Skip to content

Reference implementation doesn't unbind workloads when their labels change #345

@sadlerap

Description

@sadlerap

The following manifest should result in a binding being made to the deployment:

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: test-1
    app-custom: foo
  name: test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test-1
  template:
    metadata:
      labels:
        app: test-1
    spec:
      containers:
      - name: test
        image: ghcr.io/servicebinding/conformance/generic-test-app:main
        imagePullPolicy: IfNotPresent
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /env
            port: 8080
            scheme: HTTP
      restartPolicy: Always
---
apiVersion: v1
data:
  password: YmFy
  type: YmF6
  username: Zm9v
kind: Secret
metadata:
  name: test-secret
type: Opaque
---
apiVersion: servicebinding.io/v1beta1
kind: ServiceBinding
metadata:
  name: test-binding
spec:
  service:
    apiVersion: v1
    kind: Secret
    name: test-secret
  workload:
    apiVersion: apps/v1
    kind: Deployment
    selector:
      matchLabels:
        app-custom: foo

This works as expected with the reference implementation - the deployment gets bound as expected. However, if we alter the app-custom label on the deployment after it's been created, the deployment is not unbound:

kubectl label --overwrite deployments.apps test app-custom=bar
kubectl get deployments.apps test -o jsonpath='{.spec.template.spec.volumes}' # should return nothing, but it doesn't

As far as I can tell, the spec isn't clear on what is supposed to happen here, but I think deprojecting the binding from the workload is the behavior we should probably have.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions