After discussing this with David Martin we think the following process should work:

During bind

We want to store the name of the binding secret in our config map because it links back to the serviceBinding object. In order to trigger 'unbind' we need to be able to delete the serviceBinding object. Luckily the name of the binding secret is the same as the pod and we can easily retrieve it in Ansible with

lookup('env','POD_NAME')

Add this to the secret that we create for the sidecar:

...

stringData:

  bindingSecretName: "{{ lookup('env','POD_NAME') }}"

  ...

Then in the sidecar, when the configMap is created, save this field too.

User deletes variant in UPS

1. User deletes a variant in UPS
2. The UPS sidecar runs a loop to check all the configmaps every minute or so
3. For every config map it makes a request to UPS to check if the respective variant still exists.
4. If the variant doesn't exist in UPS anymore then we have to delete the configmap and the binding.
5. Get the name of the binding secret from the config map (bindingSecretName)
6. Get the property 'ownerReferences[0].name' from the binding secret: this contains the name of the serviceBinding object.
7. Delete the service binding object. This will trigger the unbind playbook.
8. Delete the config map.
9. Done.