CLI security

The CLI is a laptop/CI client of eve-iac-agent. It never calls native EVE REST. Shared concepts: security.

TLS

  • HTTPS only. The SDK rejects http:// (tls_required, exit 4), including with --insecure.
  • Pin the agent CA for normal use and for CI: --ca-file / EVE_IAC_CA_FILE or --ca-pem / EVE_IAC_CA_PEM. There is no TOFU UI and no SecretStorage.
  • --insecure is opt-in, per command. It skips certificate verification and the fingerprint pin (like curl -k) and prints a warning on stderr. Never the default. Not sticky. There is no EVE_IAC_INSECURE environment variable.
  • Do not use --insecure in CI. Commit or inject a PEM and set EVE_IAC_CA_FILE / EVE_IAC_CA_PEM (see GitLab CI, GitHub Actions).
  • Copy the PEM from the EVE host (/opt/unetlab/addons/eve-iac-agent/tls.crt, else /opt/unetlab/go/server.crt) with openssl x509 -outform PEM. Compare SHA-256 with the same openssl x509 -noout -fingerprint -sha256 the IDE Trust modal shows.

Credentials

  • Do not put credentials in the URL.
  • Prefer EVE_IAC_TOKEN after eve-iac login --json over repeating passwords on every command.
  • Mask secrets in CI. Human login omits the token; --json login prints token. Do not echo that output.
  • Do not commit passwords, tokens, private keys, or .eve-iac-state.json if you treat it as runtime.

Confirmation

  • --yes is the only confirmation. There are no interactive prompts.
  • Required for destroy, exec wipe, deploy --replace, and reconcile --prune.
  • Do not pass --yes on validate/plan. from_eve plus --prune is rejected.

Agent boundary

The CLI does not call 127.0.0.1 EVE REST. Only the agent does, on the EVE host.