Changelog

v0.3.0 - 2026-10-16

  • A purged panorama::FirewallConnection removes the firewall from the managed devices of Panorama, once it is disconnected. It used to never be purged, so the firewall of a deleted VM stayed in Panorama as a disconnected device

  • A panorama::Push with include_template also detects a pending push from the template status of its firewalls (show templates): a change to a template only, e.g. a logical router, left the shared policy of the device group in sync, so the push was skipped. A firewall listed without a template status is considered out of sync.

  • Add paloalto::panorama::CollectorGroupDevice, which adds a firewall to the Device Log Forwarding list of an existing Log Collector Group. It only changes the candidate configuration, a Commit and a Push with scope log_collector_group publish it. The group may have no collectors, the firewall is then added with an empty collector list. Changing the group removes the serial from the group that lists it and adds it to the new one. The collector list of the firewall follows later changes to the collectors of the group, compared as a set: removed collectors are dropped, new ones are added at the end and the order of the others is kept

  • paloalto::panorama::FirewallConnection publishes the serial of the connected firewall as the fact serial.

  • Add the scope log_collector_group to paloalto::panorama::Push, with the attribute log_collector_groups. A group is only pushed when its last push (show log-collector-group all) is older than the latest successful Commit job that changed the collector group configuration (show jobs all), or when it was never pushed. The commit does not name the group, so a commit to any group makes all groups pending. With wait_for_complete, the push waits up to 120s until Panorama shows the new last push time of the groups, so a read right after the push does not see them as pending. target is not set for this scope and is required for the other scopes

  • A panorama::Push with scope template is skipped when every device listed for the template in show templates is In Sync. It was always pushed before. A template listed without devices is still always pushed

  • A job result of Ok, as returned by a log collector group push, is accepted like OK by paloalto::panorama::Push

  • Commits only detect and include the pending changes of the Panorama account the orchestrator logs in with (and of the additional accounts in Commit.admins), so that several orchestrators can share a Panorama, each with its own account

  • Fix Unable to serialize error logged by panorama::Commit when reading pending changes, by logging the change journal as text instead of bytes

  • Explicitly set receive_events=true on panorama::Commit and panorama::Push, so that it keeps being redeployed when one of its dependencies changed once receive_events defaults to false

  • Add paloalto::LicensingProvider, holding the Licensing API credentials. paloalto::DeploymentProfile takes it as its provider instead of the two attributes. the lciensing provider and the mock argument of licensing_connect. The PALOALTO_LICENSING_MOCK environment variable is no longer read.

  • Add generate_vm_auth_key to inmanta_plugins.paloalto.common, used by the generate_auth_key plugin, which gains a mock argument. It raises PaloaltoRuntimeError instead of LookupError when Panorama returns no key.

  • Add paloalto::panorama::ManagementProfile, an interface management profile within a template.

v0.2.4 - 2026-10-05

  • The deletion of a paloalto::DeploymentProfile the licensing portal reports as pending (e.g. right after its firewalls were deactivated) is skipped and retried later, instead of failing the resource

v0.2.3 - 2026-09-28

  • Fix Panorama objects intermittently being reported as missing, and reuse the API key instead of logging in for every resource.

v0.2.2 - 2026-09-17

  • Add BgpPeerGroup and BgpPeer resources, managing the BGP peer groups of a RouteDomain’s VRF and the peers within them.

v0.2.1 - 2026-08-24

  • Fix a DeploymentProfile staying permanently broken once its creation failed on the Licensing API side: deploying or removing it kept failing with 405 Method Not Allowed on /tms/v1/deploymentProfile/.

  • Add DataplaneCores resource that enforces the dataplane core count on a VM-Series firewall through Panorama’s vm_series plugin operational commands, reading back the device’s own configured-dp-cores vs dp-cores split to detect drift and a pending reboot without ever blocking a deploy on the reboot/reconnect cycle.

v0.2.0 - 2026-07-14

  • Add timeout bool to FirewallConnection resource

v0.1.1 - 2026-07-02

  • Add DeploymentProfile resource that manages a Software NGFW deployment profile through the Palo Alto Licensing API and emits the generated authorization code as the auth_code fact.

  • Identify the DeploymentProfile by (credit_pool_id, name) and use name as its agent, so the resource works when client_id/client_secret are references (e.g. cyberark secrets), which can be used neither as an index key nor as the agent.

  • Harden mechanism to remove deployment profile

v0.1.0 - 2026-06-22

  • Add DeviceGroup, Template, TemplateStack, Commit, RouteDomain, Push, EthernetInterface, L3Subinterface.

  • Add licensing API

  • Add FirewallConnection resource that waits for a firewall to be discovered and connected to Panorama in a device group.