GitLab CI¶

This page is the consumer pipeline (validate/plan/reconcile a lab). It is not the eve-iac project’s own .gitlab-ci.yml.

Two tag families must not be mixed:

Tag	Source of truth	Example
Product	repo-root VERSION	git tag v0.9.0-1, packages 0.9.0 / 0.9.0-1, GitLab Release
CI toolchain image	ci/image/VERSION	$CI_REGISTRY_IMAGE/ci:vN (currently v2). Independent of product.

Pin the CLI to the product you documented. A bare pip install eve-iac against this GitLab index still tracks whatever was last published; use ==0.9.0 in CI.

The eve-iac repository publishes its own packages only on product tags. Tag v0.9.0-1 (v + VERSION). That is independent of the CI toolchain image (ci:vN). A product tag does not rebuild ci:vN. See versioning.

Example job. Adjust image, paths, and protected-branch rules.

stages:
  - validate
  - apply

variables:
  EVE_IAC_URL: https://eve.example:8787

.eve-iac:
  image: python:3.12
  before_script:
      - pip install "eve-iac==0.9.0" --index-url https://gitlab.com/api/v4/projects/eve-ng-dev%2Feve-iac/packages/pypi/simple
  variables:
    EVE_IAC_CA_FILE: "$CI_PROJECT_DIR/ci/eve-iac-ca.pem"

validate:
  extends: .eve-iac
  stage: validate
  script:
    - eve-iac session
    - eve-iac validate ./IaC/spine-leaf
    - eve-iac plan ./IaC/spine-leaf --json

apply:
  extends: .eve-iac
  stage: apply
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
    - eve-iac reconcile ./IaC/spine-leaf --direction to_eve
  # Remaining requires_stop (manual):
  # - eve-iac --yes reconcile ./IaC/spine-leaf --direction to_eve --plan-identity <P>
  # First deploy of a new managed lab:
  # - eve-iac deploy ./IaC/spine-leaf

Set EVE_IAC_TOKEN (or username/password plus eve-iac login) as a masked CI/CD variable. Do not echo --json login output.

Pin the agent CA with EVE_IAC_CA_FILE (or EVE_IAC_CA_PEM). Do not pass --insecure in CI. There is no EVE_IAC_INSECURE variable.

eve-iac destroy ./IaC/spine-leaf --yes and eve-iac --yes reconcile ./IaC/spine-leaf --prune --plan-identity <P> belong in manual jobs only. --yes does not invent plan identity.

eve-iac export-config ./IaC/spine-leaf --configset default --yes also belongs in a manual job. It copies the running NOS configuration into an existing startup-config set and replaces that EVE blob. It does not update Git. A later reconcile --direction from_eve is the job that can adopt the blob. Pin eve-iac==0.9.0 as in the example above.