Drift and export

People can change things by hand through the CLI or the admin UI, and every such change is in the audit log. Git wins on the next apply for everything the folder describes: a document of the folder changed by hand is put back, and something added by hand that the folder never had is left alone.

A nightly drift check#

weikio diff exits with 2 when the platform differs from the folder. A workflow that runs it against production every night is the drift alarm, and its output is the list of what somebody changed by hand:

name: drift
on:
  schedule:
    - cron: '0 3 * * *'
env:
  WEIKIO_SERVER: https://weikio.example.com
jobs:
  drift:
    runs-on: ubuntu-latest
    environment: production-plan
    env:
      WEIKIO_API_KEY: ${{ secrets.WEIKIO_API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - run: |
          curl -fsSL https://weik.io/install.sh | WEIKIO_CLI_VERSION=2026.2.1 sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - run: weikio diff -f ./finance/production --env production --prune finance

The job fails when the diff finds a difference, and GitHub notifies the people who watch the workflow. The exit codes are fixed so a pipeline can branch on them:

Changes made in the admin UI#

The admin UI saves into the same records the folder applies. An apply that replaces files or fields a person saved in the admin UI says whose save it replaced and when, in a warning row. An integration made in the browser is never pruned, because no apply of the folder put it there. One the folder put there and a person then switched to editing in the browser is kept and listed as kept, for you to delete by hand when you mean to.

Export everything#

weikio export writes documents as multi-document YAML that applies again unchanged:

$ weikio export --project finance --out-dir ./out

--out-dir writes one file per kind, named for the kind in the plural, such as projects.yaml, integrations.yaml, apis.yaml, api-versions.yaml and entity-store-policies.yaml, and prints one line per file it wrote. Without it, the YAML goes to standard output. --env production exports one environment’s documents.

Secrets are exported without their values, because the platform never prints a sealed value in an export. Set them again with weikio secret set where you apply the export.

Start a repository from what runs#

An installation that started in the admin UI moves into Git with an export. Export each project’s documents into the repository’s folders, put each Camel integration’s folder of files beside them, and apply them from the pipeline with --prune. The first apply with --prune deletes nothing, and from then on the repository is the source of truth. A platform administrator’s export with no project starts with the installation’s settings, so the platform’s own configuration can live in a repository of its own.

Move between installations#

The same export moves a project to another installation, such as from a self-hosted hub to a workspace in Weik.io Cloud or the other way:

$ weikio export --project finance --out-dir ./finance-export
$ weikio apply -f ./finance-export --context new-hub

Apply each Camel integration’s directory from your repository too, and the new installation builds its versions. Then set the secrets there, enrol its agents and deploy. The records that never live in Git, such as agents, users and API keys, are created in the new installation itself.