Tutorials · DevOps & Containers

How to Build a Safe Change Process for Networks and Edge Apps (CI/CD)

Most outages start with a change. Use a simple pipeline: change in Git, automatic checks, peer review, staged rollout, monitoring and a one-command rollback.

Advanced15 min6 steps

Before you start

Configurations and compose files in Git
A CI service (GitLab CI, GitHub Actions or similar)
A lab or pilot site

Step by step

Change on a branch
Every change is a commit with a clear message and a ticket number.

Automatic checks

The pipeline validates syntax and policy before anyone reviews it.

# .gitlab-ci.yml (example)
validate:
  image: docker:27
  script:
    - docker compose -f site1/edge/compose.yaml config --quiet
    - ansible-playbook edge.yml --syntax-check

Peer review
A second engineer reviews the diff and the rollback plan. No one approves their own change.
Staged rollout
Deploy to the lab or a pilot site first, wait and watch, then roll out to the rest in waves.
Watch the metrics
Compare alarms, latency and error rates before and after. Stop the rollout at the first unexpected alarm.
Roll back fast
Revert the commit and redeploy. Practise the rollback before you need it.
```
git revert <commit> && git push
# the pipeline redeploys the previous version
```

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.

Pro tips

Schedule risky changes in a maintenance window, but do not let windows replace testing.
Record every change in NavCloud's audit log or your ticket system.

FAQ

Frequently asked questions

Is this overkill for a small team?

Start with Git plus review plus rollback; add automation one step at a time.

Keep learning

Related guides

Safe firmware upgrades

Automate configuration with Ansible

How to Use SSH Keys Instead of Passwords for Network Devices and Servers

Passwords can be guessed, phished and reused. Create an SSH key pair, install the public key on gateways, edge servers and Linux hosts, then turn password logins off.

How to Reach Remote Sites Safely With an SSH Jump Host

Do not expose SSH on every device. Put one hardened jump host (bastion) in front of the management network and reach everything else through it.

How to Open a Device Web Page Through an SSH Tunnel

Reach the web interface of a switch, NVR or container on a remote site without opening a firewall port: forward it through SSH.

Stuck on a step?

Ask Navijin technical support or an authorised partner for help with your configuration.

Contact technical support All tutorials