Call for testing: The Juju Terraform provider v2.2.0-rc1

announcements and community
1

JujuTF 2.2.0-rc1 release notes

21 July 2026

:puzzle_piece: Requirements and compatibility

  • This release requires a Juju controller of version 3 or higher. Support for Juju 2.9 controllers was dropped in the v2 track and remains unavailable here; 2.9 continues to be supported on the v1 track for security updates and bug fixes.
  • If you are using JAAS, this release requires a Juju controller of version 3.6.5 or higher.
  • This release builds against the Juju client API code from the Juju 4.0.12 release, and is compatible with both Juju 3 and Juju 4 controllers.

:rocket: New features

Juju actions support

The headline feature of this release is first-class support for Juju actions. Charms expose actions — operational tasks such as backing up a database, rotating credentials, or fetching connection endpoints — and until now running them meant stepping outside of Terraform to the Juju CLI. This release brings actions into your Terraform plan, so operational steps can be declared, ordered, and their results consumed like any other piece of infrastructure.

  • juju_action resource — run an action on an application (or a specific unit, including the <application>/leader form) as part of terraform apply. The action is enqueued and its result awaited during the resource’s creation, and the action’s output is exposed as a computed field that downstream resources can reference. Action arguments can be passed via args.

    resource "juju_action" "action" {
  model_uuid       = juju_model.development.uuid
  application_name = juju_application.traefik.name
  action_name      = "show-proxied-endpoints"
}

# The action output can be used by other resources. For example, to
# fetch a nested value from a JSON string result:
locals {
  application_proxied_url = jsondecode(juju_action.action.output.proxied-endpoints)[juju_application.traefik.name].url
}

  • juju_action data source — fetch the result of an action by its ID. This allows actions to be run outside of Terraform (for example, from the Juju CLI or by another plan) and their results consumed by other resources.

    data "juju_action" "action" {
  model_uuid = juju_model.development.uuid
  action_id  = juju_action.action.action_id
}

  • unit_numbers exposed on juju_application — the application resource now exposes the numbers of its deployed units, making it possible to fan an action out across every unit of an application.

See the new How to manage actions guide for the full workflow (Add actions documentation by @SimoneDutto in #1309).

Controller and model upgrades

Juju upgrades can now be driven from Terraform:

  • Controller patch upgrades — the juju_controller resource now supports in-place patch upgrades by changing its agent_version.

    • Allow controller patch upgrades by @kian99 in #1240.

  • Model upgrades — the juju_model resource gains an agent_version field that tracks the model’s agent version; updating it (after the controller has been upgraded) triggers a model upgrade. Note that agent_version cannot be set at model creation time, and against Juju 4 controllers this feature requires Juju 4.0.12 or later.

    • Add model upgrade support by @kian99 in #1272.
    resource "juju_model" "model" {
  name          = "test-model"
  agent_version = "3.6.24"
}

Secret backend management

  • juju_secret_backend resource — configure an external secret backend (for example, Vault) for your models. The backend configuration is a write-only field (config_wo with a config_wo_version), so sensitive values such as a Vault admin token are never stored in the Terraform state.

    resource "juju_secret_backend" "myvault" {
  name         = "myvault"
  backend_type = "vault"
  config_wo = {
    endpoint = "http://10.0.0.1:8200"
    token    = "myroot"
  }
  config_wo_version = 1
}

resource "juju_model" "dev" {
  name = "dev"
  config = {
    secret-backend = juju_secret_backend.myvault.name
  }
}

Other enhancements

  • Write-only secret values — the juju_secret resource now supports a value_wo field (with a companion value_wo_version), following the Terraform guidance on managing sensitive data, so secret values can be kept out of the Terraform state. Add wo field to secret resource for value by @ale8k in #1284.
  • IdP groups access (JAAS) — the juju_jaas_access_* resources now support the idp_group tag, allowing access to be granted to identity-provider groups. Note that an IdP group cannot be granted membership of a traditional JAAS group. Add IdP groups access by @kian99 in #1275.

:hammer_and_wrench: Bug fixes

  • Credentials and secret values are no longer logged — sensitive information (credentials and secret values) has been removed from provider log output. Stop logging credentials and secret values by @alesstimec in #1254.
  • Fixed Juju CLI output parsing — resolved a regression (introduced by the logging fix above and present in v1.5.5) that broke the provider’s ability to read controller details from the local Juju CLI configuration, failing with Username and password or client id and client secret must be set. Fix CLI output parsing by @kian99 in #1298.

:broom: Maintenance

Full changelog: https://github.com/juju/terraform-provider-juju/compare/v2.1.1...v2.2.0

3 Likes