong email last quarter, per Nylas's new survey. Nylas IAM gives each agent its own key, scoped to one mailbox if you want. Try to send on a read-only key and the Nylas gateway refuses it before Google or Microsoft ever sees the request. Every call gets logged, refusals included. Included on every plan.

See how Nylas IAM works →

Google Kubernetes Engine dynamic slicing is now generally available for TPUs. It separates slice formation from nodepool provisioning, cutting AI workload startup times by up to 5x and recovery times by 4.5x.

AWS Nitro Sandboxes provides hardware-enforced workload isolation for Amazon EKS pods by running each one inside its own lightweight virtual machine. The feature allows users to enable strong security boundaries with a single line in the pod spec without changing container images or deployment pipelines. It offers isolated mode for standard protection and confidential mode for cryptographic attestation.

Cost Intelligence for Argo CD is an open-source extension that shows each application's cost in a UI tab, using the previous 24 hours of OpenCost data after each sync. It requires Argo CD 3.4 to 3.6 and OpenCost 1.121.1 or newer.

Kubernetes can restore an AI agent's environment but cannot record which steps finished, so restarted agents may repeat actions such as payments. The author argues for durable execution that logs each step, citing Dapr's workflow engine as an option.

A Wix engineering lead details seven habits for reliable production systems, learned from eight years of operating the editor server team. The list includes using the Five Whys method to find root causes, running post-mortems without blame, and conducting team-wide on-call handovers. He emphasizes leaving the system better than you found it by fixing one small thing per shift.

AI agents now write and execute code no human reviews first. AWS Nitro Sandboxes now runs each AI agent and container in its own lightweight VM on the AWS Nitro System, the same hardware isolation that separates every EC2 instance. Safely run untrusted, LLM-generated code with strong isolation and near bare-metal performance. Learn how it works here.

Astryx is an open-source design system with over 150 accessible components. It grew inside Meta over eight years to power more than 13,000 apps. The system is built on React 19 and StyleX, with a CLI designed for both human developers and AI assistants.

HA-MCP lets users configure and automate Home Assistant with AI assistants like Claude and ChatGPT. The recommended integration installs directly through HACS or the built-in Marketplace on Home Assistant 2026.11+, runs in-process, and works across all installation types.

CloudNativePG has moved from CNCF Sandbox to Incubation. The operator runs highly available PostgreSQL on Kubernetes and manages pods directly rather than through StatefulSets, handling failover, rolling updates, backups, and point-in-time recovery.

Model Context Protocol servers lack built-in authentication, rate limiting, and tool controls, creating security gaps for organizations. This guide explains how to deploy an AI Gateway to add token-based authentication and restrict which specific tools are available to users and agents.

Why choose between speed and security? 1Password secures developer secrets and AI-agent credentials at human and machine speed. Learn More.

Entire, a Git forge led by former GitHub CEO Thomas Dohmke, is built for collaboration between developers and AI coding agents.

An Application Load Balancer validates external clients' JWTs, then an ECS proxy signs requests to private gRPC services with AWS SigV4.

Kubernetes documents limits of 5,000 nodes and 110 pods per node, and its default etcd storage limit is 2 GB.