Changelog¶

v0.2.4 - 2026-10-05¶

The deletion of a paloalto::DeploymentProfile the licensing portal reports as pending (e.g. right after its firewalls were deactivated) is skipped and retried later, instead of failing the resource

Fix Panorama objects intermittently being reported as missing, and reuse the API key instead of logging in for every resource.

Add BgpPeerGroup and BgpPeer resources, managing the BGP peer groups of a RouteDomain’s VRF and the peers within them.

Fix a DeploymentProfile staying permanently broken once its creation failed on the Licensing API side: deploying or removing it kept failing with 405 Method Not Allowed on /tms/v1/deploymentProfile/.
Add DataplaneCores resource that enforces the dataplane core count on a VM-Series firewall through Panorama’s vm_series plugin operational commands, reading back the device’s own configured-dp-cores vs dp-cores split to detect drift and a pending reboot without ever blocking a deploy on the reboot/reconnect cycle.

Add DeploymentProfile resource that manages a Software NGFW deployment profile through the Palo Alto Licensing API and emits the generated authorization code as the auth_code fact.
Identify the DeploymentProfile by (credit_pool_id, name) and use name as its agent, so the resource works when client_id/client_secret are references (e.g. cyberark secrets), which can be used neither as an index key nor as the agent.
Harden mechanism to remove deployment profile

Add DeviceGroup, Template, TemplateStack, Commit, RouteDomain, Push, EthernetInterface, L3Subinterface.
Add licensing API
Add FirewallConnection resource that waits for a firewall to be discovered and connected to Panorama in a device group.