chore(gh): trigger helm release on tag

.github/workflows/ci.yaml

@@ -9,30 +9,28 @@ on:
 jobs:
   golangci:
     name: lint
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v2
         with:
-          go-version: '1.22'
-          check-latest: true
+          go-version: '1.18'
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v3.2.0
+        uses: golangci/golangci-lint-action@v2.3.0
         with:
-          version: v1.54.2
+          version: v1.45.2
           only-new-issues: false
           args: --timeout 5m --config .golangci.yml
   diff:
     name: diff
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-18.04
     steps:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v2
         with:
-          go-version: '1.22'
-          check-latest: true
+          go-version: '1.18'
       - run: make yaml-installation-file
       - name: Checking if YAML installer file is not aligned
         run: if [[ $(git diff | wc -l) -gt 0 ]]; then echo ">>> Untracked generated files have not been committed" && git --no-pager diff && exit 1; fi
@@ -40,8 +38,3 @@ jobs:
         run: test -z "$(git ls-files --others --exclude-standard 2> /dev/null)"
       - name: Checking if source code is not formatted
         run: test -z "$(git diff 2> /dev/null)"
-      - run: make apidoc
-      - name: Checking if generated API documentation files are not aligned
-        run: if [[ $(git diff | wc -l) -gt 0 ]]; then echo ">>> Untracked generated files have not been committed" && git --no-pager diff && exit 1; fi
-      - name: Checking if generated API documentation generated untracked files
-        run: test -z "$(git ls-files --others --exclude-standard 2> /dev/null)"

.github/workflows/docker-ci.yml

@@ -4,34 +4,14 @@ on:
   push:
     tags:        
       - "v*"
-      - "edge-*"
 
 jobs:
   docker-ci:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-20.04
     steps:
 
       - name: Checkout
         uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
-
-      - name: Generate build-args
-        id: build-args
-        run: |
-          # Declare vars for internal use
-          VERSION=$(make get_version)
-          GIT_HEAD_COMMIT=$(git rev-parse --short HEAD)
-          GIT_TAG_COMMIT=$(git rev-parse --short $VERSION)
-          GIT_MODIFIED_1=$(git diff $GIT_HEAD_COMMIT $GIT_TAG_COMMIT --quiet && echo "" || echo ".dev")
-          GIT_MODIFIED_2=$(git diff --quiet && echo "" || echo ".dirty")
-          # Export to GH_ENV
-          echo "GIT_LAST_TAG=$VERSION" >> $GITHUB_ENV
-          echo "GIT_HEAD_COMMIT=$GIT_HEAD_COMMIT" >> $GITHUB_ENV
-          echo "GIT_TAG_COMMIT=$GIT_TAG_COMMIT" >> $GITHUB_ENV
-          echo "GIT_MODIFIED=$(echo "$GIT_MODIFIED_1""$GIT_MODIFIED_2")" >> $GITHUB_ENV
-          echo "GIT_REPO=$(git config --get remote.origin.url)" >> $GITHUB_ENV
-          echo "BUILD_DATE=$(git log -1 --format="%at" | xargs -I{} date -d @{} +%Y-%m-%dT%H:%M:%S)" >> $GITHUB_ENV
 
       - name: Docker meta
         id: meta
@@ -88,13 +68,7 @@ jobs:
           platforms: linux/amd64,linux/arm64,linux/arm
           push: true
           tags: ${{ steps.meta.outputs.tags }}
-          build-args: |
-            GIT_LAST_TAG=${{ env.GIT_LAST_TAG }}
-            GIT_HEAD_COMMIT=${{ env.GIT_HEAD_COMMIT }}
-            GIT_TAG_COMMIT=${{ env.GIT_TAG_COMMIT }}
-            GIT_MODIFIED=${{ env.GIT_MODIFIED }}
-            GIT_REPO=${{ env.GIT_REPO }}
-            BUILD_DATE=${{ env.BUILD_DATE }}
+          build-args:
 
       - name: Image digest
         run: echo ${{ steps.build-release.outputs.digest }}

.github/workflows/e2e.yaml

@@ -13,7 +13,6 @@ on:
       - 'main.go'
       - 'Makefile'
       - 'internal/**'
-      - 'cmd/**'
   pull_request:
     branches: [ "*" ]
     paths:
@@ -26,20 +25,18 @@ on:
       - 'main.go'
       - 'Makefile'
       - 'internal/**'
-      - 'cmd/**'
 
 jobs:
   kind:
     name: Kubernetes
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-18.04
     steps:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v2
         with:
-          go-version: '1.22'
-          check-latest: true
+          go-version: '1.18'
       - run: |
           sudo apt-get update
           sudo apt-get install -y golang-cfssl

.github/workflows/helm.yaml

@@ -8,18 +8,8 @@ on:
     branches: [ "*" ]
 
 jobs:
-  diff:
-    name: diff
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
-      - run: make -C charts/kamaji docs
-      - name: Checking if Helm docs is not aligned
-        run: if [[ $(git diff | wc -l) -gt 0 ]]; then echo ">>> Untracked changes have not been committed" && git --no-pager diff && exit 1; fi
   lint:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
       - uses: azure/setup-helm@v1
@@ -29,7 +19,7 @@ jobs:
         run: helm lint ./charts/kamaji
   release:
     if: startsWith(github.ref, 'refs/tags/helm-v')
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
       - name: Publish Helm chart

.gitignore

@@ -24,16 +24,9 @@ bin
 *~
 .vscode
 
-# Tilt files.
-.tiltbuild
-
 **/*.kubeconfig
 **/*.crt
 **/*.key
 **/*.pem
 **/*.csr
 .DS_Store
-
-**/server-csr.json
-!deploy/kine/mysql/server-csr.json
-!deploy/kine/nats/server-csr.json

.golangci.yml

@@ -3,7 +3,7 @@ linters-settings:
     sections:
       - standard
       - default
-      - prefix(github.com/clastix/kamaji/)
+      - prefix(github.com/clastix/kamaji)
   goheader:
     template: |-
       Copyright 2022 Clastix Labs
@@ -11,10 +11,12 @@ linters-settings:
 
 linters:
   disable:
-    - depguard
     - wrapcheck
     - gomnd
     - scopelint
+    - golint
+    - interfacer
+    - maligned
     - varnamelen
     - testpackage
     - tagliatelle
@@ -25,10 +27,6 @@ linters:
     - exhaustivestruct
     - wsl
     - exhaustive
-    - nosprintfhostport
-    - nonamedreturns
-    - interfacebloat
-    - exhaustruct
     - lll
     - gosec
     - gomoddirectives
@@ -36,16 +34,6 @@ linters:
     - gochecknoinits
     - funlen
     - dupl
+    - maintidx
     - cyclop
-    - gocognit
-    - nestif
-    # deprecated linters
-    - deadcode
-    - golint
-    - interfacer
-    - structcheck
-    - varcheck
-    - nosnakecase
-    - ifshort
-    - maligned
   enable-all: true

ADOPTERS.md

@@ -1,28 +0,0 @@
-# Adopters
-
-This is a list of companies that have adopted Kamaji.
-Feel free to open a Pull-Request to get yours listed.
-
-### Adopter list (alphabetically)
-
-| Type | Name | Since | Website | Use-Case |
-|:-|:-|:-|:-|:-|
-| Vendor | DCloud | 2024 | [link](https://dcloud.co.id) | DCloud is an Indonesian Cloud Provider using Kamaji to build and offer [Managed Kubernetes Service](https://dcloud.co.id/dkubes.html). |
-| End-user | Sicuro Tech Lab | 2024 | [link](https://sicurotechlab.it/) | Sicuro Tech Lab offers cloud infrastructure for Web Agencies and uses kamaji to provide managed k8s services. |
-| R&D | TIM | 2024 | [link](https://www.gruppotim.it) | TIM is an Italian telecommunications company using Kamaji for experimental research and development purposes. |
-| End-user | KINX | 2024 | [link](https://kinx.net/?lang=en) | KINX is an Internet infrastructure service provider and will use kamaji for its new [Managed Kubernetes Service](https://kinx.net/service/cloud/kubernetes/intro/?lang=en). |
-| End-user | sevensphere | 2023 | [link](https://www.sevensphere.io) | Sevensphere provides consulting services for end-user companies / cloud providers and uses Kamaji for designing cloud/on-premises Kubernetes-as-a-Service platform. |
-| Vendor | Ænix | 2023 | [link](https://aenix.io/) | Ænix provides consulting services for cloud providers and uses Kamaji for running Kubernetes-as-a-Service in free PaaS platform [Cozystack](https://cozystack.io). |
-| Vendor | Netsons | 2023 | [link](https://www.netsons.com) | Netsons is an Italian hosting and cloud provider and uses Kamaji in its [Managed Kubernetes](https://www.netsons.com/kubernetes) offering. |
-| Vendor | Aknostic | 2023 | [link](https://aknostic.com) | Aknostic is a cloud-native consultancy company using Kamaji to build a Kubernetes based PaaS. |
-
-
-### Adopter Types
-
-**End-user**: The organization runs Kamaji in production in some way.
-
-**Integration**: The organization has a product that integrates with Kamaji, but does not contain Kamaji.
-
-**Vendor**: The organization packages Kamaji in their product and sells it as part of their product.
-
-**R&D**: Company that exploring innovative technologies  and solutions for research and development purposes.

Dockerfile

@@ -1,5 +1,13 @@
 # Build the manager binary
-FROM golang:1.22 as builder
+FROM golang:1.18 as builder
+
+ARG TARGETARCH
+ARG GIT_HEAD_COMMIT
+ARG GIT_TAG_COMMIT
+ARG GIT_LAST_TAG
+ARG GIT_MODIFIED
+ARG GIT_REPO
+ARG BUILD_DATE
 
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -11,30 +19,21 @@ RUN go mod download
 
 # Copy the go source
 COPY main.go main.go
-COPY cmd/ cmd/
 COPY api/ api/
 COPY controllers/ controllers/
 COPY internal/ internal/
-COPY indexers/ indexers/
 
 # Build
-ARG TARGETARCH
-ARG GIT_HEAD_COMMIT
-ARG GIT_TAG_COMMIT
-ARG GIT_LAST_TAG
-ARG GIT_MODIFIED
-ARG GIT_REPO
-ARG BUILD_DATE
-
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build \
     -ldflags "-X github.com/clastix/kamaji/internal.GitRepo=$GIT_REPO -X github.com/clastix/kamaji/internal.GitTag=$GIT_LAST_TAG -X github.com/clastix/kamaji/internal.GitCommit=$GIT_HEAD_COMMIT -X github.com/clastix/kamaji/internal.GitDirty=$GIT_MODIFIED -X github.com/clastix/kamaji/internal.BuildTime=$BUILD_DATE" \
-    -a -o kamaji main.go
+    -a -o manager main.go
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
 FROM gcr.io/distroless/static:nonroot
 WORKDIR /
-COPY --from=builder /workspace/kamaji .
+COPY --from=builder /workspace/manager .
+COPY ./kamaji.yaml .
 USER 65532:65532
 
-ENTRYPOINT ["/kamaji"]
+ENTRYPOINT ["/manager"]

Makefile

@@ -3,7 +3,7 @@
 # To re-generate a bundle for another specific version without changing the standard setup, you can:
 # - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
 # - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
-VERSION ?= 1.0.0
+VERSION ?= 0.0.1
 
 # CHANNELS define the bundle channels used in the bundle.
 # Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")
@@ -36,7 +36,9 @@ IMAGE_TAG_BASE ?= clastix.io/operator
 BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)
 
 # Image URL to use all building/pushing image targets
-IMG ?= clastix/kamaji:v$(VERSION)
+IMG ?= clastix/kamaji:latest
+# Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
+CRD_OPTIONS ?= "crd:trivialVersions=true,preserveUnknownFields=false"
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -77,7 +79,7 @@ helm: ## Download helm locally if necessary.
 
 GINKGO = $(shell pwd)/bin/ginkgo
 ginkgo: ## Download ginkgo locally if necessary.
-	$(call go-install-tool,$(GINKGO),github.com/onsi/ginkgo/v2/ginkgo)
+	$(call go-install-tool,$(GINKGO),github.com/onsi/ginkgo/ginkgo@v1.16.5)
 
 KIND = $(shell pwd)/bin/kind
 kind: ## Download kind locally if necessary.
@@ -85,91 +87,35 @@ kind: ## Download kind locally if necessary.
 
 CONTROLLER_GEN = $(shell pwd)/bin/controller-gen
 controller-gen: ## Download controller-gen locally if necessary.
-	$(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.14.0)
-
-GOLANGCI_LINT = $(shell pwd)/bin/golangci-lint
-golangci-lint: ## Download golangci-lint locally if necessary.
-	$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint@v1.54.2)
+	$(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.6.1)
 
 KUSTOMIZE = $(shell pwd)/bin/kustomize
 kustomize: ## Download kustomize locally if necessary.
 	$(call install-kustomize,$(KUSTOMIZE),3.8.7)
 
-APIDOCS_GEN = $(shell pwd)/bin/crdoc
-apidocs-gen: ## Download crdoc locally if necessary.
-	$(call go-install-tool,$(APIDOCS_GEN),fybrik.io/crdoc@latest)
-
 ##@ Development
 
 manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
-	$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
+	$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
+	cp config/crd/bases/kamaji.clastix.io_tenantcontrolplanes.yaml charts/kamaji/crds/tenantcontrolplane.yaml
 
 generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
 	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
 
-golint: golangci-lint ## Linting the code according to the styling guide.
-	$(GOLANGCI_LINT) run -c .golangci.yml
-
 test:
 	go test ./... -coverprofile cover.out
 
-_datastore-mysql:
-	$(MAKE) NAME=$(NAME) -C deploy/kine/mysql mariadb
-	kubectl apply -f $(shell pwd)/config/samples/kamaji_v1alpha1_datastore_mysql_$(NAME).yaml
-
-datastore-mysql:
-	$(MAKE) NAME=bronze _datastore-mysql
-	$(MAKE) NAME=silver _datastore-mysql
-	$(MAKE) NAME=gold _datastore-mysql
-
-_datastore-postgres:
-	$(MAKE) NAME=$(NAME) NAMESPACE=postgres-system -C deploy/kine/postgresql postgresql
-	kubectl apply -f $(shell pwd)/config/samples/kamaji_v1alpha1_datastore_postgresql_$(NAME).yaml
-
-datastore-postgres:
-	$(MAKE) NAME=bronze _datastore-postgres
-	$(MAKE) NAME=silver _datastore-postgres
-	$(MAKE) NAME=gold _datastore-postgres
-
-_datastore-etcd:
-	$(HELM) upgrade --install etcd-$(NAME) clastix/kamaji-etcd --create-namespace -n etcd-system --set datastore.enabled=true --set fullnameOverride=etcd-$(NAME)
-
-_datastore-nats:
-	$(MAKE) NAME=$(NAME) NAMESPACE=nats-system -C deploy/kine/nats nats
-	kubectl apply -f $(shell pwd)/config/samples/kamaji_v1alpha1_datastore_nats_$(NAME).yaml
-
-datastore-etcd: helm
-	$(HELM) repo add clastix https://clastix.github.io/charts
-	$(HELM) repo update
-	$(MAKE) NAME=bronze _datastore-etcd
-	$(MAKE) NAME=silver _datastore-etcd
-	$(MAKE) NAME=gold _datastore-etcd
-
-datastore-nats: helm
-	$(HELM) repo add nats https://nats-io.github.io/k8s/helm/charts/
-	$(HELM) repo update
-	$(MAKE) NAME=bronze _datastore-nats
-	$(MAKE) NAME=silver _datastore-nats
-	$(MAKE) NAME=gold _datastore-nats
-	$(MAKE) NAME=notls _datastore-nats
-
-datastores: datastore-mysql datastore-etcd datastore-postgres datastore-nats ## Install all Kamaji DataStores with multiple drivers, and different tiers.
-
 ##@ Build
 
 # Get information about git current status
 GIT_HEAD_COMMIT ?= $$(git rev-parse --short HEAD)
-GIT_TAG_COMMIT  ?= $$(git rev-parse --short v$(VERSION))
+GIT_TAG_COMMIT  ?= $$(git rev-parse --short $(VERSION))
 GIT_MODIFIED_1  ?= $$(git diff $(GIT_HEAD_COMMIT) $(GIT_TAG_COMMIT) --quiet && echo "" || echo ".dev")
 GIT_MODIFIED_2  ?= $$(git diff --quiet && echo "" || echo ".dirty")
 GIT_MODIFIED    ?= $$(echo "$(GIT_MODIFIED_1)$(GIT_MODIFIED_2)")
 GIT_REPO        ?= $$(git config --get remote.origin.url)
 BUILD_DATE      ?= $$(git log -1 --format="%at" | xargs -I{} date -d @{} +%Y-%m-%dT%H:%M:%S)
 
-.PHONY: get_version
-get_version:
-	@echo -n v$(VERSION)
-
 build: generate fmt vet ## Build manager binary.
 	go build -o bin/manager main.go
 
@@ -181,7 +127,7 @@ docker-build: ## Build docker image with the manager.
 		--build-arg GIT_TAG_COMMIT=$(GIT_TAG_COMMIT) \
 		--build-arg GIT_MODIFIED=$(GIT_MODIFIED) \
 		--build-arg GIT_REPO=$(GIT_REPO) \
-		--build-arg GIT_LAST_TAG=v$(VERSION) \
+		--build-arg GIT_LAST_TAG=$(VERSION) \
 		--build-arg BUILD_DATE=$(BUILD_DATE)
 
 docker-push: ## Push docker image with the manager.
@@ -189,15 +135,6 @@ docker-push: ## Push docker image with the manager.
 
 ##@ Deployment
 
-metallb:
-	kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.13.7/config/manifests/metallb-native.yaml
-	kubectl apply -f https://kind.sigs.k8s.io/examples/loadbalancer/metallb-config.yaml
-	echo ""
-	docker network inspect -f '{{.IPAM.Config}}' kind
-
-cert-manager:
-	kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.10.1/cert-manager.yaml
-
 dev: generate manifests uninstall install rbac ## Full installation for development purposes
 	go fmt ./...
 
@@ -306,12 +243,6 @@ env:
 ##@ e2e
 
 .PHONY: e2e
-e2e: env load helm ginkgo cert-manager ## Create a KinD cluster, install Kamaji on it and run the test suite.
-	$(HELM) upgrade --debug --install kamaji ./charts/kamaji --create-namespace --namespace kamaji-system --set "image.pullPolicy=Never" --set "telemetry.disabled=true"
-	$(MAKE) datastores
+e2e: env load helm ginkgo ## Create a KinD cluster, install Kamaji on it and run the test suite.
+	$(HELM) upgrade --debug --install kamaji ./charts/kamaji --create-namespace --namespace kamaji-system --set "image.pullPolicy=Never"
 	$(GINKGO) -v ./e2e
-
-##@ Document
-
-apidoc: apidocs-gen
-	$(APIDOCS_GEN) crdoc --resources config/crd/bases --output docs/content/reference/api.md --template docs/templates/reference-cr.tmpl

PROJECT

@@ -16,11 +16,4 @@ resources:
   kind: TenantControlPlane
   path: github.com/clastix/kamaji/api/v1alpha1
   version: v1alpha1
-- api:
-    crdVersion: v1
-  domain: clastix.io
-  group: kamaji
-  kind: DataStore
-  path: github.com/clastix/kamaji/api/v1alpha1
-  version: v1alpha1
 version: "3"

README.md

@@ -3,159 +3,108 @@
 <p align="left">
   <img src="https://img.shields.io/github/license/clastix/kamaji"/>
   <img src="https://img.shields.io/github/go-mod/go-version/clastix/kamaji"/>
-  <a href="https://github.com/clastix/kamaji/releases"><img src="https://img.shields.io/github/v/release/clastix/kamaji"/></a>
-  <img src="https://goreportcard.com/badge/github.com/clastix/kamaji">
-  <a href="https://kubernetes.slack.com/archives/C03GLTTMWNN"><img alt="#kamaji on Kubernetes Slack" src="https://img.shields.io/badge/slack-@kubernetes/kamaji-blue.svg?logo=slack"/></a>
+  <a href="https://github.com/clastix/kamaji/releases">
+    <img src="https://img.shields.io/github/v/release/clastix/kamaji"/>
+  </a>
 </p>
 
-![Logo](assets/logo-black.png#gh-light-mode-only)
-![Logo](assets/logo-white.png#gh-dark-mode-only)
+**Kamaji** deploys and operates **Kubernetes** at scale with a fraction of the operational burden.
 
-### 🤔 What is Kamaji?
+<p align="center" style="padding: 6px 6px">
+  <img src="assets/kamaji-logo.png" />
+</p>
 
-**Kamaji** is a **Kubernetes Control Plane Manager** leveraging on the concept of [**Hosted Control Plane**](https://clastix.io/post/the-raise-of-hosted-control-plane-in-kubernetes/).
+## Why we are building it?
+Global hyper-scalers are leading the Managed Kubernetes space, while other cloud providers, as well as large corporations, are struggling to offer the same experience to their DevOps teams because of the lack of the right tools. Also, current Kubernetes solutions are mainly designed with an enterprise-first approach and they are too costly when deployed at scale.
 
-Kamaji's approach is based on running the Kubernetes Control Plane components in Pods instead of dedicated machines.
-This allows operating Kubernetes clusters at scale, with a fraction of the operational burden.
-Thanks to this approach, running multiple Control Planes can be cheaper and easier to deploy and operate.
+**Kamaji** aims to solve these pains by leveraging multi-tenancy and simplifying how to run multiple control planes on the same infrastructure with a fraction of the operational burden.
 
-_Kamaji is like a fleet of Site Reliability Engineers with expertise codified into its logic, working 24/7 to keep up and running your Control Planes._
+## How it works
+Kamaji turns any Kubernetes cluster into an _“admin cluster”_ to orchestrate other Kubernetes clusters called _“tenant clusters”_. What makes Kamaji special is that Control Planes of _“tenant clusters”_ are just regular pods running in the _“admin cluster”_ instead of dedicated Virtual Machines. This solution makes running control planes at scale cheaper and easier to deploy and operate. View [Core Concepts](./docs/concepts.md) for a deeper understanding of principles behind Kamaji's design.
 
-<img src="docs/content/images/architecture.png"  width="600" style="display: block; margin: 0 auto">
+<p align="center">
+  <img src="assets/kamaji-light.png#gh-light-mode-only" />
+</p>
 
-### 📖 How it works
+<p align="center">
+  <img src="assets/kamaji-dark.png#gh-dark-mode-only" />
+</p>
 
-Kamaji is extending the Kubernetes API capabilities thanks to [Custom Resource Definitions](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#customresourcedefinitions).
+All the tenant clusters built with Kamaji are fully compliant CNCF Kubernetes clusters and are compatible with the standard Kubernetes toolchains everybody knows and loves.
 
-By installing Kamaji, two pairs of new APIs will be available:
+<p align="center">
+  <img src="assets/screenshot.png" />
+</p>
 
-- `TenantControlPlane`, the instance definition of your desired Kubernetes Control Plane
-- `Datastore`, the backing store used by one (or more) `TenantControlPlane`
+## Getting started
 
-The `TenantControlPlane` (short-named as `tcp`) objects are Namespace-scoped and allows configuring every aspect of your desired Control Plane.
-Besides the Kubernetes configuration values, you can specify the Pod options such as limit, request, tolerations, node selector, etc.,
-as well as how these should be exposed (e.g.: using a `ClusterIP`, a `LoadBalancer`, or a `NodePort`).
+Please refer to the [Getting Started guide](./docs/getting-started-with-kamaji.md) to deploy a minimal setup of Kamaji on KinD.
 
-The `TenantControlPlane` is the stateless definition of the Control Plane allowing to set up the required components for a full-fledged Kubernetest cluster.
-The state is managed by the `Datastore` API, a cluster-scoped resource which can hold the data of one or more Kubernetes clusters.
+> This project is still in the early development stage which means it's not ready for production as APIs, commands, flags, etc. are subject to change, but also that your feedback can still help to shape it. Please try it out and let us know what you like, dislike, what works, what doesn't, etc.
 
-> For further information about the API specifications and all the available options,
-> refer to the official [API reference](https://kamaji.clastix.io/reference/api/#tenantcontrolplane).
+## Use cases
+Kamaji project has been initially started as a solution for actual and common problems such as minimizing the Total Cost of Ownership while running Kubernetes at large scale. However, it can open a wider range of use cases.
 
-### ⭐️ Main features
+Here are a few:
 
-- **Fast provisioning time**: depending on the infrastructure, Tenant Control Planes are up and ready to serve traffic in **16 seconds**.
-- **Streamlined update**: the rollout to a new Kubernetes version for a given Tenant Control Plane takes just **10 seconds**, with a Blue/Green deployment to avoid serving mixed Kubernetes versions.
-- **Resource optimization**: thanks to the Datastore decoupling, there's no need of odd number instances (e.g.: RAFT consensus) by allowing to save up to 60% of HW resources.
-- **Scale from zero to the moon**: scale down the instance when there's no usage, or automatically scale to support the traffic spikes reusing the Kubernetes patterns.
-- **Declarative approach, constant reconciliation**: thanks to the Operator pattern, drift detection happens in real-time, maintaining the desired state.
-- **Automated certificates management**: Kamaji leverages on `kubeadm` and the certificates are automatically created and rotated for you.
-- **Managing core addons**: Kamaji allows configuring automatically `kube-proxy`, `CoreDNS`, and `konnectivity`, with automatic remediation in case of user errors (e.g.: deleting the `CoreDNS` deployment).
-- **Auto Healing**: the `TenantControlPlane` objects in the management cluster are tracked by Kamaji, in case of deletion of those, everything is created in an idempotent way.
-- **Datastore multi-tenancy**: optionally, Kamaji allows running multiple Control Planes on the same _Datastore_ instance leveraging on the multi-tenancy of each driver, decreasing operations and optimizing costs.
-- **Overcoming `etcd` limitations**: optionally, Kamaji allows using a different _Datastore_ thanks to [`kine`](https://github.com/k3s-io/kine) by supporting `MySQL`, `PostgreSQL`, or `NATS` as an alternative.
-- **Simplifying mixed-networks setup**: thanks to [`Konnectivity`](https://kubernetes.io/docs/tasks/extend-kubernetes/setup-konnectivity/),
-  the Tenant Control Plane is connected to the worker nodes hosted in a different network, overcoming the no-NAT availability when dealing with nodes with a non routable IP address
-  (e.g.: worker nodes in a different infrastructure).
+- **Managed Kubernetes:** enable companies to provide Cloud Native Infrastructure with ease by introducing a strong separation of concerns between management and workloads. Centralize clusters management, monitoring, and observability by leaving developers to focus on applications, increase productivity and reduce operational costs.
+- **Kubernetes as a Service:** provide Kubernetes clusters in a self-service fashion by running management and workloads on different infrastructures with the option of Bring Your Own Device, BYOD.
+- **Control Plane as a Service:** provide multiple Kubernetes control planes running on top of a single Kubernetes cluster. Tenants who use namespaces based isolation often still need access to cluster wide resources like Cluster Roles, Admission Webhooks, or Custom Resource Definitions.
+- **Edge Computing:** distribute Kubernetes workloads across edge computing locations without having to manage multiple clusters across various providers. Centralize management of hundreds of control planes while leaving workloads to run isolated on their own dedicated infrastructure.
+- **Cluster Simulation:** check new Kubernetes API or experimental flag or a new tool without impacting production operations. Kamaji will let you simulate such things in a safe and controlled environment.
+- **Workloads Testing:** check the behaviour of your workloads on different and multiple versions of Kubernetes with ease by deploying multiple Control Planes in a single cluster.
 
-### 🚀 Use cases
+## Features
 
-- [**Creating a private Managed Kubernetes Service**](https://clastix.io/post/netsons-builds-a-managed-kubernetes-service-with-kamaji-and-open-stack/)
-- [**Building a Platform as a Service**](https://aenix.io/cozystack/)
-- [**Overcoming public Managed Kubernetes Services**](https://clastix.io/post/overcoming-eks-limitations-with-kamaji-on-aws/) such as EKS
-- [**Hybrid infrastructures**](https://clastix.io/post/bridging-the-gap-hybrid-kubernetes-clusters-with-remote-control-planes/):
-  host the Control Plane on the Cloud and worker nodes on prem or vice-versa, according to your needs.
-- [**Kubernetes at the edge**](https://clastix.io/post/edgevolution-unleashing-the-power-of-kubernetes-clusters-for-a-revolutionary-edge-computing-experience/):
-  take full advantage of the _Kubernetes API Server as a service_ paradigm.
-- **Kubernetes Control Plane as a Service:** centrally manage multiple Kubernetes clusters from a single management point (_Multi-Cluster management_). 
-- **High-density Control Plane:** place multiple control planes on the same infrastructure, instead of having dedicated machines for each control plane.
-- **Strong Multi-tenancy:** leave users to access the control plane with admin permissions while keeping them isolated at the infrastructure level.
-- **Kubernetes Inception:** use Kubernetes to manage Kubernetes with automation, high-availability, fault tolerance, and autoscaling out of the box. 
-- **Bring Your Own Device:** keep the control plane isolated from data plane. Worker nodes can join and run consistently from everywhere: cloud, edge, and data-center.
-- **Full CNCF compliant:** all clusters are built with upstream Kubernetes binaries, resulting in full CNCF compliant Kubernetes clusters.
+- **Self Service Kubernetes:** leave users the freedom to self-provision their Kubernetes clusters according to the assigned boundaries.
+- **Multi-cluster Management:** centrally manage multiple tenant clusters from a single admin cluster. Happy SREs. 
+- **Cheaper Control Planes:** place multiple tenant control planes on a single node, instead of having three nodes for a single control plane.
+- **Stronger Multi-Tenancy:** leave tenants to access the control plane with admin permissions while keeping the tenant isolated at the infrastructure level.
+- **Kubernetes Inception:** use Kubernetes to manage Kubernetes by re-using all the Kubernetes goodies you already know and love.
+- **Full APIs compliant:** tenant clusters are fully CNCF compliant built with upstream Kubernetes binaries. A user does not see differences between a Kamaji provisioned cluster and a dedicated cluster.
 
-> 🤔 You'd like to do the same but don't know how?
-> 💡 [CLASTIX](https://clastix.io/) can help you with your needs!
+## Roadmap
 
-### 🧑‍💻‍ Production grade
-
-Kamaji is empowering several businesses, and it counts public adopters.
-Check out the [adopters](./ADOPTERS.md) file to learn more.
-
-> 🤗 If you're using Kamaji, share your love by opening a PR!
-
-### 🍦 Vanilla Kubernetes clusters
-
-Kamaji is **not** yet-another-Kubernetes distribution: you have full freedom on the technology stack to provide to end users.
-Kamaji is a perfect fit for Platform Engineering, hiding the complexity of the Control Plane management to developers and DevOps engineers.
-
-The provided Kubernetes Control Planes are [CNCF compliant clusters](https://kamaji.clastix.io/reference/conformance/).
-
-<img src="https://raw.githubusercontent.com/cncf/artwork/master/projects/kubernetes/certified-kubernetes/versionless/color/certified-kubernetes-color.png" style="display: block; width: 75px; margin: 0 auto">
-
-### 🐢 Cluster API support
-
-Kamaji is **not** a [Cluster API](https://cluster-api.sigs.k8s.io/) replacement, rather, it plays very well with it.
-
-Since Kamaji is just focusing on the Control Plane a [Kamaji's Cluster API Control Plane provider](https://github.com/clastix/cluster-api-control-plane-provider-kamaji) has been developed.
-
-### 🛣️ Roadmap
-
-- [x] Dynamic address on Load Balancer
+- [ ] Benchmarking and stress-test
+- [x] Support for dynamic address allocation on native Load Balancer
 - [x] Zero Downtime Tenant Control Plane upgrade
-- [x] [Join worker nodes from anywhere thanks to Konnectivity](https://kamaji.clastix.io/concepts/#konnectivity)
-- [x] [Alternative datastore MySQL, PostgreSQL, NATS](https://kamaji.clastix.io/guides/alternative-datastore/)
-- [x] [Pool of multiple datastores](https://kamaji.clastix.io/concepts/#datastores)
-- [x] [Seamless migration between datastores](https://kamaji.clastix.io/guides/datastore-migration/)
-- [ ] Automatic assignment to a datastore
-- [ ] Autoscaling of Tenant Control Plane
-- [x] [Provisioning through Cluster APIs](https://github.com/clastix/cluster-api-control-plane-provider-kamaji)
+- [x] `konnectivity` integration
+- [ ] Provisioning of Tenant Control Plane through Cluster APIs
 - [ ] Terraform provider
-- [ ] Custom Prometheus metrics
+- [ ] Custom Prometheus metrics for monitoring and alerting
+- [x] `kine` integration for MySQL as datastore
+- [x] `kine` integration for PostgreSQL as datastore
+- [ ] Deeper `kubeadm` integration
+- [ ] Pooling of multiple `etcd` datastores
+- [ ] Autoscaling of Tenant Control Plane pods
 
-### 🎥 Multimedia
 
-- Playlist ▶️ [Tutorials and How-Tos by Dario Tranchitella, CLASTIX](https://www.youtube.com/playlist?list=PLjiUjoV4Ws_3pNsUpTXI-KKk731nD2MQY)
-- YouTube ▶️ [Metal³ provisioning with Kamaji Hosted Control Planes by Huy Mai, Ericsson](https://youtu.be/u9sbURj6jXY?t=10536)
-- YouTube ▶️ [Hands-on introduction to Kamaji](https://www.youtube.com/watch?v=HhevxwQWQ88)
-- YouTube ▶️ [Scaling Kubernetes up to 1,000 Control Planes](https://www.youtube.com/watch?v=W_HXRXJh96U)
-- YouTube ▶️ [Equinix, Kamaji, and Cluster API](https://www.youtube.com/watch?v=TLBTqROj_wA)
-- YouTube ▶️ [Rancher & Kamaji: solving multitenancy challenges in the Kubernetes world](https://www.youtube.com/watch?v=VXHNrMmlF8U)
-- YouTube ▶️ [Enabling Self-Service Kubernetes clusters with Kamaji and Paralus](https://www.youtube.com/watch?v=JWA2LwZazM0)
-- YouTube ▶️ [Hosted Control Plane on Kubernetes (HPC) with Kamaji and K0mostron by Hervé Leclerc, ALTER WAY](https://www.youtube.com/watch?v=vmRdE2ngn78)
+## Documentation
+Please, check the project's [documentation](./docs/) for getting started with Kamaji.
 
-### 🏷️ Versioning
+## Contributions
+Kamaji is Open Source with Apache 2 license and any contribution is welcome.
 
-Versioning adheres to the [Semantic Versioning](http://semver.org/) principles.
-A full list of the available releases is available in the GitHub repository's [**Release** section](https://github.com/clastix/kamaji/releases).
+## Community
+Join the [Kubernetes Slack Workspace](https://slack.k8s.io/) and the [`#kamaji`](https://kubernetes.slack.com/archives/C03GLTTMWNN) channel to meet end-users and contributors.
 
-### 📄 Documentation
+## FAQs
+Q. What does Kamaji means?
 
-Further documentation can be found on the official [Kamaji documentation website](https://kamaji.clastix.io/).
+A. Kamaji is named as the character _Kamaji_ from the Japanese movie [_Spirited Away_](https://en.wikipedia.org/wiki/Spirited_Away).
 
-### 🤝 Contributions
+Q. Is Kamaji another Kubernetes distribution?
 
-Contributions are highly appreciated and very welcomed!
+A. No, Kamaji is a Kubernetes Operator you can install on top of any Kubernetes cluster to provide hundreds of managed Kubernetes clusters as a service. We tested Kamaji on vanilla Kubernetes 1.22+, KinD, and Azure AKS. We expect it to work smoothly on other Kubernetes distributions. The tenant clusters made with Kamaji are conformant CNCF Kubernetes clusters as we leverage on [`kubeadm`](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/).
 
-In case of bugs, please, check if the issue has been already opened by checking the [GitHub Issues](https://github.com/clastix/kamaji/issues) section.
-In case it isn't, you can open a new one: a detailed report will help us to replicate it, assess it, and work on a fix.
+Q. Is it safe to run Kubernetes control plane components in a pod instead of dedicated virtual machines?
 
-You can express your intention in working on the fix on your own.
-The commit messages are checked according to the described [semantics](https://github.com/projectcapsule/capsule/blob/main/CONTRIBUTING.md#semantics).
-Commits are used to generate the changelog, and their author will be referenced in it.
+A. Yes, the tenant control plane components are packaged in the same way they are running in bare metal or virtual nodes. We leverage the `kubeadm` code to set up the control plane components as they were running on their own server. The unchanged images of upstream `kube-apiserver`, `kube-scheduler`, and `kube-controller-manager` are used.
 
-In case of **✨ Feature Requests** please use the [Discussion's Feature Request section](https://github.com/clastix/kamaji/discussions/categories/feature-requests).
+Q. You already provide a Kubernetes multi-tenancy solution with [Capsule](https://capsule.clastix.io). Why does Kamaji matter?
 
-### 📝 License
+A. A multi-tenancy solution, like Capsule shares the Kubernetes control plane among all tenants keeping tenant namespaces isolated by policies. While the solution is the right choice by balancing between features and ease of usage, there are cases where a tenant user requires access to the control plane, for example, when a tenant requires to manage CRDs on his own. With Kamaji, you can provide cluster admin permissions to the tenant.
 
-The Kamaji Cluster API Control Plane provider is licensed under Apache 2.0.
-The code is provided as-is with no warranties.
+Q. Well you convinced me, how to get a try?
 
-### 🛟 Commercial Support
-
-![CLASTIX](https://avatars.githubusercontent.com/u/39170129?s=50&v=4) [CLASTIX](https://clastix.io/) is the commercial company behind Kamaji and the Cluster API Control Plane provider.
-
-If you're looking to run Kamaji in production and would like to learn more, **CLASTIX** can help by offering [Open Source support plans](https://clastix.io/support),
-as well as providing a comprehensive Enterprise Platform named [CLASTIX Enterprise Platform](https://clastix.cloud/), built on top of the Kamaji and [Capsule](https://capsule.clastix.io/) project (now donated to CNCF as a Sandbox project).
-
-Feel free to get in touch with the provided [Contact form](https://clastix.io/contact).
+A. It is possible to get started with Kamaji on a laptop with [KinD](./docs/getting-started-with-kamaji.md) installed.

api/v1alpha1/datastore_funcs.go

@@ -1,39 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"context"
-	"fmt"
-
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/types"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-)
-
-// GetContent is the resolver for the container of the Secret.
-// The bare content has priority over the external reference.
-func (in *ContentRef) GetContent(ctx context.Context, client client.Client) ([]byte, error) {
-	if content := in.Content; len(content) > 0 {
-		return content, nil
-	}
-
-	secretRef := in.SecretRef
-
-	if secretRef == nil {
-		return nil, fmt.Errorf("no bare content and no external Secret reference")
-	}
-
-	secret, namespacedName := &corev1.Secret{}, types.NamespacedName{Name: secretRef.Name, Namespace: secretRef.Namespace}
-	if err := client.Get(ctx, namespacedName, secret); err != nil {
-		return nil, err
-	}
-
-	v, ok := secret.Data[string(secretRef.KeyPath)]
-	if !ok {
-		return nil, fmt.Errorf("secret %s does not have key %s", namespacedName.String(), secretRef.KeyPath)
-	}
-
-	return v, nil
-}

api/v1alpha1/datastore_types.go

@@ -1,115 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:validation:Enum=etcd;MySQL;PostgreSQL;NATS
-
-type Driver string
-
-var (
-	EtcdDriver           Driver = "etcd"
-	KineMySQLDriver      Driver = "MySQL"
-	KinePostgreSQLDriver Driver = "PostgreSQL"
-	KineNatsDriver       Driver = "NATS"
-)
-
-// +kubebuilder:validation:MinItems=1
-
-type Endpoints []string
-
-// DataStoreSpec defines the desired state of DataStore.
-type DataStoreSpec struct {
-	// The driver to use to connect to the shared datastore.
-	Driver Driver `json:"driver"`
-	// List of the endpoints to connect to the shared datastore.
-	// No need for protocol, just bare IP/FQDN and port.
-	Endpoints Endpoints `json:"endpoints"`
-	// In case of authentication enabled for the given data store, specifies the username and password pair.
-	// This value is optional.
-	BasicAuth *BasicAuth `json:"basicAuth,omitempty"`
-	// Defines the TLS/SSL configuration required to connect to the data store in a secure way.
-	// This value is optional.
-	TLSConfig *TLSConfig `json:"tlsConfig,omitempty"`
-}
-
-// TLSConfig contains the information used to connect to the data store using a secured connection.
-type TLSConfig struct {
-	// Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference.
-	// The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.
-	CertificateAuthority CertKeyPair `json:"certificateAuthority"`
-	// Specifies the SSL/TLS key and private key pair used to connect to the data store.
-	ClientCertificate *ClientCertificate `json:"clientCertificate,omitempty"`
-}
-
-type ClientCertificate struct {
-	Certificate ContentRef `json:"certificate"`
-	PrivateKey  ContentRef `json:"privateKey"`
-}
-
-type CertKeyPair struct {
-	Certificate ContentRef  `json:"certificate"`
-	PrivateKey  *ContentRef `json:"privateKey,omitempty"`
-}
-
-// BasicAuth contains the required information to perform the connection using user credentials to the data store.
-type BasicAuth struct {
-	Username ContentRef `json:"username"`
-	Password ContentRef `json:"password"`
-}
-
-type ContentRef struct {
-	// Bare content of the file, base64 encoded.
-	// It has precedence over the SecretReference value.
-	Content   []byte           `json:"content,omitempty"`
-	SecretRef *SecretReference `json:"secretReference,omitempty"`
-}
-
-// +kubebuilder:validation:MinLength=1
-type secretReferKeyPath string
-
-type SecretReference struct {
-	corev1.SecretReference `json:",inline"`
-	// Name of the key for the given Secret reference where the content is stored.
-	// This value is mandatory.
-	KeyPath secretReferKeyPath `json:"keyPath"`
-}
-
-// DataStoreStatus defines the observed state of DataStore.
-type DataStoreStatus struct {
-	// List of the Tenant Control Planes, namespaced named, using this data store.
-	UsedBy []string `json:"usedBy,omitempty"`
-}
-
-//+kubebuilder:object:root=true
-//+kubebuilder:subresource:status
-//+kubebuilder:resource:scope=Cluster
-//+kubebuilder:printcolumn:name="Driver",type="string",JSONPath=".spec.driver",description="Kamaji data store driver"
-//+kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="Age"
-
-// DataStore is the Schema for the datastores API.
-type DataStore struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   DataStoreSpec   `json:"spec,omitempty"`
-	Status DataStoreStatus `json:"status,omitempty"`
-}
-
-//+kubebuilder:object:root=true
-
-// DataStoreList contains a list of DataStore.
-type DataStoreList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []DataStore `json:"items"`
-}
-
-func init() {
-	SchemeBuilder.Register(&DataStore{}, &DataStoreList{})
-}

api/v1alpha1/groupversion_info.go

@@ -2,9 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Package v1alpha1 contains API Schema definitions for the kamaji v1alpha1 API group
-// +kubebuilder:object:generate=true
-// +groupName=kamaji.clastix.io
-//nolint
+//+kubebuilder:object:generate=true
+//+groupName=kamaji.clastix.io
 package v1alpha1
 
 import (

api/v1alpha1/indexer_datastore_usedsecret.go

@@ -1,70 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"context"
-	"fmt"
-
-	controllerruntime "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-)
-
-const (
-	DatastoreUsedSecretNamespacedNameKey = "secretRef"
-)
-
-type DatastoreUsedSecret struct{}
-
-func (d *DatastoreUsedSecret) SetupWithManager(ctx context.Context, mgr controllerruntime.Manager) error {
-	return mgr.GetFieldIndexer().IndexField(ctx, d.Object(), d.Field(), d.ExtractValue())
-}
-
-func (d *DatastoreUsedSecret) Object() client.Object {
-	return &DataStore{}
-}
-
-func (d *DatastoreUsedSecret) Field() string {
-	return DatastoreUsedSecretNamespacedNameKey
-}
-
-func (d *DatastoreUsedSecret) ExtractValue() client.IndexerFunc {
-	return func(object client.Object) (res []string) {
-		ds := object.(*DataStore) //nolint:forcetypeassert
-
-		if ds.Spec.BasicAuth != nil {
-			if ds.Spec.BasicAuth.Username.SecretRef != nil {
-				res = append(res, d.namespacedName(*ds.Spec.BasicAuth.Username.SecretRef))
-			}
-
-			if ds.Spec.BasicAuth.Password.SecretRef != nil {
-				res = append(res, d.namespacedName(*ds.Spec.BasicAuth.Password.SecretRef))
-			}
-		}
-
-		if ds.Spec.TLSConfig != nil {
-			if ds.Spec.TLSConfig.CertificateAuthority.Certificate.SecretRef != nil {
-				res = append(res, d.namespacedName(*ds.Spec.TLSConfig.CertificateAuthority.Certificate.SecretRef))
-			}
-
-			if ds.Spec.TLSConfig.CertificateAuthority.PrivateKey != nil && ds.Spec.TLSConfig.CertificateAuthority.PrivateKey.SecretRef != nil {
-				res = append(res, d.namespacedName(*ds.Spec.TLSConfig.CertificateAuthority.PrivateKey.SecretRef))
-			}
-
-			if ds.Spec.TLSConfig.ClientCertificate.Certificate.SecretRef != nil {
-				res = append(res, d.namespacedName(*ds.Spec.TLSConfig.ClientCertificate.Certificate.SecretRef))
-			}
-
-			if ds.Spec.TLSConfig.ClientCertificate.PrivateKey.SecretRef != nil {
-				res = append(res, d.namespacedName(*ds.Spec.TLSConfig.ClientCertificate.PrivateKey.SecretRef))
-			}
-		}
-
-		return res
-	}
-}
-
-func (d *DatastoreUsedSecret) namespacedName(ref SecretReference) string {
-	return fmt.Sprintf("%s/%s", ref.Namespace, ref.Name)
-}

api/v1alpha1/indexer_tenantcontrolplane_useddatastore.go

@@ -1,37 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"context"
-
-	controllerruntime "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-)
-
-const (
-	TenantControlPlaneUsedDataStoreKey = "status.storage.dataStoreName"
-)
-
-type TenantControlPlaneStatusDataStore struct{}
-
-func (t *TenantControlPlaneStatusDataStore) Object() client.Object {
-	return &TenantControlPlane{}
-}
-
-func (t *TenantControlPlaneStatusDataStore) Field() string {
-	return TenantControlPlaneUsedDataStoreKey
-}
-
-func (t *TenantControlPlaneStatusDataStore) ExtractValue() client.IndexerFunc {
-	return func(object client.Object) []string {
-		tcp := object.(*TenantControlPlane) //nolint:forcetypeassert
-
-		return []string{tcp.Status.Storage.DataStoreName}
-	}
-}
-
-func (t *TenantControlPlaneStatusDataStore) SetupWithManager(ctx context.Context, mgr controllerruntime.Manager) error {
-	return mgr.GetFieldIndexer().IndexField(ctx, t.Object(), t.Field(), t.ExtractValue())
-}

api/v1alpha1/tenantcontrolplane_addons_funcs.go

@@ -0,0 +1,17 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func (in AddonStatus) GetChecksum() string {
+	return in.Checksum
+}
+
+func (in *AddonStatus) SetChecksum(checksum string) {
+	in.LastUpdate = metav1.Now()
+	in.Checksum = checksum
+}

api/v1alpha1/tenantcontrolplane_registrysettings.go

@@ -1,18 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-type RegistrySettings struct {
-	// +kubebuilder:default="registry.k8s.io"
-	Registry string `json:"registry,omitempty"`
-	// The tag to append to all the Control Plane container images.
-	// Optional.
-	TagSuffix string `json:"tagSuffix,omitempty"`
-	// +kubebuilder:default="kube-apiserver"
-	APIServerImage string `json:"apiServerImage,omitempty"`
-	// +kubebuilder:default="kube-controller-manager"
-	ControllerManagerImage string `json:"controllerManagerImage,omitempty"`
-	// +kubebuilder:default="kube-scheduler"
-	SchedulerImage string `json:"schedulerImage,omitempty"`
-}

api/v1alpha1/tenantcontrolplane_registrysettings_funcs.go

@@ -1,30 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"fmt"
-)
-
-func (r *RegistrySettings) buildContainerImage(name, tag string) string {
-	image := fmt.Sprintf("%s/%s:%s", r.Registry, name, tag)
-
-	if len(r.TagSuffix) > 0 {
-		image += r.TagSuffix
-	}
-
-	return image
-}
-
-func (r *RegistrySettings) KubeAPIServerImage(version string) string {
-	return r.buildContainerImage(r.APIServerImage, version)
-}
-
-func (r *RegistrySettings) KubeSchedulerImage(version string) string {
-	return r.buildContainerImage(r.SchedulerImage, version)
-}
-
-func (r *RegistrySettings) KubeControllerManagerImage(version string) string {
-	return r.buildContainerImage(r.ControllerManagerImage, version)
-}

api/v1alpha1/tenantcontrolplane_status.go

@@ -8,6 +8,8 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/clastix/kamaji/internal/etcd"
 )
 
 // APIServerCertificatesStatus defines the observed state of ETCD Certificate for API server.
@@ -44,7 +46,7 @@ type PublicKeyPrivateKeyPairStatus struct {
 	Checksum   string      `json:"checksum,omitempty"`
 }
 
-// CertificatesStatus defines the observed state of ETCD TLSConfig.
+// CertificatesStatus defines the observed state of ETCD Certificates.
 type CertificatesStatus struct {
 	CA                     CertificatePrivateKeyPairStatus `json:"ca,omitempty"`
 	APIServer              CertificatePrivateKeyPairStatus `json:"apiServer,omitempty"`
@@ -55,31 +57,41 @@ type CertificatesStatus struct {
 	ETCD                   *ETCDCertificatesStatus         `json:"etcd,omitempty"`
 }
 
-type DataStoreCertificateStatus struct {
+// ETCDStatus defines the observed state of ETCDStatus.
+type ETCDStatus struct {
+	Role etcd.Role `json:"role,omitempty"`
+	User etcd.User `json:"user,omitempty"`
+}
+
+type SQLCertificateStatus struct {
 	SecretName string      `json:"secretName,omitempty"`
 	Checksum   string      `json:"checksum,omitempty"`
 	LastUpdate metav1.Time `json:"lastUpdate,omitempty"`
 }
 
-type DataStoreConfigStatus struct {
+type SQLConfigStatus struct {
 	SecretName string `json:"secretName,omitempty"`
 	Checksum   string `json:"checksum,omitempty"`
 }
 
-type DataStoreSetupStatus struct {
+type SQLSetupStatus struct {
 	Schema     string      `json:"schema,omitempty"`
 	User       string      `json:"user,omitempty"`
 	LastUpdate metav1.Time `json:"lastUpdate,omitempty"`
 	Checksum   string      `json:"checksum,omitempty"`
 }
 
+type KineStatus struct {
+	Driver      string               `json:"driver,omitempty"`
+	Config      SQLConfigStatus      `json:"config,omitempty"`
+	Setup       SQLSetupStatus       `json:"setup,omitempty"`
+	Certificate SQLCertificateStatus `json:"certificate,omitempty"`
+}
+
 // StorageStatus defines the observed state of StorageStatus.
 type StorageStatus struct {
-	Driver        string                     `json:"driver,omitempty"`
-	DataStoreName string                     `json:"dataStoreName,omitempty"`
-	Config        DataStoreConfigStatus      `json:"config,omitempty"`
-	Setup         DataStoreSetupStatus       `json:"setup,omitempty"`
-	Certificate   DataStoreCertificateStatus `json:"certificate,omitempty"`
+	ETCD *ETCDStatus `json:"etcd,omitempty"`
+	Kine *KineStatus `json:"kine,omitempty"`
 }
 
 // KubeconfigStatus contains information about the generated kubeconfig.
@@ -112,12 +124,15 @@ type KubeadmPhaseStatus struct {
 
 // KubeadmPhasesStatus contains the status of the different kubeadm phases action.
 type KubeadmPhasesStatus struct {
-	BootstrapToken KubeadmPhaseStatus `json:"bootstrapToken"`
+	UploadConfigKubeadm KubeadmPhaseStatus `json:"uploadConfigKubeadm"`
+	UploadConfigKubelet KubeadmPhaseStatus `json:"uploadConfigKubelet"`
+	BootstrapToken      KubeadmPhaseStatus `json:"bootstrapToken"`
 }
 
 type ExternalKubernetesObjectStatus struct {
 	Name      string `json:"name,omitempty"`
 	Namespace string `json:"namespace,omitempty"`
+	Checksum  string `json:"checksum,omitempty"`
 	// Last time when k8s object was updated
 	LastUpdate metav1.Time `json:"lastUpdate,omitempty"`
 }
@@ -142,13 +157,15 @@ type KonnectivityConfigMap struct {
 // AddonStatus defines the observed state of an Addon.
 type AddonStatus struct {
 	Enabled    bool        `json:"enabled"`
+	Checksum   string      `json:"checksum,omitempty"`
 	LastUpdate metav1.Time `json:"lastUpdate,omitempty"`
 }
 
 // AddonsStatus defines the observed state of the different Addons.
 type AddonsStatus struct {
-	CoreDNS      AddonStatus        `json:"coreDNS,omitempty"`
-	KubeProxy    AddonStatus        `json:"kubeProxy,omitempty"`
+	CoreDNS   AddonStatus `json:"coreDNS,omitempty"`
+	KubeProxy AddonStatus `json:"kubeProxy,omitempty"`
+
 	Konnectivity KonnectivityStatus `json:"konnectivity,omitempty"`
 }
 
@@ -183,14 +200,12 @@ type KubernetesStatus struct {
 	Ingress    *KubernetesIngressStatus   `json:"ingress,omitempty"`
 }
 
-// +kubebuilder:validation:Enum=Provisioning;CertificateAuthorityRotating;Upgrading;Migrating;Ready;NotReady
+// +kubebuilder:validation:Enum=Provisioning;Upgrading;Ready;NotReady
 type KubernetesVersionStatus string
 
 var (
 	VersionProvisioning KubernetesVersionStatus = "Provisioning"
-	VersionCARotating   KubernetesVersionStatus = "CertificateAuthorityRotating"
 	VersionUpgrading    KubernetesVersionStatus = "Upgrading"
-	VersionMigrating    KubernetesVersionStatus = "Migrating"
 	VersionReady        KubernetesVersionStatus = "Ready"
 	VersionNotReady     KubernetesVersionStatus = "NotReady"
 )
@@ -206,8 +221,6 @@ type KubernetesVersion struct {
 // KubernetesDeploymentStatus defines the status for the Tenant Control Plane Deployment in the management cluster.
 type KubernetesDeploymentStatus struct {
 	appsv1.DeploymentStatus `json:",inline"`
-	// Selector is the label selector used to group the Tenant Control Plane Pods used by the scale subresource.
-	Selector string `json:"selector"`
 	// The name of the Deployment for the given cluster.
 	Name string `json:"name"`
 	// The namespace which the Deployment for the given cluster is deployed.

api/v1alpha1/tenantcontrolplane_types.go

@@ -4,7 +4,6 @@
 package v1alpha1
 
 import (
-	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -33,23 +32,7 @@ type NetworkProfileSpec struct {
 	DNSServiceIPs []string `json:"dnsServiceIPs,omitempty"`
 }
 
-// +kubebuilder:validation:Enum=Hostname;InternalIP;ExternalIP;InternalDNS;ExternalDNS
-type KubeletPreferredAddressType string
-
-const (
-	NodeHostName    KubeletPreferredAddressType = "Hostname"
-	NodeInternalIP  KubeletPreferredAddressType = "InternalIP"
-	NodeExternalIP  KubeletPreferredAddressType = "ExternalIP"
-	NodeInternalDNS KubeletPreferredAddressType = "InternalDNS"
-	NodeExternalDNS KubeletPreferredAddressType = "ExternalDNS"
-)
-
 type KubeletSpec struct {
-	// Ordered list of the preferred NodeAddressTypes to use for kubelet connections.
-	// Default to Hostname, InternalIP, ExternalIP.
-	// +kubebuilder:default={"Hostname","InternalIP","ExternalIP"}
-	// +kubebuilder:validation:MinItems=1
-	PreferredAddressTypes []KubeletPreferredAddressType `json:"preferredAddressTypes,omitempty"`
 	// CGroupFS defines the  cgroup driver for Kubelet
 	// https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver/
 	CGroupFS CGroupDriver `json:"cgroupfs,omitempty"`
@@ -97,72 +80,18 @@ type ControlPlaneComponentsResources struct {
 	APIServer         *corev1.ResourceRequirements `json:"apiServer,omitempty"`
 	ControllerManager *corev1.ResourceRequirements `json:"controllerManager,omitempty"`
 	Scheduler         *corev1.ResourceRequirements `json:"scheduler,omitempty"`
-	// Define the kine container resources.
-	// Available only if Kamaji is running using Kine as backing storage.
-	Kine *corev1.ResourceRequirements `json:"kine,omitempty"`
 }
 
 type DeploymentSpec struct {
-	// RegistrySettings allows to override the default images for the given Tenant Control Plane instance.
-	// It could be used to point to a different container registry rather than the public one.
-	// +kubebuilder:default={registry:"registry.k8s.io",apiServerImage:"kube-apiserver",controllerManagerImage:"kube-controller-manager",schedulerImage:"kube-scheduler"}
-	RegistrySettings RegistrySettings `json:"registrySettings,omitempty"`
 	// +kubebuilder:default=2
-	Replicas *int32 `json:"replicas,omitempty"`
-	// NodeSelector is a selector which must be true for the pod to fit on a node.
-	// Selector which must match a node's labels for the pod to be scheduled on that node.
-	// More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
-	// RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used
-	// to run the Tenant Control Plane pod. If no RuntimeClass resource matches the named class, the pod will not be run.
-	// If unset or empty, the "legacy" RuntimeClass will be used, which is an implicit class with an
-	// empty definition that uses the default runtime handler.
-	// More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
-	RuntimeClassName string `json:"runtimeClassName,omitempty"`
-	// Strategy describes how to replace existing pods with new ones for the given Tenant Control Plane.
-	// Default value is set to Rolling Update, with a blue/green strategy.
-	// +kubebuilder:default={type:"RollingUpdate",rollingUpdate:{maxUnavailable:0,maxSurge:"100%"}}
-	Strategy appsv1.DeploymentStrategy `json:"strategy,omitempty"`
-	// If specified, the Tenant Control Plane pod's tolerations.
-	// More info: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
-	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
-	// If specified, the Tenant Control Plane pod's scheduling constraints.
-	// More info: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/
-	Affinity *corev1.Affinity `json:"affinity,omitempty"`
-	// TopologySpreadConstraints describes how the Tenant Control Plane pods ought to spread across topology
-	// domains. Scheduler will schedule pods in a way which abides by the constraints.
-	// In case of nil underlying LabelSelector, the Kamaji one for the given Tenant Control Plane will be used.
-	// All topologySpreadConstraints are ANDed.
-	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`
+	Replicas int32 `json:"replicas,omitempty"`
 	// Resources defines the amount of memory and CPU to allocate to each component of the Control Plane
 	// (kube-apiserver, controller-manager, and scheduler).
 	Resources *ControlPlaneComponentsResources `json:"resources,omitempty"`
 	// ExtraArgs allows adding additional arguments to the Control Plane components,
-	// such as kube-apiserver, controller-manager, and scheduler. WARNING - This option
-	// can override existing parameters and cause components to misbehave in unxpected ways.
-	// Only modify if you know what you are doing.
-	ExtraArgs             *ControlPlaneExtraArgs `json:"extraArgs,omitempty"`
-	AdditionalMetadata    AdditionalMetadata     `json:"additionalMetadata,omitempty"`
-	PodAdditionalMetadata AdditionalMetadata     `json:"podAdditionalMetadata,omitempty"`
-	// AdditionalInitContainers allows adding additional init containers to the Control Plane deployment.
-	AdditionalInitContainers []corev1.Container `json:"additionalInitContainers,omitempty"`
-	// AdditionalContainers allows adding additional containers to the Control Plane deployment.
-	AdditionalContainers []corev1.Container `json:"additionalContainers,omitempty"`
-	// AdditionalVolumes allows to add additional volumes to the Control Plane deployment.
-	AdditionalVolumes []corev1.Volume `json:"additionalVolumes,omitempty"`
-	// AdditionalVolumeMounts allows to mount an additional volume into each component of the Control Plane
-	// (kube-apiserver, controller-manager, and scheduler).
-	AdditionalVolumeMounts *AdditionalVolumeMounts `json:"additionalVolumeMounts,omitempty"`
-	// +kubebuilder:default="default"
-	// ServiceAccountName allows to specify the service account to be mounted to the pods of the Control plane deployment
-	ServiceAccountName string `json:"serviceAccountName,omitempty"`
-}
-
-// AdditionalVolumeMounts allows mounting additional volumes to the Control Plane components.
-type AdditionalVolumeMounts struct {
-	APIServer         []corev1.VolumeMount `json:"apiServer,omitempty"`
-	ControllerManager []corev1.VolumeMount `json:"controllerManager,omitempty"`
-	Scheduler         []corev1.VolumeMount `json:"scheduler,omitempty"`
+	// such as kube-apiserver, controller-manager, and scheduler.
+	ExtraArgs          *ControlPlaneExtraArgs `json:"extraArgs,omitempty"`
+	AdditionalMetadata AdditionalMetadata     `json:"additionalMetadata,omitempty"`
 }
 
 // ControlPlaneExtraArgs allows specifying additional arguments to the Control Plane components.
@@ -181,79 +110,34 @@ type ServiceSpec struct {
 }
 
 // AddonSpec defines the spec for every addon.
-type AddonSpec struct {
-	ImageOverrideTrait `json:",inline"`
-}
-
-type ImageOverrideTrait struct {
-	// ImageRepository sets the container registry to pull images from.
-	// if not set, the default ImageRepository will be used instead.
-	ImageRepository string `json:"imageRepository,omitempty"`
-	// ImageTag allows to specify a tag for the image.
-	// In case this value is set, kubeadm does not change automatically the version of the above components during upgrades.
-	ImageTag string `json:"imageTag,omitempty"`
-}
-
-// ExtraArgs allows adding additional arguments to said component.
-// WARNING - This option can override existing konnectivity
-// parameters and cause konnectivity components to misbehave in
-// unxpected ways. Only modify if you know what you are doing.
-type ExtraArgs []string
-
-type KonnectivityServerSpec struct {
-	// The port which Konnectivity server is listening to.
-	Port int32 `json:"port"`
-	// Container image version of the Konnectivity server.
-	// +kubebuilder:default=v0.28.6
-	Version string `json:"version,omitempty"`
-	// Container image used by the Konnectivity server.
-	// +kubebuilder:default=registry.k8s.io/kas-network-proxy/proxy-server
-	Image string `json:"image,omitempty"`
-	// Resources define the amount of CPU and memory to allocate to the Konnectivity server.
-	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
-	ExtraArgs ExtraArgs                    `json:"extraArgs,omitempty"`
-}
-
-type KonnectivityAgentSpec struct {
-	// AgentImage defines the container image for Konnectivity's agent.
-	// +kubebuilder:default=registry.k8s.io/kas-network-proxy/proxy-agent
-	Image string `json:"image,omitempty"`
-	// Version for Konnectivity agent.
-	// +kubebuilder:default=v0.28.6
-	Version string `json:"version,omitempty"`
-	// Tolerations for the deployed agent.
-	// Can be customized to start the konnectivity-agent even if the nodes are not ready or tainted.
-	// +kubebuilder:default={{key: "CriticalAddonsOnly", operator: "Exists"}}
-	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
-	ExtraArgs   ExtraArgs           `json:"extraArgs,omitempty"`
-}
+type AddonSpec struct{}
 
 // KonnectivitySpec defines the spec for Konnectivity.
 type KonnectivitySpec struct {
-	// +kubebuilder:default={version:"v0.28.6",image:"registry.k8s.io/kas-network-proxy/proxy-server",port:8132}
-	KonnectivityServerSpec KonnectivityServerSpec `json:"server,omitempty"`
-	// +kubebuilder:default={version:"v0.28.6",image:"registry.k8s.io/kas-network-proxy/proxy-agent"}
-	KonnectivityAgentSpec KonnectivityAgentSpec `json:"agent,omitempty"`
+	// Port of Konnectivity proxy server.
+	ProxyPort int32 `json:"proxyPort"`
+	// Version for Konnectivity server and agent.
+	// +kubebuilder:default=v0.0.31
+	Version string `json:"version,omitempty"`
+	// ServerImage defines the container image for Konnectivity's server.
+	// +kubebuilder:default=us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-server
+	ServerImage string `json:"serverImage,omitempty"`
+	// AgentImage defines the container image for Konnectivity's agent.
+	// +kubebuilder:default=us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-agent
+	AgentImage string `json:"agentImage,omitempty"`
+	// Resources define the amount of CPU and memory to allocate to the Konnectivity server.
+	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
 }
 
 // AddonsSpec defines the enabled addons and their features.
 type AddonsSpec struct {
-	// Enables the DNS addon in the Tenant Cluster.
-	// The registry and the tag are configurable, the image is hard-coded to `coredns`.
-	CoreDNS *AddonSpec `json:"coreDNS,omitempty"`
-	// Enables the Konnectivity addon in the Tenant Cluster, required if the worker nodes are in a different network.
+	CoreDNS      *AddonSpec        `json:"coreDNS,omitempty"`
 	Konnectivity *KonnectivitySpec `json:"konnectivity,omitempty"`
-	// Enables the kube-proxy addon in the Tenant Cluster.
-	// The registry and the tag are configurable, the image is hard-coded to `kube-proxy`.
-	KubeProxy *AddonSpec `json:"kubeProxy,omitempty"`
+	KubeProxy    *AddonSpec        `json:"kubeProxy,omitempty"`
 }
 
 // TenantControlPlaneSpec defines the desired state of TenantControlPlane.
 type TenantControlPlaneSpec struct {
-	// DataStore allows to specify a DataStore that should be used to store the Kubernetes data for the given Tenant Control Plane.
-	// This parameter is optional and acts as an override over the default one which is used by the Kamaji Operator.
-	// Migration from a different DataStore to another one is not yet supported and the reconciliation will be blocked.
-	DataStore    string       `json:"dataStore,omitempty"`
 	ControlPlane ControlPlane `json:"controlPlane"`
 	// Kubernetes specification for tenant control plane
 	Kubernetes KubernetesSpec `json:"kubernetes"`
@@ -265,13 +149,11 @@ type TenantControlPlaneSpec struct {
 
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
-// +kubebuilder:subresource:scale:specpath=.spec.controlPlane.deployment.replicas,statuspath=.status.kubernetesResources.deployment.replicas,selectorpath=.status.kubernetesResources.deployment.selector
-// +kubebuilder:resource:categories=kamaji,shortName=tcp
+// +kubebuilder:resource:shortName=tcp
 // +kubebuilder:printcolumn:name="Version",type="string",JSONPath=".spec.kubernetes.version",description="Kubernetes version"
-// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.kubernetesResources.version.status",description="Status"
-// +kubebuilder:printcolumn:name="Control-Plane endpoint",type="string",JSONPath=".status.controlPlaneEndpoint",description="Tenant Control Plane Endpoint (API server)"
+// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.kubernetesResources.version.status",description="Kubernetes version"
+// +kubebuilder:printcolumn:name="Control-Plane-Endpoint",type="string",JSONPath=".status.controlPlaneEndpoint",description="Tenant Control Plane Endpoint (API server)"
 // +kubebuilder:printcolumn:name="Kubeconfig",type="string",JSONPath=".status.kubeconfig.admin.secretName",description="Secret which contains admin kubeconfig"
-//+kubebuilder:printcolumn:name="Datastore",type="string",JSONPath=".status.storage.dataStoreName",description="DataStore actually used"
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="Age"
 
 // TenantControlPlane is the Schema for the tenantcontrolplanes API.

api/v1alpha1/types.go

@@ -28,10 +28,9 @@ func (c CGroupDriver) String() string {
 }
 
 const (
-	ServiceTypeLoadBalancer       = (ServiceType)(corev1.ServiceTypeLoadBalancer)
-	ServiceTypeClusterIP          = (ServiceType)(corev1.ServiceTypeClusterIP)
-	ServiceTypeNodePort           = (ServiceType)(corev1.ServiceTypeNodePort)
-	KubeconfigSecretKeyAnnotation = "kamaji.clastix.io/kubeconfig-secret-key"
+	ServiceTypeLoadBalancer = (ServiceType)(corev1.ServiceTypeLoadBalancer)
+	ServiceTypeClusterIP    = (ServiceType)(corev1.ServiceTypeClusterIP)
+	ServiceTypeNodePort     = (ServiceType)(corev1.ServiceTypeNodePort)
 )
 
 // +kubebuilder:validation:Enum=ClusterIP;NodePort;LoadBalancer

api/v1alpha1/zz_generated.deepcopy.go

@@ -1,4 +1,5 @@
 //go:build !ignore_autogenerated
+// +build !ignore_autogenerated
 
 // Copyright 2022 Clastix Labs
 // SPDX-License-Identifier: Apache-2.0
@@ -57,46 +58,9 @@ func (in *AdditionalMetadata) DeepCopy() *AdditionalMetadata {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *AdditionalVolumeMounts) DeepCopyInto(out *AdditionalVolumeMounts) {
-	*out = *in
-	if in.APIServer != nil {
-		in, out := &in.APIServer, &out.APIServer
-		*out = make([]v1.VolumeMount, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.ControllerManager != nil {
-		in, out := &in.ControllerManager, &out.ControllerManager
-		*out = make([]v1.VolumeMount, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.Scheduler != nil {
-		in, out := &in.Scheduler, &out.Scheduler
-		*out = make([]v1.VolumeMount, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdditionalVolumeMounts.
-func (in *AdditionalVolumeMounts) DeepCopy() *AdditionalVolumeMounts {
-	if in == nil {
-		return nil
-	}
-	out := new(AdditionalVolumeMounts)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AddonSpec) DeepCopyInto(out *AddonSpec) {
 	*out = *in
-	out.ImageOverrideTrait = in.ImageOverrideTrait
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AddonSpec.
@@ -192,44 +156,6 @@ func (in AdmissionControllers) DeepCopy() AdmissionControllers {
 	return *out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BasicAuth) DeepCopyInto(out *BasicAuth) {
-	*out = *in
-	in.Username.DeepCopyInto(&out.Username)
-	in.Password.DeepCopyInto(&out.Password)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BasicAuth.
-func (in *BasicAuth) DeepCopy() *BasicAuth {
-	if in == nil {
-		return nil
-	}
-	out := new(BasicAuth)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CertKeyPair) DeepCopyInto(out *CertKeyPair) {
-	*out = *in
-	in.Certificate.DeepCopyInto(&out.Certificate)
-	if in.PrivateKey != nil {
-		in, out := &in.PrivateKey, &out.PrivateKey
-		*out = new(ContentRef)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertKeyPair.
-func (in *CertKeyPair) DeepCopy() *CertKeyPair {
-	if in == nil {
-		return nil
-	}
-	out := new(CertKeyPair)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CertificatePrivateKeyPairStatus) DeepCopyInto(out *CertificatePrivateKeyPairStatus) {
 	*out = *in
@@ -272,48 +198,6 @@ func (in *CertificatesStatus) DeepCopy() *CertificatesStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ClientCertificate) DeepCopyInto(out *ClientCertificate) {
-	*out = *in
-	in.Certificate.DeepCopyInto(&out.Certificate)
-	in.PrivateKey.DeepCopyInto(&out.PrivateKey)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientCertificate.
-func (in *ClientCertificate) DeepCopy() *ClientCertificate {
-	if in == nil {
-		return nil
-	}
-	out := new(ClientCertificate)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ContentRef) DeepCopyInto(out *ContentRef) {
-	*out = *in
-	if in.Content != nil {
-		in, out := &in.Content, &out.Content
-		*out = make([]byte, len(*in))
-		copy(*out, *in)
-	}
-	if in.SecretRef != nil {
-		in, out := &in.SecretRef, &out.SecretRef
-		*out = new(SecretReference)
-		**out = **in
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ContentRef.
-func (in *ContentRef) DeepCopy() *ContentRef {
-	if in == nil {
-		return nil
-	}
-	out := new(ContentRef)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ControlPlane) DeepCopyInto(out *ControlPlane) {
 	*out = *in
@@ -354,11 +238,6 @@ func (in *ControlPlaneComponentsResources) DeepCopyInto(out *ControlPlaneCompone
 		*out = new(v1.ResourceRequirements)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.Kine != nil {
-		in, out := &in.Kine, &out.Kine
-		*out = new(v1.ResourceRequirements)
-		(*in).DeepCopyInto(*out)
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControlPlaneComponentsResources.
@@ -406,213 +285,9 @@ func (in *ControlPlaneExtraArgs) DeepCopy() *ControlPlaneExtraArgs {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStore) DeepCopyInto(out *DataStore) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStore.
-func (in *DataStore) DeepCopy() *DataStore {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStore)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *DataStore) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreCertificateStatus) DeepCopyInto(out *DataStoreCertificateStatus) {
-	*out = *in
-	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreCertificateStatus.
-func (in *DataStoreCertificateStatus) DeepCopy() *DataStoreCertificateStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreCertificateStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreConfigStatus) DeepCopyInto(out *DataStoreConfigStatus) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreConfigStatus.
-func (in *DataStoreConfigStatus) DeepCopy() *DataStoreConfigStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreConfigStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreList) DeepCopyInto(out *DataStoreList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]DataStore, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreList.
-func (in *DataStoreList) DeepCopy() *DataStoreList {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *DataStoreList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreSetupStatus) DeepCopyInto(out *DataStoreSetupStatus) {
-	*out = *in
-	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreSetupStatus.
-func (in *DataStoreSetupStatus) DeepCopy() *DataStoreSetupStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreSetupStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreSpec) DeepCopyInto(out *DataStoreSpec) {
-	*out = *in
-	if in.Endpoints != nil {
-		in, out := &in.Endpoints, &out.Endpoints
-		*out = make(Endpoints, len(*in))
-		copy(*out, *in)
-	}
-	if in.BasicAuth != nil {
-		in, out := &in.BasicAuth, &out.BasicAuth
-		*out = new(BasicAuth)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.TLSConfig != nil {
-		in, out := &in.TLSConfig, &out.TLSConfig
-		*out = new(TLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreSpec.
-func (in *DataStoreSpec) DeepCopy() *DataStoreSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreStatus) DeepCopyInto(out *DataStoreStatus) {
-	*out = *in
-	if in.UsedBy != nil {
-		in, out := &in.UsedBy, &out.UsedBy
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreStatus.
-func (in *DataStoreStatus) DeepCopy() *DataStoreStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DatastoreUsedSecret) DeepCopyInto(out *DatastoreUsedSecret) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatastoreUsedSecret.
-func (in *DatastoreUsedSecret) DeepCopy() *DatastoreUsedSecret {
-	if in == nil {
-		return nil
-	}
-	out := new(DatastoreUsedSecret)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *DeploymentSpec) DeepCopyInto(out *DeploymentSpec) {
 	*out = *in
-	out.RegistrySettings = in.RegistrySettings
-	if in.Replicas != nil {
-		in, out := &in.Replicas, &out.Replicas
-		*out = new(int32)
-		**out = **in
-	}
-	if in.NodeSelector != nil {
-		in, out := &in.NodeSelector, &out.NodeSelector
-		*out = make(map[string]string, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	in.Strategy.DeepCopyInto(&out.Strategy)
-	if in.Tolerations != nil {
-		in, out := &in.Tolerations, &out.Tolerations
-		*out = make([]v1.Toleration, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.Affinity != nil {
-		in, out := &in.Affinity, &out.Affinity
-		*out = new(v1.Affinity)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.TopologySpreadConstraints != nil {
-		in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints
-		*out = make([]v1.TopologySpreadConstraint, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
 	if in.Resources != nil {
 		in, out := &in.Resources, &out.Resources
 		*out = new(ControlPlaneComponentsResources)
@@ -624,33 +299,6 @@ func (in *DeploymentSpec) DeepCopyInto(out *DeploymentSpec) {
 		(*in).DeepCopyInto(*out)
 	}
 	in.AdditionalMetadata.DeepCopyInto(&out.AdditionalMetadata)
-	in.PodAdditionalMetadata.DeepCopyInto(&out.PodAdditionalMetadata)
-	if in.AdditionalInitContainers != nil {
-		in, out := &in.AdditionalInitContainers, &out.AdditionalInitContainers
-		*out = make([]v1.Container, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.AdditionalContainers != nil {
-		in, out := &in.AdditionalContainers, &out.AdditionalContainers
-		*out = make([]v1.Container, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.AdditionalVolumes != nil {
-		in, out := &in.AdditionalVolumes, &out.AdditionalVolumes
-		*out = make([]v1.Volume, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.AdditionalVolumeMounts != nil {
-		in, out := &in.AdditionalVolumeMounts, &out.AdditionalVolumeMounts
-		*out = new(AdditionalVolumeMounts)
-		(*in).DeepCopyInto(*out)
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeploymentSpec.
@@ -697,22 +345,20 @@ func (in *ETCDCertificatesStatus) DeepCopy() *ETCDCertificatesStatus {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in Endpoints) DeepCopyInto(out *Endpoints) {
-	{
-		in := &in
-		*out = make(Endpoints, len(*in))
-		copy(*out, *in)
-	}
+func (in *ETCDStatus) DeepCopyInto(out *ETCDStatus) {
+	*out = *in
+	in.Role.DeepCopyInto(&out.Role)
+	in.User.DeepCopyInto(&out.User)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Endpoints.
-func (in Endpoints) DeepCopy() Endpoints {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ETCDStatus.
+func (in *ETCDStatus) DeepCopy() *ETCDStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(Endpoints)
+	out := new(ETCDStatus)
 	in.DeepCopyInto(out)
-	return *out
+	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -731,40 +377,6 @@ func (in *ExternalKubernetesObjectStatus) DeepCopy() *ExternalKubernetesObjectSt
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in ExtraArgs) DeepCopyInto(out *ExtraArgs) {
-	{
-		in := &in
-		*out = make(ExtraArgs, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtraArgs.
-func (in ExtraArgs) DeepCopy() ExtraArgs {
-	if in == nil {
-		return nil
-	}
-	out := new(ExtraArgs)
-	in.DeepCopyInto(out)
-	return *out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ImageOverrideTrait) DeepCopyInto(out *ImageOverrideTrait) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImageOverrideTrait.
-func (in *ImageOverrideTrait) DeepCopy() *ImageOverrideTrait {
-	if in == nil {
-		return nil
-	}
-	out := new(ImageOverrideTrait)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *IngressSpec) DeepCopyInto(out *IngressSpec) {
 	*out = *in
@@ -782,28 +394,19 @@ func (in *IngressSpec) DeepCopy() *IngressSpec {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *KonnectivityAgentSpec) DeepCopyInto(out *KonnectivityAgentSpec) {
+func (in *KineStatus) DeepCopyInto(out *KineStatus) {
 	*out = *in
-	if in.Tolerations != nil {
-		in, out := &in.Tolerations, &out.Tolerations
-		*out = make([]v1.Toleration, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.ExtraArgs != nil {
-		in, out := &in.ExtraArgs, &out.ExtraArgs
-		*out = make(ExtraArgs, len(*in))
-		copy(*out, *in)
-	}
+	out.Config = in.Config
+	in.Setup.DeepCopyInto(&out.Setup)
+	in.Certificate.DeepCopyInto(&out.Certificate)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KonnectivityAgentSpec.
-func (in *KonnectivityAgentSpec) DeepCopy() *KonnectivityAgentSpec {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KineStatus.
+func (in *KineStatus) DeepCopy() *KineStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(KonnectivityAgentSpec)
+	out := new(KineStatus)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -824,35 +427,13 @@ func (in *KonnectivityConfigMap) DeepCopy() *KonnectivityConfigMap {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *KonnectivityServerSpec) DeepCopyInto(out *KonnectivityServerSpec) {
+func (in *KonnectivitySpec) DeepCopyInto(out *KonnectivitySpec) {
 	*out = *in
 	if in.Resources != nil {
 		in, out := &in.Resources, &out.Resources
 		*out = new(v1.ResourceRequirements)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.ExtraArgs != nil {
-		in, out := &in.ExtraArgs, &out.ExtraArgs
-		*out = make(ExtraArgs, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KonnectivityServerSpec.
-func (in *KonnectivityServerSpec) DeepCopy() *KonnectivityServerSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(KonnectivityServerSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *KonnectivitySpec) DeepCopyInto(out *KonnectivitySpec) {
-	*out = *in
-	in.KonnectivityServerSpec.DeepCopyInto(&out.KonnectivityServerSpec)
-	in.KonnectivityAgentSpec.DeepCopyInto(&out.KonnectivityAgentSpec)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KonnectivitySpec.
@@ -922,6 +503,8 @@ func (in *KubeadmPhaseStatus) DeepCopy() *KubeadmPhaseStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *KubeadmPhasesStatus) DeepCopyInto(out *KubeadmPhasesStatus) {
 	*out = *in
+	in.UploadConfigKubeadm.DeepCopyInto(&out.UploadConfigKubeadm)
+	in.UploadConfigKubelet.DeepCopyInto(&out.UploadConfigKubelet)
 	in.BootstrapToken.DeepCopyInto(&out.BootstrapToken)
 }
 
@@ -972,11 +555,6 @@ func (in *KubeconfigsStatus) DeepCopy() *KubeconfigsStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *KubeletSpec) DeepCopyInto(out *KubeletSpec) {
 	*out = *in
-	if in.PreferredAddressTypes != nil {
-		in, out := &in.PreferredAddressTypes, &out.PreferredAddressTypes
-		*out = make([]KubeletPreferredAddressType, len(*in))
-		copy(*out, *in)
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubeletSpec.
@@ -1041,7 +619,7 @@ func (in *KubernetesServiceStatus) DeepCopy() *KubernetesServiceStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *KubernetesSpec) DeepCopyInto(out *KubernetesSpec) {
 	*out = *in
-	in.Kubelet.DeepCopyInto(&out.Kubelet)
+	out.Kubelet = in.Kubelet
 	if in.AdmissionControllers != nil {
 		in, out := &in.AdmissionControllers, &out.AdmissionControllers
 		*out = make(AdmissionControllers, len(*in))
@@ -1144,32 +722,48 @@ func (in *PublicKeyPrivateKeyPairStatus) DeepCopy() *PublicKeyPrivateKeyPairStat
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RegistrySettings) DeepCopyInto(out *RegistrySettings) {
+func (in *SQLCertificateStatus) DeepCopyInto(out *SQLCertificateStatus) {
 	*out = *in
+	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RegistrySettings.
-func (in *RegistrySettings) DeepCopy() *RegistrySettings {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SQLCertificateStatus.
+func (in *SQLCertificateStatus) DeepCopy() *SQLCertificateStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(RegistrySettings)
+	out := new(SQLCertificateStatus)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SecretReference) DeepCopyInto(out *SecretReference) {
+func (in *SQLConfigStatus) DeepCopyInto(out *SQLConfigStatus) {
 	*out = *in
-	out.SecretReference = in.SecretReference
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretReference.
-func (in *SecretReference) DeepCopy() *SecretReference {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SQLConfigStatus.
+func (in *SQLConfigStatus) DeepCopy() *SQLConfigStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(SecretReference)
+	out := new(SQLConfigStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SQLSetupStatus) DeepCopyInto(out *SQLSetupStatus) {
+	*out = *in
+	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SQLSetupStatus.
+func (in *SQLSetupStatus) DeepCopy() *SQLSetupStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(SQLSetupStatus)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -1193,9 +787,16 @@ func (in *ServiceSpec) DeepCopy() *ServiceSpec {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *StorageStatus) DeepCopyInto(out *StorageStatus) {
 	*out = *in
-	out.Config = in.Config
-	in.Setup.DeepCopyInto(&out.Setup)
-	in.Certificate.DeepCopyInto(&out.Certificate)
+	if in.ETCD != nil {
+		in, out := &in.ETCD, &out.ETCD
+		*out = new(ETCDStatus)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Kine != nil {
+		in, out := &in.Kine, &out.Kine
+		*out = new(KineStatus)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StorageStatus.
@@ -1208,27 +809,6 @@ func (in *StorageStatus) DeepCopy() *StorageStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TLSConfig) DeepCopyInto(out *TLSConfig) {
-	*out = *in
-	in.CertificateAuthority.DeepCopyInto(&out.CertificateAuthority)
-	if in.ClientCertificate != nil {
-		in, out := &in.ClientCertificate, &out.ClientCertificate
-		*out = new(ClientCertificate)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig.
-func (in *TLSConfig) DeepCopy() *TLSConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(TLSConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TenantControlPlane) DeepCopyInto(out *TenantControlPlane) {
 	*out = *in
@@ -1328,18 +908,3 @@ func (in *TenantControlPlaneStatus) DeepCopy() *TenantControlPlaneStatus {
 	in.DeepCopyInto(out)
 	return out
 }
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TenantControlPlaneStatusDataStore) DeepCopyInto(out *TenantControlPlaneStatusDataStore) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TenantControlPlaneStatusDataStore.
-func (in *TenantControlPlaneStatusDataStore) DeepCopy() *TenantControlPlaneStatusDataStore {
-	if in == nil {
-		return nil
-	}
-	out := new(TenantControlPlaneStatusDataStore)
-	in.DeepCopyInto(out)
-	return out
-}

charts/kamaji/Chart.yaml

@@ -1,24 +1,37 @@
 apiVersion: v2
-appVersion: v1.0.0
-description: Kamaji is the Hosted Control Plane Manager for Kubernetes.
+name: kamaji
+description: Kamaji is a tool aimed to build and operate a Managed Kubernetes Service with a fraction of the operational burden. With Kamaji, you can deploy and operate hundreds of Kubernetes clusters as a hyper-scaler.
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: 0.1.0
+
 home: https://github.com/clastix/kamaji
-icon: https://github.com/clastix/kamaji/raw/master/assets/logo-colored.png
-kubeVersion: ">=1.21.0-0"
+sources: ["https://github.com/clastix/kamaji"]
+kubeVersion: ">=1.18"
 maintainers:
+- email: iam@mendrugory.com
+  name: Gonzalo Gabriel Jiménez Fuentes
 - email: dario@tranchitella.eu
   name: Dario Tranchitella
-  url: https://clastix.io
 - email: me@maxgio.it
   name: Massimiliano Giovagnoli
 - email: me@bsctl.io
   name: Adriano Pezzuto
-  url: https://clastix.io
-name: kamaji
-sources:
-- https://github.com/clastix/kamaji
-type: application
-version: 1.0.0
-annotations:
-  catalog.cattle.io/certified: partner
-  catalog.cattle.io/release-name: kamaji
-  catalog.cattle.io/display-name: Kamaji

charts/kamaji/README.md

@@ -1,16 +1,17 @@
 # kamaji
 
-![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.0.0](https://img.shields.io/badge/AppVersion-v1.0.0-informational?style=flat-square)
+![Version: 0.1.1](https://img.shields.io/badge/Version-0.1.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.1.0](https://img.shields.io/badge/AppVersion-0.1.0-informational?style=flat-square)
 
-Kamaji is the Hosted Control Plane Manager for Kubernetes.
+Kamaji is a tool aimed to build and operate a Managed Kubernetes Service with a fraction of the operational burden. With Kamaji, you can deploy and operate hundreds of Kubernetes clusters as a hyper-scaler.
 
 ## Maintainers
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Dario Tranchitella | <dario@tranchitella.eu> | <https://clastix.io> |
+| Gonzalo Gabriel Jiménez Fuentes | <iam@mendrugory.com> |  |
+| Dario Tranchitella | <dario@tranchitella.eu> |  |
 | Massimiliano Giovagnoli | <me@maxgio.it> |  |
-| Adriano Pezzuto | <me@bsctl.io> | <https://clastix.io> |
+| Adriano Pezzuto | <me@bsctl.io> |  |
 
 ## Source Code
 
@@ -18,7 +19,7 @@ Kamaji is the Hosted Control Plane Manager for Kubernetes.
 
 ## Requirements
 
-Kubernetes: `>=1.21.0-0`
+Kubernetes: `>=1.18`
 
 [Kamaji](https://github.com/clastix/kamaji) requires a [multi-tenant `etcd`](https://github.com/clastix/kamaji-internal/blob/master/deploy/getting-started-with-kamaji.md#setup-internal-multi-tenant-etcd) cluster.
 This Helm Chart starting from v0.1.1 provides the installation of an internal `etcd` in order to streamline the local test. If you'd like to use an externally managed etcd instance, you can specify the overrides and by setting the value `etcd.deploy=false`.
@@ -66,55 +67,29 @@ Here the values you can override:
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | affinity | object | `{}` | Kubernetes affinity rules to apply to Kamaji controller pods |
-| cfssl.image.repository | string | `"cfssl/cfssl"` |  |
-| cfssl.image.tag | string | `"latest"` |  |
-| datastore.basicAuth.passwordSecret.keyPath | string | `nil` | The Secret key where the data is stored. |
-| datastore.basicAuth.passwordSecret.name | string | `nil` | The name of the Secret containing the password used to connect to the relational database. |
-| datastore.basicAuth.passwordSecret.namespace | string | `nil` | The namespace of the Secret containing the password used to connect to the relational database. |
-| datastore.basicAuth.usernameSecret.keyPath | string | `nil` | The Secret key where the data is stored. |
-| datastore.basicAuth.usernameSecret.name | string | `nil` | The name of the Secret containing the username used to connect to the relational database. |
-| datastore.basicAuth.usernameSecret.namespace | string | `nil` | The namespace of the Secret containing the username used to connect to the relational database. |
-| datastore.driver | string | `"etcd"` | (string) The Kamaji Datastore driver, supported: etcd, MySQL, PostgreSQL (defaults=etcd). |
-| datastore.enabled | bool | `true` | (bool) Enable the Kamaji Datastore creation (default=true) |
-| datastore.endpoints | list | `[]` | (array) List of endpoints of the selected Datastore. When letting the Chart install the etcd datastore, this field is populated automatically. |
-| datastore.nameOverride | string | `nil` | The Datastore name override, if empty and enabled=true defaults to `default`, if enabled=false, this is the name of the Datastore to connect to. |
-| datastore.tlsConfig.certificateAuthority.certificate.keyPath | string | `nil` | Key of the Secret which contains the content of the certificate. |
-| datastore.tlsConfig.certificateAuthority.certificate.name | string | `nil` | Name of the Secret containing the CA required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.certificateAuthority.certificate.namespace | string | `nil` | Namespace of the Secret containing the CA required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.certificateAuthority.privateKey.keyPath | string | `nil` | Key of the Secret which contains the content of the private key. |
-| datastore.tlsConfig.certificateAuthority.privateKey.name | string | `nil` | Name of the Secret containing the CA private key required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.certificateAuthority.privateKey.namespace | string | `nil` | Namespace of the Secret containing the CA private key required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.clientCertificate.certificate.keyPath | string | `nil` | Key of the Secret which contains the content of the certificate. |
-| datastore.tlsConfig.clientCertificate.certificate.name | string | `nil` | Name of the Secret containing the client certificate required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.clientCertificate.certificate.namespace | string | `nil` | Namespace of the Secret containing the client certificate required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.clientCertificate.privateKey.keyPath | string | `nil` | Key of the Secret which contains the content of the private key. |
-| datastore.tlsConfig.clientCertificate.privateKey.name | string | `nil` | Name of the Secret containing the client certificate private key required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.clientCertificate.privateKey.namespace | string | `nil` | Namespace of the Secret containing the client certificate private key required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.enabled | bool | `true` |  |
+| configPath | string | `"./kamaji.yaml"` | Configuration file path alternative. (default "./kamaji.yaml") |
 | etcd.compactionInterval | int | `0` | ETCD Compaction interval (e.g. "5m0s"). (default: "0" (disabled)) |
 | etcd.deploy | bool | `true` | Install an etcd with enabled multi-tenancy along with Kamaji |
-| etcd.image | object | `{"pullPolicy":"IfNotPresent","repository":"quay.io/coreos/etcd","tag":"v3.5.6"}` | Install specific etcd image |
+| etcd.image | object | `{"pullPolicy":"IfNotPresent","repository":"quay.io/coreos/etcd","tag":"v3.5.4"}` | Install specific etcd image |
 | etcd.livenessProbe | object | `{"failureThreshold":8,"httpGet":{"path":"/health?serializable=true","port":2381,"scheme":"HTTP"},"initialDelaySeconds":10,"periodSeconds":10,"timeoutSeconds":15}` | The livenessProbe for the etcd container |
 | etcd.overrides.caSecret.name | string | `"etcd-certs"` | Name of the secret which contains CA's certificate and private key. (default: "etcd-certs") |
 | etcd.overrides.caSecret.namespace | string | `"kamaji-system"` | Namespace of the secret which contains CA's certificate and private key. (default: "kamaji-system") |
 | etcd.overrides.clientSecret.name | string | `"root-client-certs"` | Name of the secret which contains ETCD client certificates. (default: "root-client-certs") |
 | etcd.overrides.clientSecret.namespace | string | `"kamaji-system"` | Name of the namespace where the secret which contains ETCD client certificates is. (default: "kamaji-system") |
-| etcd.overrides.endpoints | object | `{"etcd-0":"etcd-0.etcd.kamaji-system.svc.cluster.local","etcd-1":"etcd-1.etcd.kamaji-system.svc.cluster.local","etcd-2":"etcd-2.etcd.kamaji-system.svc.cluster.local"}` | (map) Dictionary of the endpoints for the etcd cluster's members, key is the name of the etcd server. Don't define the protocol (TLS is automatically inflected), or any port, inflected from .etcd.peerApiPort value. |
+| etcd.overrides.endpoints | object | `{"etcd-0":"https://etcd-0.etcd.kamaji-system.svc.cluster.local","etcd-1":"https://etcd-1.etcd.kamaji-system.svc.cluster.local","etcd-2":"https://etcd-2.etcd.kamaji-system.svc.cluster.local"}` | (map) Dictionary of the endpoints for the etcd cluster's members, key is the name of the etcd server. Don't define any port, inflected from .etcd.peerApiPort value. |
 | etcd.peerApiPort | int | `2380` | The peer API port which servers are listening to. |
 | etcd.persistence.accessModes[0] | string | `"ReadWriteOnce"` |  |
-| etcd.persistence.customAnnotations | object | `{}` | The custom annotations to add to the PVC |
 | etcd.persistence.size | string | `"10Gi"` |  |
-| etcd.persistence.storageClassName | string | `""` |  |
+| etcd.persistence.storageClass | string | `""` |  |
 | etcd.port | int | `2379` | The client request port. |
 | etcd.serviceAccount.create | bool | `true` | Create a ServiceAccount, required to install and provision the etcd backing storage (default: true) |
 | etcd.serviceAccount.name | string | `""` | Define the ServiceAccount name to use during the setup and provision of the etcd backing storage (default: "") |
-| etcd.tolerations | list | `[]` | (array) Kubernetes affinity rules to apply to Kamaji etcd pods |
 | extraArgs | list | `[]` | A list of extra arguments to add to the kamaji controller default ones |
 | fullnameOverride | string | `""` |  |
 | healthProbeBindAddress | string | `":8081"` | The address the probe endpoint binds to. (default ":8081") |
 | image.pullPolicy | string | `"Always"` |  |
 | image.repository | string | `"clastix/kamaji"` | The container image of the Kamaji controller. |
-| image.tag | string | `nil` | Overrides the image tag whose default is the chart appVersion. |
+| image.tag | string | `"latest"` |  |
 | imagePullSecrets | list | `[]` |  |
 | livenessProbe | object | `{"httpGet":{"path":"/healthz","port":"healthcheck"},"initialDelaySeconds":15,"periodSeconds":20}` | The livenessProbe for the controller container |
 | loggingDevel.enable | bool | `false` | (string) Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error) (default false) |
@@ -130,16 +105,10 @@ Here the values you can override:
 | resources.requests.cpu | string | `"100m"` |  |
 | resources.requests.memory | string | `"20Mi"` |  |
 | securityContext | object | `{"allowPrivilegeEscalation":false}` | The securityContext to apply to the Kamaji controller container only. It does not apply to the Kamaji RBAC proxy container. |
+| service.port | int | `8443` |  |
+| service.type | string | `"ClusterIP"` |  |
 | serviceAccount.annotations | object | `{}` |  |
 | serviceAccount.create | bool | `true` |  |
 | serviceAccount.name | string | `"kamaji-controller-manager"` |  |
-| serviceMonitor.enabled | bool | `false` | Toggle the ServiceMonitor true if you have Prometheus Operator installed and configured |
-| telemetry | object | `{"disabled":false}` | Disable the analytics traces collection |
 | temporaryDirectoryPath | string | `"/tmp/kamaji"` | Directory which will be used to work with temporary files. (default "/tmp/kamaji") |
 | tolerations | list | `[]` | Kubernetes node taints that the Kamaji controller pods would tolerate |
-
-## Installing and managing etcd as DataStore
-
-Kamaji supports multiple data store, although `etcd` is the default one: thus, an initial cluster will be created upon the Chart installation.
-
-The `DataStore` resource can be configured with the proper values in case of overrides when using a different driver, otherwise all the required data will be inherited by the Chart values.

charts/kamaji/README.md.gotmpl

@@ -54,9 +54,3 @@ If you only need to make minor customizations, you can specify them on the comma
 Here the values you can override:
 
 {{ template "chart.valuesSection" . }}
-
-## Installing and managing etcd as DataStore
-
-Kamaji supports multiple data store, although `etcd` is the default one: thus, an initial cluster will be created upon the Chart installation.
-
-The `DataStore` resource can be configured with the proper values in case of overrides when using a different driver, otherwise all the required data will be inherited by the Chart values.

charts/kamaji/app-readme.md

@@ -1,12 +0,0 @@
-# Kamaji
-
-Kamaji deploys and operates Kubernetes at scale with a fraction of the operational burden.
-
-Useful links:
-- [Kamaji Github repository](https://github.com/clastix/kamaji)
-- [Kamaji Documentation](https://kamaji.clastix.io)
-
-## Requirements
-
-* Kubernetes v1.22+
-* Helm v3

charts/kamaji/crds/datastore.yaml

@@ -1,293 +0,0 @@
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    cert-manager.io/inject-ca-from: kamaji-system/kamaji-serving-cert
-    controller-gen.kubebuilder.io/version: v0.11.4
-  name: datastores.kamaji.clastix.io
-spec:
-  group: kamaji.clastix.io
-  names:
-    kind: DataStore
-    listKind: DataStoreList
-    plural: datastores
-    singular: datastore
-  scope: Cluster
-  versions:
-    - additionalPrinterColumns:
-        - description: Kamaji data store driver
-          jsonPath: .spec.driver
-          name: Driver
-          type: string
-        - description: Age
-          jsonPath: .metadata.creationTimestamp
-          name: Age
-          type: date
-      name: v1alpha1
-      schema:
-        openAPIV3Schema:
-          description: DataStore is the Schema for the datastores API.
-          properties:
-            apiVersion:
-              description: |-
-                APIVersion defines the versioned schema of this representation of an object.
-                Servers should convert recognized schemas to the latest internal value, and
-                may reject unrecognized values.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-              type: string
-            kind:
-              description: |-
-                Kind is a string value representing the REST resource this object represents.
-                Servers may infer this from the endpoint the client submits requests to.
-                Cannot be updated.
-                In CamelCase.
-                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: DataStoreSpec defines the desired state of DataStore.
-              properties:
-                basicAuth:
-                  description: |-
-                    In case of authentication enabled for the given data store, specifies the username and password pair.
-                    This value is optional.
-                  properties:
-                    password:
-                      properties:
-                        content:
-                          description: |-
-                            Bare content of the file, base64 encoded.
-                            It has precedence over the SecretReference value.
-                          format: byte
-                          type: string
-                        secretReference:
-                          properties:
-                            keyPath:
-                              description: |-
-                                Name of the key for the given Secret reference where the content is stored.
-                                This value is mandatory.
-                              minLength: 1
-                              type: string
-                            name:
-                              description: name is unique within a namespace to reference
-                                a secret resource.
-                              type: string
-                            namespace:
-                              description: namespace defines the space within which
-                                the secret name must be unique.
-                              type: string
-                          required:
-                            - keyPath
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    username:
-                      properties:
-                        content:
-                          description: |-
-                            Bare content of the file, base64 encoded.
-                            It has precedence over the SecretReference value.
-                          format: byte
-                          type: string
-                        secretReference:
-                          properties:
-                            keyPath:
-                              description: |-
-                                Name of the key for the given Secret reference where the content is stored.
-                                This value is mandatory.
-                              minLength: 1
-                              type: string
-                            name:
-                              description: name is unique within a namespace to reference
-                                a secret resource.
-                              type: string
-                            namespace:
-                              description: namespace defines the space within which
-                                the secret name must be unique.
-                              type: string
-                          required:
-                            - keyPath
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                  required:
-                    - password
-                    - username
-                  type: object
-                driver:
-                  description: The driver to use to connect to the shared datastore.
-                  enum:
-                    - etcd
-                    - MySQL
-                    - PostgreSQL
-                    - NATS
-                  type: string
-                endpoints:
-                  description: |-
-                    List of the endpoints to connect to the shared datastore.
-                    No need for protocol, just bare IP/FQDN and port.
-                  items:
-                    type: string
-                  minItems: 1
-                  type: array
-                tlsConfig:
-                  description: |-
-                    Defines the TLS/SSL configuration required to connect to the data store in a secure way.
-                    This value is optional.
-                  properties:
-                    certificateAuthority:
-                      description: |-
-                        Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference.
-                        The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.
-                      properties:
-                        certificate:
-                          properties:
-                            content:
-                              description: |-
-                                Bare content of the file, base64 encoded.
-                                It has precedence over the SecretReference value.
-                              format: byte
-                              type: string
-                            secretReference:
-                              properties:
-                                keyPath:
-                                  description: |-
-                                    Name of the key for the given Secret reference where the content is stored.
-                                    This value is mandatory.
-                                  minLength: 1
-                                  type: string
-                                name:
-                                  description: name is unique within a namespace to
-                                    reference a secret resource.
-                                  type: string
-                                namespace:
-                                  description: namespace defines the space within which
-                                    the secret name must be unique.
-                                  type: string
-                              required:
-                                - keyPath
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        privateKey:
-                          properties:
-                            content:
-                              description: |-
-                                Bare content of the file, base64 encoded.
-                                It has precedence over the SecretReference value.
-                              format: byte
-                              type: string
-                            secretReference:
-                              properties:
-                                keyPath:
-                                  description: |-
-                                    Name of the key for the given Secret reference where the content is stored.
-                                    This value is mandatory.
-                                  minLength: 1
-                                  type: string
-                                name:
-                                  description: name is unique within a namespace to
-                                    reference a secret resource.
-                                  type: string
-                                namespace:
-                                  description: namespace defines the space within which
-                                    the secret name must be unique.
-                                  type: string
-                              required:
-                                - keyPath
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                      required:
-                        - certificate
-                      type: object
-                    clientCertificate:
-                      description: Specifies the SSL/TLS key and private key pair used
-                        to connect to the data store.
-                      properties:
-                        certificate:
-                          properties:
-                            content:
-                              description: |-
-                                Bare content of the file, base64 encoded.
-                                It has precedence over the SecretReference value.
-                              format: byte
-                              type: string
-                            secretReference:
-                              properties:
-                                keyPath:
-                                  description: |-
-                                    Name of the key for the given Secret reference where the content is stored.
-                                    This value is mandatory.
-                                  minLength: 1
-                                  type: string
-                                name:
-                                  description: name is unique within a namespace to
-                                    reference a secret resource.
-                                  type: string
-                                namespace:
-                                  description: namespace defines the space within which
-                                    the secret name must be unique.
-                                  type: string
-                              required:
-                                - keyPath
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        privateKey:
-                          properties:
-                            content:
-                              description: |-
-                                Bare content of the file, base64 encoded.
-                                It has precedence over the SecretReference value.
-                              format: byte
-                              type: string
-                            secretReference:
-                              properties:
-                                keyPath:
-                                  description: |-
-                                    Name of the key for the given Secret reference where the content is stored.
-                                    This value is mandatory.
-                                  minLength: 1
-                                  type: string
-                                name:
-                                  description: name is unique within a namespace to
-                                    reference a secret resource.
-                                  type: string
-                                namespace:
-                                  description: namespace defines the space within which
-                                    the secret name must be unique.
-                                  type: string
-                              required:
-                                - keyPath
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                      required:
-                        - certificate
-                        - privateKey
-                      type: object
-                  required:
-                    - certificateAuthority
-                  type: object
-              required:
-                - driver
-                - endpoints
-              type: object
-            status:
-              description: DataStoreStatus defines the observed state of DataStore.
-              properties:
-                usedBy:
-                  description: List of the Tenant Control Planes, namespaced named,
-                    using this data store.
-                  items:
-                    type: string
-                  type: array
-              type: object
-          type: object
-      served: true
-      storage: true
-      subresources:
-        status: {}

charts/kamaji/templates/_helpers.tpl

@@ -46,9 +46,9 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 Selector labels
 */}}
 {{- define "kamaji.selectorLabels" -}}
-app.kubernetes.io/name: {{ default (include "kamaji.name" .) .name }}
-app.kubernetes.io/instance: {{ default .Release.Name .instance }}
-app.kubernetes.io/component: {{ default "controller-manager" .component }}
+app.kubernetes.io/name: {{ include "kamaji.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: controller-manager
 {{- end }}
 
 {{/*
@@ -61,31 +61,3 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
-
-{{/*
-Create the name of the Service to user for webhooks
-*/}}
-{{- define "kamaji.webhookServiceName" -}}
-{{- printf "%s-webhook-service" (include "kamaji.fullname" .) }}
-{{- end }}
-
-{{/*
-Create the name of the Service to user for metrics
-*/}}
-{{- define "kamaji.metricsServiceName" -}}
-{{- printf "%s-metrics-service" (include "kamaji.fullname" .) }}
-{{- end }}
-
-{{/*
-Create the name of the cert-manager secret
-*/}}
-{{- define "kamaji.webhookSecretName" -}}
-{{- printf "%s-webhook-server-cert" (include "kamaji.fullname" .) }}
-{{- end }}
-
-{{/*
-Create the name of the cert-manager Certificate
-*/}}
-{{- define "kamaji.certificateName" -}}
-{{- printf "%s-serving-cert" (include "kamaji.fullname" .) }}
-{{- end }}

charts/kamaji/templates/_helpers_datastore.tpl

@@ -1,94 +0,0 @@
-{{/*
-Create a default fully qualified datastore name.
-*/}}
-{{- define "datastore.fullname" -}}
-{{- if .Values.datastore.enabled }}
-{{- default "default" .Values.datastore.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- required "A valid .Values.datastore.nameOverride required!" .Values.datastore.nameOverride }}
-{{- end }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "datastore.labels" -}}
-kamaji.clastix.io/datastore: {{ .Values.datastore.driver }}
-helm.sh/chart: {{ include "kamaji.chart" . }}
-{{ include "kamaji.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Datastore endpoints, in case of ETCD, retrieving the one provided by the chart.
-*/}}
-{{- define "datastore.endpoints" -}}
-{{- if eq .Values.datastore.driver "etcd" }}
-{{ include "etcd.endpoints" . }}
-{{- else }}
-{{ .Values.datastore.endpoints }}
-{{- end }}
-{{- end }}
-
-{{/*
-The Certificate Authority section for the DataSource object.
-*/}}
-{{- define "datastore.certificateAuthority" -}}
-{{- if eq .Values.datastore.driver "etcd" }}
-certificate:
-  secretReference:
-    name: {{ include "etcd.caSecretName" . }}
-    namespace: {{ include "etcd.caSecretNamespace" . }}
-    keyPath: ca.crt
-privateKey:
-  secretReference:
-    name: {{ include "etcd.caSecretName" . }}
-    namespace: {{ include "etcd.caSecretNamespace" . }}
-    keyPath: ca.key
-{{- else }}
-certificate:
-  secretReference:
-    name: {{ .Values.datastore.tlsConfig.certificateAuthority.certificate.name }}
-    namespace: {{ .Values.datastore.tlsConfig.certificateAuthority.certificate.namespace }}
-    keyPath: {{ .Values.datastore.tlsConfig.certificateAuthority.certificate.keyPath }}
-{{- if .Values.datastore.tlsConfig.certificateAuthority.privateKey.name }}
-privateKey:
-  secretReference:
-    name: {{ .Values.datastore.tlsConfig.certificateAuthority.privateKey.name }}
-    namespace: {{ .Values.datastore.tlsConfig.certificateAuthority.privateKey.namespace }}
-    keyPath: {{ .Values.datastore.tlsConfig.certificateAuthority.privateKey.keyPath }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-The Client Certificate section for the DataSource object.
-*/}}
-{{- define "datastore.clientCertificate" -}}
-{{- if eq .Values.datastore.driver "etcd" }}
-certificate:
-    secretReference:
-      name: {{ include "etcd.clientSecretName" . }}
-      namespace: {{ include "etcd.clientSecretNamespace" . }}
-      keyPath: tls.crt
-privateKey:
-    secretReference:
-      name: {{ include "etcd.clientSecretName" . }}
-      namespace: {{ include "etcd.clientSecretNamespace" . }}
-      keyPath: tls.key
-{{- else }}
-certificate:
-  secretReference:
-    name: {{ .Values.datastore.tlsConfig.clientCertificate.certificate.name }}
-    namespace: {{ .Values.datastore.tlsConfig.clientCertificate.certificate.namespace }}
-    keyPath: {{ .Values.datastore.tlsConfig.clientCertificate.certificate.keyPath }}
-privateKey:
-  secretReference:
-    name: {{ .Values.datastore.tlsConfig.clientCertificate.privateKey.name }}
-    namespace: {{ .Values.datastore.tlsConfig.clientCertificate.privateKey.namespace }}
-    keyPath: {{ .Values.datastore.tlsConfig.clientCertificate.privateKey.keyPath }}
-{{- end }}
-{{- end }}

charts/kamaji/templates/_helpers_etcd.tpl

@@ -99,7 +99,7 @@ Comma separated list of etcd endpoints, using the overrides in case of unmanaged
 {{- $list := list -}}
 {{- if .Values.etcd.deploy }}
     {{- range $count := until 3 -}}
-        {{- $list = append $list (printf "%s-%d.%s.%s.svc.cluster.local:%d" "etcd" $count ( include "etcd.serviceName" . ) $.Release.Namespace (int $.Values.etcd.port) ) -}}
+        {{- $list = append $list (printf "https://%s-%d.%s.%s.svc.cluster.local:%d" "etcd" $count ( include "etcd.serviceName" . ) $.Release.Namespace (int $.Values.etcd.port) ) -}}
     {{- end }}
 {{- else if .Values.etcd.overrides.endpoints }}
     {{- range $v := .Values.etcd.overrides.endpoints -}}
@@ -108,7 +108,7 @@ Comma separated list of etcd endpoints, using the overrides in case of unmanaged
 {{- else if not .Values.etcd.overrides.endpoints }}
     {{- fail "A valid .Values.etcd.overrides.endpoints required!" }}
 {{- end }}
-{{- $list | toYaml }}
+{{- join "," $list -}}
 {{- end }}
 
 {{/*

charts/kamaji/templates/certmanager_certificate.yaml

@@ -1,16 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  labels:
-    {{- $data := . | mustMergeOverwrite (dict "component" "certificate") -}}
-    {{- include "kamaji.labels" $data | nindent 4 }}
-  name: {{ include "kamaji.certificateName" . }}
-  namespace: {{ .Release.Namespace }}
-spec:
-  dnsNames:
-    - {{ include "kamaji.webhookServiceName" . }}.{{ .Release.Namespace }}.svc
-    - {{ include "kamaji.webhookServiceName" . }}.{{ .Release.Namespace }}.svc.cluster.local
-  issuerRef:
-    kind: Issuer
-    name: kamaji-selfsigned-issuer
-  secretName: {{ include "kamaji.webhookSecretName" . }}

charts/kamaji/templates/certmanager_issuer.yaml

@@ -1,10 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  labels:
-    {{- $data := . | mustMergeOverwrite (dict "component" "issuer") -}}
-    {{- include "kamaji.labels" $data | nindent 4 }}
-  name: kamaji-selfsigned-issuer
-  namespace: {{ .Release.Namespace }}
-spec:
-  selfSigned: {}

charts/kamaji/templates/controller.yaml

@@ -28,15 +28,28 @@ spec:
       serviceAccountName: {{ include "kamaji.serviceAccountName" . }}
       containers:
       - args:
-        - manager
+        - --secure-listen-address=0.0.0.0:8443
+        - --upstream=http://127.0.0.1:8080/
+        - --logtostderr=true
+        - --v=10
+        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
+        name: kube-rbac-proxy
+        ports:
+        - containerPort: 8443
+          name: https
+          protocol: TCP
+      - args:
+        - --config-file={{ .Values.configPath }}
+        - --etcd-ca-secret-name={{ include "etcd.caSecretName" . }}
+        - --etcd-ca-secret-namespace={{ include "etcd.caSecretNamespace" . }}
+        - --etcd-client-secret-name={{ include "etcd.clientSecretName" . }}
+        - --etcd-client-secret-namespace={{ include "etcd.clientSecretNamespace" . }}
+        - --etcd-compaction-interval={{ .Values.etcd.compactionInterval }}
+        - --etcd-endpoints={{ include "etcd.endpoints" . }}
         - --health-probe-bind-address={{ .Values.healthProbeBindAddress }}
         - --leader-elect
         - --metrics-bind-address={{ .Values.metricsBindAddress }}
         - --tmp-directory={{ .Values.temporaryDirectoryPath }}
-        - --datastore={{ include "datastore.fullname" . }}
-        {{- if .Values.telemetry.disabled }}
-        - --disable-telemetry
-        {{- end }}
         {{- if .Values.loggingDevel.enable }}
         - --zap-devel
         {{- end }}
@@ -44,16 +57,7 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
         command:
-        - /kamaji
-        env:
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                fieldPath: spec.serviceAccountName
+        - /manager
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         {{- with .Values.livenessProbe }}
@@ -62,12 +66,6 @@ spec:
         {{- end }}
         name: manager
         ports:
-        - containerPort: 9443
-          name: webhook-server
-          protocol: TCP
-        - containerPort: 8080
-          name: metrics
-          protocol: TCP
         - containerPort: 8081
           name: healthcheck
           protocol: TCP
@@ -79,21 +77,7 @@ spec:
           {{- toYaml .Values.resources | nindent 12 }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
-        volumeMounts:
-          - mountPath: /tmp
-            name: tmp
-          - mountPath: /tmp/k8s-webhook-server/serving-certs
-            name: cert
-            readOnly: true
       terminationGracePeriodSeconds: 10
-      volumes:
-        - name: tmp
-          emptyDir:
-            medium: Memory
-        - name: cert
-          secret:
-            defaultMode: 420
-            secretName: {{ include "kamaji.webhookSecretName" . }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/kamaji/templates/datastore.yaml

@@ -1,33 +0,0 @@
-{{- if .Values.datastore.enabled}}
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: {{ include "datastore.fullname" . }}
-  annotations:
-    "helm.sh/hook": pre-install
-  labels:
-    {{- include "datastore.labels" . | nindent 4 }}
-spec:
-  driver: {{ .Values.datastore.driver }}
-  endpoints:
-    {{- include "datastore.endpoints" . | indent 4 }}
-{{- if (and .Values.datastore.basicAuth.usernameSecret.name .Values.datastore.basicAuth.passwordSecret.name) }}
-  basicAuth:
-    username:
-      secretReference:
-        {{- .Values.datastore.basicAuth.usernameSecret | toYaml | nindent 8 }}
-    password:
-      secretReference:
-        {{- .Values.datastore.basicAuth.passwordSecret | toYaml | nindent 8 }}
-{{- end }}
-{{- if .Values.datastore.tlsConfig.enabled }}
-  tlsConfig:
-    certificateAuthority:
-      {{- include "datastore.certificateAuthority" . | indent 6 }}
-
-    {{- if .Values.datastore.tlsConfig.clientCertificate }}
-    clientCertificate:
-      {{- include "datastore.clientCertificate" . | indent 6 }}
-    {{- end }}
-{{- end}}
-{{- end}}

charts/kamaji/templates/etcd_cm.yaml

@@ -6,10 +6,6 @@ metadata:
     {{- include "etcd.labels" . | nindent 4 }}
   name: {{ include "etcd.csrConfigMapName" . }}
   namespace: {{ .Release.Namespace }}
-  annotations:
-    "helm.sh/hook": pre-install
-    "helm.sh/hook-weight": "-5"
-    "helm.sh/hook-delete-policy": "hook-succeeded,hook-failed"
 data:
   ca-csr.json: |-
     {

charts/kamaji/templates/etcd_job_postdelete.yaml

@@ -28,8 +28,4 @@ spec:
             - --ignore-not-found=true
             - {{ include "etcd.caSecretName" . }}
             - {{ include "etcd.clientSecretName" . }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
 {{- end }}

charts/kamaji/templates/etcd_job_postinstall.yaml

@@ -18,27 +18,45 @@ spec:
       serviceAccountName: {{ include "etcd.serviceAccountName" . }}
       restartPolicy: Never
       initContainers:
+        - name: cfssl
+          image: cfssl/cfssl:latest
+          command:
+            - bash
+            - -c
+            - |-
+              cfssl gencert -initca /csr/ca-csr.json | cfssljson -bare /certs/ca &&
+              mv /certs/ca.pem /certs/ca.crt && mv /certs/ca-key.pem /certs/ca.key &&
+              cfssl gencert -ca=/certs/ca.crt -ca-key=/certs/ca.key -config=/csr/config.json -profile=peer-authentication /csr/peer-csr.json | cfssljson -bare /certs/peer &&
+              cfssl gencert -ca=/certs/ca.crt -ca-key=/certs/ca.key -config=/csr/config.json -profile=peer-authentication /csr/server-csr.json | cfssljson -bare /certs/server &&
+              cfssl gencert -ca=/certs/ca.crt -ca-key=/certs/ca.key -config=/csr/config.json -profile=client-authentication /csr/root-client-csr.json | cfssljson -bare /certs/root-client
+          volumeMounts:
+            - mountPath: /certs
+              name: certs
+            - mountPath: /csr
+              name: csr
         - name: kubectl
           image: {{ printf "clastix/kubectl:%s" (include "etcd.jobsTagKubeVersion" .) }}
           command:
             - sh
             - -c
             - |-
+              kubectl --namespace={{ .Release.Namespace }} delete secret --ignore-not-found=true {{ include "etcd.caSecretName" . }} {{ include "etcd.clientSecretName" . }} &&
+              kubectl --namespace={{ .Release.Namespace }} create secret generic {{ include "etcd.caSecretName" . }} --from-file=/certs/ca.crt --from-file=/certs/ca.key --from-file=/certs/peer-key.pem --from-file=/certs/peer.pem --from-file=/certs/server-key.pem --from-file=/certs/server.pem &&
+              kubectl --namespace={{ .Release.Namespace }} create secret tls {{ include "etcd.clientSecretName" . }} --key=/certs/root-client-key.pem --cert=/certs/root-client.pem &&
               kubectl --namespace={{ .Release.Namespace }} rollout status sts/etcd --timeout=300s
+          volumeMounts:
+            - mountPath: /certs
+              name: certs
       containers:
         - command:
             - bash
             - -c
             - |-
-              etcdctl member list -w table
-              if etcdctl user get root &>/dev/null; then
-                echo "User already exists, nothing to do"
-              else
-                etcdctl user add --no-password=true root &&
-                etcdctl role add root &&
-                etcdctl user grant-role root root &&
-                etcdctl auth enable
-              fi
+              etcdctl member list -w table &&
+              etcdctl user add --no-password=true root &&
+              etcdctl role add root &&
+              etcdctl user grant-role root root &&
+              etcdctl auth enable
           env:
             - name: ETCDCTL_ENDPOINTS
               value: https://etcd-0.{{ include "etcd.serviceName" . }}.{{ .Release.Namespace }}.svc.cluster.local:2379
@@ -64,11 +82,10 @@ spec:
         - name: root-certs
           secret:
             secretName: {{ include "etcd.clientSecretName" . }}
+            optional: true
+        - name: csr
+          configMap:
+            name: {{ include "etcd.csrConfigMapName" . }}
         - name: certs
-          secret:
-            secretName: {{ include "etcd.caSecretName" . }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+          emptyDir: {}
 {{- end }}

charts/kamaji/templates/etcd_job_preinstall.yaml

@@ -1,72 +0,0 @@
-{{- if .Values.etcd.deploy }}
-apiVersion: batch/v1
-kind: Job
-metadata:
-  labels:
-    {{- include "etcd.labels" . | nindent 4 }}
-  annotations:
-    "helm.sh/hook": pre-install
-    "helm.sh/hook-weight": "-5"
-    "helm.sh/hook-delete-policy": "hook-succeeded"
-  name: "{{ .Release.Name }}-etcd-certs"
-  namespace: {{ .Release.Namespace }}
-spec:
-  template:
-    metadata:
-      name: "{{ .Release.Name }}"
-    spec:
-      serviceAccountName: {{ include "etcd.serviceAccountName" . }}
-      restartPolicy: Never
-      initContainers:
-        - name: cfssl
-          image: "{{ .Values.cfssl.image.repository }}:{{ .Values.cfssl.image.tag }}"
-          command:
-            - bash
-            - -c
-            - |-
-              cfssl gencert -initca /csr/ca-csr.json | cfssljson -bare /certs/ca &&
-              mv /certs/ca.pem /certs/ca.crt && mv /certs/ca-key.pem /certs/ca.key &&
-              cfssl gencert -ca=/certs/ca.crt -ca-key=/certs/ca.key -config=/csr/config.json -profile=peer-authentication /csr/peer-csr.json | cfssljson -bare /certs/peer &&
-              cfssl gencert -ca=/certs/ca.crt -ca-key=/certs/ca.key -config=/csr/config.json -profile=peer-authentication /csr/server-csr.json | cfssljson -bare /certs/server &&
-              cfssl gencert -ca=/certs/ca.crt -ca-key=/certs/ca.key -config=/csr/config.json -profile=client-authentication /csr/root-client-csr.json | cfssljson -bare /certs/root-client
-          volumeMounts:
-            - mountPath: /certs
-              name: certs
-            - mountPath: /csr
-              name: csr
-      containers:
-        - name: kubectl
-          image: {{ printf "clastix/kubectl:%s" (include "etcd.jobsTagKubeVersion" .) }}
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              if kubectl get secret {{ include "etcd.caSecretName" . }} --namespace={{ .Release.Namespace }} &>/dev/null; then
-                echo "Secret {{ include "etcd.caSecretName" . }} already exists"
-              else
-                echo "Creating secret {{ include "etcd.caSecretName" . }}"
-                kubectl --namespace={{ .Release.Namespace }} create secret generic {{ include "etcd.caSecretName" . }} --from-file=/certs/ca.crt --from-file=/certs/ca.key --from-file=/certs/peer-key.pem --from-file=/certs/peer.pem --from-file=/certs/server-key.pem --from-file=/certs/server.pem
-              fi
-              if kubectl get secret {{ include "etcd.clientSecretName" . }} --namespace={{ .Release.Namespace }} &>/dev/null; then
-                echo "Secret {{ include "etcd.clientSecretName" . }} already exists"
-              else
-                echo "Creating secret {{ include "etcd.clientSecretName" . }}"
-                kubectl --namespace={{ .Release.Namespace }} create secret tls {{ include "etcd.clientSecretName" . }} --key=/certs/root-client-key.pem --cert=/certs/root-client.pem
-              fi
-          volumeMounts:
-            - mountPath: /certs
-              name: certs
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-      volumes:
-        - name: csr
-          configMap:
-            name: {{ include "etcd.csrConfigMapName" . }}
-        - name: certs
-          emptyDir: {}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-{{- end }}

charts/kamaji/templates/etcd_rbac.yaml

@@ -5,9 +5,6 @@ metadata:
   labels:
     {{- include "etcd.labels" . | nindent 4 }}
   name: etcd-gen-certs-role
-  annotations:
-    "helm.sh/hook": pre-install
-    "helm.sh/hook-weight": "-5"
   namespace: {{ .Release.Namespace }}
 rules:
   - apiGroups:
@@ -15,7 +12,6 @@ rules:
     resources:
       - secrets
     verbs:
-      - get
       - delete
     resourceNames:
       - {{ include "etcd.caSecretName" . }}
@@ -42,9 +38,6 @@ metadata:
     {{- include "etcd.labels" . | nindent 4 }}
   name: etcd-gen-certs-rolebiding
   namespace: {{ .Release.Namespace }}
-  annotations:
-    "helm.sh/hook": pre-install
-    "helm.sh/hook-weight": "-5"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role

charts/kamaji/templates/etcd_sa.yaml

@@ -5,8 +5,5 @@ metadata:
   labels:
     {{- include "etcd.labels" . | nindent 4 }}
   name: {{ include "etcd.serviceAccountName" . }}
-  annotations:
-    "helm.sh/hook": pre-install
-    "helm.sh/hook-weight": "-5"
   namespace: {{ .Release.Namespace }}
 {{- end }}

charts/kamaji/templates/etcd_sts.yaml

@@ -22,10 +22,6 @@ spec:
         - name: certs
           secret:
             secretName: {{ include "etcd.caSecretName" . }}
-      {{- with .Values.etcd.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         - name: etcd
           image: {{ .Values.etcd.image.repository }}:{{ .Values.etcd.image.tag | default "v3.5.4" }}
@@ -85,10 +81,6 @@ spec:
   volumeClaimTemplates:
   - metadata:
       name: data
-      {{- with .Values.etcd.persistence.customAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
     spec:
       storageClassName: {{ .Values.etcd.persistence.storageClassName }}
       accessModes:

charts/kamaji/templates/mutatingwebhookconfiguration.yaml

@@ -1,30 +0,0 @@
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  annotations:
-    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "kamaji.certificateName" . }}
-  labels:
-    {{- $data := . | mustMergeOverwrite (dict "instance" "mutating-webhook-configuration") -}}
-    {{- include "kamaji.labels" $data | nindent 4 }}
-  name: kamaji-mutating-webhook-configuration
-webhooks:
-  - admissionReviewVersions:
-      - v1
-    clientConfig:
-      service:
-        name: {{ include "kamaji.webhookServiceName" . }}
-        namespace: {{ .Release.Namespace }}
-        path: /mutate-kamaji-clastix-io-v1alpha1-tenantcontrolplane
-    failurePolicy: Fail
-    name: mtenantcontrolplane.kb.io
-    rules:
-      - apiGroups:
-          - kamaji.clastix.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - tenantcontrolplanes
-    sideEffects: None

charts/kamaji/templates/rbac.yaml

@@ -66,16 +66,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-    - batch
-  resources:
-    - jobs
-  verbs:
-    - create
-    - delete
-    - get
-    - list
-    - watch
 - apiGroups:
   - ""
   resources:
@@ -112,26 +102,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-    - kamaji.clastix.io
-  resources:
-    - datastores
-  verbs:
-    - create
-    - delete
-    - get
-    - list
-    - patch
-    - update
-    - watch
-- apiGroups:
-    - kamaji.clastix.io
-  resources:
-    - datastores/status
-  verbs:
-    - get
-    - patch
-    - update
 - apiGroups:
   - kamaji.clastix.io
   resources:

charts/kamaji/templates/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "kamaji.fullname" . }}
+  labels:
+    {{- include "kamaji.labels" . | nindent 4 }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+  - name: https
+    port: {{ .Values.service.port }}
+    protocol: TCP
+    targetPort: https
+  selector:
+    {{- include "kamaji.selectorLabels" . | nindent 4 }}

charts/kamaji/templates/service_metrics.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    {{- $data := . | mustMergeOverwrite (dict "component" "metrics") -}}
-    {{- include "kamaji.labels" $data | nindent 4 }}
-  name: {{ include "kamaji.metricsServiceName" . }}
-  namespace: {{ .Release.Namespace }}
-spec:
-  ports:
-    - port: 8080
-      name: metrics
-      protocol: TCP
-      targetPort: metrics
-  selector:
-    {{- include "kamaji.selectorLabels" . | nindent 4 }}

charts/kamaji/templates/service_webhook.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    {{- $data := . | mustMergeOverwrite (dict "component" "webhook" "instance" "webhook-service") -}}
-    {{- include "kamaji.labels" $data | nindent 4 }}
-  name: {{ include "kamaji.webhookServiceName" . }}
-  namespace: {{ .Release.Namespace }}
-spec:
-  ports:
-    - port: 443
-      protocol: TCP
-      name: webhook-server
-      targetPort: webhook-server
-  selector:
-    {{- include "kamaji.selectorLabels" . | nindent 4 }}

charts/kamaji/templates/servicemonitor.yaml

@@ -1,21 +0,0 @@
-{{- if and (.Capabilities.APIVersions.Has "monitoring.coreos.com/v1") .Values.serviceMonitor.enabled }}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  labels:
-    {{- $data := . | mustMergeOverwrite (dict "component" "servicemonitor") -}}
-    {{- include "kamaji.labels" $data | nindent 4 }}
-  name: {{ include "kamaji.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-spec:
-  endpoints:
-    - path: /metrics
-      port: metrics
-      scheme: http
-  namespaceSelector:
-    matchNames:
-      - {{ .Release.Namespace }}
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: {{ include "kamaji.name" . }}
-{{- end }}

charts/kamaji/templates/validatingwebhookconfiguration.yaml

@@ -1,91 +0,0 @@
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  annotations:
-    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "kamaji.certificateName" . }}
-  labels:
-    {{- $data := . | mustMergeOverwrite (dict "instance" "validating-webhook-configuration") -}}
-    {{- include "kamaji.labels" $data | nindent 4 }}
-  name: kamaji-validating-webhook-configuration
-webhooks:
-  - admissionReviewVersions:
-      - v1
-    clientConfig:
-      service:
-        name: {{ include "kamaji.webhookServiceName" . }}
-        namespace: {{ .Release.Namespace }}
-        path: /telemetry
-    failurePolicy: Ignore
-    name: telemetry.kamaji.clastix.io
-    rules:
-      - apiGroups:
-          - kamaji.clastix.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-          - UPDATE
-          - DELETE
-        resources:
-          - tenantcontrolplanes
-    sideEffects: None
-  - admissionReviewVersions:
-      - v1
-    clientConfig:
-      service:
-        name: {{ include "kamaji.webhookServiceName" . }}
-        namespace: {{ .Release.Namespace }}
-        path: /validate--v1-secret
-    failurePolicy: Ignore
-    name: vdatastoresecrets.kb.io
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - DELETE
-        resources:
-          - secrets
-    sideEffects: None
-  - admissionReviewVersions:
-      - v1
-    clientConfig:
-      service:
-        name: {{ include "kamaji.webhookServiceName" . }}
-        namespace: {{ .Release.Namespace }}
-        path: /validate-kamaji-clastix-io-v1alpha1-datastore
-    failurePolicy: Fail
-    name: vdatastore.kb.io
-    rules:
-      - apiGroups:
-          - kamaji.clastix.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-          - UPDATE
-          - DELETE
-        resources:
-          - datastores
-    sideEffects: None
-  - admissionReviewVersions:
-      - v1
-    clientConfig:
-      service:
-        name: {{ include "kamaji.webhookServiceName" . }}
-        namespace: {{ .Release.Namespace }}
-        path: /validate-kamaji-clastix-io-v1alpha1-tenantcontrolplane
-    failurePolicy: Fail
-    name: vtenantcontrolplane.kb.io
-    rules:
-      - apiGroups:
-          - kamaji.clastix.io
-        apiVersions:
-          - v1alpha1
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - tenantcontrolplanes
-    sideEffects: None

charts/kamaji/values.yaml

@@ -9,16 +9,14 @@ image:
   # -- The container image of the Kamaji controller.
   repository: clastix/kamaji
   pullPolicy: Always
-  # -- Overrides the image tag whose default is the chart appVersion.
-  tag:
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: latest
 
 # -- A list of extra arguments to add to the kamaji controller default ones
 extraArgs: []
 
-
-serviceMonitor:
-  # -- Toggle the ServiceMonitor true if you have Prometheus Operator installed and configured
-  enabled: false
+# -- Configuration file path alternative. (default "./kamaji.yaml")
+configPath: "./kamaji.yaml"
 
 etcd:
   # -- Install an etcd with enabled multi-tenancy along with Kamaji
@@ -33,7 +31,7 @@ etcd:
   # -- Install specific etcd image
   image:
     repository: quay.io/coreos/etcd
-    tag: "v3.5.6"
+    tag: "v3.5.4"
     pullPolicy: IfNotPresent
 
   # -- The livenessProbe for the etcd container
@@ -54,15 +52,9 @@ etcd:
     name: ""
   persistence:
     size: 10Gi
-    storageClassName: ""
+    storageClass: ""
     accessModes:
     - ReadWriteOnce
-    # -- The custom annotations to add to the PVC
-    customAnnotations: {}
-    #  volumeType: local
-
-  # -- (array) Kubernetes affinity rules to apply to Kamaji etcd pods
-  tolerations: []
 
   overrides:
     caSecret:
@@ -75,11 +67,11 @@ etcd:
       name: root-client-certs
       # -- Name of the namespace where the secret which contains ETCD client certificates is. (default: "kamaji-system")
       namespace: kamaji-system
-    # -- (map) Dictionary of the endpoints for the etcd cluster's members, key is the name of the etcd server. Don't define the protocol (TLS is automatically inflected), or any port, inflected from .etcd.peerApiPort value.
+    # -- (map) Dictionary of the endpoints for the etcd cluster's members, key is the name of the etcd server. Don't define any port, inflected from .etcd.peerApiPort value.
     endpoints:
-      etcd-0: etcd-0.etcd.kamaji-system.svc.cluster.local
-      etcd-1: etcd-1.etcd.kamaji-system.svc.cluster.local
-      etcd-2: etcd-2.etcd.kamaji-system.svc.cluster.local
+      etcd-0: https://etcd-0.etcd.kamaji-system.svc.cluster.local
+      etcd-1: https://etcd-1.etcd.kamaji-system.svc.cluster.local
+      etcd-2: https://etcd-2.etcd.kamaji-system.svc.cluster.local
   # -- ETCD Compaction interval (e.g. "5m0s"). (default: "0" (disabled))
   compactionInterval: 0
 
@@ -135,6 +127,10 @@ securityContext:
   # runAsNonRoot: true
   # runAsUser: 1000
 
+service:
+  type: ClusterIP
+  port: 8443
+
 resources:
   limits:
     cpu: 200m
@@ -158,70 +154,3 @@ temporaryDirectoryPath: "/tmp/kamaji"
 loggingDevel:
   # -- (string) Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error) (default false)
   enable: false
-
-datastore:
-  # -- (bool) Enable the Kamaji Datastore creation (default=true)
-  enabled: true
-  # -- (string) The Datastore name override, if empty and enabled=true defaults to `default`, if enabled=false, this is the name of the Datastore to connect to.
-  nameOverride:
-  # -- (string) The Kamaji Datastore driver, supported: etcd, MySQL, PostgreSQL (defaults=etcd).
-  driver: etcd
-  # -- (array) List of endpoints of the selected Datastore. When letting the Chart install the etcd datastore, this field is populated automatically.
-  endpoints: []
-  basicAuth:
-    usernameSecret:
-      # -- The name of the Secret containing the username used to connect to the relational database.
-      name:
-      # -- The namespace of the Secret containing the username used to connect to the relational database.
-      namespace:
-      # -- The Secret key where the data is stored.
-      keyPath:
-    passwordSecret:
-      # -- The name of the Secret containing the password used to connect to the relational database.
-      name:
-      # -- The namespace of the Secret containing the password used to connect to the relational database.
-      namespace:
-      # -- The Secret key where the data is stored.
-      keyPath:
-  tlsConfig:
-    enabled: true
-    certificateAuthority:
-      certificate:
-        # -- Name of the Secret containing the CA required to establish the mandatory SSL/TLS connection to the datastore.
-        name:
-        # -- Namespace of the Secret containing the CA required to establish the mandatory SSL/TLS connection to the datastore.
-        namespace:
-        # -- Key of the Secret which contains the content of the certificate.
-        keyPath:
-      privateKey:
-        # -- Name of the Secret containing the CA private key required to establish the mandatory SSL/TLS connection to the datastore.
-        name:
-        # -- Namespace of the Secret containing the CA private key required to establish the mandatory SSL/TLS connection to the datastore.
-        namespace:
-        # -- Key of the Secret which contains the content of the private key.
-        keyPath:
-    clientCertificate:
-      certificate:
-        # -- Name of the Secret containing the client certificate required to establish the mandatory SSL/TLS connection to the datastore.
-        name:
-        # -- Namespace of the Secret containing the client certificate required to establish the mandatory SSL/TLS connection to the datastore.
-        namespace:
-        # -- Key of the Secret which contains the content of the certificate.
-        keyPath:
-      privateKey:
-        # -- Name of the Secret containing the client certificate private key required to establish the mandatory SSL/TLS connection to the datastore.
-        name:
-        # -- Namespace of the Secret containing the client certificate private key required to establish the mandatory SSL/TLS connection to the datastore.
-        namespace:
-        # -- Key of the Secret which contains the content of the private key.
-        keyPath:
-
-cfssl:
-  image:
-    repository: cfssl/cfssl
-    tag: latest
-
-# -- Disable the analytics traces collection
-telemetry:
-  disabled: false 
-  

cmd/manager/cmd.go

@@ -1,317 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package manager
-
-import (
-	"flag"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	goRuntime "runtime"
-	"time"
-
-	telemetryclient "github.com/clastix/kamaji-telemetry/pkg/client"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/rest"
-	"k8s.io/klog/v2"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/cache"
-	"sigs.k8s.io/controller-runtime/pkg/healthz"
-	"sigs.k8s.io/controller-runtime/pkg/log/zap"
-	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
-	ctrlwebhook "sigs.k8s.io/controller-runtime/pkg/webhook"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	cmdutils "github.com/clastix/kamaji/cmd/utils"
-	"github.com/clastix/kamaji/controllers"
-	"github.com/clastix/kamaji/controllers/soot"
-	"github.com/clastix/kamaji/internal"
-	"github.com/clastix/kamaji/internal/builders/controlplane"
-	datastoreutils "github.com/clastix/kamaji/internal/datastore/utils"
-	"github.com/clastix/kamaji/internal/webhook"
-	"github.com/clastix/kamaji/internal/webhook/handlers"
-	"github.com/clastix/kamaji/internal/webhook/routes"
-)
-
-//nolint:maintidx
-func NewCmd(scheme *runtime.Scheme) *cobra.Command {
-	// CLI flags
-	var (
-		metricsBindAddress         string
-		healthProbeBindAddress     string
-		leaderElect                bool
-		tmpDirectory               string
-		kineImage                  string
-		controllerReconcileTimeout time.Duration
-		cacheResyncPeriod          time.Duration
-		datastore                  string
-		managerNamespace           string
-		managerServiceAccountName  string
-		managerServiceName         string
-		webhookCABundle            []byte
-		migrateJobImage            string
-		maxConcurrentReconciles    int
-		disableTelemetry           bool
-
-		webhookCAPath string
-	)
-
-	ctx := ctrl.SetupSignalHandler()
-
-	cmd := &cobra.Command{
-		Use:           "manager",
-		Short:         "Start the Kamaji Kubernetes Operator",
-		SilenceErrors: false,
-		SilenceUsage:  true,
-		PreRunE: func(cmd *cobra.Command, args []string) (err error) {
-			// Avoid to pollute Kamaji stdout with useless details by the underlying klog implementations
-			klog.SetOutput(io.Discard)
-			klog.LogToStderr(false)
-
-			if err = cmdutils.CheckFlags(cmd.Flags(), []string{"kine-image", "datastore", "migrate-image", "tmp-directory", "pod-namespace", "webhook-service-name", "serviceaccount-name", "webhook-ca-path"}...); err != nil {
-				return err
-			}
-
-			if webhookCABundle, err = os.ReadFile(webhookCAPath); err != nil {
-				return fmt.Errorf("unable to read webhook CA: %w", err)
-			}
-
-			if err = datastoreutils.CheckExists(ctx, scheme, datastore); err != nil {
-				return err
-			}
-
-			if controllerReconcileTimeout.Seconds() == 0 {
-				return fmt.Errorf("the controller reconcile timeout must be greater than zero")
-			}
-
-			return nil
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			setupLog := ctrl.Log.WithName("setup")
-
-			setupLog.Info(fmt.Sprintf("Kamaji version %s %s%s", internal.GitTag, internal.GitCommit, internal.GitDirty))
-			setupLog.Info(fmt.Sprintf("Build from: %s", internal.GitRepo))
-			setupLog.Info(fmt.Sprintf("Build date: %s", internal.BuildTime))
-			setupLog.Info(fmt.Sprintf("Go Version: %s", goRuntime.Version()))
-			setupLog.Info(fmt.Sprintf("Go OS/Arch: %s/%s", goRuntime.GOOS, goRuntime.GOARCH))
-			setupLog.Info(fmt.Sprintf("Telemetry enabled: %t", !disableTelemetry))
-
-			telemetryClient := telemetryclient.New(http.Client{Timeout: 5 * time.Second}, "https://telemetry.clastix.io")
-			if disableTelemetry {
-				telemetryClient = telemetryclient.NewNewOp()
-			}
-
-			ctrlOpts := ctrl.Options{
-				Scheme: scheme,
-				Metrics: metricsserver.Options{
-					BindAddress: metricsBindAddress,
-				},
-				WebhookServer: ctrlwebhook.NewServer(ctrlwebhook.Options{
-					Port: 9443,
-				}),
-				HealthProbeBindAddress:  healthProbeBindAddress,
-				LeaderElection:          leaderElect,
-				LeaderElectionNamespace: managerNamespace,
-				LeaderElectionID:        "kamaji.clastix.io",
-				NewCache: func(config *rest.Config, opts cache.Options) (cache.Cache, error) {
-					opts.SyncPeriod = &cacheResyncPeriod
-
-					return cache.New(config, opts)
-				},
-			}
-
-			mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrlOpts)
-			if err != nil {
-				setupLog.Error(err, "unable to start manager")
-
-				return err
-			}
-
-			tcpChannel, certChannel := make(controllers.TenantControlPlaneChannel), make(controllers.CertificateChannel)
-
-			if err = (&controllers.DataStore{Client: mgr.GetClient(), TenantControlPlaneTrigger: tcpChannel}).SetupWithManager(mgr); err != nil {
-				setupLog.Error(err, "unable to create controller", "controller", "DataStore")
-
-				return err
-			}
-
-			reconciler := &controllers.TenantControlPlaneReconciler{
-				Client:    mgr.GetClient(),
-				APIReader: mgr.GetAPIReader(),
-				Config: controllers.TenantControlPlaneReconcilerConfig{
-					ReconcileTimeout:     controllerReconcileTimeout,
-					DefaultDataStoreName: datastore,
-					KineContainerImage:   kineImage,
-					TmpBaseDirectory:     tmpDirectory,
-				},
-				CertificateChan:         certChannel,
-				TriggerChan:             tcpChannel,
-				KamajiNamespace:         managerNamespace,
-				KamajiServiceAccount:    managerServiceAccountName,
-				KamajiService:           managerServiceName,
-				KamajiMigrateImage:      migrateJobImage,
-				MaxConcurrentReconciles: maxConcurrentReconciles,
-			}
-
-			if err = reconciler.SetupWithManager(mgr); err != nil {
-				setupLog.Error(err, "unable to create controller", "controller", "Namespace")
-
-				return err
-			}
-
-			k8sVersion, versionErr := cmdutils.KubernetesVersion(mgr.GetConfig())
-			if versionErr != nil {
-				setupLog.Error(err, "unable to get kubernetes version")
-
-				k8sVersion = "Unknown"
-			}
-
-			if !disableTelemetry {
-				err = mgr.Add(&controllers.TelemetryController{
-					Client:                  mgr.GetClient(),
-					KubernetesVersion:       k8sVersion,
-					KamajiVersion:           internal.GitTag,
-					TelemetryClient:         telemetryClient,
-					LeaderElectionNamespace: ctrlOpts.LeaderElectionNamespace,
-					LeaderElectionID:        ctrlOpts.LeaderElectionID,
-				})
-				if err != nil {
-					setupLog.Error(err, "unable to create controller", "controller", "TelemetryController")
-
-					return err
-				}
-			}
-
-			if err = (&controllers.CertificateLifecycle{Channel: certChannel}).SetupWithManager(mgr); err != nil {
-				setupLog.Error(err, "unable to create controller", "controller", "CertificateLifecycle")
-
-				return err
-			}
-
-			if err = (&kamajiv1alpha1.DatastoreUsedSecret{}).SetupWithManager(ctx, mgr); err != nil {
-				setupLog.Error(err, "unable to create indexer", "indexer", "DatastoreUsedSecret")
-
-				return err
-			}
-
-			if err = (&kamajiv1alpha1.TenantControlPlaneStatusDataStore{}).SetupWithManager(ctx, mgr); err != nil {
-				setupLog.Error(err, "unable to create indexer", "indexer", "TenantControlPlaneStatusDataStore")
-
-				return err
-			}
-
-			err = webhook.Register(mgr, map[routes.Route][]handlers.Handler{
-				routes.TenantControlPlaneMigrate{}: {
-					handlers.Freeze{},
-				},
-				routes.TenantControlPlaneDefaults{}: {
-					handlers.TenantControlPlaneDefaults{
-						DefaultDatastore: datastore,
-					},
-				},
-				routes.TenantControlPlaneValidate{}: {
-					handlers.TenantControlPlaneName{},
-					handlers.TenantControlPlaneVersion{},
-					handlers.TenantControlPlaneKubeletAddresses{},
-					handlers.TenantControlPlaneDataStore{Client: mgr.GetClient()},
-					handlers.TenantControlPlaneDeployment{
-						Client: mgr.GetClient(),
-						DeploymentBuilder: controlplane.Deployment{
-							Client:             mgr.GetClient(),
-							KineContainerImage: kineImage,
-						},
-						KonnectivityBuilder: controlplane.Konnectivity{
-							Scheme: *mgr.GetScheme(),
-						},
-					},
-					handlers.TenantControlPlaneServiceCIDR{},
-				},
-				routes.TenantControlPlaneTelemetry{}: {
-					handlers.TenantControlPlaneTelemetry{
-						Enabled:           !disableTelemetry,
-						TelemetryClient:   telemetryClient,
-						KamajiVersion:     internal.GitTag,
-						KubernetesVersion: k8sVersion,
-					},
-				},
-				routes.DataStoreValidate{}: {
-					handlers.DataStoreValidation{Client: mgr.GetClient()},
-				},
-				routes.DataStoreSecrets{}: {
-					handlers.DataStoreSecretValidation{Client: mgr.GetClient()},
-				},
-			})
-			if err != nil {
-				setupLog.Error(err, "unable to create webhook")
-
-				return err
-			}
-
-			if err = (&soot.Manager{
-				MigrateCABundle:         webhookCABundle,
-				MigrateServiceName:      managerServiceName,
-				MigrateServiceNamespace: managerNamespace,
-				AdminClient:             mgr.GetClient(),
-			}).SetupWithManager(mgr); err != nil {
-				setupLog.Error(err, "unable to set up soot manager")
-
-				return err
-			}
-
-			if err = mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
-				setupLog.Error(err, "unable to set up health check")
-
-				return err
-			}
-			if err = mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
-				setupLog.Error(err, "unable to set up ready check")
-
-				return err
-			}
-
-			setupLog.Info("starting manager")
-			if err = mgr.Start(ctx); err != nil {
-				setupLog.Error(err, "problem running manager")
-
-				return err
-			}
-
-			return nil
-		},
-	}
-
-	// Setting zap logger
-	zapfs := flag.NewFlagSet("zap", flag.ExitOnError)
-	opts := zap.Options{
-		Development: true,
-	}
-	opts.BindFlags(zapfs)
-	cmd.Flags().AddGoFlagSet(zapfs)
-	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
-	// Setting CLI flags
-	cmd.Flags().StringVar(&metricsBindAddress, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
-	cmd.Flags().StringVar(&healthProbeBindAddress, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
-	cmd.Flags().BoolVar(&leaderElect, "leader-elect", true, "Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.")
-	cmd.Flags().StringVar(&tmpDirectory, "tmp-directory", "/tmp/kamaji", "Directory which will be used to work with temporary files.")
-	cmd.Flags().StringVar(&kineImage, "kine-image", "rancher/kine:v0.11.10-amd64", "Container image along with tag to use for the Kine sidecar container (used only if etcd-storage-type is set to one of kine strategies).")
-	cmd.Flags().StringVar(&datastore, "datastore", "etcd", "The default DataStore that should be used by Kamaji to setup the required storage.")
-	cmd.Flags().StringVar(&migrateJobImage, "migrate-image", fmt.Sprintf("clastix/kamaji:%s", internal.GitTag), "Specify the container image to launch when a TenantControlPlane is migrated to a new datastore.")
-	cmd.Flags().IntVar(&maxConcurrentReconciles, "max-concurrent-tcp-reconciles", 1, "Specify the number of workers for the Tenant Control Plane controller (beware of CPU consumption)")
-	cmd.Flags().StringVar(&managerNamespace, "pod-namespace", os.Getenv("POD_NAMESPACE"), "The Kubernetes Namespace on which the Operator is running in, required for the TenantControlPlane migration jobs.")
-	cmd.Flags().StringVar(&managerServiceName, "webhook-service-name", "kamaji-webhook-service", "The Kamaji webhook server Service name which is used to get validation webhooks, required for the TenantControlPlane migration jobs.")
-	cmd.Flags().StringVar(&managerServiceAccountName, "serviceaccount-name", os.Getenv("SERVICE_ACCOUNT"), "The Kubernetes Namespace on which the Operator is running in, required for the TenantControlPlane migration jobs.")
-	cmd.Flags().StringVar(&webhookCAPath, "webhook-ca-path", "/tmp/k8s-webhook-server/serving-certs/ca.crt", "Path to the Manager webhook server CA, required for the TenantControlPlane migration jobs.")
-	cmd.Flags().DurationVar(&controllerReconcileTimeout, "controller-reconcile-timeout", 30*time.Second, "The reconciliation request timeout before the controller withdraw the external resource calls, such as dealing with the Datastore, or the Tenant Control Plane API endpoint.")
-	cmd.Flags().DurationVar(&cacheResyncPeriod, "cache-resync-period", 10*time.Hour, "The controller-runtime.Manager cache resync period.")
-	cmd.Flags().BoolVar(&disableTelemetry, "disable-telemetry", false, "Disable the analytics traces collection.")
-
-	cobra.OnInitialize(func() {
-		viper.AutomaticEnv()
-	})
-
-	return cmd
-}

cmd/migrate/cmd.go

@@ -1,119 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package migrate
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/spf13/cobra"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	ctrl "sigs.k8s.io/controller-runtime"
-	ctrlclient "sigs.k8s.io/controller-runtime/pkg/client"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/datastore"
-)
-
-func NewCmd(scheme *runtime.Scheme) *cobra.Command {
-	// CLI flags
-	var (
-		tenantControlPlane string
-		targetDataStore    string
-		timeout            time.Duration
-	)
-
-	cmd := &cobra.Command{
-		Use:          "migrate",
-		Short:        "Migrate the data of a TenantControlPlane to another compatible DataStore",
-		SilenceUsage: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			ctx, cancelFn := context.WithTimeout(context.Background(), timeout)
-			defer cancelFn()
-
-			log := ctrl.Log
-
-			log.Info("generating the controller-runtime client")
-
-			client, err := ctrlclient.New(ctrl.GetConfigOrDie(), ctrlclient.Options{
-				Scheme: scheme,
-			})
-			if err != nil {
-				return err
-			}
-
-			parts := strings.Split(tenantControlPlane, string(types.Separator))
-			if len(parts) != 2 {
-				return fmt.Errorf("non well-formed namespaced name for the tenant control plane, expected <NAMESPACE>/NAME, fot %s", tenantControlPlane)
-			}
-
-			log.Info("retrieving the TenantControlPlane")
-
-			tcp := &kamajiv1alpha1.TenantControlPlane{}
-			if err = client.Get(ctx, types.NamespacedName{Namespace: parts[0], Name: parts[1]}, tcp); err != nil {
-				return err
-			}
-
-			log.Info("retrieving the TenantControlPlane used DataStore")
-
-			originDs := &kamajiv1alpha1.DataStore{}
-			if err = client.Get(ctx, types.NamespacedName{Name: tcp.Status.Storage.DataStoreName}, originDs); err != nil {
-				return err
-			}
-
-			log.Info("retrieving the target DataStore")
-
-			targetDs := &kamajiv1alpha1.DataStore{}
-			if err = client.Get(ctx, types.NamespacedName{Name: targetDataStore}, targetDs); err != nil {
-				return err
-			}
-
-			if tcp.Status.Storage.Driver != string(targetDs.Spec.Driver) {
-				return fmt.Errorf("migration between DataStore with different driver is not supported")
-			}
-
-			if tcp.Status.Storage.DataStoreName == targetDs.GetName() {
-				return fmt.Errorf("cannot migrate to the same DataStore")
-			}
-
-			log.Info("generating the origin storage connection")
-
-			originConnection, err := datastore.NewStorageConnection(ctx, client, *originDs)
-			if err != nil {
-				return err
-			}
-			defer originConnection.Close()
-
-			log.Info("generating the target storage connection")
-
-			targetConnection, err := datastore.NewStorageConnection(ctx, client, *targetDs)
-			if err != nil {
-				return err
-			}
-			defer targetConnection.Close()
-			// Start migrating from the old Datastore to the new one
-			log.Info("migration from origin to target started")
-
-			if err = originConnection.Migrate(ctx, *tcp, targetConnection); err != nil {
-				return fmt.Errorf("unable to migrate data from %s to %s: %w", originDs.GetName(), targetDs.GetName(), err)
-			}
-
-			log.Info("migration completed")
-
-			return nil
-		},
-	}
-
-	cmd.Flags().StringVar(&tenantControlPlane, "tenant-control-plane", "", "Namespaced-name of the TenantControlPlane that must be migrated (e.g.: default/test)")
-	cmd.Flags().StringVar(&targetDataStore, "target-datastore", "", "Name of the Datastore to which the TenantControlPlane will be migrated")
-	cmd.Flags().DurationVar(&timeout, "timeout", 5*time.Minute, "Amount of time for the context timeout")
-
-	_ = cmd.MarkFlagRequired("tenant-control-plane")
-	_ = cmd.MarkFlagRequired("target-datastore")
-
-	return cmd
-}

cmd/root.go

@@ -1,27 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package cmd
-
-import (
-	"github.com/spf13/cobra"
-	_ "go.uber.org/automaxprocs" // Automatically set `GOMAXPROCS` to match Linux container CPU quota.
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	appsv1 "k8s.io/kubernetes/pkg/apis/apps/v1"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-)
-
-func NewCmd(scheme *runtime.Scheme) *cobra.Command {
-	return &cobra.Command{
-		Use:   "kamaji",
-		Short: "Build and operate Kubernetes at scale with a fraction of operational burden.",
-		PersistentPreRun: func(cmd *cobra.Command, args []string) {
-			utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-			utilruntime.Must(kamajiv1alpha1.AddToScheme(scheme))
-			utilruntime.Must(appsv1.RegisterDefaults(scheme))
-		},
-	}
-}

cmd/utils/check_flags.go

@@ -1,22 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package utils
-
-import (
-	"fmt"
-
-	"github.com/spf13/pflag"
-)
-
-func CheckFlags(flags *pflag.FlagSet, args ...string) error {
-	for _, arg := range args {
-		v, _ := flags.GetString(arg)
-
-		if len(v) == 0 {
-			return fmt.Errorf("expecting a value for --%s arg", arg)
-		}
-	}
-
-	return nil
-}

cmd/utils/k8s_version.go

@@ -1,24 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package utils
-
-import (
-	"github.com/pkg/errors"
-	"k8s.io/client-go/kubernetes"
-	"k8s.io/client-go/rest"
-)
-
-func KubernetesVersion(config *rest.Config) (string, error) {
-	cs, csErr := kubernetes.NewForConfig(config)
-	if csErr != nil {
-		return "", errors.Wrap(csErr, "cannot create kubernetes clientset")
-	}
-
-	sv, svErr := cs.ServerVersion()
-	if svErr != nil {
-		return "", errors.Wrap(svErr, "cannot get Kubernetes version")
-	}
-
-	return sv.GitVersion, nil
-}

config/certmanager/certificate.yaml

@@ -1,39 +0,0 @@
-# The following manifests contain a self-signed issuer CR and a certificate CR.
-# More document can be found at https://docs.cert-manager.io
-# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes.
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  labels:
-    app.kubernetes.io/name: issuer
-    app.kubernetes.io/instance: selfsigned-issuer
-    app.kubernetes.io/component: certificate
-    app.kubernetes.io/created-by: operator
-    app.kubernetes.io/part-of: operator
-    app.kubernetes.io/managed-by: kustomize
-  name: selfsigned-issuer
-  namespace: system
-spec:
-  selfSigned: {}
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  labels:
-    app.kubernetes.io/name: certificate
-    app.kubernetes.io/instance: serving-cert
-    app.kubernetes.io/component: certificate
-    app.kubernetes.io/created-by: operator
-    app.kubernetes.io/part-of: operator
-    app.kubernetes.io/managed-by: kustomize
-  name: serving-cert  # this name should match the one appeared in kustomizeconfig.yaml
-  namespace: system
-spec:
-  # $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize
-  dnsNames:
-  - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc
-  - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local
-  issuerRef:
-    kind: Issuer
-    name: selfsigned-issuer
-  secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize

config/certmanager/kustomization.yaml

@@ -1,5 +0,0 @@
-resources:
-- certificate.yaml
-
-configurations:
-- kustomizeconfig.yaml

config/certmanager/kustomizeconfig.yaml

@@ -1,16 +0,0 @@
-# This configuration is for teaching kustomize how to update name ref and var substitution 
-nameReference:
-- kind: Issuer
-  group: cert-manager.io
-  fieldSpecs:
-  - kind: Certificate
-    group: cert-manager.io
-    path: spec/issuerRef/name
-
-varReference:
-- kind: Certificate
-  group: cert-manager.io
-  path: spec/commonName
-- kind: Certificate
-  group: cert-manager.io
-  path: spec/dnsNames

config/crd/bases/kamaji.clastix.io_datastores.yaml

@@ -1,292 +0,0 @@
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
-  name: datastores.kamaji.clastix.io
-spec:
-  group: kamaji.clastix.io
-  names:
-    kind: DataStore
-    listKind: DataStoreList
-    plural: datastores
-    singular: datastore
-  scope: Cluster
-  versions:
-  - additionalPrinterColumns:
-    - description: Kamaji data store driver
-      jsonPath: .spec.driver
-      name: Driver
-      type: string
-    - description: Age
-      jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: DataStore is the Schema for the datastores API.
-        properties:
-          apiVersion:
-            description: |-
-              APIVersion defines the versioned schema of this representation of an object.
-              Servers should convert recognized schemas to the latest internal value, and
-              may reject unrecognized values.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-            type: string
-          kind:
-            description: |-
-              Kind is a string value representing the REST resource this object represents.
-              Servers may infer this from the endpoint the client submits requests to.
-              Cannot be updated.
-              In CamelCase.
-              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: DataStoreSpec defines the desired state of DataStore.
-            properties:
-              basicAuth:
-                description: |-
-                  In case of authentication enabled for the given data store, specifies the username and password pair.
-                  This value is optional.
-                properties:
-                  password:
-                    properties:
-                      content:
-                        description: |-
-                          Bare content of the file, base64 encoded.
-                          It has precedence over the SecretReference value.
-                        format: byte
-                        type: string
-                      secretReference:
-                        properties:
-                          keyPath:
-                            description: |-
-                              Name of the key for the given Secret reference where the content is stored.
-                              This value is mandatory.
-                            minLength: 1
-                            type: string
-                          name:
-                            description: name is unique within a namespace to reference
-                              a secret resource.
-                            type: string
-                          namespace:
-                            description: namespace defines the space within which
-                              the secret name must be unique.
-                            type: string
-                        required:
-                        - keyPath
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  username:
-                    properties:
-                      content:
-                        description: |-
-                          Bare content of the file, base64 encoded.
-                          It has precedence over the SecretReference value.
-                        format: byte
-                        type: string
-                      secretReference:
-                        properties:
-                          keyPath:
-                            description: |-
-                              Name of the key for the given Secret reference where the content is stored.
-                              This value is mandatory.
-                            minLength: 1
-                            type: string
-                          name:
-                            description: name is unique within a namespace to reference
-                              a secret resource.
-                            type: string
-                          namespace:
-                            description: namespace defines the space within which
-                              the secret name must be unique.
-                            type: string
-                        required:
-                        - keyPath
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                required:
-                - password
-                - username
-                type: object
-              driver:
-                description: The driver to use to connect to the shared datastore.
-                enum:
-                - etcd
-                - MySQL
-                - PostgreSQL
-                - NATS
-                type: string
-              endpoints:
-                description: |-
-                  List of the endpoints to connect to the shared datastore.
-                  No need for protocol, just bare IP/FQDN and port.
-                items:
-                  type: string
-                minItems: 1
-                type: array
-              tlsConfig:
-                description: |-
-                  Defines the TLS/SSL configuration required to connect to the data store in a secure way.
-                  This value is optional.
-                properties:
-                  certificateAuthority:
-                    description: |-
-                      Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference.
-                      The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.
-                    properties:
-                      certificate:
-                        properties:
-                          content:
-                            description: |-
-                              Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: |-
-                                  Name of the key for the given Secret reference where the content is stored.
-                                  This value is mandatory.
-                                minLength: 1
-                                type: string
-                              name:
-                                description: name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      privateKey:
-                        properties:
-                          content:
-                            description: |-
-                              Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: |-
-                                  Name of the key for the given Secret reference where the content is stored.
-                                  This value is mandatory.
-                                minLength: 1
-                                type: string
-                              name:
-                                description: name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                    required:
-                    - certificate
-                    type: object
-                  clientCertificate:
-                    description: Specifies the SSL/TLS key and private key pair used
-                      to connect to the data store.
-                    properties:
-                      certificate:
-                        properties:
-                          content:
-                            description: |-
-                              Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: |-
-                                  Name of the key for the given Secret reference where the content is stored.
-                                  This value is mandatory.
-                                minLength: 1
-                                type: string
-                              name:
-                                description: name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                      privateKey:
-                        properties:
-                          content:
-                            description: |-
-                              Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: |-
-                                  Name of the key for the given Secret reference where the content is stored.
-                                  This value is mandatory.
-                                minLength: 1
-                                type: string
-                              name:
-                                description: name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                            x-kubernetes-map-type: atomic
-                        type: object
-                    required:
-                    - certificate
-                    - privateKey
-                    type: object
-                required:
-                - certificateAuthority
-                type: object
-            required:
-            - driver
-            - endpoints
-            type: object
-          status:
-            description: DataStoreStatus defines the observed state of DataStore.
-            properties:
-              usedBy:
-                description: List of the Tenant Control Planes, namespaced named,
-                  using this data store.
-                items:
-                  type: string
-                type: array
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}

config/crd/kustomization.yaml

@@ -3,15 +3,17 @@
 # It should be run by config/default
 resources:
 - bases/kamaji.clastix.io_tenantcontrolplanes.yaml
-- bases/kamaji.clastix.io_datastores.yaml
 #+kubebuilder:scaffold:crdkustomizeresource
 
 patchesStrategicMerge:
-- patches/webhook_in_clusters.yaml
+# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
+# patches here are for enabling the conversion webhook for each CRD
+#- patches/webhook_in_clusters.yaml
 #+kubebuilder:scaffold:crdkustomizewebhookpatch
 
-- patches/cainjection_in_clusters.yaml
-- patches/cainjection_in_datastores.yaml
+# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
+# patches here are for enabling the CA injection for each CRD
+#- patches/cainjection_in_clusters.yaml
 #+kubebuilder:scaffold:crdkustomizecainjectionpatch
 
 # the following config is for teaching kustomize how to do kustomization for CRDs.

config/crd/patches/cainjection_in_datastores.yaml

@@ -1,7 +0,0 @@
-# The following patch adds a directive for certmanager to inject CA into the CRD
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
-  name: datastores.kamaji.clastix.io

config/crd/patches/webhook_in_datastores.yaml

@@ -1,16 +0,0 @@
-# The following patch enables a conversion webhook for the CRD
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: datastores.kamaji.clastix.io
-spec:
-  conversion:
-    strategy: Webhook
-    webhook:
-      clientConfig:
-        service:
-          namespace: system
-          name: webhook-service
-          path: /convert
-      conversionReviewVersions:
-      - v1

config/default/kustomization.yaml

@@ -9,50 +9,66 @@ namespace: kamaji-system
 namePrefix: kamaji-
 
 # Labels to add to all resources and selectors.
-commonLabels:
-  cluster.x-k8s.io/provider: "kamaji-core"
+#commonLabels:
+#  someName: someValue
 
 bases:
 - ../crd
 - ../rbac
 - ../manager
-- ../samples
-- ../webhook
-- ../certmanager
-- ../prometheus
+# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
+# crd/kustomization.yaml
+#- ../webhook
+# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
+#- ../certmanager
+# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
+#- ../prometheus
 
 patchesStrategicMerge:
+# Protect the /metrics endpoint by putting it behind auth.
+# If you want your controller-manager to expose the /metrics
+# endpoint w/o any authn/z, please comment the following line.
+- manager_auth_proxy_patch.yaml
+
 # Mount the controller config file for loading manager configurations
 # through a ComponentConfig type
 #- manager_config_patch.yaml
-- manager_webhook_patch.yaml
-- webhookcainjection_patch.yaml
+
+# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
+# crd/kustomization.yaml
+#- manager_webhook_patch.yaml
+
+# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
+# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
+# 'CERTMANAGER' needs to be enabled to use ca injection
+#- webhookcainjection_patch.yaml
 
 # the following config is for teaching kustomize how to do var substitution
 vars:
-- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
-  objref:
-    kind: Certificate
-    group: cert-manager.io
-    version: v1
-    name: serving-cert # this name should match the one in certificate.yaml
-  fieldref:
-    fieldpath: metadata.namespace
-- name: CERTIFICATE_NAME
-  objref:
-    kind: Certificate
-    group: cert-manager.io
-    version: v1
-    name: serving-cert # this name should match the one in certificate.yaml
-- name: SERVICE_NAMESPACE # namespace of the service
-  objref:
-    kind: Service
-    version: v1
-    name: webhook-service
-  fieldref:
-    fieldpath: metadata.namespace
-- name: SERVICE_NAME
-  objref:
-    kind: Service
-    version: v1
-    name: webhook-service
+# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
+#- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
+#  objref:
+#    kind: Certificate
+#    group: cert-manager.io
+#    version: v1
+#    name: serving-cert # this name should match the one in certificate.yaml
+#  fieldref:
+#    fieldpath: metadata.namespace
+#- name: CERTIFICATE_NAME
+#  objref:
+#    kind: Certificate
+#    group: cert-manager.io
+#    version: v1
+#    name: serving-cert # this name should match the one in certificate.yaml
+#- name: SERVICE_NAMESPACE # namespace of the service
+#  objref:
+#    kind: Service
+#    version: v1
+#    name: webhook-service
+#  fieldref:
+#    fieldpath: metadata.namespace
+#- name: SERVICE_NAME
+#  objref:
+#    kind: Service
+#    version: v1
+#    name: webhook-service

config/default/manager_auth_proxy_patch.yaml

@@ -25,4 +25,3 @@ spec:
         - "--health-probe-bind-address=:8081"
         - "--metrics-bind-address=127.0.0.1:8080"
         - "--leader-elect"
-        - "--datastore=kamaji-etcd"

config/default/manager_webhook_patch.yaml

@@ -1,23 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: controller-manager
-  namespace: system
-spec:
-  template:
-    spec:
-      containers:
-      - name: manager
-        ports:
-        - containerPort: 9443
-          name: webhook-server
-          protocol: TCP
-        volumeMounts:
-        - mountPath: /tmp/k8s-webhook-server/serving-certs
-          name: cert
-          readOnly: true
-      volumes:
-      - name: cert
-        secret:
-          defaultMode: 420
-          secretName: webhook-server-cert

config/default/webhookcainjection_patch.yaml

@@ -1,29 +0,0 @@
-# This patch add annotation to admission webhook config and
-# the variables $(CERTIFICATE_NAMESPACE) and $(CERTIFICATE_NAME) will be substituted by kustomize.
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  labels:
-    app.kubernetes.io/name: mutatingwebhookconfiguration
-    app.kubernetes.io/instance: mutating-webhook-configuration
-    app.kubernetes.io/component: webhook
-    app.kubernetes.io/created-by: operator
-    app.kubernetes.io/part-of: operator
-    app.kubernetes.io/managed-by: kustomize
-  name: mutating-webhook-configuration
-  annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  labels:
-    app.kubernetes.io/name: validatingwebhookconfiguration
-    app.kubernetes.io/instance: validating-webhook-configuration
-    app.kubernetes.io/component: webhook
-    app.kubernetes.io/created-by: operator
-    app.kubernetes.io/part-of: operator
-    app.kubernetes.io/managed-by: kustomize
-  name: validating-webhook-configuration
-  annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)

config/manager/kustomization.yaml

@@ -13,4 +13,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: clastix/kamaji
-  newTag: v1.0.0
+  newTag: latest

config/manager/manager.yaml

@@ -26,27 +26,12 @@ spec:
         runAsNonRoot: true
       containers:
       - command:
-        - /kamaji
+        - /manager
         args:
-        - manager
         - --leader-elect
-        - --datastore=kamaji-etcd
-        env:
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                fieldPath: spec.serviceAccountName
         image: controller:latest
         imagePullPolicy: Always
         name: manager
-        ports:
-          - containerPort: 8080
-            name: metrics
-            protocol: TCP
         securityContext:
           allowPrivilegeEscalation: false
         livenessProbe:

config/metadata.yaml

@@ -1,10 +0,0 @@
-# maps release series of major.minor to cluster-api contract version
-# the contract version may change between minor or major versions, but *not*
-# between patch versions.
-#
-# update this file only when a new major or minor version is released
-apiVersion: clusterctl.cluster.x-k8s.io/v1alpha3
-releaseSeries:
-  - major: 0
-    minor: 3
-    contract: v1beta1

config/prometheus/kustomization.yaml

@@ -1,5 +1,2 @@
 resources:
 - monitor.yaml
-
-configurations:
-- kustomizeconfig.yaml

config/prometheus/kustomizeconfig.yaml

@@ -1,4 +0,0 @@
-varReference:
-  - kind: ServiceMonitor
-    group: monitoring.coreos.com
-    path: spec/namespaceSelector/matchNames

config/prometheus/monitor.yaml

@@ -1,3 +1,4 @@
+
 # Prometheus Monitor Service (Metrics)
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
@@ -9,11 +10,11 @@ metadata:
 spec:
   endpoints:
     - path: /metrics
-      port: metrics
-      scheme: http
-  namespaceSelector:
-    matchNames:
-      - $(SERVICE_NAMESPACE)
+      port: https
+      scheme: https
+      bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+      tlsConfig:
+        insecureSkipVerify: true
   selector:
     matchLabels:
       control-plane: controller-manager

config/rbac/datastore_editor_role.yaml

@@ -1,24 +0,0 @@
-# permissions for end users to edit datastores.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: datastore-editor-role
-rules:
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores/status
-  verbs:
-  - get

config/rbac/datastore_viewer_role.yaml

@@ -1,20 +0,0 @@
-# permissions for end users to view datastores.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: datastore-viewer-role
-rules:
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores/status
-  verbs:
-  - get

config/rbac/role.yaml

@@ -1,7 +1,9 @@
+
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  creationTimestamp: null
   name: manager-role
 rules:
 - apiGroups:
@@ -16,16 +18,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - batch
-  resources:
-  - jobs
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
 - apiGroups:
   - ""
   resources:
@@ -62,26 +54,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores/status
-  verbs:
-  - get
-  - patch
-  - update
 - apiGroups:
   - kamaji.clastix.io
   resources:

config/samples/kamaji_v1alpha1_datastore_etcd.yaml

@@ -1,34 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: etcd
-spec:
-  driver: etcd
-  endpoints:
-    - etcd-0.etcd.kamaji-system.svc.cluster.local:2379
-    - etcd-1.etcd.kamaji-system.svc.cluster.local:2379
-    - etcd-2.etcd.kamaji-system.svc.cluster.local:2379
-  basicAuth: null
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: etcd-certs
-          namespace: kamaji-system
-          keyPath: "ca.crt"
-      privateKey:
-        secretReference:
-          name: etcd-certs
-          namespace: kamaji-system
-          keyPath: "ca.key"
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: root-client-certs
-          namespace: kamaji-system
-          keyPath: "tls.crt"
-      privateKey:
-        secretReference:
-          name: root-client-certs
-          namespace: kamaji-system
-          keyPath: "tls.key"

config/samples/kamaji_v1alpha1_datastore_mysql_bronze.yaml

@@ -1,34 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: mysql-bronze
-spec:
-  driver: MySQL
-  endpoints:
-    - bronze.mysql-system.svc:3306
-  basicAuth:
-    username:
-      content: cm9vdA==
-    password:
-      secretReference:
-        name: mysql-bronze-config
-        namespace: mysql-system
-        keyPath: MYSQL_ROOT_PASSWORD
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: mysql-bronze-config
-          namespace: mysql-system
-          keyPath: "ca.crt"
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: mysql-bronze-config
-          namespace: mysql-system
-          keyPath: "server.crt"
-      privateKey:
-        secretReference:
-          name: mysql-bronze-config
-          namespace: mysql-system
-          keyPath: "server.key"

config/samples/kamaji_v1alpha1_datastore_mysql_gold.yaml

@@ -1,34 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: mysql-gold
-spec:
-  driver: MySQL
-  endpoints:
-    - gold.mysql-system.svc:3306
-  basicAuth:
-    username:
-      content: cm9vdA==
-    password:
-      secretReference:
-        name: mysql-gold-config
-        namespace: mysql-system
-        keyPath: MYSQL_ROOT_PASSWORD
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: mysql-gold-config
-          namespace: mysql-system
-          keyPath: "ca.crt"
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: mysql-gold-config
-          namespace: mysql-system
-          keyPath: "server.crt"
-      privateKey:
-        secretReference:
-          name: mysql-gold-config
-          namespace: mysql-system
-          keyPath: "server.key"

config/samples/kamaji_v1alpha1_datastore_mysql_silver.yaml

@@ -1,34 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: mysql-silver
-spec:
-  driver: MySQL
-  endpoints:
-    - silver.mysql-system.svc:3306
-  basicAuth:
-    username:
-      content: cm9vdA==
-    password:
-      secretReference:
-        name: mysql-silver-config
-        namespace: mysql-system
-        keyPath: MYSQL_ROOT_PASSWORD
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: mysql-silver-config
-          namespace: mysql-system
-          keyPath: "ca.crt"
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: mysql-silver-config
-          namespace: mysql-system
-          keyPath: "server.crt"
-      privateKey:
-        secretReference:
-          name: mysql-silver-config
-          namespace: mysql-system
-          keyPath: "server.key"

config/samples/kamaji_v1alpha1_datastore_nats_bronze.yaml

@@ -1,34 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: nats-bronze
-spec:
-  driver: NATS
-  endpoints:
-    - bronze-nats.nats-system.svc:4222
-  basicAuth:
-    username:
-      content: YWRtaW4=
-    password:
-      secretReference:
-        name: nats-bronze-config
-        namespace: nats-system
-        keyPath: password
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: nats-bronze-config
-          namespace: nats-system
-          keyPath: ca.crt
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: nats-bronze-config
-          namespace: nats-system
-          keyPath: server.crt
-      privateKey:
-        secretReference:
-          name: nats-bronze-config
-          namespace: nats-system
-          keyPath: server.key

config/samples/kamaji_v1alpha1_datastore_nats_gold.yaml

@@ -1,34 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: nats-gold
-spec:
-  driver: NATS
-  endpoints:
-    - nats-gold.nats-system.svc:4222
-  basicAuth:
-    username:
-      content: YWRtaW4=
-    password:
-      secretReference:
-        name: nats-gold-config
-        namespace: nats-system
-        keyPath: password
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: nats-gold-config
-          namespace: nats-system
-          keyPath: ca.crt
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: nats-gold-config
-          namespace: nats-system
-          keyPath: server.crt
-      privateKey:
-        secretReference:
-          name: nats-gold-config
-          namespace: nats-system
-          keyPath: server.key

config/samples/kamaji_v1alpha1_datastore_nats_notls.yaml

@@ -1,17 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: nats-notls
-spec:
-  driver: NATS
-  endpoints:
-    - notls-nats.nats-system.svc:4222
-  basicAuth:
-    username:
-      content: YWRtaW4=
-    password:
-      secretReference:
-        name: nats-notls-config
-        namespace: nats-system
-        keyPath: password
-

config/samples/kamaji_v1alpha1_datastore_nats_silver.yaml

@@ -1,34 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: nats-silver
-spec:
-  driver: NATS
-  endpoints:
-    - nats-silver.nats-system.svc:4222
-  basicAuth:
-    username:
-      content: YWRtaW4=
-    password:
-      secretReference:
-        name: nats-silver-config
-        namespace: nats-system
-        keyPath: password
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: nats-silver-config
-          namespace: nats-system
-          keyPath: ca.crt
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: nats-silver-config
-          namespace: nats-system
-          keyPath: server.crt
-      privateKey:
-        secretReference:
-          name: nats-silver-config
-          namespace: nats-system
-          keyPath: server.key

config/samples/kamaji_v1alpha1_datastore_postgresql_bronze.yaml

@@ -1,37 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: postgresql-bronze
-spec:
-  driver: PostgreSQL
-  endpoints:
-    - postgres-bronze-rw.postgres-system.svc:5432
-  basicAuth:
-    username:
-      secretReference:
-        name: postgres-bronze-superuser
-        namespace: postgres-system
-        keyPath: username
-    password:
-      secretReference:
-        name: postgres-bronze-superuser
-        namespace: postgres-system
-        keyPath: password
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: postgres-bronze-ca
-          namespace: postgres-system
-          keyPath: ca.crt
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: postgres-bronze-root-cert
-          namespace: postgres-system
-          keyPath: tls.crt
-      privateKey:
-        secretReference:
-          name: postgres-bronze-root-cert
-          namespace: postgres-system
-          keyPath: tls.key

config/samples/kamaji_v1alpha1_datastore_postgresql_gold.yaml

@@ -1,37 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: postgresql-gold
-spec:
-  driver: PostgreSQL
-  endpoints:
-    - postgres-gold-rw.postgres-system.svc:5432
-  basicAuth:
-    username:
-      secretReference:
-        name: postgres-gold-superuser
-        namespace: postgres-system
-        keyPath: username
-    password:
-      secretReference:
-        name: postgres-gold-superuser
-        namespace: postgres-system
-        keyPath: password
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: postgres-gold-ca
-          namespace: postgres-system
-          keyPath: ca.crt
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: postgres-gold-root-cert
-          namespace: postgres-system
-          keyPath: tls.crt
-      privateKey:
-        secretReference:
-          name: postgres-gold-root-cert
-          namespace: postgres-system
-          keyPath: tls.key

config/samples/kamaji_v1alpha1_datastore_postgresql_silver.yaml

@@ -1,37 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: postgresql-silver
-spec:
-  driver: PostgreSQL
-  endpoints:
-    - postgres-silver-rw.postgres-system.svc:5432
-  basicAuth:
-    username:
-      secretReference:
-        name: postgres-silver-superuser
-        namespace: postgres-system
-        keyPath: username
-    password:
-      secretReference:
-        name: postgres-silver-superuser
-        namespace: postgres-system
-        keyPath: password
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: postgres-silver-ca
-          namespace: postgres-system
-          keyPath: ca.crt
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: postgres-silver-root-cert
-          namespace: postgres-system
-          keyPath: tls.crt
-      privateKey:
-        secretReference:
-          name: postgres-silver-root-cert
-          namespace: postgres-system
-          keyPath: tls.key

config/samples/kamaji_v1alpha1_tenantcontrolplane.yaml

@@ -1,24 +1,22 @@
 apiVersion: kamaji.clastix.io/v1alpha1
 kind: TenantControlPlane
 metadata:
-  name: k8s-126
-  labels:
-    tenant.clastix.io: k8s-126
+  name: test
 spec:
   controlPlane:
     deployment:
-      replicas: 2
+      replicas: 1
     service:
       serviceType: LoadBalancer
   kubernetes:
-    version: "v1.26.0"
+    version: "v1.23.1"
     kubelet:
-      cgroupfs: systemd
+      cgroupfs: cgroupfs
+    admissionControllers:
+      - ResourceQuota
+      - LimitRanger
   networkProfile:
     port: 6443
   addons:
     coreDNS: {}
     kubeProxy: {}
-    konnectivity:
-      server:
-        port: 8132

config/samples/kamaji_v1alpha1_tenantcontrolplane_additionalcontainers.yaml

@@ -1,32 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: TenantControlPlane
-metadata:
-  name: additionalcontainers
-  labels:
-    tenant.clastix.io: additionalcontainers
-spec:
-  dataStore: postgresql-bronze
-  controlPlane:
-    deployment:
-      replicas: 1
-      additionalInitContainers:
-        - name: init
-          image: registry.k8s.io/e2e-test-images/busybox:1.29-4
-          command:
-            - /bin/sh
-            - -c
-            - echo hello world
-      additionalContainers:
-        - name: nginx
-          image: registry.k8s.io/e2e-test-images/nginx:1.15-4
-    service:
-      serviceType: LoadBalancer
-  kubernetes:
-    version: "v1.26.0"
-    kubelet:
-      cgroupfs: systemd
-  networkProfile:
-    port: 6443
-  addons:
-    coreDNS: {}
-    kubeProxy: {}

config/samples/kamaji_v1alpha1_tenantcontrolplane_additionalvolumes.yaml

@@ -1,62 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: TenantControlPlane
-metadata:
-  name: additional-volumes
-  labels:
-    tenant.clastix.io: additional-volumes
-spec:
-  controlPlane:
-    deployment:
-      replicas: 1
-      additionalVolumes:
-        - name: api-server-volume
-          configMap:
-            name: api-server-extra-cm
-        - name: controller-manager-volume
-          configMap:
-            name: controller-manager-extra-cm
-        - name: scheduler-volume
-          configMap:
-            name: scheduler-extra-cm
-      additionalVolumeMounts:
-        apiServer:
-          - name: api-server-volume
-            mountPath: "/tmp/api-server"
-        controllerManager:
-          - name: controller-manager-volume
-            mountPath: "/tmp/controller-manager"
-        scheduler:
-          - name: scheduler-volume
-            mountPath: "/tmp/scheduler"
-    service:
-      serviceType: LoadBalancer
-  kubernetes:
-    version: "v1.26.0"
-    kubelet:
-      cgroupfs: systemd
-  networkProfile:
-    port: 6443
-  addons:
-    coreDNS: {}
-    kubeProxy: {}
----
-apiVersion: v1
-data:
-  api-server: "This is an API Server volume"
-kind: ConfigMap
-metadata:
-  name: api-server-extra-cm
----
-apiVersion: v1
-data:
-  controller-manager: "This is a Controller Manager volume"
-kind: ConfigMap
-metadata:
-  name: controller-manager-extra-cm
----
-apiVersion: v1
-data:
-  controller-manager: "This is a Scheduler volume"
-kind: ConfigMap
-metadata:
-  name: scheduler-extra-cm