A commercial tenant rarely owns the building's wiring. When the landlord retenders the maintenance contract, the rent is the visible number; the load-bearing risk is that nobody remembers who certified the fuse box.

Enterprise infrastructure is now living through that retendering. Broadcom's VMware subscription bundling and 72-core order minimums, the Kubernetes project's retirement of ingress-nginx in March 2026, the EU Data Act's switching regime that became applicable on 12 September 2025, the correlated hyperscaler control-plane outages of October and November 2025, and the measurable delivery-instability penalty now attached to AI-assisted pipelines are not five stories. They are one story: the operational substrate beneath cloud-native delivery is being repriced, deprecated and legislated simultaneously, while the engineering capacity required to absorb that change is not being funded.

The CentOS Playbook, Repriced

The precedent is not a hyperscaler failure. It is 8 December 2020, when Red Hat moved CentOS 8's end-of-life from 2029 to the end of 2021 and converted a stable downstream rebuild into an upstream rolling stream. Nothing broke that day. What broke was the assumption that a free, production-grade substrate carried an implicit support contract. The response was structural: Rocky Linux and AlmaLinux were founded within weeks, and the market learned that governance risk is a distinct asset class from technical risk.

The same mechanism produced OpenTofu after HashiCorp's move to the Business Source License in August 2023, a fork now under Linux Foundation stewardship while IBM completed its $6.4bn acquisition in February 2025. The lesson operators consistently fail to price: licence changes and maintainer retirements are not procurement events, they are migration projects with 12-to-24-month lead times. Organisations that treated CentOS as a technical decision spent 2022 in emergency remediation. Those that treated it as a governance decision had already budgeted the exit.

Correlated Failure Is Now the Default Failure Mode

Mainstream coverage of the 20 October 2025 AWS us-east-1 event fixated on duration. The engineering signal was in the mechanism: a latent race condition in DynamoDB's DNS automation produced an empty record, and the failure propagated through the authentication and control-plane dependencies of services that customers believed were independent. Azure's Front Door incident nine days later and Cloudflare's 18 November Bot Management file failure followed the same grammar — not capacity exhaustion, but a validated configuration change applied globally at machine speed.

The implication for platform teams is that multi-AZ architecture, the industry's default resilience answer, addresses the wrong failure domain. All three incidents originated above the availability-zone boundary, in globalised configuration and DNS systems. Resilience that matters now is control-plane diversity: pre-baked, regionally cached deployment artefacts; break-glass paths that do not authenticate through the failing identity provider; and CI/CD runners that can still ship a rollback when the vendor's status page cannot load. Most disaster-recovery runbooks in production today fail that test.

The Maintainer Economy Has No Balance Sheet

ingress-nginx was the most widely deployed ingress controller in Kubernetes and, per the project's own retirement notice, sustained by a handful of maintainers working largely unpaid. Its March 2026 retirement — no further releases or security patches — followed the IngressNightmare disclosure (CVE-2025-1974, CVSS 9.8), which Wiz Research assessed as exposing roughly 43% of cloud environments to unauthenticated remote code execution. Clusters still running those binaries in November 2026 are unpatched by definition, not by oversight.

This is the same fragility Andres Freund surfaced in March 2024, when he traced the xz backdoor to "logins with ssh taking a lot of CPU time, valgrind errors" — a supply-chain compromise of the entire Linux SSH path found by one engineer chasing a 500ms latency anomaly. The September 2025 self-replicating Shai-Hulud npm worm confirmed the pattern at registry scale. The EU Cyber Resilience Act's exploited-vulnerability reporting obligations, live since 11 September 2026, now attach legal consequence to that dependency graph. Enterprises that consume open source as a free input while assigning zero headcount to upstream maintenance are carrying an unpriced liability that regulators have begun to recognise.

Egress Freedom Is Not Portability

The Data Act obliges providers to withdraw switching charges entirely by 12 January 2027, and the major hyperscalers pre-empted this with contractual egress waivers. Boards have interpreted that as the end of lock-in. It is not. Egress fees were never the binding constraint; the binding constraints are proprietary IAM policy semantics, managed-database wire protocols, event-bus integrations and the observability stack's query language. Kubernetes addressed this only partially: "Kubernetes is a platform for building platforms. It's a better place to start; not the endgame," as Kelsey Hightower put it — and the abstraction leaks precisely where managed services attach.

The quieter cost sits in AI-assisted delivery. DORA's 2024 research found a 25% increase in AI adoption associated with a 1.5% decline in delivery throughput and a 7.2% decline in delivery stability, while Flexera's 2025 State of the Cloud Report put wasted cloud spend at 27%. Generated infrastructure-as-code accelerates provisioning faster than it accelerates review, which converts model productivity into GPU and idle-capacity sprawl. Dynamic Resource Allocation reaching GA in Kubernetes 1.34 helps scheduling efficiency; it does nothing about a pipeline that ships unreviewed Terraform at four times the previous rate.

What Operators Should Do Before Q2

Inventory the deprecated layer first. Enumerate every cluster still terminating traffic through ingress-nginx and every VMware estate approaching renewal; assign a named owner and a dated Gateway API migration plan. Test the break-glass path. Run a game day in which the primary region's control plane and identity provider are assumed unavailable, and measure whether a rollback can still ship. Instrument cost at the pull-request level. Attach unit-economics attribution to AI-generated infrastructure changes and enforce policy-as-code gates on GPU requests. Fund upstream. Allocate a fixed percentage of platform headcount to maintainer sponsorship or direct contribution for the three projects whose failure would halt deployment. Model the exit, don't execute it. Build the three-year TCO comparison now, while it is optional.

May 2027: The Bifurcated Control Plane

Expect the January 2027 egress-charge withdrawal to trigger a wave of announced multi-cloud strategies that stall at the data-gravity layer, producing measurable switching intent and minimal switching volume. Gateway API consolidation will accelerate, and the first CVE against a widely deployed successor controller will demonstrate that replacing an unmaintained component relocated rather than removed the risk. CRA reporting will make software composition analysis a board-level disclosure item rather than a security-team artefact, and at least one major enterprise will restate delivery metrics after discovering that AI-driven throughput gains masked a stability regression. The durable advantage will not belong to the largest estates, but to the operators who can prove — with an audit trail — exactly what is running, who maintains it, and how it is rolled back.