Platform engineering in 2026 is less about finding the perfect tool and more about building a cohesive internal developer platform (IDP): a service catalog + paved roads (golden paths) + automation + guardrails + production insights.

The tooling landscape is moving fast, but the pattern is stable:

Developer-facing layer: portals, catalogs, scorecards, self-service actions
Platform backbone: Kubernetes + GitOps + infrastructure control planes + Infrastructure as code (IaC)
Guardrails: policy-as-code + secrets + supply-chain controls
Feedback loops: observability + reliability + cost signals
Automation: workflow engines + ops in chat / agents

Below is a curated list of 20 tools that are modern, widely discussed in current platform engineering circles, and gaining traction across real platform teams, including a mix of OSS and commercial solutions.

1. Infisical (Secrets + Identity Security Layer)

The Infisical secrets dashboard in dark mode for the Platform folder of Example Project in Acme Corp, listing folders microservice-1 and microservice-2 and masked secrets API_KEY, DATABASE_PASSWORD, DATABASE_URL and DATABASE_USERNAME, with a 21 Snapshots button, Add Secret button, and a drag and drop area for .env, .json or .yml files. A secrets management and identity security platform used to manage application/runtime secrets (and related identity/security controls) across environments. It’s commonly integrated into developer self-service and deployment workflows as part of a modern platform stack.

2. Backstage (Spotify OSS)

Spotify's Backstage portal in a browser at backstage.spotify.net, showing Squad Metrics tiles (Test Certified 24%, Cloud Cost, 16 Security Issues, Incidents 10 days since last, Cycle Time) and Squad Ownership tiles such as 24 Services, 3 Websites, 9 Data Endpoints and 7 Workflows. An open-source framework for building an internal developer portal (service catalog, templates/scaffolding, plugin ecosystem). It’s commonly the “front door” to a platform team’s golden paths.

3. Port

Port's developer portal Service Catalog table listing 22 services such as rating, ads, payment and fraud-detection, with columns for identifier, title, Port Team, last update, GitHub URL and language, and a sidebar of catalog sections. A commercial internal developer portal focused on flexible software catalogs, scorecards, and developer self-service actions (workflow triggers) to standardize how teams ship.

4. Cortex

The Cortex developer portal home page with navigation for Catalogs, Scorecards, Tools, Actions, Plugins and Eng Intelligence, on-call and scorecard insight cards, and a table of owned services showing active incidents, monitors, error rate and Apdex. A developer portal approach combining service catalogs and scorecards that emphasizes standards, production readiness, and operational maturity tracking (often integrated with Backstage).

5. OpsLevel

The OpsLevel dashboard showing a Maturity Report for 237 services by level (Beginner to Platinum), a Deploys chart with 147 deploys, a Members list, three Campaigns with pass rates of 75%, 78% and 48%, and an Ownership table of services with maturity levels, owners and tools. An internal developer portal/service catalog oriented around operational maturity and “campaigns” to drive org-wide improvements (standards, migrations, reliability initiatives).

6. Roadie

Roadie's Administration settings page for Catalog Tab Configuration, with a Hidden Tabs list (Locations, Groups, Lambdas, Resources, Repositories, Products, Systems) and a Displayed Tabs list (Components, Teams, Users, API, Templates, Domains), plus New Tab and Save buttons. A managed Backstage offering (hosted/operated), typically chosen by teams that want Backstage’s ecosystem without running it themselves.

7. Humanitec (Platform Orchestrator)

The Humanitec console for microservice-demo with a 'Clone deployment to prod' dialog listing workloads such as adservice, cartservice, checkoutservice, currencyservice, cvshealth and emailservice, each with a Select button, plus a Clone 0 workloads button; the page behind shows environments and past deployments. A platform orchestration layer that sits at the core of an IDP to standardize deployments and dependencies via golden paths, generating environment-specific configuration dynamically.

8. Qovery

The Qovery console Environments page for a production project, listing 17 environments such as production, staging and preview branches like fix/logout, with columns for service status, deployment status, last update, type, AWS cluster and tags, and a New environment button. An internal platform and application deployment layer (often Kubernetes-based) that provides self-service environments, deployment workflows, and platform abstractions. It’s frequently used to reduce “yak shaving” for app teams.

9. Kubernetes

The Kubernetes Dashboard in a browser on the Workloads Pods page for the kube-system namespace, with CPU usage and Memory usage line charts over 11:10 to 11:24 and a table of running pods on minikube, including kubernetes-dashboard, heapster, influxdb-grafana, kube-scheduler-minikube and etcd-minikube. Kubernetes is the default foundation for many internal platforms, handling cluster orchestration and workload runtime. As a result, much of today’s platform engineering tooling assumes Kubernetes as the baseline.

10. Argo CD

The Argo CD application details tree for my-first-app showing Healthy, Synced to HEAD and Sync OK, with a resource graph from the app to an nginx-svc service (endpoints and endpoint slice) and an nginx-deploy-1 deployment, replica set and pod. A GitOps continuous delivery controller for Kubernetes that continuously reconciles “desired state in Git” with what’s running in clusters (self-healing delivery).

11. Crossplane

Layered diagram of Crossplane: Users at the top interact with an Interface, which sits on top of Crossplane, labeled situated above the clouds, which in turn connects to Azure, AWS, Google Cloud, GitLab and any other cloud service. It shows Crossplane as a control plane exposing one API over many providers. A Kubernetes-native control plane framework that lets platform teams expose higher-level APIs for infrastructure and services (cloud resources, dependencies) so developers can self-serve without becoming infrastructure experts.

12. OpenTofu

A main.tf Terraform and OpenTofu configuration file that requires the hashicorp/aws provider at version ~> 5.0, sets the aws provider region to us-west-1, and declares an aws_s3_bucket resource named example with the bucket my-example-bucket. A community-driven open-source IaC tool positioned as a drop-in alternative to Terraform, under Linux Foundation stewardship, with strong ecosystem compatibility.

13. Pulumi

The Pulumi Cloud Resources page in a browser, with a search bar, advanced filters for types, packages, projects, stacks and teams, and a table of 72,773 resources such as aws:route53:Record and aws:s3:BucketAclV2 for the www.pulumi.com project. IaC using real programming languages (TypeScript, Python, Go, etc.). It’s useful when teams want software engineering constructs (modules, tests, loops) for platform builds.

14. Spacelift

The Spacelift Policies page listing 9 policies by type, including Require 1 Developer to Approve (approval), Login, several push policies, an access policy, a plan policy requiring tags on S3 buckets and a trigger policy, with the Add policy button highlighted. Infrastructure automation/orchestration for IaC workflows (Terraform/OpenTofu/Pulumi, policies, approvals, drift detection) that is often used as the “control plane” for infrastructure changes across many repos/teams.

15. OPA Gatekeeper

A Grafana dashboard titled K8S Internal / Kubernetes / OPA Gatekeeper showing 39 active constraint templates and 0 errors, 2745 warn violations, violations by kind, a table of K8sPSPHostNamespace warnings for pods, violations over time and enforcement actions, all warn. A Kubernetes-native policy controller built on Open Policy Agent (OPA) that enforces admission policies (guardrails) using constraints and policy definitions.

16. Kyverno

The Policy Reporter dashboard in dark mode on the Kyverno page, with a pie chart of 631 Kyverno results that are mostly pass with some fail, a bar chart of pass and fail results per namespace led by kube-system, and cluster scoped pass and fail counts of 0. A Kubernetes-native policy-as-code engine that lets teams write and enforce policies using familiar Kubernetes-style configuration (YAML/CEL), commonly used for cluster guardrails and automation.

17. OpenTelemetry

The OpenTelemetry logo and wordmark on an orange gradient banner with the Grafana logo, above a Grafana Explore view of Tempo with the Service Graph query type and a table of services showing rate, error rate and p90 duration. A Cloud Native Computing Foundation standard for instrumenting and collecting telemetry (traces, metrics, logs) so you can export to any observability backend. It’s critical for platform-wide visibility without vendor lock-in.

18. Grafana (LGTM-style stack)

A dark Grafana dashboard named Website performance with panels for memory and CPU, logins, memory and Google hits gauges, support calls and sign ups, server requests by web server, Google hits by series, and client side full page load times. A widely adopted observability UI and ecosystem that often serves as the single pane of glass for metrics, logs, and traces. Grafana is commonly used alongside the LGTM stack, which refers to Loki for logs, Grafana for visualization, Tempo for traces, and Mimir for metrics, and is frequently embedded into internal platform portals and runbooks.

19. Dagger

A code editor showing a Dagger README.md whose front matter sets the shell to dagger shell, with the line selected and Chat and Edit prompts, above the heading 'The Docs, daggerized with Dagger Shell'. A programmable CI/CD engine that runs pipeline steps in containers, making pipelines portable across laptops/CI environments and easier to standardize across many services.

20. External Secrets Operator (ESO)

External Secrets Operator diagram: inside a Kubernetes cluster, an operator icon sits between namespace-foo and namespace-bar and syncs secrets into each. An arrow runs from the operator up to an external secret store labeled AWS / GCP / Vault, showing secrets pulled from external systems into Kubernetes. A Kubernetes operator that reads secrets from external systems/APIs and syncs/injects them into Kubernetes Secrets. It’s useful for “don’t put secrets in Git” workflows while keeping apps Kubernetes-native.

How to Pick From This List (So You Don’t Create a Tool Zoo)

If you’re building (or fixing) a platform program in 2026, pick tools based on jobs-to-be-done:

Make security the default: secrets integration (Infisical + ESO pattern)
Make it easy to do the right thing (golden paths): Backstage/Port + an orchestrator (Humanitec/Qovery)
Make changes safe and auditable: GitOps (Argo CD) + IaC automation (Spacelift) + policy-as-code (Gatekeeper/Kyverno)
Make production behavior visible: OpenTelemetry + your observability stack

A good platform tool isn’t the one with the most features. It’s the one that reduces cognitive load for dev teams while making the platform team’s standards easier to adopt than to bypass.

Mathew Pregasen

Technical Writer, Infisical

Starting with Infisical is simple, fast, and free.

Get started for free Request a demo