March 2026 Summaries

The integration of AI into platform teams' workflows is significantly enhancing the speed and efficiency of software development without compromising control over infrastructure management. As AI-assisted coding becomes a staple, platform teams are tasked with balancing rapid infrastructure provision with maintaining security and compliance. Spacelift Intent and Spacelift Intelligence are tools designed to bridge this gap by allowing developers to express infrastructure needs in natural language, while platform-defined policies ensure governance and operational consistency. At Cityblock Health, the focus was on simplifying cloud complexity for developers, enabling faster experimentation without compromising infrastructure governance. Conversely, Vega's approach emphasized safe, isolated environments for experimentation, reducing risk and encouraging innovation. Across both cases, AI is most effective when complementing existing Infrastructure as Code (IaC) and GitOps workflows, translating developer intent into action while adhering to established rules and policies. The insights from these experiences underline the importance of pairing AI-driven workflows with robust guardrails to enhance platform team expertise and maintain control as development velocity increases.

Atlantis, when integrated with GitHub Actions, offers a streamlined approach to managing Terraform infrastructure as code (IaC) within a pull request-driven workflow. This integration enhances visibility, reduces state conflicts, and enforces rigorous validation and quality gates, addressing the challenges of traditional Terraform workflows such as lack of visibility, concurrent state conflicts, and inconsistent execution environments. Atlantis manages Terraform operations by executing plans upon pull request triggers, ensuring directory locking, and centralizing cloud credentials, while GitHub Actions provides quality checks like format validation and security scanning. The guide outlines a detailed process for setting up Atlantis with GitHub Actions on Kubernetes, including repository setup, Atlantis deployment, and configuration of .atlantis.yaml for project management. Additionally, it discusses security hardening strategies and scaling best practices, such as implementing least privilege IAM roles and using a StatefulSet to manage Terraform provider caching. The text also introduces Spacelift as an alternative that offers a more integrated platform with capabilities like native policy enforcement, drift detection, and self-service infrastructure management, which can simplify infrastructure automation and governance.

Spacelift Intelligence is a new AI-driven product designed to enhance infrastructure workflows by embedding AI directly within the process rather than simply accelerating code generation. It introduces two key components: an AI Infrastructure Assistant and a natural language deployment model, which together enable engineers to interact with infrastructure in a conversational manner and execute changes without traditional pipeline constraints. This approach addresses the growing velocity gap between AI-augmented development workflows and traditional infrastructure processes by allowing AI to participate actively in workflow operations, thereby reducing the friction caused by artifact-driven pipelines. Spacelift Intelligence maintains existing infrastructure-as-code and GitOps practices, providing a new path for platform engineers, DevOps leads, and infrastructure architects to manage and optimize workflows at scale while preserving existing control mechanisms and governance models. This integration signifies a shift in how AI is utilized within infrastructure, positioning it as an integral participant in the workflow rather than an upstream accelerant.

Cloud change management is a structured approach that governs the planning, approving, testing, and deployment of changes in cloud environments, aiming to enhance reliability, security, and cost efficiency by minimizing misconfigurations and ensuring predictable, auditable deployments. This discipline leverages tools such as Infrastructure as Code (IaC) and CI/CD pipelines, along with policy-driven governance, to provide visibility and control over high-volume changes typical in cloud settings. Implementing a robust cloud change management strategy involves integrating automated deployment processes, visibility mechanisms, and governance controls, which facilitate higher deployment velocity, reduced risk of incidents, and optimized cost management. By enabling a consistent, standardized approach to managing changes, organizations can increase their pace of innovation and improve service reliability while maintaining operational discipline and compliance.

Choosing between a monorepo and a polyrepo architecture is a critical decision for software projects, impacting developer experience, CI/CD complexity, scalability, and collaboration. A monorepo consolidates all code into a single repository, facilitating cross-service work and simplifying onboarding, but can lead to scalability challenges and complex CI/CD configurations. In contrast, a polyrepo organizes code into multiple repositories, enhancing autonomy and security but potentially increasing coordination overhead and risking code duplication. Organizations like Google and Microsoft successfully use monorepos at scale, while polyrepos are preferred for projects requiring stronger separation and independent release cycles. Ultimately, the decision hinges on the specific needs and operational requirements of the team, such as the desired level of code-sharing, autonomy, and security boundaries. Teams must carefully analyze their DevOps processes and collaboration style to select the most suitable approach, as switching architectures later can be complex and disruptive.

Cloud security involves implementing policies, controls, and technologies to protect cloud-hosted data, applications, and infrastructure from unauthorized access and attacks, with challenges including misconfigurations, IAM sprawl, and limited visibility. Best practices emphasize clear ownership, repeatable controls, and principles like least privilege, defense-in-depth, and a zero-trust approach, while addressing areas such as data encryption, identity management, and configuration drift. It is crucial to integrate continuous vulnerability scanning, maintain cloud asset visibility, and prioritize incident response preparation. Security responsibilities vary across cloud models, such as IaaS, PaaS, and SaaS, necessitating a clear understanding of the shared responsibility model to avoid common pitfalls. Tools like Spacelift can enhance cloud security by automating infrastructure management and enforcing security policies, ultimately fostering a culture of shared security responsibility within organizations.

Enterprise drift management is essential for maintaining the integrity and security of large-scale cloud environments, where infrastructure can diverge from its intended state, leading to compliance issues and security vulnerabilities. Drift, which occurs when the actual state of cloud resources differs from the expected configuration, can be categorized into infrastructure, configuration, policy, security, and environment drift. Managing drift at an enterprise level involves recognizing its inevitability and implementing a strategy that includes continuous detection, precise analysis, real-time alerts, and automated remediation. Effective drift management requires the integration of automated tools and processes capable of handling the complexity and scale of enterprise operations, ensuring drift is quickly identified and rectified. Platforms like Spacelift facilitate this by offering automated drift detection and reconciliation, allowing organizations to maintain control over their cloud infrastructure. Additionally, best practices such as integrating drift management with incident response systems, using metrics to measure drift impact, preferring dynamic detection methods, clearly defining stakeholder roles, and regularly reviewing strategies are recommended to enhance drift management capabilities.

Spacelift's new Templates feature offers a solution to the persistent challenge in platform engineering, where the need for developers to deploy infrastructure quickly without deep expertise in Infrastructure as Code (IaC) conflicts with platform teams' need for consistent and secure infrastructure. Templates provide a governed self-service model that allows platform teams to define deployable infrastructure configurations while enabling developers to deploy these configurations without detailed IaC knowledge. Unlike Spacelift Blueprints, which are used for one-time provisioning, Templates are designed for ongoing lifecycle management, ensuring that deployments are version-pinned, immutable, and consistently governed. This approach prevents configuration drift and enhances reproducibility and auditability across environments. The Templates Workbench enables platform engineers to define, publish, and manage these configurations, while developers use a simple, curated interface to deploy infrastructure. This feature is particularly beneficial for organizations with separate platform and application teams, aiming to streamline infrastructure provisioning without compromising on standards. Templates are available on Spacelift's Business plan and are designed to simplify cloud infrastructure orchestration through enhanced collaboration, automation, and control.