commit and push changes made by automation job (Panorama, Terraform)

[DawidZ]

Hello Guys, I'm dealing with automation project where saome sec. policies must be applied through Panorama. I'm using Terraform provider which does not support commit.

My idea was to commit and push changes made by specific admin account used for automation. (this is what can be manually done form Panorama GUI by using: "Commit and Push" + selected "Commit Changes Made By: ()".

Unfortunatelly I can't find any way to reproduce such an action by API ?!

Any ideas how to do it? Or any other approach to commits to avoid mess?

thanks in advance for your help!

[JimmyHolland]

Does this work for you?

https://{{host}}/api/?key={{key}}&type=commit&action=all&cmd=<commit-all><shared-policy><admin><member>{{admin}}</member></admin><device-group><entry name="{{device-group-name}}"/></device-group></shared-policy></commit-all>

[DawidZ]

<response status="error" code="17">
    <msg>
        <line>
            <![CDATA[ commit-all -> shared-policy -> admin unexpected here]]>
        </line>
        <line>
            <![CDATA[ commit-all -> shared-policy  is unexpected ]]>
        </line>
        <line>
            <![CDATA[ commit-all  is unexpected ]]>
        </line>
    </msg>
</response>

commit all unfortunatelly does not accept all those parameters

[JimmyHolland]

Yeah, looks like this one isn't available via XML API. This is what the GUI does:

https://{{host}}/api/?key={{key}}&type=commit&action=all&cmd=<commit-and-push><partial><admin><member>{{admin}}</member></admin><device-group><member>{{device-group-name}}</member></device-group></partial></commit-and-push>

I guess the other approach is to incorporate locks to your Terraform automation; lock, perform changes, commit, unlock. If lock can't be acquired or other admins are logged in, don't allow Terraform to proceed so it does not try to commit other admins' potentially half-completed changes.