GitOps workflow

Treat IaC/<lab>/ as the unit of desired state.

IaC/
  spine-leaf/
    .eve-iac.yml
    topology.yml
    configs/
    eve-presentation.yml    # optional

Do not commit .eve-iac-state.json, .eve-iac-source.json, tokens, or CA private keys. You may commit a public CA certificate used for pinning if that matches your threat model.

Pipeline shape

  1. eve-iac validate ./IaC/spine-leaf
  2. eve-iac plan ./IaC/spine-leaf --json (gate on empty/acceptable plan)
  3. Apply only on the protected branch:
  4. first time: eve-iac deploy ./IaC/spine-leaf
  5. later: eve-iac reconcile ./IaC/spine-leaf --direction to_eve
  6. Optional reverse sync (review Git diff): eve-iac reconcile ./IaC/spine-leaf --direction from_eve

--direction is sent only when you pass it. Omitted stays omitted on the wire; the agent treats omitted as to_eve.

Drift

Plan is the drift report. Do not infer drift from Git mtime or “which side changed”. There is no merge mode.

plan_stale on reconcile means the live plan no longer matches plan_identity. Re-run plan.

prune deletes extra live objects on to_eve and requires --yes. It is invalid with from_eve.

Import is a one-time adoption (eve-iac import). It is not the reverse-sync job.

Secrets

Use CI variables / a secret store for EVE_IAC_TOKEN or EVE_IAC_PASSWORD. Pin TLS with EVE_IAC_CA_FILE. See security.