Drift and export

People can change things by hand through the CLI or the admin UI, and every such change is in the audit log. The next apply restores everything the folder describes: a document of the folder changed by hand is put back, and something added by hand that the folder never had is left alone.

A nightly drift check#

weikio diff exits with 2 when Weik.io differs from the folder. Run it in a workflow against production every night, and its output lists what somebody changed by hand:

name: drift
on:
  schedule:
    - cron: '0 3 * * *'
env:
  WEIKIO_SERVER: https://weikio.example.com
jobs:
  drift:
    runs-on: ubuntu-latest
    environment: production-plan
    env:
      WEIKIO_API_KEY: ${{ secrets.WEIKIO_API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - run: |
          curl -fsSL https://weik.io/install.sh | WEIKIO_CLI_VERSION=2026.2.2 sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - run: weikio diff -f ./finance/production --env production --prune finance

The job fails when the diff finds a difference, and GitHub notifies the people who watch the workflow. The exit codes are fixed so a pipeline can branch on them:

Changes made in the admin UI#

The admin UI saves into the same records the folder applies. An apply that replaces files or fields a person saved in the admin UI says whose save it replaced and when, in a warning row. An integration made in the browser is never pruned, because no apply of the folder put it there. One the folder put there and a person then switched to editing in the browser is kept and listed as kept, for you to delete by hand when you mean to.

Export everything#

weikio export writes documents as multi-document YAML that applies again unchanged:

$ weikio export --project finance --out-dir ./out

--out-dir writes one file per kind, named for the kind in the plural, such as projects.yaml, integrations.yaml, apis.yaml, api-versions.yaml and entity-store-policies.yaml, and prints one line per file it wrote. Without it, the YAML goes to standard output. --env production exports one environment’s documents.

Secrets are exported without their values, because the platform never prints a sealed value in an export. Set them again with weikio secret set where you apply the export.

Start a repository from what runs#

A Weik.io installation that started in the admin UI moves into Git with an export. Export each project’s documents into the repository’s folders, put each Camel integration’s folder of files beside them, and apply them from the pipeline with --prune. The first apply with --prune deletes nothing, and from then on every change reaches Weik.io through the repository. A platform administrator’s export with no project starts with the installation’s settings, so the platform’s own configuration can live in a repository of its own.

Move between installations#

The same export moves a project to another installation, such as from a self-hosted installation to an installation in Weik.io Cloud or the other way:

$ weikio export --project finance --out-dir ./finance-export
$ weikio apply -f ./finance-export --context new-hub

Apply each Camel integration’s directory from your repository too, and the new installation builds its versions. Then set the secrets there, enrol its agents and deploy. The records that never live in Git, such as agents, users and API keys, are created in the new installation itself.