This release fixes CVE-2023-44487 and CVE-2023-39325.

What's Changed

• cherry-pick(release-v1.4.x): add cherry pick action for v1.4.x release branch by @service-binding-operator-bot in #1484
• cherry-pick(release-v1.4.x): Bump vulture from 2.8 to 2.9 in /hack/check-python by @service-binding-operator-bot in #1485
• cherry-pick(release-v1.4.x): Bump securego/gosec from 2.16.0 to 2.17.0 by @service-binding-operator-bot in #1486
• cherry-pick(release-v1.4.x): ci: run security checks on push to branch by @service-binding-operator-bot in #1487
• cherry-pick(release-v1.4.x): test: retry app creation on failure by @service-binding-operator-bot in #1489
• cherry-pick(release-v1.4.x): ci: cleanup security checks by @service-binding-operator-bot in #1497
• cherry-pick(release-v1.4.x): Bump vulture from 2.9 to 2.9.1 in /hack/check-python by @service-binding-operator-bot in #1502
• V1.4.1 rollup by @sadlerap in #1515
• cherry-pick(release-v1.4.x): Bump securego/gosec from 2.18.1 to 2.18.2 by @service-binding-operator-bot in #1522
• cherry-pick(release-v1.4.x): Bump github.com/go-logr/logr from 1.2.4 to 1.3.0 by @service-binding-operator-bot in #1524
• cherry-pick(release-v1.4.x): Bump github.com/operator-framework/api from 0.17.7 to 0.18.0 by @service-binding-operator-bot in #1523
• cherry-pick(release-v1.4.x): Bump github.com/onsi/gomega from 1.28.1 to 1.29.0 by @service-binding-operator-bot in #1525
• cherry-pick(release-v1.4.x): bump version to v1.4.1 by @service-binding-operator-bot in #1521

Full Changelog: v1.4.0...v1.4.1

Service Binding Operator v1.4.0

The Service Binding Operator team is pleased to announce the release of Service Binding Operator v1.4.0. A summary of changes:

• A lot of dependency updates
• Support for go v1.20
• Fixes for acceptance tests

A full list of changes can be found at the end of the release notes for this release.

⚠️ Deprecation notice ⚠️

In a future release, we are planning on deprecating support for ServiceBinding.binding.operators.coreos.com resources, with an eventual removal in the v2.x release series. We are not deprecating them for the v1.4.x series, however - they will remain fully supported for the lifecycle of this release series.

What's Changed

• Update chart with sbo 1.1.1 app version by @Kartikey-star in #1177
• Ignore security warnings without known fixes by @pmacik in #1178
• Change quay.io/redhat-developer/servicebinding-operator:index image to file-based catalog by @pmacik in #1179
• Enable annotations mapping to be optional by @baijum in #1161
• Update sample apps by @yselkowitz in #1181
• Update version of PerconaXtraDBCluster and collect kube resources for OpenShift CI jobs by @pmacik in #1186
• Add negative scenario for Provisioned Service referencing non-existing secret by @pmacik in #1188
• Do not skip acceptance tests if the main Dockerfile is changed. by @pmacik in #1168
• fix(ci): collect kube resources and split acceptance testing jobs by @pmacik in #1189
• Update minikube version to v1.26.0 and revert OLM version for install.sh to 0.18.1 by @pmacik in #1190
• Extend the acceptance testing framework to support installing operator with both manual and automatic subscriptions by @pmacik in #1193
• Add docs to set permissions due to Kubernetes bug by @baijum in #1191
• Correct asciidoc syntax for link by @baijum in #1196
• Tweak golangci-lint to avoid out-of-memory in Github Actions by @pmacik in #1198
• Support spec v1beta1 resources by @sadlerap in #1176
• Update DCO to align with redhat-developer organization guidelines. by @pmacik in #1200
• Fix hidden dependency between scenarios in acceptance tests by @pmacik in #1199
• Tweak security vulnerabilities by @pmacik in #1184
• Upgrade cert-manager release to v1.9.1 by @sadlerap in #1203
• Update Crunchy postgres operator version to v5.1.2 by @pmacik in #1204
• Document rebind behavior by @baijum in #1197
• Use fewer pod replicas in testing deployments by @sadlerap in #1207
• Upgrade Go to 1.17 and Operator SDK to 1.17.0 by @baijum in #1205
• Expose binding secret without requiring a workload by @sadlerap in #1206
• Delete namespace after every scenario by @shruthihub in #1192
• Enable PR checks on release branches by @pmacik in #1209
• Add merge-to-release-branch GH workflow by @pmacik in #1208
• Bump Version 1.2.0 by @fbm3307 in #1212
• Document labels used for issues by @baijum in #1195
• Update operator manifests with spec v1beta1 resources by @pmacik in #1215
• docs: difference between coreos & spec API by @sadlerap in #1220
• CVE-2022-27664 fix to go binary by @Kartikey-star in #1224
• Update chart directory with service binding operator 1.2.0 by @Kartikey-star in #1222
• Disable TLS verification for acceptance test setup by @pmacik in #1228
• Fix result collecting script in performance test by @pmacik in #1230
• Ignore non-served crds in the crd controller by @sadlerap in #1229
• Bump vesion to 1.2.1 (#1236) by @baijum in #1237
• Add hack scripts for smoke-performance testing by @pmacik in #1242
• Fix RHOAS operator installation and CSV headers for performance test by @pmacik in #1233
• Tag OLM Descriptor related tests by @olm-descriptor tag by @pmacik in #1245
• Fix typos in documentation by @filariow in #1248
• Add filariow as an owner by @sadlerap in #1249
• Ensure only desired install plan is approved in acceptance tests by @pmacik in #1250
• disable olm descriptor support by @sadlerap in #1251
• Bump version to v1.3.0 by @pmacik in #1255
• update chart with service binding operator 1.3.0 by @Kartikey-star in #1258
• Fix or temporarily disable tests for supported operators that does not currently work with OCP 4.12 by @pmacik in #1262
• Remove duplicate scenario by @pmacik in #1260
• Add GH workflows for cherry-picking PRs to release branches by @pmacik in #1217
• remove shruthihub as an owner by @sadlerap in #1273
• Compare various KPIs to the threshold values and fail if any is crossed by @pmacik in #1271
• Bump version of Go to v1.18 and fix CVE-2022-32149 by @pmacik in #1275
• Revert "Bump version of Go to v1.18 and fix CVE-2022-32149" by @pmacik in #1278
• Fix CVE-2022-32149 by @pmacik in #1279
• Bump version to v1.3.1 by @pmacik in #1282
• Stop using deprecated features in GH actions by @pmacik in #1274
• Add install-tools and local-env rules to Makefiles by @filariow in #1280
• Fix Percona MongoDB operator support by @pmacik in #1284
• Fix deploy/uninstall rule by @filariow in #1293
• bump SBO helm chart to v1.3.1 by @sadlerap in #1292
• Update versions of dependencies by @baijum in #1297
• Fix resource samples in CSV by @pmacik in #1294
• Remove v1beta1 CRD by @baijum in #1300
• Rebind workloads when their mappings change by @sadlerap in #1296
• Bump version of Go to v1.18 by @pmacik in #1302
• Detect bindable resource based on status attribute by @baijum in #1270
• Test upgrade SBO with OLM by @pmacik in #1221
• docs: Align docs branches to release branches by @pmacik in #1307
• Add hack script for creating release branches from master by @pmac...

What's Changed

• cherry-pick(release-v1.3.x): Bump version to v1.3.3 for helm chart by @service-binding-operator-bot in #1365
• cherry-pick(release-v1.3.x): #1331, #1335 and #1363 for latest changes in the performance test by @pmacik in #1372
• cherry-pick(release-v1.3.x): Create cluster-wide resources only once in performance test (#1308) by @pmacik in #1373
• cherry-pick(release-v1.3.x): Disable scenarios not supported for OCP v4.12 also for OCP v4.13 by @service-binding-operator-bot in #1375
• cherry-pick(release-v1.3.x): Fixed the type of execution_timestamp by @service-binding-operator-bot in #1377
• cherry-pick(release-v1.3.x): Bump opensearch-py to v2.1.1 by @service-binding-operator-bot in #1379
• fix(release-v1.3.x): Fix CVE-2022-28948 by @pmacik in #1386
• cherry-pick(release-v1.3.x): Bump golang.org/x/net from 0.0.0-20220906165146-f3363e06e74c to 0.7.0 in /test/_projects/api-controller by @service-binding-operator-bot in #1405
• cherry-pick(release-v1.3.x): Bump golang.org/x/net from 0.0.0-20220906165146-f3363e06e74c to 0.7.0 in /test/_projects/api-client by @service-binding-operator-bot in #1406
• fix CVE-2022-41723 (release v1.3.x) by @sadlerap in #1404
• cherry-pick(release-v1.3.x): Bump pyyaml from 5.4 to 6.0 in /test/acceptance/features by @service-binding-operator-bot in #1414
• cherry-pick(release-v1.3.x): bump to version v1.3.4 by @service-binding-operator-bot in #1392

Full Changelog: v1.3.3...v1.3.4

What's Changed

• cherry-pick(release-v1.3.x): bump version to v1.3.2 for helm chart by @service-binding-operator-bot in #1322
• cherry-pick(release-v1.3.x): Add displayName and description to older versions of owned CRDs in CSV by @service-binding-operator-bot in #1324
• cherry-pick(release-v1.3.x): Update Crunchy Postgres Operator to v5.3.0 in acceptance tests by @service-binding-operator-bot in #1333
• cherry-pick(release-v1.3.x): Test upgrade SBO with OLM by @pmacik in #1359
• cherry-pick(release-v1.3.x): Remove v1beta1 CRD by @pmacik in #1358
• cherry-pick(release-v1.3.x): Detect bindable resource based on status attribute by @pmacik in #1357
• cherry-pick(release-v1.3.x): Bump version to v1.3.3 by @service-binding-operator-bot in #1362

Full Changelog: v1.3.2...v1.3.3

Installing Service Binding Operator

Check OperatorHub page for installation instructions.

Alternatively, you can install the operator by applying the published release.yaml file. If not installed through OLM, the operator requires that cert-manager is available on the cluster. It can be installed by:

kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.9.1/cert-manager.yaml

after that install the operator:

kubectl apply -f https://github.com/redhat-developer/service-binding-operator/releases/download/v1.3.3/release.yaml

The operator will be deployed in service-binding-operator namespace.

What's Changed

• cherry-pick(release-v1.3.x): Stop using deprecated features in GH actions by @service-binding-operator-bot in #1285
• cherry-pick(release-v1.3.x): Fix Percona MongoDB operator support by @service-binding-operator-bot in #1290
• cherry-pick(release-v1.3.x): Add install-tools and local-env rules to Makefiles by @service-binding-operator-bot in #1288
• cherry-pick(release-v1.3.x): bump SBO helm chart to v1.3.1 by @service-binding-operator-bot in #1295
• cherry-pick(release-v1.3.x): Update versions of dependencies by @service-binding-operator-bot in #1298
• cherry-pick(release-v1.3.x): Fix resource samples in CSV by @service-binding-operator-bot in #1299
• cherry-pick(release-v1.3.x): remove shruthihub as an owner by @pmacik in #1306
• cherry-pick(release-v1.3.x): Use community version of Percona MongoDB Operator in acceptance tests by @pmacik in #1312
• fix(release-v1.3.x): Fix CVE-2022-41717 by @pmacik in #1316
• cherry-pick(release-v1.3.x): Include UNKNOWN severity in the security vulnerability check by @service-binding-operator-bot in #1318
• cherry-pick(release-v1.3.x): Bump version to v1.3.2 by @service-binding-operator-bot in #1320

Full Changelog: v1.3.1...v1.3.2

Installing Service Binding Operator

Check OperatorHub page for installation instructions.

Alternatively, you can install the operator by applying the published release.yaml file. If not installed through OLM, the operator requires that cert-manager is available on the cluster. It can be installed by:

kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.9.1/cert-manager.yaml

after that install the operator:

kubectl apply -f https://github.com/redhat-developer/service-binding-operator/releases/download/v1.3.2/release.yaml

The operator will be deployed in service-binding-operator namespace.

What's Changed

• cherry-pick(release-v1.3.x): update chart with 1.3.0 by @pmacik in #1261
• cherry-pick(release-v1.3.x): Fix or temporarily disable tests for supported operators that does not currently work with OCP 4.12 by @pmacik in #1264
• cherry-pick(release-v1.3.x): Remove duplicate scenario by @pmacik in #1265
• cherry-pick(release-v1.3.x): Add GH workflows for cherry-picking PRs to release branches by @service-binding-operator-bot in #1268
• cherry-pick(release-v1.3.x): Compare various KPIs to the threshold values and fail if any is crossed by @service-binding-operator-bot in #1276
• cherry-pick(release-v1.3.x): Fix CVE-2022-32149 by @service-binding-operator-bot in #1281
• cherry-pick(release-v1.3.x): Bump version to v1.3.1 by @service-binding-operator-bot in #1283
• cherry-pick(release-v1.3.x): Stop using deprecated features in GH actions by @service-binding-operator-bot in #1285
• cherry-pick(release-v1.3.x): Fix Percona MongoDB operator support by @service-binding-operator-bot in #1290
• cherry-pick(release-v1.3.x): Add install-tools and local-env rules to Makefiles by @service-binding-operator-bot in #1288
• cherry-pick(release-v1.3.x): bump SBO helm chart to v1.3.1 by @service-binding-operator-bot in #1295

Full Changelog: v1.3.0...v1.3.1-rc1

What's Changed

• cherry-pick(release-v1.3.x): update chart with 1.3.0 by @pmacik in #1261
• cherry-pick(release-v1.3.x): Fix or temporarily disable tests for supported operators that does not currently work with OCP 4.12 by @pmacik in #1264
• cherry-pick(release-v1.3.x): Remove duplicate scenario by @pmacik in #1265
• cherry-pick(release-v1.3.x): Add GH workflows for cherry-picking PRs to release branches by @service-binding-operator-bot in #1268
• cherry-pick(release-v1.3.x): Compare various KPIs to the threshold values and fail if any is crossed by @service-binding-operator-bot in #1276
• cherry-pick(release-v1.3.x): Fix CVE-2022-32149 by @service-binding-operator-bot in #1281
• cherry-pick(release-v1.3.x): Bump version to v1.3.1 by @service-binding-operator-bot in #1283
• cherry-pick(release-v1.3.x): Stop using deprecated features in GH actions by @service-binding-operator-bot in #1285
• cherry-pick(release-v1.3.x): Fix Percona MongoDB operator support by @service-binding-operator-bot in #1290
• cherry-pick(release-v1.3.x): Add install-tools and local-env rules to Makefiles by @service-binding-operator-bot in #1288
• cherry-pick(release-v1.3.x): bump SBO helm chart to v1.3.1 by @service-binding-operator-bot in #1295

Full Changelog: v1.3.0...v1.3.1-rc1

What's Changed

• cherry-pick(release-v1.3.x): update chart with 1.3.0 by @pmacik in #1261
• cherry-pick(release-v1.3.x): Fix or temporarily disable tests for supported operators that does not currently work with OCP 4.12 by @pmacik in #1264
• cherry-pick(release-v1.3.x): Remove duplicate scenario by @pmacik in #1265
• cherry-pick(release-v1.3.x): Add GH workflows for cherry-picking PRs to release branches by @service-binding-operator-bot in #1268
• cherry-pick(release-v1.3.x): Compare various KPIs to the threshold values and fail if any is crossed by @service-binding-operator-bot in #1276
• cherry-pick(release-v1.3.x): Fix CVE-2022-32149 by @service-binding-operator-bot in #1281
• cherry-pick(release-v1.3.x): Bump version to v1.3.1 by @service-binding-operator-bot in #1283

Full Changelog: v1.3.0...v1.3.1

What's Changed

• cherry-pick(release-v1.3.x): update chart with 1.3.0 by @pmacik in #1261
• cherry-pick(release-v1.3.x): Fix or temporarily disable tests for supported operators that does not currently work with OCP 4.12 by @pmacik in #1264
• cherry-pick(release-v1.3.x): Remove duplicate scenario by @pmacik in #1265
• cherry-pick(release-v1.3.x): Add GH workflows for cherry-picking PRs to release branches by @service-binding-operator-bot in #1268
• cherry-pick(release-v1.3.x): Compare various KPIs to the threshold values and fail if any is crossed by @service-binding-operator-bot in #1276
• cherry-pick(release-v1.3.x): Fix CVE-2022-32149 by @service-binding-operator-bot in #1281
• cherry-pick(release-v1.3.x): Bump version to v1.3.1 by @service-binding-operator-bot in #1283

Full Changelog: v1.3.0...v1.3.1-rc2

⚠️ OLM descriptors support removed

There has been no indication that OLM descriptors are being used as a source of binding data. In order to simplify SBO and to greatly improve resource utilization, OLM descriptors will no longer be supported. Users making use of OLM descriptors should move to CRD annotations as an upgrade path.

What's Changed

• Document labels used for issues by @baijum in #1195
• Update operator manifests with spec v1beta1 resources by @pmacik in #1215
• docs: difference between coreos & spec API by @sadlerap in #1220
• CVE-2022-27664 fix to go binary by @Kartikey-star in #1224
• Update chart directory with service binding operator 1.2.0 by @Kartikey-star in #1222
• Disable TLS verification for acceptance test setup by @pmacik in #1228
• Fix result collecting script in performance test by @pmacik in #1230
• Ignore non-served crds in the crd controller by @sadlerap in #1229
• Bump vesion to 1.2.1 (#1236) by @baijum in #1237
• Add hack scripts for smoke-performance testing by @pmacik in #1242
• Fix RHOAS operator installation and CSV headers for performance test by @pmacik in #1233
• Tag OLM Descriptor related tests by @olm-descriptor tag by @pmacik in #1245
• Fix typos in documentation by @filariow in #1248
• Add filariow as an owner by @sadlerap in #1249
• cherry-pick(release-v1.3.x): Ensure the desired install plan is approved in acceptance tests by @pmacik in #1253
• cherry-pick(release-v1.3.x): disable olm descriptor support @sadlerap in #1251
• cherry-pick(release-v1.3.x): Bump version to v1.3.0 by @pmacik in #1257

New Contributors

• @filariow made their first contribution in #1248

Full Changelog: v1.2.0...v1.3.0

Installing Service Binding Operator

Check OperatorHub page for installation instructions.

Alternatively, you can install the operator by applying the published release.yaml file. If not installed through OLM, the operator requires that cert-manager is available on the cluster. It can be installed by:

kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.6.0/cert-manager.yaml
after that install the operator:

kubectl apply -f https://github.com/redhat-developer/service-binding-operator/releases/download/v1.3.0/release.yaml
The operator will be deployed in service-binding-operator namespace.

What's Changed

• Update chart with sbo 1.1.1 app version by @Kartikey-star in #1177
• Ignore security warnings without known fixes by @pmacik in #1178
• Change quay.io/redhat-developer/servicebinding-operator:index image to file-based catalog by @pmacik in #1179
• Enable annotations mapping to be optional by @baijum in #1161
• Update sample apps by @yselkowitz in #1181
• Update version of PerconaXtraDBCluster and collect kube resources for OpenShift CI jobs by @pmacik in #1186
• Add negative scenario for Provisioned Service referencing non-existing secret by @pmacik in #1188
• Do not skip acceptance tests if the main Dockerfile is changed. by @pmacik in #1168
• fix(ci): collect kube resources and split acceptance testing jobs by @pmacik in #1189
• Update minikube version to v1.26.0 and revert OLM version for install.sh to 0.18.1 by @pmacik in #1190
• Extend the acceptance testing framework to support installing operator with both manual and automatic subscriptions by @pmacik in #1193
• Add docs to set permissions due to Kubernetes bug by @baijum in #1191
• Correct asciidoc syntax for link by @baijum in #1196
• Tweak golangci-lint to avoid out-of-memory in Github Actions by @pmacik in #1198
• Support spec v1beta1 resources by @sadlerap in #1176
• Update DCO to align with redhat-developer organization guidelines. by @pmacik in #1200
• Fix hidden dependency between scenarios in acceptance tests by @pmacik in #1199
• Tweak security vulnerabilities by @pmacik in #1184
• Upgrade cert-manager release to v1.9.1 by @sadlerap in #1203
• Update Crunchy postgres operator version to v5.1.2 by @pmacik in #1204
• Document rebind behavior by @baijum in #1197
• Use fewer pod replicas in testing deployments by @sadlerap in #1207
• Upgrade Go to 1.17 and Operator SDK to 1.17.0 by @baijum in #1205
• Expose binding secret without requiring a workload by @sadlerap in #1206
• Delete namespace after every scenario by @shruthihub in #1192
• Enable PR checks on release branches by @pmacik in #1209
• Add merge-to-release-branch GH workflow by @pmacik in #1208
• cherry-pick(release-v1.2.x): Bump Version 1.2.0 by @fbm3307 in #1214
• docs: difference between coreos & spec API by @sadlerap in #1219
• cherry-pick(release-v1.2.x): Update operator manifests with spec v1beta1 by @pmacik in #1216

Full Changelog: v1.1.1...v1.2.0

Installing Service Binding Operator

Check OperatorHub page for installation instructions.

Alternatively, you can install the operator by applying the published release.yaml file. If not installed through OLM, the operator requires that cert-manager is available on the cluster. It can be installed by:

kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.6.0/cert-manager.yaml
after that install the operator:

kubectl apply -f https://github.com/redhat-developer/service-binding-operator/releases/download/v1.2.0/release.yaml
The operator will be deployed in service-binding-operator namespace.