Changelog¶

v1.1.1 - 2026-09-10¶

Report what the device objected to when it rejects a request: FortiOS returns cli_error as a list of cli output lines and the handler only recognised a single string, so every rejection surfaced as a bare 500 Server Error with no reason at all. A static route created without device now reports Attribute 'device' MUST be set. instead.

Support FortiOS 7.4 and 7.6: send the intf field of local-in policies and the monitor field of ipsec phase1 interfaces in the form the device expects, a table on 7.4 and 7.6 and a single value on 7.2. The form is decided by reading the schema the device publishes for its own objects rather than by comparing FortiOS versions, so releases that changed at another point work too. The model keeps the single value either way, so existing models need no change.
Keep the rest of the body when an administrator password changes: the password payload replaced the update payload, so a fortigate::SystemAdmin deploy that changed both the password and another attribute reported success and applied only the password.
Ignore the name field of fortiflex configuration parameters when diffing: the fortiflex api started reporting the parameter display label (e.g. “Number of CPUs”) instead of the parameter type (e.g. “CPU”), which made every configuration permanently out of sync.
Select the service parameters to clean by parameter id instead of parameter name in the fortiflex cleaner: the same api change made the name comparison always fail, silently disabling the cleaning of all fortiguard and cloud services.

Explicitly disable followProgram when updating the end date of an entitlement: a program renewal with auto-extend marks active entitlements as follow-program, after which the fortiflex api rejects end date updates that do not disable the flag in the same request.
Make Entitlement.end_date optional: when null the orchestrator does not manage the end date and the entitlement follows the program end date (fortiflex termination mode “Follow Program”).
Never select the mandatory FortiManager support service (FMGFC247) for cleaning in the fortiflex cleaner: the fortiflex api rejects configuration updates that blank it, which wedged the test suite cleanup.
Add the support_services (mandatory since May 2026) and cloud_services parameters to FortiManagerConfiguration.

Cache fortiflex credentials in agent state directory, for minimal fortiflex api usage.

Handle GRACE_PERIOD status in fortigate::fortiflex::Entitlement resource handler

Add default token field
Fix agent name for Fortiflex resources
- Make sure that two fortigate resources cannot deploy at the same time (entitlement + other Fortigate resource)
Improve Entitlement Handler
- Will now wait for the license to be up before interacting with the Firewall. If it takes too much time, the resource will be skipped
The body of the password change request is now hidden
Fix interface mode not being reset

Handle redistributes correctly on BGP
Handle graceful-restart-time correctly on BGP
Normalize netmasks in Fortigate resources
Stop using deprecated jsonschema.RefResolver
Add restbase caching mechanism for schemas
Add Administrator resources + ability to change admin password
Fix special case where the installation of the entitlement would fail: install an entitlement with an expired end date