Git-driven workflow

Treat IaC/<lab>/ as the unit of desired state.

EVE IaC uses Git as the desired-state source. It intentionally does not implement autonomous pull-based continuous reconciliation (OpenGitOps “Pulled Automatically” / “Continuously Reconciled”). Humans or CI push validate → plan → deploy / reconcile. Nothing polls Git and applies it in the background.

That is an architecture decision. A controller that silently stops a fabric because a commit landed is the wrong default for network labs.

Older docs said “GitOps”. Prefer Git-driven IaC or push-based CI for this product.

IaC/
  spine-leaf/
    .eve-iac.yml
    topology.yml
    configs/
    eve-presentation.yml    # optional

Do not commit .eve-iac-state.json, .eve-iac-source.json, tokens, or CA private keys. You may commit a public CA certificate used for pinning if that matches your threat model.

Pipeline shape

  1. eve-iac validate ./IaC/spine-leaf
  2. eve-iac plan ./IaC/spine-leaf --json (inspect status / classification; do not gate on .applicable)
  3. Apply only on the protected branch:
  4. first time: eve-iac deploy ./IaC/spine-leaf
  5. later live-safe: eve-iac reconcile ./IaC/spine-leaf --direction to_eve
  6. remaining requires_stop: eve-iac --yes reconcile ./IaC/spine-leaf --direction to_eve --plan-identity <P>
  7. Optional reverse sync (review Git diff): eve-iac reconcile ./IaC/spine-leaf --direction from_eve

--direction is sent only when you pass it. Omitted stays omitted on the wire; the agent treats omitted as to_eve. --yes sets confirm=true and does not invent plan_identity. Partial convergence (pending_stop / partial) is a valid pipeline result, not an automatic failure.

Drift

Plan is the drift report. Do not infer drift from Git mtime or “which side changed”. There is no merge mode and no background sync.

plan_stale on reconcile means confirm=true was sent without a matching plan_identity (or the live classified plan changed). Re-run plan or live-only reconcile, copy the returned identity, then --yes --plan-identity. Zero StopNode on mismatch.

prune deletes extra live objects on to_eve and requires --yes. It is invalid with from_eve. If remaining work is requires_stop, still pass --plan-identity.

Import is a one-time adoption (eve-iac import). It is not the reverse-sync job.

Secrets

Use CI variables / a secret store for EVE_IAC_TOKEN or EVE_IAC_PASSWORD. Pin TLS with EVE_IAC_CA_FILE. See security.