Service Binding for operator-backed services by sbose78 · Pull Request #12 · operator-framework/enhancements

sbose78 · 2020-03-19T23:28:22Z

Add details about existing work
Advanced configuration
Bill of materials
Permissions
Migration strategy: Bringing a non Operator Framework project into Operator Framework
Roadmap

sbose78 · 2020-03-24T22:46:41Z

@dmesser @ecordell I've made some progress with the proposal with 20% remaining, do you mind taking a look and helping me with early feedback if the format and content of the proposal makes sense? Let me know if there's something explicitly I should be adding.

CC @siamaksade

dmesser · 2020-03-30T10:44:20Z

@sbose78 Thank you. Can you add some information about the following:

the "bill of materials" for the service binding operator itself
how the process of Service Binding factors in RBAC

sbose78 · 2020-04-07T14:49:46Z

Thank you. I am working to define a specification as well ( early stage, needs work ) along with a plan for the first wave of adopters . I'll update this with the new information!

sbose78 · 2020-05-07T14:10:12Z

We made agreements on what the specification could look like https://github.com/application-stacks/service-binding-specification and stabilized it for the time being.

Based on the conversations, I will be updating the proposal and taking it to completion.

sbose78 · 2020-05-08T22:02:18Z

Removed WIP, there are a few additions I'll make along the way, however it is ready for a detailed review now.

Avni-Sharma · 2020-05-09T12:42:34Z

+### Custom Environment variables
+
+
+To make binding applications (e.g., legacy Java applications that depend on JDBC connectioon strings)  together with backing services more flexible, the Service Binding Operator supports the optional use of custom environment variables. To use custom environment variables, an application developer creates a ServiceBindingRequest that looks like the one shown 


ServiceBinding instead of ServiceBindingRequest

Avni-Sharma · 2020-05-09T12:43:30Z

+operator's OLM (Operator Lifecycle Manager) descriptor. The Service Binding
+Operator extracts to bind the application together with the backing service.
+The information may be specified in the "status" and/or "spec" section of the
+OLM in plaintext or as a reference to a secret.


secret or configmap resource

Done, thanks!

Avni-Sharma · 2020-05-11T09:06:24Z

+    kind: Database
+    resourceRef: db-demo
+
+  customEnvVar:


Should this be renamed to dataMapping as well? refer https://issues.redhat.com/browse/APPSVC-538

done, thanks!

dmesser

@sbose78 Thanks for the update. I think we still need a section that discusses the security model of this Operator. How do avoid that a user that normally doesn't have the privileges to read bindable fields can misuse the Service Binding Operator to get those injected into a resource they have access to?

sbose78 · 2020-05-20T17:49:54Z

How do avoid that a user that normally doesn't have the privileges to read bindable fields can misuse the Service Binding Operator to get those injected into a resource they have access to?

I'll add the section, thank you @dmesser !

We'll be doing Subject Access Review checks using a validating webhook - it isn't supported yet, but we have an epic on our backlog https://issues.redhat.com/browse/APPSVC-546

If there's anything that needs to be prioritized to ensure the transition is smooth, we shall prioritize.

shawn-hurley · 2020-05-26T16:08:15Z

Do we want this apart of the default OLM install for upstream install of OLM?

sbose78 · 2020-06-15T15:27:49Z

Do we want this apart of the default OLM install for upstream install of OLM?

@dmesser @siamaksade I'll need you to weigh in on this.

sbose78 · 2020-09-18T19:13:45Z

+  wildcardPolicy: None
+```
+
+A detailed guide to decorating backing services to make them binding friendly has been documented [here](https://github.com/application-stacks/service-binding-specification/blob/master/annotations.md).


This has moved, and will be updated.

sbose78 · 2020-09-18T19:14:17Z

+To make binding applications (e.g., legacy Java applications that depend on JDBC connectioon strings)  together with backing services more flexible, the Service Binding Operator supports the optional use of custom environment variables. To use custom environment variables, an application developer creates a ServiceBinding that looks like the one shown 
+
+```yaml
+apiVersion: service.binding/v1alpha1


We are using operators.coreos.com at the moment.

baijum · 2020-10-29T07:37:02Z

Thank you. I am working to define a specification as well ( early stage, needs work ) along with a plan for the first wave of adopters . I'll update this with the new information!

The specification @sbose78 mentioned has moved here: https://github.com/k8s-service-bindings/spec
Also, Red Hat's Service Binding Operator is no more conforming to the spec. Current the only spec-compliant implementation is from VMWare: https://github.com/vmware-labs/service-bindings
I have a side project which is aiming for core-spec compliance with few extensions: https://github.com/kubepreset/kubepreset (demo)

baijum · 2021-01-12T08:03:11Z

I have a side project which is aiming for core-spec compliance with few extensions: https://github.com/kubepreset/kubepreset (demo)

Update: I stopped working on my side-project for now.

The spec is now part of a Kubernetes SIG:
kubernetes-retired/service-catalog#2857

sspeiche · 2021-01-26T21:32:47Z

+
+The Service Binding Controller enables applications to use external services by automatically collecting and sharing binding information (credentials, connection details, volume mounts, secrets, etc.) with the application. In effect, the Service Binding Operator defines a contract between a “bindable” backing service (for example, a database operator) and an application requiring that backing service.
+
+Note that in addition to the initial sharing of binding information, the binding is also “managed” by the Service Binding Operator. This statement means that, if credentials or URLs undergo modification by the backing service operator, those changes are automatically reflected in the application.


Have we concluded that this should/would be managed by the Service Binding Operator or should be part of OLM? (or enabled by default with OLM?)

Or is the discussion on how it is included in a different enhancement/discussion?

This proposal intends to make a pitch to move Service Binding into the OperatorFramework umbrella. Shipping it with OLM is a related conversation.

bparees · 2021-02-03T20:44:43Z

@sbose78 i am struggling to understand what this is proposing, vs what exists already in SBO + OLM.

It talks about several different apis/annotations for specifying bindings, some generic and some specific to operators. Can you rework this to make it clearer which part is "background info" about how things work today, and which parts are the actual proposed enhancements?

It would also help if it was clearer whether this is proposing changes just in OLM, changes just in SBO, or both.

sbose78 · 2021-02-03T21:19:20Z

Yes, this enhancement proposal needs some maintenance since this was a while ago. I'm on it!

sbose78 · 2021-03-03T03:00:20Z

@bparees I've updated the proposal to reflect the current state of SBO accurately.

bparees

i'm still a bit confused as to why this is an operator-framework EP.

bparees · 2021-03-03T21:35:16Z

+
+The backing service may provide binding information as
+* Metadata in the CRD as annotations
+* Metadata in the OLM bunde manifest file as Descriptors


is this referring to the CSV? (also typo on bundle)

bparees · 2021-03-03T21:42:07Z

+status: proposed
+---
+
+# Service Binding for operator-backed services


very little of this seems specific to operators. it's generically about binding for a variety of resource types.

how much of this represents capabilities the SBO already has?

what does it really have to do with OLM? (at a minimum i'd expect to see examples/discussion of how operators expose bindable information, or bind to information, using the CSV metadata mechanism).

how much of this represents capabilities the SBO already has?

All of it

what does it really have to do with OLM? (at a minimum i'd expect to see examples/discussion of how operators expose bindable information, or bind to information, using the CSV metadata mechanism).

Yes, CSV descriptors are an option. I wanted to cast a wider net with Operators/CRDs in this proposal. Let me add in the pieces for CSV too.

All of it

so what is the enhancement that is being proposed? this reads more like (possibly sorely needed) product docs. Or preamble/background leading up to a proposal but not actually making one.

so what is the enhancement that is being proposed?

A proposal to enhance the Service Binding Operator would be made to the Service Binding Operator project.

This proposal describes what the Service Binding Operator is, with the ultimate goal of making it an Operator Framework project ( ie, a part of it). The latter is what I'm really proposing.

This proposal describes what the Service Binding Operator is, with the ultimate goal of making it an Operator Framework project ( ie, a part of it). The latter is what I'm really proposing.

ok, can you clarify what that would mean? (lift+shift the operator into the operator-framework github org? deprecate the standalone operator and embed the binding logic/behavior into OLM itself? something else?) That seems like the critical piece of the proposal. (But the background is very helpful)

add service binding enhancement

f2c3bd5

openshift-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 19, 2020

sbose78 added 3 commits March 19, 2020 19:28

add service binding enhancement

1c2c08c

add service binding enhancement

e84ec48

add samples

f9326e9

take new spec into account

6bb456d

sbose78 changed the title ~~WIP - Service Binding for operator-backed services~~ Service Binding for operator-backed services May 8, 2020

openshift-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 8, 2020

Avni-Sharma reviewed May 9, 2020

View reviewed changes

fix typos

ba9254f

Avni-Sharma reviewed May 11, 2020

View reviewed changes

Use dataMapping

259374a

dmesser requested changes May 20, 2020

View reviewed changes

sbose78 added 3 commits May 21, 2020 09:38

address security concerns

4bf167b

fix dataMapping

dd787ad

Merge branch 'sbo' of https://github.com/sbose78/enhancements-1 into sbo

afc7794

sbose78 mentioned this pull request May 27, 2020

Change API Group and Kind, and Spec redhat-developer/service-binding-operator#495

Closed

13 tasks

akashshinde mentioned this pull request Aug 18, 2020

Breaking api changes - Refactor ServiceBindingRequest api redhat-developer/service-binding-operator#608

Merged

8 tasks

sbose78 commented Sep 18, 2020

View reviewed changes

arthurdm mentioned this pull request Sep 19, 2020

Proposal to add an alternate service binding implementation redhat-developer/service-binding-operator#674

Closed

sspeiche reviewed Jan 26, 2021

View reviewed changes

update annotations section

58ef07d

remove broken link

e804837

bparees reviewed Mar 3, 2021

View reviewed changes

sbose78 added 3 commits March 3, 2021 23:31

add org & delivery

28f0ed9

clarify summary

2807660

split the org & delivery section

3678edc

		### Custom Environment variables


		To make binding applications (e.g., legacy Java applications that depend on JDBC connectioon strings) together with backing services more flexible, the Service Binding Operator supports the optional use of custom environment variables. To use custom environment variables, an application developer creates a ServiceBindingRequest that looks like the one shown


		The Service Binding Controller enables applications to use external services by automatically collecting and sharing binding information (credentials, connection details, volume mounts, secrets, etc.) with the application. In effect, the Service Binding Operator defines a contract between a “bindable” backing service (for example, a database operator) and an application requiring that backing service.

		Note that in addition to the initial sharing of binding information, the binding is also “managed” by the Service Binding Operator. This statement means that, if credentials or URLs undergo modification by the backing service operator, those changes are automatically reflected in the application.

Uh oh!

Conversation

sbose78 commented Mar 19, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sbose78 commented Mar 24, 2020

Uh oh!

dmesser commented Mar 30, 2020

Uh oh!

sbose78 commented Apr 7, 2020

Uh oh!

sbose78 commented May 7, 2020

Uh oh!

sbose78 commented May 8, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dmesser left a comment

Choose a reason for hiding this comment

Uh oh!

sbose78 commented May 20, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

shawn-hurley commented May 26, 2020

Uh oh!

sbose78 commented Jun 15, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

baijum commented Oct 29, 2020

Uh oh!

baijum commented Jan 12, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bparees commented Feb 3, 2021

Uh oh!

sbose78 commented Feb 3, 2021

Uh oh!

sbose78 commented Mar 3, 2021

Uh oh!

bparees left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sbose78 Mar 3, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

sbose78 commented Mar 19, 2020 •

edited

Loading

sbose78 commented May 8, 2020 •

edited

Loading

sbose78 commented May 20, 2020 •

edited

Loading

sbose78 Mar 3, 2021 •

edited

Loading