Git-driven workflow

Treat IaC/<lab>/ as the unit of desired state.

EVE IaC uses Git as the desired-state source. It intentionally does not implement autonomous pull-based continuous reconciliation (OpenGitOps “Pulled Automatically” / “Continuously Reconciled”). Humans or CI push validate → plan → deploy / reconcile. Nothing polls Git and applies it in the background.

That is an architecture decision. A controller that silently stops a fabric because a commit landed is the wrong default for network labs.

Older docs said “GitOps”. Prefer Git-driven IaC or push-based CI for this product.

IaC/
  spine-leaf/
    .eve-iac.yml
    topology.yml
    configs/
    eve-presentation.yml    # optional

Do not commit .eve-iac-state.json, .eve-iac-source.json, .eve-iac/oob/, .eve-iac/inventory/, tokens, or CA private keys. OOB files and generated inventories are local runtime material. You may commit a public CA certificate used for pinning if that matches your threat model.

Pipeline shape

  1. eve-iac validate ./IaC/spine-leaf
  2. eve-iac plan ./IaC/spine-leaf --json (inspect status / classification; do not gate on .applicable)
  3. Apply only on the protected branch:
  4. first time: eve-iac deploy ./IaC/spine-leaf
  5. later live-safe: eve-iac reconcile ./IaC/spine-leaf --direction to_eve
  6. remaining requires_stop: eve-iac --yes reconcile ./IaC/spine-leaf --direction to_eve --plan-identity <P>
  7. Optional reverse sync (review Git diff): eve-iac reconcile ./IaC/spine-leaf --direction from_eve
  8. Optional, before that pull, when the useful configuration is the running NOS config: eve-iac export-config ./IaC/spine-leaf --configset default --yes. That replaces an existing EVE startup-config blob. It does not write Git. An unknown set is not created. Keep it out of the default apply job.

--direction is sent only when you pass it. Omitted stays omitted on the wire; the agent treats omitted as to_eve. --yes sets confirm=true and does not invent plan_identity. Partial convergence (pending_stop / partial) is a valid pipeline result, not an automatic failure. Any unsupported plan action must fail the job: reconcile writes nothing until the YAML changes. See plan / reconcile.

Drift

Plan is the drift report. Do not infer drift from Git mtime or “which side changed”. There is no merge mode and no background sync.

plan_stale on reconcile means confirm=true was sent without a matching plan_identity (or the live classified plan changed). Re-run plan or live-only reconcile, copy the returned identity, then --yes --plan-identity. Zero StopNode on mismatch.

prune deletes extra live objects on to_eve and requires --yes. It is invalid with from_eve. If remaining work is requires_stop, still pass --plan-identity.

Import is a one-time adoption (eve-iac import). It is not the reverse-sync job.

Secrets

Use CI variables / a secret store for EVE_IAC_TOKEN or EVE_IAC_PASSWORD. Pin TLS with EVE_IAC_CA_FILE. See security.