The Service Binding Operator consists of a controller and an accompanying custom resource definition (CRD) for service binding. It manages the data plane for workloads and backing services. The Service Binding Controller reads the data made available by the control plane of backing services. Then, it projects this data to workloads according to the rules specified through the ServiceBinding resource.
With Service Binding Operator, you can:
Bind your workloads together with Operator-managed backing services.
Automate configuration of binding data.
Provide service operators a low-touch administrative experience to provision and manage access to services.
Enrich development lifecycle with a consistent and declarative service binding method that eliminates discrepancies in cluster environments.
Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see Red Hat CTO Chris Wright’s message.
Service Binding Operator is now available on OpenShift Container Platform 4.7, 4.8 and 4.9.
Service Binding Operator 1.0.1 supports OpenShift Container Platform 4.9 and later running on:
IBM Power Systems
IBM Z and LinuxONE
The custom resource definition (CRD) of the Service Binding Operator 1.0.1 supports the following APIs:
Service Binding with the binding.operators.coreos.com API group.
Service Binding (Spec API Tech Preview) with the servicebinding.io API group.
|
Service Binding (Spec API Tech Preview) with the For more information about the support scope of Red Hat Technology Preview features, see https://access.redhat.com/support/offerings/techpreview/. |
Some features in this release are currently in Technology Preview. These experimental features are not intended for production use.
In the table below, features are marked with the following statuses:
TP: Technology Preview
GA: General Availability
Note the following scope of support on the Red Hat Customer Portal for these features:
| Feature | Service Binding Operator 1.0.1 |
|---|---|
|
GA |
|
TP |
Before this update, binding the data values from a Cluster custom resource (CR) of the postgresql.k8s.enterpriesedb.io/v1 API collected the host binding value from the .metadata.name field of the CR. The collected binding value is an incorrect hostname and the correct hostname is available at the .status.writeService field. With this update, the annotations that the Service Binding Operator uses to expose the binding data values from the backing service CR are now modified to collect the host binding value from the .status.writeService field. The Service Binding Operator uses these modified annotations to project the correct hostname in the host and provider bindings. APPSVC-1040
Before this update, when you would bind a PostgresCluster CR of the postgres-operator.crunchydata.com/v1beta1 API, the binding data values did not include the values for the database certificates. As a result, the application failed to connect to the database. With this update, modifications to the annotations that the Service Binding Operator uses to expose the binding data from the backing service CR now include the database certificates. The Service Binding Operator uses these modified annotations to project the correct ca.crt, tls.crt, and tls.key certificate files. APPSVC-1045
Before this update, when you would bind a PerconaXtraDBCluster custom resource (CR) of the pxc.percona.com API, the binding data values did not include the port and database values. These binding values along with the others already projected are necessary for an application to successfully connect to the database service. With this update, the annotations that the Service Binding Operator uses to expose the binding data values from the backing service CR are now modified to project the additional port and database binding values. The Service Binding Operator uses these modified annotations to project the complete set of binding values that the application can use to successfully connect to the database service. APPSVC-1073
Currently, when you install the Service Binding Operator in the single namespace installation mode, the absence of an appropriate namespace-scoped role-based access control (RBAC) rule prevents the successful binding of an application to a few known Operator-backed services that the Service Binding Operator can automatically detect and bind to. In addition, the following error message is generated:
`postgresclusters.postgres-operator.crunchydata.com "hippo" is forbidden:
User "system:serviceaccount:my-petclinic:service-binding-operator" cannot
get resource "postgresclusters" in API group "postgres-operator.crunchydata.com"
in the namespace "my-petclinic"`
Workaround 1: Install the Service Binding Operator in the all namespaces installation mode. As a result, the appropriate cluster-scoped RBAC rule now exists and the binding succeeds.
Workaround 2: If you cannot install the Service Binding Operator in the all namespaces installation mode, install the following role binding into the namespace where the Service Binding Operator is installed:
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: service-binding-crunchy-postgres-viewer
subjects:
- kind: ServiceAccount
name: service-binding-operator
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: service-binding-crunchy-postgres-viewer-roleService Binding Operator is now available on OpenShift Container Platform 4.7, 4.8 and 4.9.
The custom resource definition (CRD) of the Service Binding Operator 1.0 supports the following APIs:
Service Binding with the binding.operators.coreos.com API group.
Service Binding (Spec API Tech Preview) with the servicebinding.io API group.
|
Service Binding (Spec API Tech Preview) with the For more information about the support scope of Red Hat Technology Preview features, see https://access.redhat.com/support/offerings/techpreview/. |
Some features in this release are currently in Technology Preview. These experimental features are not intended for production use.
In the table below, features are marked with the following statuses:
TP: Technology Preview
GA: General Availability
Note the following scope of support on the Red Hat Customer Portal for these features:
| Feature | Service Binding Operator 1.0 |
|---|---|
|
GA |
|
TP |
Service Binding Operator 1.0 supports OpenShift Container Platform 4.9 and later running on:
IBM Power Systems
IBM Z and LinuxONE
This section highlights what is new in Service Binding Operator 1.0:
Exposal of binding data from services
Based on annotations present in CRD, custom resources (CRs), or resources.
Based on descriptors present in Operator Lifecycle Manager (OLM) descriptors.
Support for provisioned services
Workload projection
Projection of binding data as files, with volume mounts.
Projection of binding data as environment variables.
Service Binding Options
Bind backing services in a namespace that is different from the workload namespace.
Project binding data into the specific container workloads.
Auto-detection of the binding data from resources owned by the backing service CR.
Compose custom binding data from the exposed binding data.
Support for non-PodSpec compliant workload resources.
Security
Support for role-based access control (RBAC).