<a id="manage-offers"></a>

# Manage offers

> See also: [Juju | Offer](https://canonical.com/juju/docs/juju-cli/latest/reference/offer/#offer)

## Reference an externally managed offer

To reference an offer you’ve created outside of the current Terraform plan, in your Terraform plan add a data source of the `juju_offer` type, specifying the offer’s URL. For example:

```terraform
data "juju_offer" "myoffer" {
  url = "admin/development.mysql"
}
```

> See more: [`juju_offer` (data source)](https://documentation.ubuntu.com/terraform-provider-juju/latest/reference/terraform-provider/data-sources/offer.md)

## Create an offer

> Who: User with [offer admin access](https://canonical.com/juju/docs/juju-cli/latest/reference/user/#user-access-offer-admin).

To create an offer, in your Terraform plan, create a resource of the `juju_offer` type, specifying the offering model and the name of the application and application endpoint from which the offer is created:

```terraform
resource "juju_offer" "percona-cluster" {
  model_uuid       = juju_model.development.uuid
  application_name = juju_application.percona-cluster.name
  endpoint         = "server"
}
```

You can optionally configure behaviour:

- `timeouts` — A block to configure custom timeouts for create and delete operations.
- `allow_force_destroy` (default: `false`) — Allows the offer to be force-destroyed even if it has active connections. Force destroy may not actually be used if not necessary.

Use of `allow_force_destroy` is potentially dangerous and should be avoided if at all possible. Note that changing it to `true` first requires applying the plan, so it is updated on the resource.

```terraform
resource "juju_offer" "percona-cluster" {
  model_uuid       = juju_model.development.uuid
  application_name = juju_application.percona-cluster.name
  endpoints         = ["server"]
  allow_force_destroy = true

  timeouts {
    create = "2m"
    delete = "10m"
  }
}
```

> See more: [`juju_offer` (resource)](https://documentation.ubuntu.com/terraform-provider-juju/latest/reference/terraform-provider/resources/offer.md)

<a id="integrate-with-an-offer"></a>

## Integrate with an offer

### Integrate with an offer from the same controller

> Who: User with [offer consume access](https://canonical.com/juju/docs/juju-cli/latest/reference/user/#user-access-offer-consume).

To integrate with an offer coming from the same controller, in your Terraform plan create a `juju_integration` resource as usual by specifying two application blocks and a `lifecycle > replace_triggered_by` block, but for the application representing the offer specify the `offer_url`, and in the `lifecycle` block list triggers only for the regular application (not the offer). For example:

```terraform
resource "juju_integration" "wordpress-db" {
  model = juju_model.development-destination.name

  application {
    name     = juju_application.wordpress.name
    endpoint = "db"
  }

  application {
    offer_url = juju_offer.this.url
  }

  lifecycle {
    replace_triggered_by = [
      juju_application.wordpress.name,
      juju_application.wordpress.model,
      juju_application.wordpress.constraints,
      juju_application.wordpress.placement,
      juju_application.wordpress.charm.name,
    ]
  }

}

```

> See more: [`juju_integration` (resource)](https://documentation.ubuntu.com/terraform-provider-juju/latest/reference/terraform-provider/resources/integration.md)

<a id="integrate-with-an-offer-from-a-different-controller"></a>

### Integrate with an offer from a different controller

The Juju Terraform provider is configured to connect to a single controller; however we support the consuming of cross controller offers.
To integrate with an offer coming from a different controller:

- In the `provider` definition specify the `offering_controllers` block.
- In the `juju_integration` resource, in the definition of the application representing the offer, specify the `offer_url` and the `offering_controller`. In the `lifecycle > replace_triggered_by_block` only include triggers for the regular application (not the offer).

For example:

```terraform
locals {
  external_controller_name = "my-controller"
}
provider "juju" {
  offering_controllers = {
    (local.external_controller_name) = {
      controller_addresses = "<ip>"
      username             = "<username>"
      password             = "<password>"
      ca_certificate       = file("<ca-cer-path>")
    }
  }
}
resource "juju_model" "model" {
  name = "test"
}
resource "juju_application" "juju-qa-dummy-sink" {
  name  = "juju-qa-dummy-sink"
  trust = true
  charm {
    name = "juju-qa-dummy-sink"
  }
  model_uuid = juju_model.model.uuid
}
resource "juju_integration" "sink-source" {
  application {
    offering_controller = local.external_controller_name
    offer_url           = "admin/offering-model.dummy-source"
  }
  application {
    name     = juju_application.juju-qa-dummy-sink.name
    endpoint = "source"
  }
  model_uuid = juju_model.model.uuid
}

  lifecycle {
    replace_triggered_by = [
      juju_application.juju-qa-dummy-sink.name,
      juju_application.juju-qa-dummy-sink.model,
      juju_application.juju-qa-dummy-sink.constraints,
      juju_application.juju-qa-dummy-sink.placement,
      juju_application.juju-qa-dummy-sink.charm.name,
    ]
  }
```

## Allow traffic from an integrated offer

> Who: User with [offer admin access](https://canonical.com/juju/docs/juju-cli/latest/reference/user/#user-access-offer-admin).

To allow traffic from an integrated offer, in your Terraform plan, in the resource definition where you define the integration with an offer, use the `via` attribute to specify the list of CIDRs for outbound traffic. For example:

```terraform
resource "juju_integration" "this" {
...
  via   = "10.0.0.0/24,10.0.1.0/24"

# the rest of your integration definition

}

```

> See more: [`juju_integration` > `via`](https://documentation.ubuntu.com/terraform-provider-juju/latest/reference/terraform-provider/resources/integration.md)

<a id="manage-access-to-an-offer"></a>

## Manage access to an offer

Your offer access management options depend on whether the controller you are applying the Terraform plan to is a regular Juju controller or rather a a Juju controller connected to JIMM – for the former you can grant access only to a user, but for the latter you can grant access to a user, a service account, a role, or a group.

### For a regular Juju controller

To grant one or more users access to an offer, in your Terraform plan add a `juju_access_offer` resource. You must specify the offer URL and setting the Juju access level to the list of users you want to grant that level. For example:

```terraform
resource "juju_access_offer" "this" {
  offer_url = juju_offer.my_application_offer.url
  consume   = [juju_user.dev.name]
}
```

> See more: [`juju_access_offer`](https://documentation.ubuntu.com/terraform-provider-juju/latest/reference/terraform-provider/resources/access_offer.md), [Juju | Offer access levels](https://documentation.ubuntu.com/juju/3.6/reference/user/#valid-access-levels-for-application-offers)

### For a Juju controller added to JIMM

To grant one or more users, service accounts, roles, and/or groups access to a model, in your Terraform plan add a resource type `juju_jaas_access_offer`. You must specify the offer URL, the JAAS offer access level, and the desired list desired users, service accounts, roles, and/or groups. For example:

```terraform
resource "juju_jaas_access_offer" "development" {
  offer_url        = juju_offer.myoffer.url
  access           = "consumer"
  users            = ["foo@domain.com"]
  service_accounts = ["Client-ID-1", "Client-ID-2"]
  roles            = [juju_jaas_role.development.uuid]
  groups           = [juju_jaas_group.development.uuid]
}
```

> See more: [`juju_jaas_access_offer`](https://documentation.ubuntu.com/terraform-provider-juju/latest/reference/terraform-provider/resources/jaas_access_offer.md), [JAAS | Offer access levels](https://canonical.com/juju/docs/jaas/v3/reference/offer/#list-of-offer-permissions)

## Remove an offer

> Who: User with [offer admin access](https://canonical.com/juju/docs/juju-cli/latest/reference/user/#user-access-offer-admin).

To remove an offer, in your Terraform plan, remove its resource definition.

> See more: [`juju_offer`](https://documentation.ubuntu.com/terraform-provider-juju/latest/reference/terraform-provider/resources/offer.md)