topic Re: commit and push changes made by automation job (Panorama, Terraform) in Automation/API Discussions

commit and push changes made by automation job (Panorama, Terraform)

DawidZ — Wed, 02 Feb 2022 12:25:55 GMT

Hello Guys, I'm dealing with automation project where saome sec. policies must be applied through Panorama. I'm using Terraform provider which does not support commit.

My idea was to commit and push changes made by specific admin account used for automation. (this is what can be manually done form Panorama GUI by using: "Commit and Push" + selected "Commit Changes Made By: ()".

Unfortunatelly I can't find any way to reproduce such an action by API ?!

Any ideas how to do it? Or any other approach to commits to avoid mess?

thanks in advance for your help!

Re: commit and push changes made by automation job (Panorama, Terraform)

JimmyHolland — Wed, 02 Feb 2022 16:03:16 GMT

Does this work for you?

https://{{host}}/api/?key={{key}}&type=commit&action=all&cmd=<commit-all><shared-policy><admin><member>{{admin}}</member></admin><device-group><entry name="{{device-group-name}}"/></device-group></shared-policy></commit-all>

Re: commit and push changes made by automation job (Panorama, Terraform)

DawidZ — Wed, 02 Feb 2022 19:27:11 GMT

<response status="error" code="17">
    <msg>
        <line>
            <![CDATA[ commit-all -> shared-policy -> admin unexpected here]]>
        </line>
        <line>
            <![CDATA[ commit-all -> shared-policy  is unexpected ]]>
        </line>
        <line>
            <![CDATA[ commit-all  is unexpected ]]>
        </line>
    </msg>
</response>

commit all unfortunatelly does not accept all those parameters

Re: commit and push changes made by automation job (Panorama, Terraform)

JimmyHolland — Wed, 02 Feb 2022 21:05:40 GMT

Yeah, looks like this one isn't available via XML API. This is what the GUI does:

https://{{host}}/api/?key={{key}}&type=commit&action=all&cmd=<commit-and-push><partial><admin><member>{{admin}}</member></admin><device-group><member>{{device-group-name}}</member></device-group></partial></commit-and-push>

I guess the other approach is to incorporate locks to your Terraform automation; lock, perform changes, commit, unlock. If lock can't be acquired or other admins are logged in, don't allow Terraform to proceed so it does not try to commit other admins' potentially half-completed changes.