chore(ci): check helm non committed changes

The TCP Deployment container kube-apiserver is deeply hacked with extra
details for konnectivity: most of them weren't cleaned-up properly, and
the function wasn't entirely idempotent in toggling the feature.

This fix is addressing this situation, and rearranging the code
according to the latest polish.

.github/workflows/ci.yaml

@@ -12,13 +12,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v3
         with:
           go-version: '1.18'
+          check-latest: true
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v2.3.0
+        uses: golangci/golangci-lint-action@v3.2.0
         with:
-          version: v1.45.2
+          version: v1.49.0
           only-new-issues: false
           args: --timeout 5m --config .golangci.yml
   diff:
@@ -28,9 +29,10 @@ jobs:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v3
         with:
           go-version: '1.18'
+          check-latest: true
       - run: make yaml-installation-file
       - name: Checking if YAML installer file is not aligned
         run: if [[ $(git diff | wc -l) -gt 0 ]]; then echo ">>> Untracked generated files have not been committed" && git --no-pager diff && exit 1; fi

.github/workflows/e2e.yaml

@@ -34,9 +34,10 @@ jobs:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v3
         with:
           go-version: '1.18'
+          check-latest: true
       - run: |
           sudo apt-get update
           sudo apt-get install -y golang-cfssl

.github/workflows/helm.yaml

@@ -8,6 +8,16 @@ on:
     branches: [ "*" ]
 
 jobs:
+  diff:
+    name: diff
+    runs-on: ubuntu-18.04
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - run: make -C charts/kamaji docs
+      - name: Checking if Helm docs is not aligned
+        run: if [[ $(git diff | wc -l) -gt 0 ]]; then echo ">>> Untracked changes have not been committed" && git --no-pager diff && exit 1; fi
   lint:
     runs-on: ubuntu-latest
     steps:

.golangci.yml

@@ -14,9 +14,6 @@ linters:
     - wrapcheck
     - gomnd
     - scopelint
-    - golint
-    - interfacer
-    - maligned
     - varnamelen
     - testpackage
     - tagliatelle
@@ -27,6 +24,10 @@ linters:
     - exhaustivestruct
     - wsl
     - exhaustive
+    - nosprintfhostport
+    - nonamedreturns
+    - interfacebloat
+    - exhaustruct
     - lll
     - gosec
     - gomoddirectives
@@ -34,6 +35,14 @@ linters:
     - gochecknoinits
     - funlen
     - dupl
-    - maintidx
     - cyclop
+    # deprecated linters
+    - deadcode
+    - golint
+    - interfacer
+    - structcheck
+    - varcheck
+    - nosnakecase
+    - ifshort
+    - maligned
   enable-all: true

Dockerfile

@@ -22,6 +22,7 @@ COPY main.go main.go
 COPY api/ api/
 COPY controllers/ controllers/
 COPY internal/ internal/
+COPY indexers/ indexers/
 
 # Build
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build \

Makefile

@@ -37,8 +37,6 @@ BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)
 
 # Image URL to use all building/pushing image targets
 IMG ?= clastix/kamaji:latest
-# Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
-CRD_OPTIONS ?= "crd:trivialVersions=true,preserveUnknownFields=false"
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -87,7 +85,7 @@ kind: ## Download kind locally if necessary.
 
 CONTROLLER_GEN = $(shell pwd)/bin/controller-gen
 controller-gen: ## Download controller-gen locally if necessary.
-	$(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.6.1)
+	$(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.9.2)
 
 KUSTOMIZE = $(shell pwd)/bin/kustomize
 kustomize: ## Download kustomize locally if necessary.
@@ -96,7 +94,7 @@ kustomize: ## Download kustomize locally if necessary.
 ##@ Development
 
 manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
-	$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
+	$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
 	cp config/crd/bases/kamaji.clastix.io_tenantcontrolplanes.yaml charts/kamaji/crds/tenantcontrolplane.yaml
 	cp config/crd/bases/kamaji.clastix.io_datastores.yaml charts/kamaji/crds/datastore.yaml
 

api/v1alpha1/groupversion_info.go

@@ -2,8 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Package v1alpha1 contains API Schema definitions for the kamaji v1alpha1 API group
-//+kubebuilder:object:generate=true
-//+groupName=kamaji.clastix.io
+// +kubebuilder:object:generate=true
+// +groupName=kamaji.clastix.io
+//nolint
 package v1alpha1
 
 import (

api/v1alpha1/tenantcontrolplane_status.go

@@ -8,8 +8,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	"github.com/clastix/kamaji/internal/etcd"
 )
 
 // APIServerCertificatesStatus defines the observed state of ETCD Certificate for API server.
@@ -57,41 +55,31 @@ type CertificatesStatus struct {
 	ETCD                   *ETCDCertificatesStatus         `json:"etcd,omitempty"`
 }
 
-// ETCDStatus defines the observed state of ETCDStatus.
-type ETCDStatus struct {
-	Role etcd.Role `json:"role,omitempty"`
-	User etcd.User `json:"user,omitempty"`
-}
-
-type SQLCertificateStatus struct {
+type DataStoreCertificateStatus struct {
 	SecretName string      `json:"secretName,omitempty"`
 	Checksum   string      `json:"checksum,omitempty"`
 	LastUpdate metav1.Time `json:"lastUpdate,omitempty"`
 }
 
-type SQLConfigStatus struct {
+type DataStoreConfigStatus struct {
 	SecretName string `json:"secretName,omitempty"`
 	Checksum   string `json:"checksum,omitempty"`
 }
 
-type SQLSetupStatus struct {
+type DataStoreSetupStatus struct {
 	Schema     string      `json:"schema,omitempty"`
 	User       string      `json:"user,omitempty"`
 	LastUpdate metav1.Time `json:"lastUpdate,omitempty"`
 	Checksum   string      `json:"checksum,omitempty"`
 }
 
-type KineStatus struct {
-	Driver      string               `json:"driver,omitempty"`
-	Config      SQLConfigStatus      `json:"config,omitempty"`
-	Setup       SQLSetupStatus       `json:"setup,omitempty"`
-	Certificate SQLCertificateStatus `json:"certificate,omitempty"`
-}
-
 // StorageStatus defines the observed state of StorageStatus.
 type StorageStatus struct {
-	ETCD *ETCDStatus `json:"etcd,omitempty"`
-	Kine *KineStatus `json:"kine,omitempty"`
+	Driver        string                     `json:"driver,omitempty"`
+	DataStoreName string                     `json:"dataStoreName,omitempty"`
+	Config        DataStoreConfigStatus      `json:"config,omitempty"`
+	Setup         DataStoreSetupStatus       `json:"setup,omitempty"`
+	Certificate   DataStoreCertificateStatus `json:"certificate,omitempty"`
 }
 
 // KubeconfigStatus contains information about the generated kubeconfig.
@@ -163,9 +151,8 @@ type AddonStatus struct {
 
 // AddonsStatus defines the observed state of the different Addons.
 type AddonsStatus struct {
-	CoreDNS   AddonStatus `json:"coreDNS,omitempty"`
-	KubeProxy AddonStatus `json:"kubeProxy,omitempty"`
-
+	CoreDNS      AddonStatus        `json:"coreDNS,omitempty"`
+	KubeProxy    AddonStatus        `json:"kubeProxy,omitempty"`
 	Konnectivity KonnectivityStatus `json:"konnectivity,omitempty"`
 }
 
@@ -221,6 +208,8 @@ type KubernetesVersion struct {
 // KubernetesDeploymentStatus defines the status for the Tenant Control Plane Deployment in the management cluster.
 type KubernetesDeploymentStatus struct {
 	appsv1.DeploymentStatus `json:",inline"`
+	// Selector is the label selector used to group the Tenant Control Plane Pods used by the scale subresource.
+	Selector string `json:"selector"`
 	// The name of the Deployment for the given cluster.
 	Name string `json:"name"`
 	// The namespace which the Deployment for the given cluster is deployed.

api/v1alpha1/tenantcontrolplane_types.go

@@ -85,6 +85,11 @@ type ControlPlaneComponentsResources struct {
 type DeploymentSpec struct {
 	// +kubebuilder:default=2
 	Replicas int32 `json:"replicas,omitempty"`
+	// TopologySpreadConstraints describes how the Tenant Control Plane pods ought to spread across topology
+	// domains. Scheduler will schedule pods in a way which abides by the constraints.
+	// In case of nil underlying LabelSelector, the Kamaji one for the given Tenant Control Plane will be used.
+	// All topologySpreadConstraints are ANDed.
+	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`
 	// Resources defines the amount of memory and CPU to allocate to each component of the Control Plane
 	// (kube-apiserver, controller-manager, and scheduler).
 	Resources *ControlPlaneComponentsResources `json:"resources,omitempty"`
@@ -110,20 +115,31 @@ type ServiceSpec struct {
 }
 
 // AddonSpec defines the spec for every addon.
-type AddonSpec struct{}
+type AddonSpec struct {
+	ImageOverrideTrait `json:",inline"`
+}
+
+type ImageOverrideTrait struct {
+	// ImageRepository sets the container registry to pull images from.
+	// if not set, the default ImageRepository will be used instead.
+	ImageRepository string `json:"imageRepository,omitempty"`
+	// ImageTag allows to specify a tag for the image.
+	// In case this value is set, kubeadm does not change automatically the version of the above components during upgrades.
+	ImageTag string `json:"imageTag,omitempty"`
+}
 
 // KonnectivitySpec defines the spec for Konnectivity.
 type KonnectivitySpec struct {
 	// Port of Konnectivity proxy server.
 	ProxyPort int32 `json:"proxyPort"`
 	// Version for Konnectivity server and agent.
-	// +kubebuilder:default=v0.0.31
+	// +kubebuilder:default=v0.0.32
 	Version string `json:"version,omitempty"`
 	// ServerImage defines the container image for Konnectivity's server.
-	// +kubebuilder:default=us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-server
+	// +kubebuilder:default=registry.k8s.io/kas-network-proxy/proxy-server
 	ServerImage string `json:"serverImage,omitempty"`
 	// AgentImage defines the container image for Konnectivity's agent.
-	// +kubebuilder:default=us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-agent
+	// +kubebuilder:default=registry.k8s.io/kas-network-proxy/proxy-agent
 	AgentImage string `json:"agentImage,omitempty"`
 	// Resources define the amount of CPU and memory to allocate to the Konnectivity server.
 	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
@@ -131,13 +147,22 @@ type KonnectivitySpec struct {
 
 // AddonsSpec defines the enabled addons and their features.
 type AddonsSpec struct {
-	CoreDNS      *AddonSpec        `json:"coreDNS,omitempty"`
+	// Enables the DNS addon in the Tenant Cluster.
+	// The registry and the tag are configurable, the image is hard-coded to `coredns`.
+	CoreDNS *AddonSpec `json:"coreDNS,omitempty"`
+	// Enables the Konnectivity addon in the Tenant Cluster, required if the worker nodes are in a different network.
 	Konnectivity *KonnectivitySpec `json:"konnectivity,omitempty"`
-	KubeProxy    *AddonSpec        `json:"kubeProxy,omitempty"`
+	// Enables the kube-proxy addon in the Tenant Cluster.
+	// The registry and the tag are configurable, the image is hard-coded to `kube-proxy`.
+	KubeProxy *AddonSpec `json:"kubeProxy,omitempty"`
 }
 
 // TenantControlPlaneSpec defines the desired state of TenantControlPlane.
 type TenantControlPlaneSpec struct {
+	// DataStore allows to specify a DataStore that should be used to store the Kubernetes data for the given Tenant Control Plane.
+	// This parameter is optional and acts as an override over the default one which is used by the Kamaji Operator.
+	// Migration from a different DataStore to another one is not yet supported and the reconciliation will be blocked.
+	DataStore    string       `json:"dataStore,omitempty"`
 	ControlPlane ControlPlane `json:"controlPlane"`
 	// Kubernetes specification for tenant control plane
 	Kubernetes KubernetesSpec `json:"kubernetes"`
@@ -149,6 +174,7 @@ type TenantControlPlaneSpec struct {
 
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
+// +kubebuilder:subresource:scale:specpath=.spec.controlPlane.deployment.replicas,statuspath=.status.kubernetesResources.deployment.replicas,selectorpath=.status.kubernetesResources.deployment.selector
 // +kubebuilder:resource:shortName=tcp
 // +kubebuilder:printcolumn:name="Version",type="string",JSONPath=".spec.kubernetes.version",description="Kubernetes version"
 // +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.kubernetesResources.version.status",description="Kubernetes version"

api/v1alpha1/zz_generated.deepcopy.go

@@ -61,6 +61,7 @@ func (in *AdditionalMetadata) DeepCopy() *AdditionalMetadata {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AddonSpec) DeepCopyInto(out *AddonSpec) {
 	*out = *in
+	out.ImageOverrideTrait = in.ImageOverrideTrait
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AddonSpec.
@@ -392,6 +393,37 @@ func (in *DataStore) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DataStoreCertificateStatus) DeepCopyInto(out *DataStoreCertificateStatus) {
+	*out = *in
+	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreCertificateStatus.
+func (in *DataStoreCertificateStatus) DeepCopy() *DataStoreCertificateStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(DataStoreCertificateStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DataStoreConfigStatus) DeepCopyInto(out *DataStoreConfigStatus) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreConfigStatus.
+func (in *DataStoreConfigStatus) DeepCopy() *DataStoreConfigStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(DataStoreConfigStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *DataStoreList) DeepCopyInto(out *DataStoreList) {
 	*out = *in
@@ -424,6 +456,22 @@ func (in *DataStoreList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DataStoreSetupStatus) DeepCopyInto(out *DataStoreSetupStatus) {
+	*out = *in
+	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreSetupStatus.
+func (in *DataStoreSetupStatus) DeepCopy() *DataStoreSetupStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(DataStoreSetupStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *DataStoreSpec) DeepCopyInto(out *DataStoreSpec) {
 	*out = *in
@@ -473,6 +521,13 @@ func (in *DataStoreStatus) DeepCopy() *DataStoreStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *DeploymentSpec) DeepCopyInto(out *DeploymentSpec) {
 	*out = *in
+	if in.TopologySpreadConstraints != nil {
+		in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints
+		*out = make([]v1.TopologySpreadConstraint, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	if in.Resources != nil {
 		in, out := &in.Resources, &out.Resources
 		*out = new(ControlPlaneComponentsResources)
@@ -529,23 +584,6 @@ func (in *ETCDCertificatesStatus) DeepCopy() *ETCDCertificatesStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ETCDStatus) DeepCopyInto(out *ETCDStatus) {
-	*out = *in
-	in.Role.DeepCopyInto(&out.Role)
-	in.User.DeepCopyInto(&out.User)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ETCDStatus.
-func (in *ETCDStatus) DeepCopy() *ETCDStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(ETCDStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ExternalKubernetesObjectStatus) DeepCopyInto(out *ExternalKubernetesObjectStatus) {
 	*out = *in
@@ -562,6 +600,21 @@ func (in *ExternalKubernetesObjectStatus) DeepCopy() *ExternalKubernetesObjectSt
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ImageOverrideTrait) DeepCopyInto(out *ImageOverrideTrait) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImageOverrideTrait.
+func (in *ImageOverrideTrait) DeepCopy() *ImageOverrideTrait {
+	if in == nil {
+		return nil
+	}
+	out := new(ImageOverrideTrait)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *IngressSpec) DeepCopyInto(out *IngressSpec) {
 	*out = *in
@@ -578,24 +631,6 @@ func (in *IngressSpec) DeepCopy() *IngressSpec {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *KineStatus) DeepCopyInto(out *KineStatus) {
-	*out = *in
-	out.Config = in.Config
-	in.Setup.DeepCopyInto(&out.Setup)
-	in.Certificate.DeepCopyInto(&out.Certificate)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KineStatus.
-func (in *KineStatus) DeepCopy() *KineStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(KineStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *KonnectivityConfigMap) DeepCopyInto(out *KonnectivityConfigMap) {
 	*out = *in
@@ -906,53 +941,6 @@ func (in *PublicKeyPrivateKeyPairStatus) DeepCopy() *PublicKeyPrivateKeyPairStat
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SQLCertificateStatus) DeepCopyInto(out *SQLCertificateStatus) {
-	*out = *in
-	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SQLCertificateStatus.
-func (in *SQLCertificateStatus) DeepCopy() *SQLCertificateStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(SQLCertificateStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SQLConfigStatus) DeepCopyInto(out *SQLConfigStatus) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SQLConfigStatus.
-func (in *SQLConfigStatus) DeepCopy() *SQLConfigStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(SQLConfigStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SQLSetupStatus) DeepCopyInto(out *SQLSetupStatus) {
-	*out = *in
-	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SQLSetupStatus.
-func (in *SQLSetupStatus) DeepCopy() *SQLSetupStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(SQLSetupStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *SecretReference) DeepCopyInto(out *SecretReference) {
 	*out = *in
@@ -988,16 +976,9 @@ func (in *ServiceSpec) DeepCopy() *ServiceSpec {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *StorageStatus) DeepCopyInto(out *StorageStatus) {
 	*out = *in
-	if in.ETCD != nil {
-		in, out := &in.ETCD, &out.ETCD
-		*out = new(ETCDStatus)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.Kine != nil {
-		in, out := &in.Kine, &out.Kine
-		*out = new(KineStatus)
-		(*in).DeepCopyInto(*out)
-	}
+	out.Config = in.Config
+	in.Setup.DeepCopyInto(&out.Setup)
+	in.Certificate.DeepCopyInto(&out.Certificate)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StorageStatus.

charts/kamaji/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.0
+version: 0.9.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/kamaji/README.md

@@ -1,6 +1,6 @@
 # kamaji
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.1.0](https://img.shields.io/badge/AppVersion-0.1.0-informational?style=flat-square)
+![Version: 0.9.1](https://img.shields.io/badge/Version-0.9.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.1.0](https://img.shields.io/badge/AppVersion-0.1.0-informational?style=flat-square)
 
 Kamaji is a tool aimed to build and operate a Managed Kubernetes Service with a fraction of the operational burden. With Kamaji, you can deploy and operate hundreds of Kubernetes clusters as a hyper-scaler.
 
@@ -97,7 +97,7 @@ Here the values you can override:
 | etcd.overrides.caSecret.namespace | string | `"kamaji-system"` | Namespace of the secret which contains CA's certificate and private key. (default: "kamaji-system") |
 | etcd.overrides.clientSecret.name | string | `"root-client-certs"` | Name of the secret which contains ETCD client certificates. (default: "root-client-certs") |
 | etcd.overrides.clientSecret.namespace | string | `"kamaji-system"` | Name of the namespace where the secret which contains ETCD client certificates is. (default: "kamaji-system") |
-| etcd.overrides.endpoints | object | `{"etcd-0":"https://etcd-0.etcd.kamaji-system.svc.cluster.local","etcd-1":"https://etcd-1.etcd.kamaji-system.svc.cluster.local","etcd-2":"https://etcd-2.etcd.kamaji-system.svc.cluster.local"}` | (map) Dictionary of the endpoints for the etcd cluster's members, key is the name of the etcd server. Don't define any port, inflected from .etcd.peerApiPort value. |
+| etcd.overrides.endpoints | object | `{"etcd-0":"etcd-0.etcd.kamaji-system.svc.cluster.local","etcd-1":"etcd-1.etcd.kamaji-system.svc.cluster.local","etcd-2":"etcd-2.etcd.kamaji-system.svc.cluster.local"}` | (map) Dictionary of the endpoints for the etcd cluster's members, key is the name of the etcd server. Don't define the protocol (TLS is automatically inflected), or any port, inflected from .etcd.peerApiPort value. |
 | etcd.peerApiPort | int | `2380` | The peer API port which servers are listening to. |
 | etcd.persistence.accessModes[0] | string | `"ReadWriteOnce"` |  |
 | etcd.persistence.size | string | `"10Gi"` |  |

charts/kamaji/crds/datastore.yaml

@@ -1,10 +1,9 @@
-
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.6.1
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: datastores.kamaji.clastix.io
 spec:
@@ -63,16 +62,17 @@ spec:
                               where the content is stored. This value is mandatory.
                             type: string
                           name:
-                            description: Name is unique within a namespace to reference
+                            description: name is unique within a namespace to reference
                               a secret resource.
                             type: string
                           namespace:
-                            description: Namespace defines the space within which
+                            description: namespace defines the space within which
                               the secret name must be unique.
                             type: string
                         required:
                         - keyPath
                         type: object
+                        x-kubernetes-map-type: atomic
                     type: object
                   username:
                     properties:
@@ -88,16 +88,17 @@ spec:
                               where the content is stored. This value is mandatory.
                             type: string
                           name:
-                            description: Name is unique within a namespace to reference
+                            description: name is unique within a namespace to reference
                               a secret resource.
                             type: string
                           namespace:
-                            description: Namespace defines the space within which
+                            description: namespace defines the space within which
                               the secret name must be unique.
                             type: string
                         required:
                         - keyPath
                         type: object
+                        x-kubernetes-map-type: atomic
                     type: object
                 required:
                 - password
@@ -137,16 +138,17 @@ spec:
                                   is mandatory.
                                 type: string
                               name:
-                                description: Name is unique within a namespace to
+                                description: name is unique within a namespace to
                                   reference a secret resource.
                                 type: string
                               namespace:
-                                description: Namespace defines the space within which
+                                description: namespace defines the space within which
                                   the secret name must be unique.
                                 type: string
                             required:
                             - keyPath
                             type: object
+                            x-kubernetes-map-type: atomic
                         type: object
                       privateKey:
                         properties:
@@ -163,16 +165,17 @@ spec:
                                   is mandatory.
                                 type: string
                               name:
-                                description: Name is unique within a namespace to
+                                description: name is unique within a namespace to
                                   reference a secret resource.
                                 type: string
                               namespace:
-                                description: Namespace defines the space within which
+                                description: namespace defines the space within which
                                   the secret name must be unique.
                                 type: string
                             required:
                             - keyPath
                             type: object
+                            x-kubernetes-map-type: atomic
                         type: object
                     required:
                     - certificate
@@ -196,16 +199,17 @@ spec:
                                   is mandatory.
                                 type: string
                               name:
-                                description: Name is unique within a namespace to
+                                description: name is unique within a namespace to
                                   reference a secret resource.
                                 type: string
                               namespace:
-                                description: Namespace defines the space within which
+                                description: namespace defines the space within which
                                   the secret name must be unique.
                                 type: string
                             required:
                             - keyPath
                             type: object
+                            x-kubernetes-map-type: atomic
                         type: object
                       privateKey:
                         properties:
@@ -222,16 +226,17 @@ spec:
                                   is mandatory.
                                 type: string
                               name:
-                                description: Name is unique within a namespace to
+                                description: name is unique within a namespace to
                                   reference a secret resource.
                                 type: string
                               namespace:
-                                description: Namespace defines the space within which
+                                description: namespace defines the space within which
                                   the secret name must be unique.
                                 type: string
                             required:
                             - keyPath
                             type: object
+                            x-kubernetes-map-type: atomic
                         type: object
                     required:
                     - certificate
@@ -261,9 +266,3 @@ spec:
     storage: true
     subresources:
       status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

charts/kamaji/crds/tenantcontrolplane.yaml

@@ -1,10 +1,9 @@
-
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.6.1
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: tenantcontrolplanes.kamaji.clastix.io
 spec:
@@ -64,13 +63,27 @@ spec:
                 description: Addons contain which addons are enabled
                 properties:
                   coreDNS:
-                    description: AddonSpec defines the spec for every addon.
+                    description: Enables the DNS addon in the Tenant Cluster. The
+                      registry and the tag are configurable, the image is hard-coded
+                      to `coredns`.
+                    properties:
+                      imageRepository:
+                        description: ImageRepository sets the container registry to
+                          pull images from. if not set, the default ImageRepository
+                          will be used instead.
+                        type: string
+                      imageTag:
+                        description: ImageTag allows to specify a tag for the image.
+                          In case this value is set, kubeadm does not change automatically
+                          the version of the above components during upgrades.
+                        type: string
                     type: object
                   konnectivity:
-                    description: KonnectivitySpec defines the spec for Konnectivity.
+                    description: Enables the Konnectivity addon in the Tenant Cluster,
+                      required if the worker nodes are in a different network.
                     properties:
                       agentImage:
-                        default: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-agent
+                        default: registry.k8s.io/kas-network-proxy/proxy-agent
                         description: AgentImage defines the container image for Konnectivity's
                           agent.
                         type: string
@@ -107,19 +120,32 @@ spec:
                             type: object
                         type: object
                       serverImage:
-                        default: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-server
+                        default: registry.k8s.io/kas-network-proxy/proxy-server
                         description: ServerImage defines the container image for Konnectivity's
                           server.
                         type: string
                       version:
-                        default: v0.0.31
+                        default: v0.0.32
                         description: Version for Konnectivity server and agent.
                         type: string
                     required:
                     - proxyPort
                     type: object
                   kubeProxy:
-                    description: AddonSpec defines the spec for every addon.
+                    description: Enables the kube-proxy addon in the Tenant Cluster.
+                      The registry and the tag are configurable, the image is hard-coded
+                      to `kube-proxy`.
+                    properties:
+                      imageRepository:
+                        description: ImageRepository sets the container registry to
+                          pull images from. if not set, the default ImageRepository
+                          will be used instead.
+                        type: string
+                      imageTag:
+                        description: ImageTag allows to specify a tag for the image.
+                          In case this value is set, kubeadm does not change automatically
+                          the version of the above components during upgrades.
+                        type: string
                     type: object
                 type: object
               controlPlane:
@@ -263,6 +289,194 @@ spec:
                                 type: object
                             type: object
                         type: object
+                      topologySpreadConstraints:
+                        description: TopologySpreadConstraints describes how the Tenant
+                          Control Plane pods ought to spread across topology domains.
+                          Scheduler will schedule pods in a way which abides by the
+                          constraints. In case of nil underlying LabelSelector, the
+                          Kamaji one for the given Tenant Control Plane will be used.
+                          All topologySpreadConstraints are ANDed.
+                        items:
+                          description: TopologySpreadConstraint specifies how to spread
+                            matching pods among the given topology.
+                          properties:
+                            labelSelector:
+                              description: LabelSelector is used to find matching
+                                pods. Pods that match this label selector are counted
+                                to determine the number of pods in their corresponding
+                                topology domain.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: A label selector requirement is a
+                                      selector that contains values, a key, and an
+                                      operator that relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: operator represents a key's relationship
+                                          to a set of values. Valid operators are
+                                          In, NotIn, Exists and DoesNotExist.
+                                        type: string
+                                      values:
+                                        description: values is an array of string
+                                          values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the
+                                          operator is Exists or DoesNotExist, the
+                                          values array must be empty. This array is
+                                          replaced during a strategic merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                matchLabels:
+                                  additionalProperties:
+                                    type: string
+                                  description: matchLabels is a map of {key,value}
+                                    pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions,
+                                    whose key field is "key", the operator is "In",
+                                    and the values array contains only "value". The
+                                    requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            matchLabelKeys:
+                              description: MatchLabelKeys is a set of pod label keys
+                                to select the pods over which spreading will be calculated.
+                                The keys are used to lookup values from the incoming
+                                pod labels, those key-value labels are ANDed with
+                                labelSelector to select the group of existing pods
+                                over which spreading will be calculated for the incoming
+                                pod. Keys that don't exist in the incoming pod labels
+                                will be ignored. A null or empty list means only match
+                                against labelSelector.
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            maxSkew:
+                              description: 'MaxSkew describes the degree to which
+                                pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`,
+                                it is the maximum permitted difference between the
+                                number of matching pods in the target topology and
+                                the global minimum. The global minimum is the minimum
+                                number of matching pods in an eligible domain or zero
+                                if the number of eligible domains is less than MinDomains.
+                                For example, in a 3-zone cluster, MaxSkew is set to
+                                1, and pods with the same labelSelector spread as
+                                2/2/1: In this case, the global minimum is 1. | zone1
+                                | zone2 | zone3 | |  P P  |  P P  |   P   | - if MaxSkew
+                                is 1, incoming pod can only be scheduled to zone3
+                                to become 2/2/2; scheduling it onto zone1(zone2) would
+                                make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1).
+                                - if MaxSkew is 2, incoming pod can be scheduled onto
+                                any zone. When `whenUnsatisfiable=ScheduleAnyway`,
+                                it is used to give higher precedence to topologies
+                                that satisfy it. It''s a required field. Default value
+                                is 1 and 0 is not allowed.'
+                              format: int32
+                              type: integer
+                            minDomains:
+                              description: "MinDomains indicates a minimum number
+                                of eligible domains. When the number of eligible domains
+                                with matching topology keys is less than minDomains,
+                                Pod Topology Spread treats \"global minimum\" as 0,
+                                and then the calculation of Skew is performed. And
+                                when the number of eligible domains with matching
+                                topology keys equals or greater than minDomains, this
+                                value has no effect on scheduling. As a result, when
+                                the number of eligible domains is less than minDomains,
+                                scheduler won't schedule more than maxSkew Pods to
+                                those domains. If value is nil, the constraint behaves
+                                as if MinDomains is equal to 1. Valid values are integers
+                                greater than 0. When value is not nil, WhenUnsatisfiable
+                                must be DoNotSchedule. \n For example, in a 3-zone
+                                cluster, MaxSkew is set to 2, MinDomains is set to
+                                5 and pods with the same labelSelector spread as 2/2/2:
+                                | zone1 | zone2 | zone3 | |  P P  |  P P  |  P P  |
+                                The number of domains is less than 5(MinDomains),
+                                so \"global minimum\" is treated as 0. In this situation,
+                                new pod with the same labelSelector cannot be scheduled,
+                                because computed skew will be 3(3 - 0) if new Pod
+                                is scheduled to any of the three zones, it will violate
+                                MaxSkew. \n This is a beta field and requires the
+                                MinDomainsInPodTopologySpread feature gate to be enabled
+                                (enabled by default)."
+                              format: int32
+                              type: integer
+                            nodeAffinityPolicy:
+                              description: "NodeAffinityPolicy indicates how we will
+                                treat Pod's nodeAffinity/nodeSelector when calculating
+                                pod topology spread skew. Options are: - Honor: only
+                                nodes matching nodeAffinity/nodeSelector are included
+                                in the calculations. - Ignore: nodeAffinity/nodeSelector
+                                are ignored. All nodes are included in the calculations.
+                                \n If this value is nil, the behavior is equivalent
+                                to the Honor policy. This is a alpha-level feature
+                                enabled by the NodeInclusionPolicyInPodTopologySpread
+                                feature flag."
+                              type: string
+                            nodeTaintsPolicy:
+                              description: "NodeTaintsPolicy indicates how we will
+                                treat node taints when calculating pod topology spread
+                                skew. Options are: - Honor: nodes without taints,
+                                along with tainted nodes for which the incoming pod
+                                has a toleration, are included. - Ignore: node taints
+                                are ignored. All nodes are included. \n If this value
+                                is nil, the behavior is equivalent to the Ignore policy.
+                                This is a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread
+                                feature flag."
+                              type: string
+                            topologyKey:
+                              description: TopologyKey is the key of node labels.
+                                Nodes that have a label with this key and identical
+                                values are considered to be in the same topology.
+                                We consider each <key, value> as a "bucket", and try
+                                to put balanced number of pods into each bucket. We
+                                define a domain as a particular instance of a topology.
+                                Also, we define an eligible domain as a domain whose
+                                nodes meet the requirements of nodeAffinityPolicy
+                                and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname",
+                                each Node is a domain of that topology. And, if TopologyKey
+                                is "topology.kubernetes.io/zone", each zone is a domain
+                                of that topology. It's a required field.
+                              type: string
+                            whenUnsatisfiable:
+                              description: 'WhenUnsatisfiable indicates how to deal
+                                with a pod if it doesn''t satisfy the spread constraint.
+                                - DoNotSchedule (default) tells the scheduler not
+                                to schedule it. - ScheduleAnyway tells the scheduler
+                                to schedule the pod in any location, but giving higher
+                                precedence to topologies that would help reduce the
+                                skew. A constraint is considered "Unsatisfiable" for
+                                an incoming pod if and only if every possible node
+                                assignment for that pod would violate "MaxSkew" on
+                                some topology. For example, in a 3-zone cluster, MaxSkew
+                                is set to 1, and pods with the same labelSelector
+                                spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P
+                                |   P   |   P   | If WhenUnsatisfiable is set to DoNotSchedule,
+                                incoming pod can only be scheduled to zone2(zone3)
+                                to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3)
+                                satisfies MaxSkew(1). In other words, the cluster
+                                can still be imbalanced, but scheduler won''t make
+                                it *more* imbalanced. It''s a required field.'
+                              type: string
+                          required:
+                          - maxSkew
+                          - topologyKey
+                          - whenUnsatisfiable
+                          type: object
+                        type: array
                     type: object
                   ingress:
                     description: Defining the options for an Optional Ingress which
@@ -323,6 +537,14 @@ spec:
                 required:
                 - service
                 type: object
+              dataStore:
+                description: DataStore allows to specify a DataStore that should be
+                  used to store the Kubernetes data for the given Tenant Control Plane.
+                  This parameter is optional and acts as an override over the default
+                  one which is used by the Kamaji Operator. Migration from a different
+                  DataStore to another one is not yet supported and the reconciliation
+                  will be blocked.
+                type: string
               kubernetes:
                 description: Kubernetes specification for tenant control plane
                 properties:
@@ -554,15 +776,15 @@ spec:
                               description: "Condition contains details for one aspect
                                 of the current state of this API Resource. --- This
                                 struct is intended for direct use as an array at the
-                                field path .status.conditions.  For example, type
-                                FooStatus struct{     // Represents the observations
-                                of a foo's current state.     // Known .status.conditions.type
+                                field path .status.conditions.  For example, \n type
+                                FooStatus struct{ // Represents the observations of
+                                a foo's current state. // Known .status.conditions.type
                                 are: \"Available\", \"Progressing\", and \"Degraded\"
-                                \    // +patchMergeKey=type     // +patchStrategy=merge
-                                \    // +listType=map     // +listMapKey=type     Conditions
-                                []metav1.Condition `json:\"conditions,omitempty\"
-                                patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
-                                \n     // other fields }"
+                                // +patchMergeKey=type // +patchStrategy=merge //
+                                +listType=map // +listMapKey=type Conditions []metav1.Condition
+                                `json:\"conditions,omitempty\" patchStrategy:\"merge\"
+                                patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
+                                \n // other fields }"
                               properties:
                                 lastTransitionTime:
                                   description: lastTransitionTime is the last time
@@ -666,11 +888,10 @@ spec:
                                               the error shall comply with the following
                                               rules: - built-in error values shall
                                               be specified in this file and those
-                                              shall use   CamelCase names - cloud
-                                              provider specific error values must
-                                              have names that comply with the   format
-                                              foo.example.com/CamelCase. --- The regex
-                                              it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
+                                              shall use CamelCase names - cloud provider
+                                              specific error values must have names
+                                              that comply with the format foo.example.com/CamelCase.
+                                              --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                             maxLength: 316
                                             pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                                             type: string
@@ -1006,6 +1227,10 @@ spec:
                           by this deployment (their labels match the selector).
                         format: int32
                         type: integer
+                      selector:
+                        description: Selector is the label selector used to group
+                          the Tenant Control Plane Pods used by the scale subresource.
+                        type: string
                       unavailableReplicas:
                         description: Total number of unavailable pods targeted by
                           this deployment. This is the total number of pods that are
@@ -1022,6 +1247,7 @@ spec:
                     required:
                     - name
                     - namespace
+                    - selector
                     type: object
                   ingress:
                     description: KubernetesIngressStatus defines the status for the
@@ -1060,9 +1286,9 @@ spec:
                                           with the service port The format of the
                                           error shall comply with the following rules:
                                           - built-in error values shall be specified
-                                          in this file and those shall use   CamelCase
+                                          in this file and those shall use CamelCase
                                           names - cloud provider specific error values
-                                          must have names that comply with the   format
+                                          must have names that comply with the format
                                           foo.example.com/CamelCase. --- The regex
                                           it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                         maxLength: 316
@@ -1111,14 +1337,14 @@ spec:
                           description: "Condition contains details for one aspect
                             of the current state of this API Resource. --- This struct
                             is intended for direct use as an array at the field path
-                            .status.conditions.  For example, type FooStatus struct{
-                            \    // Represents the observations of a foo's current
-                            state.     // Known .status.conditions.type are: \"Available\",
-                            \"Progressing\", and \"Degraded\"     // +patchMergeKey=type
-                            \    // +patchStrategy=merge     // +listType=map     //
-                            +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\"
-                            patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
-                            \n     // other fields }"
+                            .status.conditions.  For example, \n type FooStatus struct{
+                            // Represents the observations of a foo's current state.
+                            // Known .status.conditions.type are: \"Available\", \"Progressing\",
+                            and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
+                            // +listType=map // +listMapKey=type Conditions []metav1.Condition
+                            `json:\"conditions,omitempty\" patchStrategy:\"merge\"
+                            patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
+                            \n // other fields }"
                           properties:
                             lastTransitionTime:
                               description: lastTransitionTime is the last time the
@@ -1217,9 +1443,9 @@ spec:
                                           with the service port The format of the
                                           error shall comply with the following rules:
                                           - built-in error values shall be specified
-                                          in this file and those shall use   CamelCase
+                                          in this file and those shall use CamelCase
                                           names - cloud provider specific error values
-                                          must have names that comply with the   format
+                                          must have names that comply with the format
                                           foo.example.com/CamelCase. --- The regex
                                           it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                         maxLength: 316
@@ -1287,78 +1513,38 @@ spec:
                 description: Storage Status contains information about Kubernetes
                   storage system
                 properties:
-                  etcd:
-                    description: ETCDStatus defines the observed state of ETCDStatus.
+                  certificate:
                     properties:
-                      role:
-                        properties:
-                          exists:
-                            type: boolean
-                          name:
-                            type: string
-                          permissions:
-                            items:
-                              properties:
-                                key:
-                                  type: string
-                                rangeEnd:
-                                  type: string
-                                type:
-                                  type: integer
-                              type: object
-                            type: array
-                        required:
-                        - exists
-                        - name
-                        type: object
-                      user:
-                        properties:
-                          exists:
-                            type: boolean
-                          name:
-                            type: string
-                          roles:
-                            items:
-                              type: string
-                            type: array
-                        required:
-                        - exists
-                        - name
-                        type: object
-                    type: object
-                  kine:
-                    properties:
-                      certificate:
-                        properties:
-                          checksum:
-                            type: string
-                          lastUpdate:
-                            format: date-time
-                            type: string
-                          secretName:
-                            type: string
-                        type: object
-                      config:
-                        properties:
-                          checksum:
-                            type: string
-                          secretName:
-                            type: string
-                        type: object
-                      driver:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  config:
+                    properties:
+                      checksum:
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  dataStoreName:
+                    type: string
+                  driver:
+                    type: string
+                  setup:
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      schema:
+                        type: string
+                      user:
                         type: string
-                      setup:
-                        properties:
-                          checksum:
-                            type: string
-                          lastUpdate:
-                            format: date-time
-                            type: string
-                          schema:
-                            type: string
-                          user:
-                            type: string
-                        type: object
                     type: object
                 type: object
             type: object
@@ -1366,10 +1552,8 @@ spec:
     served: true
     storage: true
     subresources:
+      scale:
+        labelSelectorPath: .status.kubernetesResources.deployment.selector
+        specReplicasPath: .spec.controlPlane.deployment.replicas
+        statusReplicasPath: .status.kubernetesResources.deployment.replicas
       status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

charts/kamaji/templates/_helpers_etcd.tpl

@@ -99,7 +99,7 @@ Comma separated list of etcd endpoints, using the overrides in case of unmanaged
 {{- $list := list -}}
 {{- if .Values.etcd.deploy }}
     {{- range $count := until 3 -}}
-        {{- $list = append $list (printf "https://%s-%d.%s.%s.svc.cluster.local:%d" "etcd" $count ( include "etcd.serviceName" . ) $.Release.Namespace (int $.Values.etcd.port) ) -}}
+        {{- $list = append $list (printf "%s-%d.%s.%s.svc.cluster.local:%d" "etcd" $count ( include "etcd.serviceName" . ) $.Release.Namespace (int $.Values.etcd.port) ) -}}
     {{- end }}
 {{- else if .Values.etcd.overrides.endpoints }}
     {{- range $v := .Values.etcd.overrides.endpoints -}}

charts/kamaji/values.yaml

@@ -67,11 +67,11 @@ etcd:
       name: root-client-certs
       # -- Name of the namespace where the secret which contains ETCD client certificates is. (default: "kamaji-system")
       namespace: kamaji-system
-    # -- (map) Dictionary of the endpoints for the etcd cluster's members, key is the name of the etcd server. Don't define any port, inflected from .etcd.peerApiPort value.
+    # -- (map) Dictionary of the endpoints for the etcd cluster's members, key is the name of the etcd server. Don't define the protocol (TLS is automatically inflected), or any port, inflected from .etcd.peerApiPort value.
     endpoints:
-      etcd-0: https://etcd-0.etcd.kamaji-system.svc.cluster.local
-      etcd-1: https://etcd-1.etcd.kamaji-system.svc.cluster.local
-      etcd-2: https://etcd-2.etcd.kamaji-system.svc.cluster.local
+      etcd-0: etcd-0.etcd.kamaji-system.svc.cluster.local
+      etcd-1: etcd-1.etcd.kamaji-system.svc.cluster.local
+      etcd-2: etcd-2.etcd.kamaji-system.svc.cluster.local
   # -- ETCD Compaction interval (e.g. "5m0s"). (default: "0" (disabled))
   compactionInterval: 0
 

config/crd/bases/kamaji.clastix.io_datastores.yaml

@@ -1,10 +1,9 @@
-
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.6.1
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: datastores.kamaji.clastix.io
 spec:
@@ -63,16 +62,17 @@ spec:
                               where the content is stored. This value is mandatory.
                             type: string
                           name:
-                            description: Name is unique within a namespace to reference
+                            description: name is unique within a namespace to reference
                               a secret resource.
                             type: string
                           namespace:
-                            description: Namespace defines the space within which
+                            description: namespace defines the space within which
                               the secret name must be unique.
                             type: string
                         required:
                         - keyPath
                         type: object
+                        x-kubernetes-map-type: atomic
                     type: object
                   username:
                     properties:
@@ -88,16 +88,17 @@ spec:
                               where the content is stored. This value is mandatory.
                             type: string
                           name:
-                            description: Name is unique within a namespace to reference
+                            description: name is unique within a namespace to reference
                               a secret resource.
                             type: string
                           namespace:
-                            description: Namespace defines the space within which
+                            description: namespace defines the space within which
                               the secret name must be unique.
                             type: string
                         required:
                         - keyPath
                         type: object
+                        x-kubernetes-map-type: atomic
                     type: object
                 required:
                 - password
@@ -137,16 +138,17 @@ spec:
                                   is mandatory.
                                 type: string
                               name:
-                                description: Name is unique within a namespace to
+                                description: name is unique within a namespace to
                                   reference a secret resource.
                                 type: string
                               namespace:
-                                description: Namespace defines the space within which
+                                description: namespace defines the space within which
                                   the secret name must be unique.
                                 type: string
                             required:
                             - keyPath
                             type: object
+                            x-kubernetes-map-type: atomic
                         type: object
                       privateKey:
                         properties:
@@ -163,16 +165,17 @@ spec:
                                   is mandatory.
                                 type: string
                               name:
-                                description: Name is unique within a namespace to
+                                description: name is unique within a namespace to
                                   reference a secret resource.
                                 type: string
                               namespace:
-                                description: Namespace defines the space within which
+                                description: namespace defines the space within which
                                   the secret name must be unique.
                                 type: string
                             required:
                             - keyPath
                             type: object
+                            x-kubernetes-map-type: atomic
                         type: object
                     required:
                     - certificate
@@ -196,16 +199,17 @@ spec:
                                   is mandatory.
                                 type: string
                               name:
-                                description: Name is unique within a namespace to
+                                description: name is unique within a namespace to
                                   reference a secret resource.
                                 type: string
                               namespace:
-                                description: Namespace defines the space within which
+                                description: namespace defines the space within which
                                   the secret name must be unique.
                                 type: string
                             required:
                             - keyPath
                             type: object
+                            x-kubernetes-map-type: atomic
                         type: object
                       privateKey:
                         properties:
@@ -222,16 +226,17 @@ spec:
                                   is mandatory.
                                 type: string
                               name:
-                                description: Name is unique within a namespace to
+                                description: name is unique within a namespace to
                                   reference a secret resource.
                                 type: string
                               namespace:
-                                description: Namespace defines the space within which
+                                description: namespace defines the space within which
                                   the secret name must be unique.
                                 type: string
                             required:
                             - keyPath
                             type: object
+                            x-kubernetes-map-type: atomic
                         type: object
                     required:
                     - certificate
@@ -261,9 +266,3 @@ spec:
     storage: true
     subresources:
       status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crd/bases/kamaji.clastix.io_tenantcontrolplanes.yaml

@@ -1,10 +1,9 @@
-
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.6.1
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: tenantcontrolplanes.kamaji.clastix.io
 spec:
@@ -64,13 +63,27 @@ spec:
                 description: Addons contain which addons are enabled
                 properties:
                   coreDNS:
-                    description: AddonSpec defines the spec for every addon.
+                    description: Enables the DNS addon in the Tenant Cluster. The
+                      registry and the tag are configurable, the image is hard-coded
+                      to `coredns`.
+                    properties:
+                      imageRepository:
+                        description: ImageRepository sets the container registry to
+                          pull images from. if not set, the default ImageRepository
+                          will be used instead.
+                        type: string
+                      imageTag:
+                        description: ImageTag allows to specify a tag for the image.
+                          In case this value is set, kubeadm does not change automatically
+                          the version of the above components during upgrades.
+                        type: string
                     type: object
                   konnectivity:
-                    description: KonnectivitySpec defines the spec for Konnectivity.
+                    description: Enables the Konnectivity addon in the Tenant Cluster,
+                      required if the worker nodes are in a different network.
                     properties:
                       agentImage:
-                        default: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-agent
+                        default: registry.k8s.io/kas-network-proxy/proxy-agent
                         description: AgentImage defines the container image for Konnectivity's
                           agent.
                         type: string
@@ -107,19 +120,32 @@ spec:
                             type: object
                         type: object
                       serverImage:
-                        default: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-server
+                        default: registry.k8s.io/kas-network-proxy/proxy-server
                         description: ServerImage defines the container image for Konnectivity's
                           server.
                         type: string
                       version:
-                        default: v0.0.31
+                        default: v0.0.32
                         description: Version for Konnectivity server and agent.
                         type: string
                     required:
                     - proxyPort
                     type: object
                   kubeProxy:
-                    description: AddonSpec defines the spec for every addon.
+                    description: Enables the kube-proxy addon in the Tenant Cluster.
+                      The registry and the tag are configurable, the image is hard-coded
+                      to `kube-proxy`.
+                    properties:
+                      imageRepository:
+                        description: ImageRepository sets the container registry to
+                          pull images from. if not set, the default ImageRepository
+                          will be used instead.
+                        type: string
+                      imageTag:
+                        description: ImageTag allows to specify a tag for the image.
+                          In case this value is set, kubeadm does not change automatically
+                          the version of the above components during upgrades.
+                        type: string
                     type: object
                 type: object
               controlPlane:
@@ -263,6 +289,194 @@ spec:
                                 type: object
                             type: object
                         type: object
+                      topologySpreadConstraints:
+                        description: TopologySpreadConstraints describes how the Tenant
+                          Control Plane pods ought to spread across topology domains.
+                          Scheduler will schedule pods in a way which abides by the
+                          constraints. In case of nil underlying LabelSelector, the
+                          Kamaji one for the given Tenant Control Plane will be used.
+                          All topologySpreadConstraints are ANDed.
+                        items:
+                          description: TopologySpreadConstraint specifies how to spread
+                            matching pods among the given topology.
+                          properties:
+                            labelSelector:
+                              description: LabelSelector is used to find matching
+                                pods. Pods that match this label selector are counted
+                                to determine the number of pods in their corresponding
+                                topology domain.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: A label selector requirement is a
+                                      selector that contains values, a key, and an
+                                      operator that relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: operator represents a key's relationship
+                                          to a set of values. Valid operators are
+                                          In, NotIn, Exists and DoesNotExist.
+                                        type: string
+                                      values:
+                                        description: values is an array of string
+                                          values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the
+                                          operator is Exists or DoesNotExist, the
+                                          values array must be empty. This array is
+                                          replaced during a strategic merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                matchLabels:
+                                  additionalProperties:
+                                    type: string
+                                  description: matchLabels is a map of {key,value}
+                                    pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions,
+                                    whose key field is "key", the operator is "In",
+                                    and the values array contains only "value". The
+                                    requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            matchLabelKeys:
+                              description: MatchLabelKeys is a set of pod label keys
+                                to select the pods over which spreading will be calculated.
+                                The keys are used to lookup values from the incoming
+                                pod labels, those key-value labels are ANDed with
+                                labelSelector to select the group of existing pods
+                                over which spreading will be calculated for the incoming
+                                pod. Keys that don't exist in the incoming pod labels
+                                will be ignored. A null or empty list means only match
+                                against labelSelector.
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            maxSkew:
+                              description: 'MaxSkew describes the degree to which
+                                pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`,
+                                it is the maximum permitted difference between the
+                                number of matching pods in the target topology and
+                                the global minimum. The global minimum is the minimum
+                                number of matching pods in an eligible domain or zero
+                                if the number of eligible domains is less than MinDomains.
+                                For example, in a 3-zone cluster, MaxSkew is set to
+                                1, and pods with the same labelSelector spread as
+                                2/2/1: In this case, the global minimum is 1. | zone1
+                                | zone2 | zone3 | |  P P  |  P P  |   P   | - if MaxSkew
+                                is 1, incoming pod can only be scheduled to zone3
+                                to become 2/2/2; scheduling it onto zone1(zone2) would
+                                make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1).
+                                - if MaxSkew is 2, incoming pod can be scheduled onto
+                                any zone. When `whenUnsatisfiable=ScheduleAnyway`,
+                                it is used to give higher precedence to topologies
+                                that satisfy it. It''s a required field. Default value
+                                is 1 and 0 is not allowed.'
+                              format: int32
+                              type: integer
+                            minDomains:
+                              description: "MinDomains indicates a minimum number
+                                of eligible domains. When the number of eligible domains
+                                with matching topology keys is less than minDomains,
+                                Pod Topology Spread treats \"global minimum\" as 0,
+                                and then the calculation of Skew is performed. And
+                                when the number of eligible domains with matching
+                                topology keys equals or greater than minDomains, this
+                                value has no effect on scheduling. As a result, when
+                                the number of eligible domains is less than minDomains,
+                                scheduler won't schedule more than maxSkew Pods to
+                                those domains. If value is nil, the constraint behaves
+                                as if MinDomains is equal to 1. Valid values are integers
+                                greater than 0. When value is not nil, WhenUnsatisfiable
+                                must be DoNotSchedule. \n For example, in a 3-zone
+                                cluster, MaxSkew is set to 2, MinDomains is set to
+                                5 and pods with the same labelSelector spread as 2/2/2:
+                                | zone1 | zone2 | zone3 | |  P P  |  P P  |  P P  |
+                                The number of domains is less than 5(MinDomains),
+                                so \"global minimum\" is treated as 0. In this situation,
+                                new pod with the same labelSelector cannot be scheduled,
+                                because computed skew will be 3(3 - 0) if new Pod
+                                is scheduled to any of the three zones, it will violate
+                                MaxSkew. \n This is a beta field and requires the
+                                MinDomainsInPodTopologySpread feature gate to be enabled
+                                (enabled by default)."
+                              format: int32
+                              type: integer
+                            nodeAffinityPolicy:
+                              description: "NodeAffinityPolicy indicates how we will
+                                treat Pod's nodeAffinity/nodeSelector when calculating
+                                pod topology spread skew. Options are: - Honor: only
+                                nodes matching nodeAffinity/nodeSelector are included
+                                in the calculations. - Ignore: nodeAffinity/nodeSelector
+                                are ignored. All nodes are included in the calculations.
+                                \n If this value is nil, the behavior is equivalent
+                                to the Honor policy. This is a alpha-level feature
+                                enabled by the NodeInclusionPolicyInPodTopologySpread
+                                feature flag."
+                              type: string
+                            nodeTaintsPolicy:
+                              description: "NodeTaintsPolicy indicates how we will
+                                treat node taints when calculating pod topology spread
+                                skew. Options are: - Honor: nodes without taints,
+                                along with tainted nodes for which the incoming pod
+                                has a toleration, are included. - Ignore: node taints
+                                are ignored. All nodes are included. \n If this value
+                                is nil, the behavior is equivalent to the Ignore policy.
+                                This is a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread
+                                feature flag."
+                              type: string
+                            topologyKey:
+                              description: TopologyKey is the key of node labels.
+                                Nodes that have a label with this key and identical
+                                values are considered to be in the same topology.
+                                We consider each <key, value> as a "bucket", and try
+                                to put balanced number of pods into each bucket. We
+                                define a domain as a particular instance of a topology.
+                                Also, we define an eligible domain as a domain whose
+                                nodes meet the requirements of nodeAffinityPolicy
+                                and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname",
+                                each Node is a domain of that topology. And, if TopologyKey
+                                is "topology.kubernetes.io/zone", each zone is a domain
+                                of that topology. It's a required field.
+                              type: string
+                            whenUnsatisfiable:
+                              description: 'WhenUnsatisfiable indicates how to deal
+                                with a pod if it doesn''t satisfy the spread constraint.
+                                - DoNotSchedule (default) tells the scheduler not
+                                to schedule it. - ScheduleAnyway tells the scheduler
+                                to schedule the pod in any location, but giving higher
+                                precedence to topologies that would help reduce the
+                                skew. A constraint is considered "Unsatisfiable" for
+                                an incoming pod if and only if every possible node
+                                assignment for that pod would violate "MaxSkew" on
+                                some topology. For example, in a 3-zone cluster, MaxSkew
+                                is set to 1, and pods with the same labelSelector
+                                spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P
+                                |   P   |   P   | If WhenUnsatisfiable is set to DoNotSchedule,
+                                incoming pod can only be scheduled to zone2(zone3)
+                                to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3)
+                                satisfies MaxSkew(1). In other words, the cluster
+                                can still be imbalanced, but scheduler won''t make
+                                it *more* imbalanced. It''s a required field.'
+                              type: string
+                          required:
+                          - maxSkew
+                          - topologyKey
+                          - whenUnsatisfiable
+                          type: object
+                        type: array
                     type: object
                   ingress:
                     description: Defining the options for an Optional Ingress which
@@ -323,6 +537,14 @@ spec:
                 required:
                 - service
                 type: object
+              dataStore:
+                description: DataStore allows to specify a DataStore that should be
+                  used to store the Kubernetes data for the given Tenant Control Plane.
+                  This parameter is optional and acts as an override over the default
+                  one which is used by the Kamaji Operator. Migration from a different
+                  DataStore to another one is not yet supported and the reconciliation
+                  will be blocked.
+                type: string
               kubernetes:
                 description: Kubernetes specification for tenant control plane
                 properties:
@@ -554,15 +776,15 @@ spec:
                               description: "Condition contains details for one aspect
                                 of the current state of this API Resource. --- This
                                 struct is intended for direct use as an array at the
-                                field path .status.conditions.  For example, type
-                                FooStatus struct{     // Represents the observations
-                                of a foo's current state.     // Known .status.conditions.type
+                                field path .status.conditions.  For example, \n type
+                                FooStatus struct{ // Represents the observations of
+                                a foo's current state. // Known .status.conditions.type
                                 are: \"Available\", \"Progressing\", and \"Degraded\"
-                                \    // +patchMergeKey=type     // +patchStrategy=merge
-                                \    // +listType=map     // +listMapKey=type     Conditions
-                                []metav1.Condition `json:\"conditions,omitempty\"
-                                patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
-                                \n     // other fields }"
+                                // +patchMergeKey=type // +patchStrategy=merge //
+                                +listType=map // +listMapKey=type Conditions []metav1.Condition
+                                `json:\"conditions,omitempty\" patchStrategy:\"merge\"
+                                patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
+                                \n // other fields }"
                               properties:
                                 lastTransitionTime:
                                   description: lastTransitionTime is the last time
@@ -666,11 +888,10 @@ spec:
                                               the error shall comply with the following
                                               rules: - built-in error values shall
                                               be specified in this file and those
-                                              shall use   CamelCase names - cloud
-                                              provider specific error values must
-                                              have names that comply with the   format
-                                              foo.example.com/CamelCase. --- The regex
-                                              it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
+                                              shall use CamelCase names - cloud provider
+                                              specific error values must have names
+                                              that comply with the format foo.example.com/CamelCase.
+                                              --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                             maxLength: 316
                                             pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                                             type: string
@@ -1006,6 +1227,10 @@ spec:
                           by this deployment (their labels match the selector).
                         format: int32
                         type: integer
+                      selector:
+                        description: Selector is the label selector used to group
+                          the Tenant Control Plane Pods used by the scale subresource.
+                        type: string
                       unavailableReplicas:
                         description: Total number of unavailable pods targeted by
                           this deployment. This is the total number of pods that are
@@ -1022,6 +1247,7 @@ spec:
                     required:
                     - name
                     - namespace
+                    - selector
                     type: object
                   ingress:
                     description: KubernetesIngressStatus defines the status for the
@@ -1060,9 +1286,9 @@ spec:
                                           with the service port The format of the
                                           error shall comply with the following rules:
                                           - built-in error values shall be specified
-                                          in this file and those shall use   CamelCase
+                                          in this file and those shall use CamelCase
                                           names - cloud provider specific error values
-                                          must have names that comply with the   format
+                                          must have names that comply with the format
                                           foo.example.com/CamelCase. --- The regex
                                           it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                         maxLength: 316
@@ -1111,14 +1337,14 @@ spec:
                           description: "Condition contains details for one aspect
                             of the current state of this API Resource. --- This struct
                             is intended for direct use as an array at the field path
-                            .status.conditions.  For example, type FooStatus struct{
-                            \    // Represents the observations of a foo's current
-                            state.     // Known .status.conditions.type are: \"Available\",
-                            \"Progressing\", and \"Degraded\"     // +patchMergeKey=type
-                            \    // +patchStrategy=merge     // +listType=map     //
-                            +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\"
-                            patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
-                            \n     // other fields }"
+                            .status.conditions.  For example, \n type FooStatus struct{
+                            // Represents the observations of a foo's current state.
+                            // Known .status.conditions.type are: \"Available\", \"Progressing\",
+                            and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
+                            // +listType=map // +listMapKey=type Conditions []metav1.Condition
+                            `json:\"conditions,omitempty\" patchStrategy:\"merge\"
+                            patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
+                            \n // other fields }"
                           properties:
                             lastTransitionTime:
                               description: lastTransitionTime is the last time the
@@ -1217,9 +1443,9 @@ spec:
                                           with the service port The format of the
                                           error shall comply with the following rules:
                                           - built-in error values shall be specified
-                                          in this file and those shall use   CamelCase
+                                          in this file and those shall use CamelCase
                                           names - cloud provider specific error values
-                                          must have names that comply with the   format
+                                          must have names that comply with the format
                                           foo.example.com/CamelCase. --- The regex
                                           it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                         maxLength: 316
@@ -1287,78 +1513,38 @@ spec:
                 description: Storage Status contains information about Kubernetes
                   storage system
                 properties:
-                  etcd:
-                    description: ETCDStatus defines the observed state of ETCDStatus.
+                  certificate:
                     properties:
-                      role:
-                        properties:
-                          exists:
-                            type: boolean
-                          name:
-                            type: string
-                          permissions:
-                            items:
-                              properties:
-                                key:
-                                  type: string
-                                rangeEnd:
-                                  type: string
-                                type:
-                                  type: integer
-                              type: object
-                            type: array
-                        required:
-                        - exists
-                        - name
-                        type: object
-                      user:
-                        properties:
-                          exists:
-                            type: boolean
-                          name:
-                            type: string
-                          roles:
-                            items:
-                              type: string
-                            type: array
-                        required:
-                        - exists
-                        - name
-                        type: object
-                    type: object
-                  kine:
-                    properties:
-                      certificate:
-                        properties:
-                          checksum:
-                            type: string
-                          lastUpdate:
-                            format: date-time
-                            type: string
-                          secretName:
-                            type: string
-                        type: object
-                      config:
-                        properties:
-                          checksum:
-                            type: string
-                          secretName:
-                            type: string
-                        type: object
-                      driver:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  config:
+                    properties:
+                      checksum:
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  dataStoreName:
+                    type: string
+                  driver:
+                    type: string
+                  setup:
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      schema:
+                        type: string
+                      user:
                         type: string
-                      setup:
-                        properties:
-                          checksum:
-                            type: string
-                          lastUpdate:
-                            format: date-time
-                            type: string
-                          schema:
-                            type: string
-                          user:
-                            type: string
-                        type: object
                     type: object
                 type: object
             type: object
@@ -1366,10 +1552,8 @@ spec:
     served: true
     storage: true
     subresources:
+      scale:
+        labelSelectorPath: .status.kubernetesResources.deployment.selector
+        specReplicasPath: .spec.controlPlane.deployment.replicas
+        statusReplicasPath: .status.kubernetesResources.deployment.replicas
       status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crd/kustomization.yaml

@@ -3,6 +3,7 @@
 # It should be run by config/default
 resources:
 - bases/kamaji.clastix.io_tenantcontrolplanes.yaml
+- bases/kamaji.clastix.io_datastores.yaml
 #+kubebuilder:scaffold:crdkustomizeresource
 
 patchesStrategicMerge:

config/default/manager_auth_proxy_patch.yaml

@@ -25,3 +25,4 @@ spec:
         - "--health-probe-bind-address=:8081"
         - "--metrics-bind-address=127.0.0.1:8080"
         - "--leader-elect"
+        - "--datastore=kamaji-etcd"

config/install.yaml

@@ -9,7 +9,235 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.6.1
+    controller-gen.kubebuilder.io/version: v0.9.2
+  creationTimestamp: null
+  name: datastores.kamaji.clastix.io
+spec:
+  group: kamaji.clastix.io
+  names:
+    kind: DataStore
+    listKind: DataStoreList
+    plural: datastores
+    singular: datastore
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - description: Kamaji data store driver
+      jsonPath: .spec.driver
+      name: Driver
+      type: string
+    - description: Age
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: DataStore is the Schema for the datastores API.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: DataStoreSpec defines the desired state of DataStore.
+            properties:
+              basicAuth:
+                description: In case of authentication enabled for the given data store, specifies the username and password pair. This value is optional.
+                properties:
+                  password:
+                    properties:
+                      content:
+                        description: Bare content of the file, base64 encoded. It has precedence over the SecretReference value.
+                        format: byte
+                        type: string
+                      secretReference:
+                        properties:
+                          keyPath:
+                            description: Name of the key for the given Secret reference where the content is stored. This value is mandatory.
+                            type: string
+                          name:
+                            description: name is unique within a namespace to reference a secret resource.
+                            type: string
+                          namespace:
+                            description: namespace defines the space within which the secret name must be unique.
+                            type: string
+                        required:
+                        - keyPath
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                  username:
+                    properties:
+                      content:
+                        description: Bare content of the file, base64 encoded. It has precedence over the SecretReference value.
+                        format: byte
+                        type: string
+                      secretReference:
+                        properties:
+                          keyPath:
+                            description: Name of the key for the given Secret reference where the content is stored. This value is mandatory.
+                            type: string
+                          name:
+                            description: name is unique within a namespace to reference a secret resource.
+                            type: string
+                          namespace:
+                            description: namespace defines the space within which the secret name must be unique.
+                            type: string
+                        required:
+                        - keyPath
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                required:
+                - password
+                - username
+                type: object
+              driver:
+                description: The driver to use to connect to the shared datastore.
+                type: string
+              endpoints:
+                description: List of the endpoints to connect to the shared datastore. No need for protocol, just bare IP/FQDN and port.
+                items:
+                  type: string
+                type: array
+              tlsConfig:
+                description: Defines the TLS/SSL configuration required to connect to the data store in a secure way.
+                properties:
+                  certificateAuthority:
+                    description: Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference. The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.
+                    properties:
+                      certificate:
+                        properties:
+                          content:
+                            description: Bare content of the file, base64 encoded. It has precedence over the SecretReference value.
+                            format: byte
+                            type: string
+                          secretReference:
+                            properties:
+                              keyPath:
+                                description: Name of the key for the given Secret reference where the content is stored. This value is mandatory.
+                                type: string
+                              name:
+                                description: name is unique within a namespace to reference a secret resource.
+                                type: string
+                              namespace:
+                                description: namespace defines the space within which the secret name must be unique.
+                                type: string
+                            required:
+                            - keyPath
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      privateKey:
+                        properties:
+                          content:
+                            description: Bare content of the file, base64 encoded. It has precedence over the SecretReference value.
+                            format: byte
+                            type: string
+                          secretReference:
+                            properties:
+                              keyPath:
+                                description: Name of the key for the given Secret reference where the content is stored. This value is mandatory.
+                                type: string
+                              name:
+                                description: name is unique within a namespace to reference a secret resource.
+                                type: string
+                              namespace:
+                                description: namespace defines the space within which the secret name must be unique.
+                                type: string
+                            required:
+                            - keyPath
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                    required:
+                    - certificate
+                    type: object
+                  clientCertificate:
+                    description: Specifies the SSL/TLS key and private key pair used to connect to the data store.
+                    properties:
+                      certificate:
+                        properties:
+                          content:
+                            description: Bare content of the file, base64 encoded. It has precedence over the SecretReference value.
+                            format: byte
+                            type: string
+                          secretReference:
+                            properties:
+                              keyPath:
+                                description: Name of the key for the given Secret reference where the content is stored. This value is mandatory.
+                                type: string
+                              name:
+                                description: name is unique within a namespace to reference a secret resource.
+                                type: string
+                              namespace:
+                                description: namespace defines the space within which the secret name must be unique.
+                                type: string
+                            required:
+                            - keyPath
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                      privateKey:
+                        properties:
+                          content:
+                            description: Bare content of the file, base64 encoded. It has precedence over the SecretReference value.
+                            format: byte
+                            type: string
+                          secretReference:
+                            properties:
+                              keyPath:
+                                description: Name of the key for the given Secret reference where the content is stored. This value is mandatory.
+                                type: string
+                              name:
+                                description: name is unique within a namespace to reference a secret resource.
+                                type: string
+                              namespace:
+                                description: namespace defines the space within which the secret name must be unique.
+                                type: string
+                            required:
+                            - keyPath
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        type: object
+                    required:
+                    - certificate
+                    - privateKey
+                    type: object
+                required:
+                - certificateAuthority
+                - clientCertificate
+                type: object
+            required:
+            - driver
+            - endpoints
+            - tlsConfig
+            type: object
+          status:
+            description: DataStoreStatus defines the observed state of DataStore.
+            properties:
+              usedBy:
+                description: List of the Tenant Control Planes, namespaced named, using this data store.
+                items:
+                  type: string
+                type: array
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.9.2
   creationTimestamp: null
   name: tenantcontrolplanes.kamaji.clastix.io
 spec:
@@ -64,13 +292,20 @@ spec:
                 description: Addons contain which addons are enabled
                 properties:
                   coreDNS:
-                    description: AddonSpec defines the spec for every addon.
+                    description: Enables the DNS addon in the Tenant Cluster. The registry and the tag are configurable, the image is hard-coded to `coredns`.
+                    properties:
+                      imageRepository:
+                        description: ImageRepository sets the container registry to pull images from. if not set, the default ImageRepository will be used instead.
+                        type: string
+                      imageTag:
+                        description: ImageTag allows to specify a tag for the image. In case this value is set, kubeadm does not change automatically the version of the above components during upgrades.
+                        type: string
                     type: object
                   konnectivity:
-                    description: KonnectivitySpec defines the spec for Konnectivity.
+                    description: Enables the Konnectivity addon in the Tenant Cluster, required if the worker nodes are in a different network.
                     properties:
                       agentImage:
-                        default: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-agent
+                        default: registry.k8s.io/kas-network-proxy/proxy-agent
                         description: AgentImage defines the container image for Konnectivity's agent.
                         type: string
                       proxyPort:
@@ -100,18 +335,25 @@ spec:
                             type: object
                         type: object
                       serverImage:
-                        default: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-server
+                        default: registry.k8s.io/kas-network-proxy/proxy-server
                         description: ServerImage defines the container image for Konnectivity's server.
                         type: string
                       version:
-                        default: v0.0.31
+                        default: v0.0.32
                         description: Version for Konnectivity server and agent.
                         type: string
                     required:
                     - proxyPort
                     type: object
                   kubeProxy:
-                    description: AddonSpec defines the spec for every addon.
+                    description: Enables the kube-proxy addon in the Tenant Cluster. The registry and the tag are configurable, the image is hard-coded to `kube-proxy`.
+                    properties:
+                      imageRepository:
+                        description: ImageRepository sets the container registry to pull images from. if not set, the default ImageRepository will be used instead.
+                        type: string
+                      imageTag:
+                        description: ImageTag allows to specify a tag for the image. In case this value is set, kubeadm does not change automatically the version of the above components during upgrades.
+                        type: string
                     type: object
                 type: object
               controlPlane:
@@ -227,6 +469,74 @@ spec:
                                 type: object
                             type: object
                         type: object
+                      topologySpreadConstraints:
+                        description: TopologySpreadConstraints describes how the Tenant Control Plane pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. In case of nil underlying LabelSelector, the Kamaji one for the given Tenant Control Plane will be used. All topologySpreadConstraints are ANDed.
+                        items:
+                          description: TopologySpreadConstraint specifies how to spread matching pods among the given topology.
+                          properties:
+                            labelSelector:
+                              description: LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the selector applies to.
+                                        type: string
+                                      operator:
+                                        description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        type: string
+                                      values:
+                                        description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                matchLabels:
+                                  additionalProperties:
+                                    type: string
+                                  description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            matchLabelKeys:
+                              description: MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector.
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            maxSkew:
+                              description: 'MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | |  P P  |  P P  |   P   | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It''s a required field. Default value is 1 and 0 is not allowed.'
+                              format: int32
+                              type: integer
+                            minDomains:
+                              description: "MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats \"global minimum\" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. \n For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | |  P P  |  P P  |  P P  | The number of domains is less than 5(MinDomains), so \"global minimum\" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. \n This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default)."
+                              format: int32
+                              type: integer
+                            nodeAffinityPolicy:
+                              description: "NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. \n If this value is nil, the behavior is equivalent to the Honor policy. This is a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread feature flag."
+                              type: string
+                            nodeTaintsPolicy:
+                              description: "NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. \n If this value is nil, the behavior is equivalent to the Ignore policy. This is a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread feature flag."
+                              type: string
+                            topologyKey:
+                              description: TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field.
+                              type: string
+                            whenUnsatisfiable:
+                              description: 'WhenUnsatisfiable indicates how to deal with a pod if it doesn''t satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P |   P   |   P   | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won''t make it *more* imbalanced. It''s a required field.'
+                              type: string
+                          required:
+                          - maxSkew
+                          - topologyKey
+                          - whenUnsatisfiable
+                          type: object
+                        type: array
                     type: object
                   ingress:
                     description: Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane
@@ -277,6 +587,9 @@ spec:
                 required:
                 - service
                 type: object
+              dataStore:
+                description: DataStore allows to specify a DataStore that should be used to store the Kubernetes data for the given Tenant Control Plane. This parameter is optional and acts as an override over the default one which is used by the Kamaji Operator. Migration from a different DataStore to another one is not yet supported and the reconciliation will be blocked.
+                type: string
               kubernetes:
                 description: Kubernetes specification for tenant control plane
                 properties:
@@ -493,7 +806,7 @@ spec:
                           conditions:
                             description: Current service state
                             items:
-                              description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions.  For example, type FooStatus struct{     // Represents the observations of a foo's current state.     // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"     // +patchMergeKey=type     // +patchStrategy=merge     // +listType=map     // +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n     // other fields }"
+                              description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions.  For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                               properties:
                                 lastTransitionTime:
                                   description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
@@ -556,7 +869,7 @@ spec:
                                       items:
                                         properties:
                                           error:
-                                            description: 'Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use   CamelCase names - cloud provider specific error values must have names that comply with the   format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
+                                            description: 'Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                             maxLength: 316
                                             pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                                             type: string
@@ -858,6 +1171,9 @@ spec:
                         description: Total number of non-terminated pods targeted by this deployment (their labels match the selector).
                         format: int32
                         type: integer
+                      selector:
+                        description: Selector is the label selector used to group the Tenant Control Plane Pods used by the scale subresource.
+                        type: string
                       unavailableReplicas:
                         description: Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.
                         format: int32
@@ -869,6 +1185,7 @@ spec:
                     required:
                     - name
                     - namespace
+                    - selector
                     type: object
                   ingress:
                     description: KubernetesIngressStatus defines the status for the Tenant Control Plane Ingress in the management cluster.
@@ -892,7 +1209,7 @@ spec:
                                   items:
                                     properties:
                                       error:
-                                        description: 'Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use   CamelCase names - cloud provider specific error values must have names that comply with the   format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
+                                        description: 'Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                         maxLength: 316
                                         pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                                         type: string
@@ -929,7 +1246,7 @@ spec:
                       conditions:
                         description: Current service state
                         items:
-                          description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions.  For example, type FooStatus struct{     // Represents the observations of a foo's current state.     // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"     // +patchMergeKey=type     // +patchStrategy=merge     // +listType=map     // +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n     // other fields }"
+                          description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions.  For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                           properties:
                             lastTransitionTime:
                               description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
@@ -992,7 +1309,7 @@ spec:
                                   items:
                                     properties:
                                       error:
-                                        description: 'Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use   CamelCase names - cloud provider specific error values must have names that comply with the   format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
+                                        description: 'Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)'
                                         maxLength: 316
                                         pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                                         type: string
@@ -1048,78 +1365,38 @@ spec:
               storage:
                 description: Storage Status contains information about Kubernetes storage system
                 properties:
-                  etcd:
-                    description: ETCDStatus defines the observed state of ETCDStatus.
+                  certificate:
                     properties:
-                      role:
-                        properties:
-                          exists:
-                            type: boolean
-                          name:
-                            type: string
-                          permissions:
-                            items:
-                              properties:
-                                key:
-                                  type: string
-                                rangeEnd:
-                                  type: string
-                                type:
-                                  type: integer
-                              type: object
-                            type: array
-                        required:
-                        - exists
-                        - name
-                        type: object
-                      user:
-                        properties:
-                          exists:
-                            type: boolean
-                          name:
-                            type: string
-                          roles:
-                            items:
-                              type: string
-                            type: array
-                        required:
-                        - exists
-                        - name
-                        type: object
-                    type: object
-                  kine:
-                    properties:
-                      certificate:
-                        properties:
-                          checksum:
-                            type: string
-                          lastUpdate:
-                            format: date-time
-                            type: string
-                          secretName:
-                            type: string
-                        type: object
-                      config:
-                        properties:
-                          checksum:
-                            type: string
-                          secretName:
-                            type: string
-                        type: object
-                      driver:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  config:
+                    properties:
+                      checksum:
+                        type: string
+                      secretName:
+                        type: string
+                    type: object
+                  dataStoreName:
+                    type: string
+                  driver:
+                    type: string
+                  setup:
+                    properties:
+                      checksum:
+                        type: string
+                      lastUpdate:
+                        format: date-time
+                        type: string
+                      schema:
+                        type: string
+                      user:
                         type: string
-                      setup:
-                        properties:
-                          checksum:
-                            type: string
-                          lastUpdate:
-                            format: date-time
-                            type: string
-                          schema:
-                            type: string
-                          user:
-                            type: string
-                        type: object
                     type: object
                 type: object
             type: object
@@ -1127,13 +1404,11 @@ spec:
     served: true
     storage: true
     subresources:
+      scale:
+        labelSelectorPath: .status.kubernetesResources.deployment.selector
+        specReplicasPath: .spec.controlPlane.deployment.replicas
+        statusReplicasPath: .status.kubernetesResources.deployment.replicas
       status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -1428,6 +1703,7 @@ spec:
         - --health-probe-bind-address=:8081
         - --metrics-bind-address=127.0.0.1:8080
         - --leader-elect
+        - --datastore=kamaji-etcd
         command:
         - /manager
         image: clastix/kamaji:latest
@@ -1468,9 +1744,9 @@ spec:
   basicAuth: null
   driver: etcd
   endpoints:
-  - etcd-0.etcd.kamaji-system.svc:2379
-  - etcd-1.etcd.kamaji-system.svc:2379
-  - etcd-2.etcd.kamaji-system.svc:2379
+  - etcd-0.etcd.kamaji-system.svc.cluster.local:2379
+  - etcd-1.etcd.kamaji-system.svc.cluster.local:2379
+  - etcd-2.etcd.kamaji-system.svc.cluster.local:2379
   tlsConfig:
     certificateAuthority:
       certificate:

config/rbac/role.yaml

@@ -1,4 +1,3 @@
-
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

config/samples/kamaji_v1alpha1_datastore_etcd.yaml

@@ -5,9 +5,9 @@ metadata:
 spec:
   driver: etcd
   endpoints:
-    - etcd-0.etcd.kamaji-system.svc:2379
-    - etcd-1.etcd.kamaji-system.svc:2379
-    - etcd-2.etcd.kamaji-system.svc:2379
+    - etcd-0.etcd.kamaji-system.svc.cluster.local:2379
+    - etcd-1.etcd.kamaji-system.svc.cluster.local:2379
+    - etcd-2.etcd.kamaji-system.svc.cluster.local:2379
   basicAuth: null
   tlsConfig:
     certificateAuthority:

controllers/datastore_controller.go

@@ -5,18 +5,30 @@ package controllers
 
 import (
 	"context"
+	"fmt"
 
-	"github.com/pkg/errors"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/fields"
+	k8stypes "k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/client-go/util/workqueue"
 	controllerruntime "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	"sigs.k8s.io/controller-runtime/pkg/source"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/indexers"
+)
+
+const (
+	dataStoreFinalizer = "finalizer.kamaji.clastix.io/datastore"
 )
 
 type DataStore struct {
@@ -25,39 +37,87 @@ type DataStore struct {
 	// if a Data Source is updated we have to be sure that the reconciliation of the certificates content
 	// for each Tenant Control Plane is put in place properly.
 	TenantControlPlaneTrigger TenantControlPlaneChannel
-	// ResourceName is the DataStore object that should be watched for changes.
-	ResourceName string
 }
 
 //+kubebuilder:rbac:groups=kamaji.clastix.io,resources=datastores,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=kamaji.clastix.io,resources=datastores/status,verbs=get;update;patch
 
 func (r *DataStore) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) {
-	ds := kamajiv1alpha1.DataStore{}
-	if err := r.client.Get(ctx, request.NamespacedName, &ds); err != nil {
+	log := log.FromContext(ctx)
+
+	ds := &kamajiv1alpha1.DataStore{}
+	if err := r.client.Get(ctx, request.NamespacedName, ds); err != nil {
 		if k8serrors.IsNotFound(err) {
 			return reconcile.Result{}, nil
 		}
 
+		log.Error(err, "unable to retrieve the request")
+
 		return reconcile.Result{}, err
 	}
+	// Managing the finalizer, required to don't drop a DataSource if this is still used by a Tenant Control Plane.
+	switch {
+	case ds.DeletionTimestamp != nil && controllerutil.ContainsFinalizer(ds, dataStoreFinalizer):
+		log.Info("marked for deletion, checking conditions")
+
+		if len(ds.Status.UsedBy) == 0 {
+			log.Info("resource is no more used by any Tenant Control Plane")
+
+			controllerutil.RemoveFinalizer(ds, dataStoreFinalizer)
+
+			return reconcile.Result{}, r.client.Update(ctx, ds)
+		}
+
+		log.Info("DataStore is still used by some Tenant Control Planes, cannot be removed")
+	case ds.DeletionTimestamp == nil && !controllerutil.ContainsFinalizer(ds, dataStoreFinalizer):
+		log.Info("the resource is missing the required finalizer, adding it")
+
+		controllerutil.AddFinalizer(ds, dataStoreFinalizer)
+
+		return reconcile.Result{}, r.client.Update(ctx, ds)
+	}
 	// A Data Source can trigger several Tenant Control Planes and requires a minimum validation:
 	// we have to ensure the data provided by the Data Source is valid and referencing an existing Secret object.
 	if _, err := ds.Spec.TLSConfig.CertificateAuthority.Certificate.GetContent(ctx, r.client); err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "invalid Certificate Authority data")
+		log.Error(err, "invalid Certificate Authority data")
+
+		return reconcile.Result{}, err
+	}
+
+	if ds.Spec.Driver == kamajiv1alpha1.EtcdDriver {
+		if ds.Spec.TLSConfig.CertificateAuthority.PrivateKey == nil {
+			err := fmt.Errorf("a valid private key is required for the etcd driver")
+
+			log.Error(err, "missing Certificate Authority private key data")
+
+			return reconcile.Result{}, err
+		}
+		if _, err := ds.Spec.TLSConfig.CertificateAuthority.PrivateKey.GetContent(ctx, r.client); err != nil {
+			log.Error(err, "invalid Certificate Authority private key data")
+
+			return reconcile.Result{}, err
+		}
 	}
 
 	if _, err := ds.Spec.TLSConfig.ClientCertificate.Certificate.GetContent(ctx, r.client); err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "invalid Client Certificate data")
+		log.Error(err, "invalid Client Certificate data")
+
+		return reconcile.Result{}, err
 	}
 
 	if _, err := ds.Spec.TLSConfig.ClientCertificate.PrivateKey.GetContent(ctx, r.client); err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "invalid Client Certificate data")
+		log.Error(err, "invalid Client Certificate private key data")
+
+		return reconcile.Result{}, err
 	}
 
 	tcpList := kamajiv1alpha1.TenantControlPlaneList{}
 
-	if err := r.client.List(ctx, &tcpList); err != nil {
+	if err := r.client.List(ctx, &tcpList, client.MatchingFieldsSelector{
+		Selector: fields.OneTermEqualSelector(indexers.TenantControlPlaneUsedDataStoreKey, ds.GetName()),
+	}); err != nil {
+		log.Error(err, "cannot retrieve list of the Tenant Control Plane using the following instance")
+
 		return reconcile.Result{}, err
 	}
 	// Updating the status with the list of Tenant Control Plane using the following Data Source
@@ -68,7 +128,9 @@ func (r *DataStore) Reconcile(ctx context.Context, request reconcile.Request) (r
 
 	ds.Status.UsedBy = tcpSets.List()
 
-	if err := r.client.Status().Update(ctx, &ds); err != nil {
+	if err := r.client.Status().Update(ctx, ds); err != nil {
+		log.Error(err, "cannot update the status for the given instance")
+
 		return reconcile.Result{}, err
 	}
 	// Triggering the reconciliation of the Tenant Control Plane upon a Secret change
@@ -88,9 +150,31 @@ func (r *DataStore) InjectClient(client client.Client) error {
 }
 
 func (r *DataStore) SetupWithManager(mgr controllerruntime.Manager) error {
+	enqueueFn := func(tcp *kamajiv1alpha1.TenantControlPlane, limitingInterface workqueue.RateLimitingInterface) {
+		if dataStoreName := tcp.Status.Storage.DataStoreName; len(dataStoreName) > 0 {
+			limitingInterface.AddRateLimited(reconcile.Request{
+				NamespacedName: k8stypes.NamespacedName{
+					Name: dataStoreName,
+				},
+			})
+		}
+	}
+	//nolint:forcetypeassert
 	return controllerruntime.NewControllerManagedBy(mgr).
-		For(&kamajiv1alpha1.DataStore{}, builder.WithPredicates(predicate.NewPredicateFuncs(func(object client.Object) bool {
-			return object.GetName() == r.ResourceName
-		}))).
+		For(&kamajiv1alpha1.DataStore{}, builder.WithPredicates(
+			predicate.ResourceVersionChangedPredicate{},
+		)).
+		Watches(&source.Kind{Type: &kamajiv1alpha1.TenantControlPlane{}}, handler.Funcs{
+			CreateFunc: func(createEvent event.CreateEvent, limitingInterface workqueue.RateLimitingInterface) {
+				enqueueFn(createEvent.Object.(*kamajiv1alpha1.TenantControlPlane), limitingInterface)
+			},
+			UpdateFunc: func(updateEvent event.UpdateEvent, limitingInterface workqueue.RateLimitingInterface) {
+				enqueueFn(updateEvent.ObjectOld.(*kamajiv1alpha1.TenantControlPlane), limitingInterface)
+				enqueueFn(updateEvent.ObjectNew.(*kamajiv1alpha1.TenantControlPlane), limitingInterface)
+			},
+			DeleteFunc: func(deleteEvent event.DeleteEvent, limitingInterface workqueue.RateLimitingInterface) {
+				enqueueFn(deleteEvent.Object.(*kamajiv1alpha1.TenantControlPlane), limitingInterface)
+			},
+		}).
 		Complete(r)
 }

controllers/resources.go

@@ -12,9 +12,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/datastore"
 	"github.com/clastix/kamaji/internal/resources"
+	ds "github.com/clastix/kamaji/internal/resources/datastore"
 	"github.com/clastix/kamaji/internal/resources/konnectivity"
-	"github.com/clastix/kamaji/internal/sql"
 )
 
 type GroupResourceBuilderConfiguration struct {
@@ -22,7 +23,7 @@ type GroupResourceBuilderConfiguration struct {
 	log                 logr.Logger
 	tcpReconcilerConfig TenantControlPlaneReconcilerConfig
 	tenantControlPlane  kamajiv1alpha1.TenantControlPlane
-	DBConnection        sql.DBConnection
+	Connection          datastore.Connection
 	DataStore           kamajiv1alpha1.DataStore
 }
 
@@ -31,62 +32,49 @@ type GroupDeleteableResourceBuilderConfiguration struct {
 	log                 logr.Logger
 	tcpReconcilerConfig TenantControlPlaneReconcilerConfig
 	tenantControlPlane  kamajiv1alpha1.TenantControlPlane
-	DBConnection        sql.DBConnection
+	connection          datastore.Connection
 }
 
 // GetResources returns a list of resources that will be used to provide tenant control planes
 // Currently there is only a default approach
 // TODO: the idea of this function is to become a factory to return the group of resources according to the given configuration.
-func GetResources(config GroupResourceBuilderConfiguration, dataStore kamajiv1alpha1.DataStore) []resources.Resource {
-	return getDefaultResources(config, dataStore)
+func GetResources(config GroupResourceBuilderConfiguration) []resources.Resource {
+	return getDefaultResources(config)
 }
 
 // GetDeletableResources returns a list of resources that have to be deleted when tenant control planes are deleted
 // Currently there is only a default approach
 // TODO: the idea of this function is to become a factory to return the group of deleteable resources according to the given configuration.
-func GetDeletableResources(config GroupDeleteableResourceBuilderConfiguration, dataStore kamajiv1alpha1.DataStore) []resources.DeleteableResource {
-	return getDefaultDeleteableResources(config, dataStore)
+func GetDeletableResources(config GroupDeleteableResourceBuilderConfiguration) []resources.DeleteableResource {
+	return getDefaultDeleteableResources(config)
 }
 
-func getDefaultResources(config GroupResourceBuilderConfiguration, dataStore kamajiv1alpha1.DataStore) []resources.Resource {
-	resources := append(getUpgradeResources(config.client, config.tenantControlPlane), getKubernetesServiceResources(config.client, config.tenantControlPlane)...)
-	resources = append(resources, getKubeadmConfigResources(config.client, getTmpDirectory(config.tcpReconcilerConfig.TmpBaseDirectory, config.tenantControlPlane), dataStore)...)
-	resources = append(resources, getKubernetesCertificatesResources(config.client, config.log, config.tcpReconcilerConfig, config.tenantControlPlane)...)
-	resources = append(resources, getKubeconfigResources(config.client, config.log, config.tcpReconcilerConfig, config.tenantControlPlane)...)
-	resources = append(resources, getKubernetesStorageResources(config.client, config.log, config.tcpReconcilerConfig, config.DBConnection, config.tenantControlPlane, dataStore)...)
-	resources = append(resources, getInternalKonnectivityResources(config.client, config.log, config.tcpReconcilerConfig, config.tenantControlPlane)...)
-	resources = append(resources, getKubernetesDeploymentResources(config.client, config.tcpReconcilerConfig, dataStore)...)
-	resources = append(resources, getKubernetesIngressResources(config.client, config.tenantControlPlane)...)
-	resources = append(resources, getKubeadmPhaseResources(config.client, config.log, config.tenantControlPlane)...)
-	resources = append(resources, getKubeadmAddonResources(config.client, config.log, config.tenantControlPlane)...)
-	resources = append(resources, getExternalKonnectivityResources(config.client, config.log, config.tcpReconcilerConfig, config.tenantControlPlane)...)
+func getDefaultResources(config GroupResourceBuilderConfiguration) []resources.Resource {
+	resources := append(getUpgradeResources(config.client), getKubernetesServiceResources(config.client)...)
+	resources = append(resources, getKubeadmConfigResources(config.client, getTmpDirectory(config.tcpReconcilerConfig.TmpBaseDirectory, config.tenantControlPlane), config.DataStore)...)
+	resources = append(resources, getKubernetesCertificatesResources(config.client, config.tcpReconcilerConfig, config.tenantControlPlane)...)
+	resources = append(resources, getKubeconfigResources(config.client, config.tcpReconcilerConfig, config.tenantControlPlane)...)
+	resources = append(resources, getKubernetesStorageResources(config.client, config.Connection, config.DataStore)...)
+	resources = append(resources, getInternalKonnectivityResources(config.client)...)
+	resources = append(resources, getKubernetesDeploymentResources(config.client, config.tcpReconcilerConfig, config.DataStore)...)
+	resources = append(resources, getKubernetesIngressResources(config.client)...)
+	resources = append(resources, getKubeadmPhaseResources(config.client)...)
+	resources = append(resources, getKubeadmAddonResources(config.client)...)
+	resources = append(resources, getExternalKonnectivityResources(config.client)...)
 
 	return resources
 }
 
-func getDefaultDeleteableResources(config GroupDeleteableResourceBuilderConfiguration, dataStore kamajiv1alpha1.DataStore) []resources.DeleteableResource {
-	switch dataStore.Spec.Driver {
-	case kamajiv1alpha1.EtcdDriver:
-		return []resources.DeleteableResource{
-			&resources.ETCDSetupResource{
-				Client:    config.client,
-				Log:       config.log,
-				DataStore: dataStore,
-			},
-		}
-	case kamajiv1alpha1.KineMySQLDriver, kamajiv1alpha1.KinePostgreSQLDriver:
-		return []resources.DeleteableResource{
-			&resources.SQLSetup{
-				Client:       config.client,
-				DBConnection: config.DBConnection,
-			},
-		}
-	default:
-		return []resources.DeleteableResource{}
+func getDefaultDeleteableResources(config GroupDeleteableResourceBuilderConfiguration) []resources.DeleteableResource {
+	return []resources.DeleteableResource{
+		&ds.Setup{
+			Client:     config.client,
+			Connection: config.connection,
+		},
 	}
 }
 
-func getUpgradeResources(c client.Client, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
+func getUpgradeResources(c client.Client) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubernetesUpgrade{
 			Client: c,
@@ -94,7 +82,7 @@ func getUpgradeResources(c client.Client, tenantControlPlane kamajiv1alpha1.Tena
 	}
 }
 
-func getKubernetesServiceResources(c client.Client, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
+func getKubernetesServiceResources(c client.Client) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubernetesServiceResource{
 			Client: c,
@@ -121,133 +109,88 @@ func getKubeadmConfigResources(c client.Client, tmpDirectory string, dataStore k
 	}
 }
 
-func getKubernetesCertificatesResources(c client.Client, log logr.Logger, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
+func getKubernetesCertificatesResources(c client.Client, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&resources.CACertificate{
 			Client:       c,
-			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.FrontProxyCACertificate{
 			Client:       c,
-			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.SACertificate{
 			Client:       c,
-			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.APIServerCertificate{
 			Client:       c,
-			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.APIServerKubeletClientCertificate{
 			Client:       c,
-			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.FrontProxyClientCertificate{
 			Client:       c,
-			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 	}
 }
 
-func getKubeconfigResources(c client.Client, log logr.Logger, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
+func getKubeconfigResources(c client.Client, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubeconfigResource{
 			Name:               "admin-kubeconfig",
 			Client:             c,
-			Log:                log,
 			KubeConfigFileName: resources.AdminKubeConfigFileName,
 			TmpDirectory:       getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.KubeconfigResource{
 			Name:               "controller-manager-kubeconfig",
 			Client:             c,
-			Log:                log,
 			KubeConfigFileName: resources.ControllerManagerKubeConfigFileName,
 			TmpDirectory:       getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.KubeconfigResource{
 			Name:               "scheduler-kubeconfig",
 			Client:             c,
-			Log:                log,
 			KubeConfigFileName: resources.SchedulerKubeConfigFileName,
 			TmpDirectory:       getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 	}
 }
 
-func getKubernetesStorageResources(c client.Client, log logr.Logger, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, dbConnection sql.DBConnection, tenantControlPlane kamajiv1alpha1.TenantControlPlane, ds kamajiv1alpha1.DataStore) []resources.Resource {
-	switch ds.Spec.Driver {
-	case kamajiv1alpha1.EtcdDriver:
-		return []resources.Resource{
-			&resources.ETCDCACertificatesResource{
-				Name:      "etcd-ca-certificates",
-				Client:    c,
-				Log:       log,
-				DataStore: ds,
-			},
-			&resources.ETCDCertificatesResource{
-				Name:   "etcd-certificates",
-				Client: c,
-				Log:    log,
-			},
-			&resources.ETCDSetupResource{
-				Client:    c,
-				Log:       log,
-				DataStore: ds,
-			},
-		}
-	case kamajiv1alpha1.KineMySQLDriver, kamajiv1alpha1.KinePostgreSQLDriver:
-		return []resources.Resource{
-			&resources.SQLStorageConfig{
-				Client: c,
-				Name:   "sql-config",
-				Host:   dbConnection.GetHost(),
-				Port:   dbConnection.GetPort(),
-				Driver: dbConnection.Driver(),
-			},
-			&resources.SQLSetup{
-				Client:       c,
-				DBConnection: dbConnection,
-				Driver:       dbConnection.Driver(),
-			},
-			&resources.SQLCertificate{
-				Client:    c,
-				DataStore: ds,
-			},
-		}
-	default:
-		return []resources.Resource{}
+func getKubernetesStorageResources(c client.Client, dbConnection datastore.Connection, datastore kamajiv1alpha1.DataStore) []resources.Resource {
+	return []resources.Resource{
+		&ds.Config{
+			Client:     c,
+			ConnString: dbConnection.GetConnectionString(),
+			DataStore:  datastore,
+		},
+		&ds.Setup{
+			Client:     c,
+			Connection: dbConnection,
+			DataStore:  datastore,
+		},
+		&ds.Certificate{
+			Client:    c,
+			DataStore: datastore,
+		},
 	}
 }
 
 func getKubernetesDeploymentResources(c client.Client, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, dataStore kamajiv1alpha1.DataStore) []resources.Resource {
-	var endpoints []string
-
-	switch dataStore.Spec.Driver {
-	case kamajiv1alpha1.EtcdDriver:
-		endpoints = dataStore.Spec.Endpoints
-	default:
-		endpoints = []string{"127.0.0.1:2379"}
-	}
-
 	return []resources.Resource{
 		&resources.KubernetesDeploymentResource{
 			Client:             c,
-			ETCDEndpoints:      endpoints,
-			DataStoreDriver:    dataStore.Spec.Driver,
+			DataStore:          dataStore,
 			KineContainerImage: tcpReconcilerConfig.KineContainerImage,
 		},
 	}
 }
 
-func getKubernetesIngressResources(c client.Client, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
+func getKubernetesIngressResources(c client.Client) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubernetesIngressResource{
 			Client: c,
@@ -255,86 +198,56 @@ func getKubernetesIngressResources(c client.Client, tenantControlPlane kamajiv1a
 	}
 }
 
-func getKubeadmPhaseResources(c client.Client, log logr.Logger, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
+func getKubeadmPhaseResources(c client.Client) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubeadmPhase{
 			Name:   "upload-config-kubeadm",
 			Client: c,
-			Log:    log,
 			Phase:  resources.PhaseUploadConfigKubeadm,
 		},
 		&resources.KubeadmPhase{
 			Name:   "upload-config-kubelet",
 			Client: c,
-			Log:    log,
 			Phase:  resources.PhaseUploadConfigKubelet,
 		},
 		&resources.KubeadmPhase{
 			Name:   "bootstrap-token",
 			Client: c,
-			Log:    log,
 			Phase:  resources.PhaseBootstrapToken,
 		},
 	}
 }
 
-func getKubeadmAddonResources(c client.Client, log logr.Logger, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
+func getKubeadmAddonResources(c client.Client) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubeadmAddonResource{
 			Name:         "coredns",
 			Client:       c,
-			Log:          log,
 			KubeadmAddon: resources.AddonCoreDNS,
 		},
 		&resources.KubeadmAddonResource{
 			Name:         "kubeproxy",
 			Client:       c,
-			Log:          log,
 			KubeadmAddon: resources.AddonKubeProxy,
 		},
 	}
 }
 
-func getExternalKonnectivityResources(c client.Client, log logr.Logger, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
+func getExternalKonnectivityResources(c client.Client) []resources.Resource {
 	return []resources.Resource{
-		&konnectivity.ServiceAccountResource{
-			Client: c,
-			Name:   "konnectivity-sa",
-		},
-		&konnectivity.ClusterRoleBindingResource{
-			Client: c,
-			Name:   "konnectivity-clusterrolebinding",
-		},
-		&konnectivity.KubernetesDeploymentResource{
-			Client: c,
-			Name:   "konnectivity-deployment",
-		},
-		&konnectivity.ServiceResource{
-			Client: c,
-			Name:   "konnectivity-service",
-		},
-		&konnectivity.Agent{
-			Client: c,
-			Name:   "konnectivity-agent",
-		},
+		&konnectivity.ServiceAccountResource{Client: c},
+		&konnectivity.ClusterRoleBindingResource{Client: c},
+		&konnectivity.KubernetesDeploymentResource{Client: c},
+		&konnectivity.ServiceResource{Client: c},
+		&konnectivity.Agent{Client: c},
 	}
 }
 
-func getInternalKonnectivityResources(c client.Client, log logr.Logger, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
+func getInternalKonnectivityResources(c client.Client) []resources.Resource {
 	return []resources.Resource{
-		&konnectivity.EgressSelectorConfigurationResource{
-			Client: c,
-			Name:   "konnectivity-egress-selector-configuration",
-		},
-		&konnectivity.CertificateResource{
-			Client: c,
-			Log:    log,
-			Name:   "konnectivity-certificate",
-		},
-		&konnectivity.KubeconfigResource{
-			Client: c,
-			Name:   "konnectivity-kubeconfig",
-		},
+		&konnectivity.EgressSelectorConfigurationResource{Client: c},
+		&konnectivity.CertificateResource{Client: c},
+		&konnectivity.KubeconfigResource{Client: c},
 	}
 }
 

controllers/storage.go

@@ -14,26 +14,10 @@ import (
 	"github.com/pkg/errors"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/sql"
+	"github.com/clastix/kamaji/internal/datastore"
 )
 
-func (r *TenantControlPlaneReconciler) getStorageConnection(ctx context.Context, ds kamajiv1alpha1.DataStore) (sql.DBConnection, error) {
-	var driver sql.Driver
-	var dbName string
-
-	// TODO: https://github.com/clastix/kamaji/issues/67
-	switch ds.Spec.Driver {
-	case kamajiv1alpha1.EtcdDriver:
-		return nil, nil
-	case kamajiv1alpha1.KineMySQLDriver:
-		driver = sql.MySQL
-		dbName = "mysql"
-	case kamajiv1alpha1.KinePostgreSQLDriver:
-		driver = sql.PostgreSQL
-	default:
-		return nil, nil
-	}
-
+func (r *TenantControlPlaneReconciler) getStorageConnection(ctx context.Context, ds kamajiv1alpha1.DataStore) (datastore.Connection, error) {
 	ca, err := ds.Spec.TLSConfig.CertificateAuthority.Certificate.GetContent(ctx, r.Client)
 	if err != nil {
 		return nil, err
@@ -74,29 +58,47 @@ func (r *TenantControlPlaneReconciler) getStorageConnection(ctx context.Context,
 		password = string(p)
 	}
 
-	host, stringPort, err := net.SplitHostPort(ds.Spec.Endpoints[0])
-	if err != nil {
-		return nil, errors.Wrap(err, "cannot retrieve host-port pair from DataStore endpoints")
+	eps := make([]datastore.ConnectionEndpoint, 0, len(ds.Spec.Endpoints))
+
+	for _, ep := range ds.Spec.Endpoints {
+		host, stringPort, err := net.SplitHostPort(ep)
+		if err != nil {
+			return nil, errors.Wrap(err, "cannot retrieve host-port pair from DataStore endpoints")
+		}
+
+		port, err := strconv.Atoi(stringPort)
+		if err != nil {
+			return nil, errors.Wrap(err, "cannot convert port from string for the given DataStore")
+		}
+
+		eps = append(eps, datastore.ConnectionEndpoint{
+			Host: host,
+			Port: port,
+		})
 	}
 
-	port, err := strconv.Atoi(stringPort)
-	if err != nil {
-		return nil, errors.Wrap(err, "cannot convert port from string for the given DataStore")
-	}
-
-	return sql.GetDBConnection(
-		sql.ConnectionConfig{
-			SQLDriver: driver,
-			User:      user,
-			Password:  password,
-			Host:      host,
-			Port:      port,
-			DBName:    dbName,
-			TLSConfig: &tls.Config{
-				ServerName:   host,
-				RootCAs:      rootCAs,
-				Certificates: []tls.Certificate{certificate},
-			},
+	cc := datastore.ConnectionConfig{
+		User:      user,
+		Password:  password,
+		Endpoints: eps,
+		TLSConfig: &tls.Config{
+			RootCAs:      rootCAs,
+			Certificates: []tls.Certificate{certificate},
 		},
-	)
+	}
+
+	switch ds.Spec.Driver {
+	case kamajiv1alpha1.KineMySQLDriver:
+		cc.TLSConfig.ServerName = cc.Endpoints[0].Host
+
+		return datastore.NewMySQLConnection(cc)
+	case kamajiv1alpha1.KinePostgreSQLDriver:
+		cc.TLSConfig.ServerName = cc.Endpoints[0].Host
+		//nolint:contextcheck
+		return datastore.NewPostgreSQLConnection(cc)
+	case kamajiv1alpha1.EtcdDriver:
+		return datastore.NewETCDConnection(cc)
+	default:
+		return nil, fmt.Errorf("%s is not a valid driver", ds.Spec.Driver)
+	}
 }

controllers/tenantcontrolplane_controller.go

@@ -29,7 +29,7 @@ import (
 )
 
 const (
-	finalizer = "finalizer.kamaji.clastix.io"
+	tenantControlPlaneFinalizer = "finalizer.kamaji.clastix.io"
 )
 
 // TenantControlPlaneReconciler reconciles a TenantControlPlane object.
@@ -42,19 +42,19 @@ type TenantControlPlaneReconciler struct {
 
 // TenantControlPlaneReconcilerConfig gives the necessary configuration for TenantControlPlaneReconciler.
 type TenantControlPlaneReconcilerConfig struct {
-	DataStoreName      string
-	KineContainerImage string
-	TmpBaseDirectory   string
+	DefaultDataStoreName string
+	KineContainerImage   string
+	TmpBaseDirectory     string
 }
 
 //+kubebuilder:rbac:groups=kamaji.clastix.io,resources=tenantcontrolplanes,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=kamaji.clastix.io,resources=tenantcontrolplanes/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=kamaji.clastix.io,resources=tenantcontrolplanes/finalizers,verbs=update
-// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=get;list;watch;create;update;patch;delete
 
 func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	log := log.FromContext(ctx)
@@ -62,6 +62,8 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 	tenantControlPlane := &kamajiv1alpha1.TenantControlPlane{}
 	isTenantControlPlane, err := r.getTenantControlPlane(ctx, req.NamespacedName, tenantControlPlane)
 	if err != nil {
+		log.Error(err, "cannot retrieve the required instance")
+
 		return ctrl.Result{}, err
 	}
 	if !isTenantControlPlane {
@@ -69,28 +71,26 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 	}
 
 	markedToBeDeleted := tenantControlPlane.GetDeletionTimestamp() != nil
-	hasFinalizer := hasFinalizer(*tenantControlPlane)
+	hasFinalizer := controllerutil.ContainsFinalizer(tenantControlPlane, tenantControlPlaneFinalizer)
 
 	if markedToBeDeleted && !hasFinalizer {
 		return ctrl.Result{}, nil
 	}
-
-	ds := kamajiv1alpha1.DataStore{}
-	if err = r.Client.Get(ctx, k8stypes.NamespacedName{Name: r.Config.DataStoreName}, &ds); err != nil {
-		return ctrl.Result{}, errors.Wrap(err, "cannot retrieve kamajiv1alpha.DataStore object")
-	}
-
-	dbConnection, err := r.getStorageConnection(ctx, ds)
+	// Retrieving the DataStore to use for the current reconciliation
+	ds, err := r.dataStore(ctx, tenantControlPlane)
 	if err != nil {
+		log.Error(err, "cannot retrieve the DataStore for the given instance")
+
 		return ctrl.Result{}, err
 	}
-	defer func() {
-		// TODO: Currently, etcd is not accessed using this dbConnection. For that reason we need this check
-		// Check: https://github.com/clastix/kamaji/issues/67
-		if dbConnection != nil {
-			dbConnection.Close()
-		}
-	}()
+
+	dsConnection, err := r.getStorageConnection(ctx, *ds)
+	if err != nil {
+		log.Error(err, "cannot generate the DataStore connection for the given instance")
+
+		return ctrl.Result{}, err
+	}
+	defer dsConnection.Close()
 
 	if markedToBeDeleted {
 		log.Info("marked for deletion, performing clean-up")
@@ -100,12 +100,14 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 			log:                 log,
 			tcpReconcilerConfig: r.Config,
 			tenantControlPlane:  *tenantControlPlane,
-			DBConnection:        dbConnection,
+			connection:          dsConnection,
 		}
-		registeredDeletableResources := GetDeletableResources(groupDeleteableResourceBuilderConfiguration, ds)
+		registeredDeletableResources := GetDeletableResources(groupDeleteableResourceBuilderConfiguration)
 
 		for _, resource := range registeredDeletableResources {
-			if err := resources.HandleDeletion(ctx, resource, tenantControlPlane); err != nil {
+			if err = resources.HandleDeletion(ctx, resource, tenantControlPlane); err != nil {
+				log.Error(err, "resource deletion failed", "resource", resource.GetName())
+
 				return ctrl.Result{}, err
 			}
 		}
@@ -113,7 +115,9 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 		if hasFinalizer {
 			log.Info("removing finalizer")
 
-			if err := r.RemoveFinalizer(ctx, tenantControlPlane); err != nil {
+			if err = r.RemoveFinalizer(ctx, tenantControlPlane); err != nil {
+				log.Error(err, "cannot remove the finalizer for the given resource")
+
 				return ctrl.Result{}, err
 			}
 		}
@@ -132,10 +136,10 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 		log:                 log,
 		tcpReconcilerConfig: r.Config,
 		tenantControlPlane:  *tenantControlPlane,
-		DataStore:           ds,
-		DBConnection:        dbConnection,
+		DataStore:           *ds,
+		Connection:          dsConnection,
 	}
-	registeredResources := GetResources(groupResourceBuilderConfiguration, ds)
+	registeredResources := GetResources(groupResourceBuilderConfiguration)
 
 	for _, resource := range registeredResources {
 		result, err := resources.Handle(ctx, resource, tenantControlPlane)
@@ -146,6 +150,8 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 				return ctrl.Result{Requeue: true}, nil
 			}
 
+			log.Error(err, "handling of resource failed", "resource", resource.GetName())
+
 			return ctrl.Result{}, err
 		}
 
@@ -154,6 +160,8 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 		}
 
 		if err := r.updateStatus(ctx, req.NamespacedName, resource); err != nil {
+			log.Error(err, "update of the resource failed", "resource", resource.GetName())
+
 			return ctrl.Result{}, err
 		}
 
@@ -221,24 +229,34 @@ func (r *TenantControlPlaneReconciler) updateStatus(ctx context.Context, namespa
 	return nil
 }
 
-func hasFinalizer(tenantControlPlane kamajiv1alpha1.TenantControlPlane) bool {
-	for _, f := range tenantControlPlane.GetFinalizers() {
-		if f == finalizer {
-			return true
-		}
-	}
-
-	return false
-}
-
 func (r *TenantControlPlaneReconciler) AddFinalizer(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	controllerutil.AddFinalizer(tenantControlPlane, finalizer)
+	controllerutil.AddFinalizer(tenantControlPlane, tenantControlPlaneFinalizer)
 
 	return r.Update(ctx, tenantControlPlane)
 }
 
 func (r *TenantControlPlaneReconciler) RemoveFinalizer(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	controllerutil.RemoveFinalizer(tenantControlPlane, finalizer)
+	controllerutil.RemoveFinalizer(tenantControlPlane, tenantControlPlaneFinalizer)
 
 	return r.Update(ctx, tenantControlPlane)
 }
+
+// dataStore retrieves the override DataStore for the given Tenant Control Plane if specified,
+// otherwise fallback to the default one specified in the Kamaji setup.
+func (r *TenantControlPlaneReconciler) dataStore(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (*kamajiv1alpha1.DataStore, error) {
+	dataStoreName := tenantControlPlane.Spec.DataStore
+	if len(dataStoreName) == 0 {
+		dataStoreName = r.Config.DefaultDataStoreName
+	}
+
+	if statusDataStore := tenantControlPlane.Status.Storage.DataStoreName; len(statusDataStore) > 0 && dataStoreName != statusDataStore {
+		return nil, fmt.Errorf("migration from a DataStore (current: %s) to another one (desired: %s) is not yet supported", statusDataStore, dataStoreName)
+	}
+
+	ds := &kamajiv1alpha1.DataStore{}
+	if err := r.Client.Get(ctx, k8stypes.NamespacedName{Name: dataStoreName}, ds); err != nil {
+		return nil, errors.Wrap(err, "cannot retrieve *kamajiv1alpha.DataStore object")
+	}
+
+	return ds, nil
+}

deploy/etcd/etcd-cluster.yaml

@@ -54,13 +54,6 @@ spec:
         app: etcd
     spec:
       serviceAccountName: etcd
-      topologySpreadConstraints:
-      - maxSkew: 1
-        topologyKey: topology.kubernetes.io/zone
-        whenUnsatisfiable: DoNotSchedule
-        labelSelector:
-          matchLabels:
-            app: etcd
       volumes:
       - name: certs
         secret:

deploy/kine/postgresql/Makefile

@@ -17,11 +17,10 @@ cnpg:
       sh -s -- -b $(shell git rev-parse --show-toplevel)/bin
 
 postgresql-secret: cnpg
-	@kubectl -n kamaji-system get secret postgres-root-cert > /dev/null 2>&1 || $(CNPG) certificate postgres-root-cert \
+	@kubectl -n kamaji-system get secret postgres-root-cert > /dev/null 2>&1 || $(CNPG) -n kamaji-system certificate postgres-root-cert \
     		--cnpg-cluster postgresql \
     		--cnpg-user $$(kubectl -n kamaji-system get secret postgresql-superuser -o jsonpath='{.data.username}' | base64 -d)
 
 postgresql-destroy:
 	@kubectl delete -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-1.16.0.yaml --ignore-not-found && \
-	kubectl delete secret postgres-root-cert --ignore-not-found && \
-	kubectl delete secret kine-secret --ignore-not-found
+	kubectl -n kamaji-system delete secret postgres-root-cert --ignore-not-found

docs/getting-started-with-kamaji.md

@@ -8,13 +8,16 @@ We assume you have installed on your workstation:
 
 - [Docker](https://docs.docker.com/engine/install/)
 - [KinD](https://kind.sigs.k8s.io/)
-- [kubectl](https://kubernetes.io/docs/tasks/tools/)
-- [kubeadm](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/)
+- [kubectl@v1.25.0](https://kubernetes.io/docs/tasks/tools/)
+- [kubeadm@v1.25.0](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/)
 - [jq](https://stedolan.github.io/jq/)
 - [openssl](https://www.openssl.org/)
 - [cfssl](https://github.com/cloudflare/cfssl)
 - [cfssljson](https://github.com/cloudflare/cfssl)
 
+> Starting from Kamaji v0.0.2, `kubectl` and `kubeadm` need to meet at least minimum version to `v1.25.0`:
+> this is required due to the latest changes addressed from the release Kubernetes 1.25 release regarding the `kubelet-config` ConfigMap required for the node join.
+
 ## Setup Kamaji on KinD
 
 The instance of Kamaji is made of a single node hosting:

docs/reference.md

@@ -101,7 +101,7 @@ addons:
 addons:
   konnectivity:
     proxyPort: 31132 # mandatory
-    version: v0.0.31
+    version: v0.0.32
     resources:
       requests:
         cpu: 100m
@@ -109,6 +109,6 @@ addons:
       limits:
         cpu: 100m
         memory: 128Mi
-    serverImage: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-server
-    agentImage: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-agent
+    serverImage: registry.k8s.io/kas-network-proxy/proxy-server
+    agentImage: registry.k8s.io/kas-network-proxy/proxy-agent
 ```

e2e/suite_test.go

@@ -55,7 +55,6 @@ var _ = BeforeSuite(func() {
 	Expect(err).NotTo(HaveOccurred())
 
 	//+kubebuilder:scaffold:scheme
-
 	k8sClient, err = client.New(cfg, client.Options{Scheme: scheme.Scheme})
 	Expect(err).NotTo(HaveOccurred())
 	Expect(k8sClient).NotTo(BeNil())

e2e/tenant_control_plane_ready_test.go

@@ -18,7 +18,6 @@ import (
 var _ = Describe("Deploy a TenantControlPlane resource", func() {
 	// Fill TenantControlPlane object
 	tcp := kamajiv1alpha1.TenantControlPlane{
-		TypeMeta: metav1.TypeMeta{},
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "tcp-clusterip",
 			Namespace: "default",

e2e/utils_test.go

@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"os/exec"
 
 	. "github.com/onsi/ginkgo"
@@ -96,7 +96,7 @@ func PrintKamajiLogs() {
 
 		defer podLogs.Close()
 
-		podBytes, err := ioutil.ReadAll(podLogs)
+		podBytes, err := io.ReadAll(podLogs)
 		Expect(err).ToNot(HaveOccurred())
 
 		_, _ = fmt.Fprintln(GinkgoWriter, "DEBUG: retrieving Kamaji Pod logs")

e2e/worker_kubeadm_join_test.go

@@ -7,7 +7,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"strings"
 	"time"
@@ -37,7 +36,6 @@ var _ = Describe("starting a kind worker with kubeadm", func() {
 
 	JustBeforeEach(func() {
 		tcp = kamajiv1alpha1.TenantControlPlane{
-			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "worker-nodes-join",
 				Namespace: "default",
@@ -84,7 +82,7 @@ var _ = Describe("starting a kind worker with kubeadm", func() {
 		})
 		Expect(err).ToNot(HaveOccurred())
 
-		kubeconfigFile, err = ioutil.TempFile("", "kamaji")
+		kubeconfigFile, err = os.CreateTemp("", "kamaji")
 		Expect(err).ToNot(HaveOccurred())
 	})
 

e2e/worker_tcp_change_port_test.go

@@ -6,7 +6,6 @@ package e2e
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"time"
 
@@ -66,7 +65,7 @@ var _ = Describe("validating kubeconfig", func() {
 
 		var err error
 
-		kubeconfigFile, err = ioutil.TempFile("", "kamaji")
+		kubeconfigFile, err = os.CreateTemp("", "kamaji")
 		Expect(err).ToNot(HaveOccurred())
 	})
 

go.mod

@@ -3,30 +3,27 @@ module github.com/clastix/kamaji
 go 1.18
 
 require (
-	github.com/go-logr/logr v1.2.0
+	github.com/go-logr/logr v1.2.3
 	github.com/go-pg/pg/v10 v10.10.6
 	github.com/go-sql-driver/mysql v1.6.0
 	github.com/google/uuid v1.3.0
 	github.com/json-iterator/go v1.1.12
 	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/gomega v1.17.0
+	github.com/onsi/gomega v1.19.0
 	github.com/pkg/errors v0.9.1
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.10.1
 	github.com/testcontainers/testcontainers-go v0.13.0
-	go.etcd.io/etcd/api/v3 v3.5.1
-	go.etcd.io/etcd/client/v3 v3.5.1
-	google.golang.org/grpc v1.43.0
-	k8s.io/api v0.23.5
-	k8s.io/apimachinery v0.23.5
-	k8s.io/apiserver v0.23.5
-	k8s.io/client-go v0.23.5
+	go.etcd.io/etcd/api/v3 v3.5.4
+	go.etcd.io/etcd/client/v3 v3.5.4
+	k8s.io/api v0.25.0
+	k8s.io/apimachinery v0.25.0
+	k8s.io/apiserver v0.25.0
+	k8s.io/client-go v0.25.0
 	k8s.io/cluster-bootstrap v0.0.0
-	k8s.io/component-base v0.23.5
-	k8s.io/kube-proxy v0.0.0
 	k8s.io/kubelet v0.0.0
-	k8s.io/kubernetes v1.23.5
-	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9
+	k8s.io/kubernetes v1.25.0
+	k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed
 	sigs.k8s.io/controller-runtime v0.11.0
 )
 
@@ -35,8 +32,8 @@ require (
 	cloud.google.com/go/storage v1.18.2 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest v0.11.18 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.13 // indirect
+	github.com/Azure/go-autorest/autorest v0.11.27 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
@@ -45,7 +42,7 @@ require (
 	github.com/PuerkitoBio/purell v1.1.1 // indirect
 	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/blang/semver v3.5.1+incompatible // indirect
+	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.1.2 // indirect
 	github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
@@ -54,34 +51,35 @@ require (
 	github.com/containerd/cgroups v1.0.1 // indirect
 	github.com/containerd/containerd v1.5.9 // indirect
 	github.com/coredns/caddy v1.1.0 // indirect
-	github.com/coredns/corefile-migration v1.0.14 // indirect
+	github.com/coredns/corefile-migration v1.0.17 // indirect
 	github.com/coreos/go-semver v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/distribution v2.7.1+incompatible // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/docker v20.10.11+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
-	github.com/envoyproxy/go-control-plane v0.10.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.8.0 // indirect
+	github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1 // indirect
 	github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
-	github.com/form3tech-oss/jwt-go v3.2.3+incompatible // indirect
 	github.com/fsnotify/fsnotify v1.5.1 // indirect
 	github.com/go-errors/errors v1.0.1 // indirect
-	github.com/go-logr/zapr v1.2.0 // indirect
+	github.com/go-logr/zapr v1.2.3 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.19.5 // indirect
 	github.com/go-openapi/swag v0.19.14 // indirect
 	github.com/go-pg/zerochecker v0.2.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang-jwt/jwt/v4 v4.2.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/btree v1.0.1 // indirect
+	github.com/google/gnostic v0.5.7-v3refs // indirect
 	github.com/google/go-cmp v0.5.6 // indirect
 	github.com/google/gofuzz v1.1.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/googleapis/gax-go/v2 v2.1.1 // indirect
-	github.com/googleapis/gnostic v0.5.5 // indirect
 	github.com/googleapis/google-cloud-go-testing v0.0.0-20210719221736-1c9a4c676720 // indirect
 	github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
@@ -96,16 +94,17 @@ require (
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/mitchellh/mapstructure v1.4.3 // indirect
 	github.com/moby/sys/mount v0.2.0 // indirect
-	github.com/moby/sys/mountinfo v0.5.0 // indirect
+	github.com/moby/sys/mountinfo v0.6.0 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nxadm/tail v1.4.8 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.0.2 // indirect
+	github.com/opencontainers/runc v1.1.3 // indirect
 	github.com/pelletier/go-toml v1.9.4 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
@@ -118,76 +117,78 @@ require (
 	github.com/spf13/cast v1.4.1 // indirect
 	github.com/spf13/cobra v1.4.0 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/stretchr/testify v1.7.0 // indirect
 	github.com/subosito/gotenv v1.2.0 // indirect
 	github.com/tmthrgd/go-hex v0.0.0-20190904060850-447a3041c3bc // indirect
 	github.com/vmihailenco/bufpool v0.1.11 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.3.4 // indirect
 	github.com/vmihailenco/tagparser v0.1.2 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
-	github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.5.1 // indirect
+	github.com/xlab/treeprint v1.1.0 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.5.4 // indirect
 	go.opencensus.io v0.23.0 // indirect
 	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
 	go.uber.org/zap v1.19.1 // indirect
-	golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa // indirect
-	golang.org/x/net v0.0.0-20211216030914-fe4d6282115f // indirect
+	golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd // indirect
+	golang.org/x/net v0.0.0-20220722155237-a158d28d115b // indirect
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
-	golang.org/x/sys v0.0.0-20220209214540-3681064d5158 // indirect
-	golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b // indirect
+	golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f // indirect
+	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
 	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
+	golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
 	google.golang.org/api v0.63.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
+	google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 // indirect
+	google.golang.org/grpc v1.47.0 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.66.2 // indirect
 	gopkg.in/square/go-jose.v2 v2.5.1 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
-	k8s.io/apiextensions-apiserver v0.23.5 // indirect
-	k8s.io/cli-runtime v0.23.5 // indirect
-	k8s.io/klog/v2 v2.60.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65 // indirect
-	k8s.io/system-validators v1.6.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/apiextensions-apiserver v0.25.0 // indirect
+	k8s.io/cli-runtime v0.25.0 // indirect
+	k8s.io/component-base v0.25.0 // indirect
+	k8s.io/klog/v2 v2.70.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 // indirect
+	k8s.io/kube-proxy v0.0.0 // indirect
+	k8s.io/system-validators v1.7.0 // indirect
 	mellium.im/sasl v0.3.0 // indirect
-	sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 // indirect
-	sigs.k8s.io/kustomize/api v0.10.1 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.13.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
+	sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
+	sigs.k8s.io/kustomize/api v0.12.1 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.13.9 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
 
 replace (
-	k8s.io/api => k8s.io/api v0.23.5
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.23.5
-	k8s.io/apimachinery => k8s.io/apimachinery v0.23.5
-	k8s.io/apiserver => k8s.io/apiserver v0.23.5
-	k8s.io/cli-runtime => k8s.io/cli-runtime v0.23.5
-	k8s.io/client-go => k8s.io/client-go v0.23.5
-	k8s.io/cloud-provider => k8s.io/cloud-provider v0.23.5
-	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.23.5
-	k8s.io/code-generator => k8s.io/code-generator v0.23.5
-	k8s.io/component-base => k8s.io/component-base v0.23.5
-	k8s.io/component-helpers => k8s.io/component-helpers v0.23.5
-	k8s.io/controller-manager => k8s.io/controller-manager v0.23.5
-	k8s.io/cri-api => k8s.io/cri-api v0.23.5
-	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.23.5
-	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.23.5
-	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.23.5
-	k8s.io/kube-proxy => k8s.io/kube-proxy v0.23.5
-	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.23.5
-	k8s.io/kubectl => k8s.io/kubectl v0.23.5
-	k8s.io/kubelet => k8s.io/kubelet v0.23.5
-	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.23.5
-	k8s.io/metrics => k8s.io/metrics v0.23.5
-	k8s.io/mount-utils => k8s.io/mount-utils v0.23.5
-	k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.23.5
-	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.23.5
+	k8s.io/api => k8s.io/api v0.25.0
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.25.0
+	k8s.io/apimachinery => k8s.io/apimachinery v0.25.0
+	k8s.io/apiserver => k8s.io/apiserver v0.25.0
+	k8s.io/cli-runtime => k8s.io/cli-runtime v0.25.0
+	k8s.io/client-go => k8s.io/client-go v0.25.0
+	k8s.io/cloud-provider => k8s.io/cloud-provider v0.25.0
+	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.25.0
+	k8s.io/code-generator => k8s.io/code-generator v0.25.0
+	k8s.io/component-base => k8s.io/component-base v0.25.0
+	k8s.io/component-helpers => k8s.io/component-helpers v0.25.0
+	k8s.io/controller-manager => k8s.io/controller-manager v0.25.0
+	k8s.io/cri-api => k8s.io/cri-api v0.25.0
+	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.25.0
+	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.25.0
+	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.25.0
+	k8s.io/kube-proxy => k8s.io/kube-proxy v0.25.0
+	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.25.0
+	k8s.io/kubectl => k8s.io/kubectl v0.25.0
+	k8s.io/kubelet => k8s.io/kubelet v0.25.0
+	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.25.0
+	k8s.io/metrics => k8s.io/metrics v0.25.0
+	k8s.io/mount-utils => k8s.io/mount-utils v0.25.0
+	k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.25.0
+	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.25.0
 )

indexers/indexer.go

@@ -0,0 +1,12 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package indexers
+
+import "sigs.k8s.io/controller-runtime/pkg/client"
+
+type Indexer interface {
+	Object() client.Object
+	Field() string
+	ExtractValue() client.IndexerFunc
+}

indexers/tcp_useddatastore.go

@@ -0,0 +1,40 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package indexers
+
+import (
+	"context"
+
+	controllerruntime "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+)
+
+const (
+	TenantControlPlaneUsedDataStoreKey = "status.storage.dataStoreName"
+)
+
+type TenantControlPlaneStatusDataStore struct{}
+
+func (t *TenantControlPlaneStatusDataStore) Object() client.Object {
+	return &kamajiv1alpha1.TenantControlPlane{}
+}
+
+func (t *TenantControlPlaneStatusDataStore) Field() string {
+	return TenantControlPlaneUsedDataStoreKey
+}
+
+func (t *TenantControlPlaneStatusDataStore) ExtractValue() client.IndexerFunc {
+	return func(object client.Object) []string {
+		//nolint:forcetypeassert
+		tcp := object.(*kamajiv1alpha1.TenantControlPlane)
+
+		return []string{tcp.Status.Storage.DataStoreName}
+	}
+}
+
+func (t *TenantControlPlaneStatusDataStore) SetupWithManager(ctx context.Context, mgr controllerruntime.Manager) error {
+	return mgr.GetFieldIndexer().IndexField(ctx, t.Object(), t.Field(), t.ExtractValue())
+}

internal/builders/controlplane/deployment.go

@@ -42,16 +42,14 @@ const (
 const (
 	apiServerFlagsAnnotation = "kube-apiserver.kamaji.clastix.io/args"
 	kineContainerName        = "kine"
-	kineVolumeChmod          = "kine-config"
+	dataStoreCerts           = "kine-config"
 	kineVolumeCertName       = "kine-certs"
 )
 
 type Deployment struct {
-	Address                string
-	ETCDEndpoints          []string
-	ETCDCompactionInterval string
-	ETCDStorageType        kamajiv1alpha1.Driver
-	KineContainerImage     string
+	Address            string
+	KineContainerImage string
+	DataStore          kamajiv1alpha1.DataStore
 }
 
 func (d *Deployment) SetContainers(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.TenantControlPlane, address string) {
@@ -116,19 +114,24 @@ func (d *Deployment) buildPKIVolume(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1
 		},
 	}
 
-	if d.ETCDStorageType == kamajiv1alpha1.EtcdDriver {
-		sources = append(sources, corev1.VolumeProjection{
-			Secret: d.secretProjection(tcp.Status.Certificates.ETCD.APIServer.SecretName, constants.APIServerEtcdClientCertName, constants.APIServerEtcdClientKeyName),
-		})
+	if d.DataStore.Spec.Driver == kamajiv1alpha1.EtcdDriver {
 		sources = append(sources, corev1.VolumeProjection{
 			Secret: &corev1.SecretProjection{
 				LocalObjectReference: corev1.LocalObjectReference{
-					Name: tcp.Status.Certificates.ETCD.CA.SecretName,
+					Name: tcp.Status.Storage.Certificate.SecretName,
 				},
 				Items: []corev1.KeyToPath{
 					{
-						Key:  constants.CACertName,
-						Path: constants.EtcdCACertName,
+						Key:  "ca.crt",
+						Path: "etcd/ca.crt",
+					},
+					{
+						Key:  "server.crt",
+						Path: "etcd/server.crt",
+					},
+					{
+						Key:  "server.key",
+						Path: "etcd/server.key",
 					},
 				},
 			},
@@ -140,7 +143,7 @@ func (d *Deployment) buildPKIVolume(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1
 		VolumeSource: corev1.VolumeSource{
 			Projected: &corev1.ProjectedVolumeSource{
 				Sources:     sources,
-				DefaultMode: pointer.Int32Ptr(420),
+				DefaultMode: pointer.Int32(420),
 			},
 		},
 	}
@@ -156,7 +159,7 @@ func (d *Deployment) buildCAVolume(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.
 		VolumeSource: corev1.VolumeSource{
 			Secret: &corev1.SecretVolumeSource{
 				SecretName:  tcp.Status.Certificates.CA.SecretName,
-				DefaultMode: pointer.Int32Ptr(420),
+				DefaultMode: pointer.Int32(420),
 			},
 		},
 	}
@@ -172,7 +175,7 @@ func (d *Deployment) buildSSLCertsVolume(podSpec *corev1.PodSpec, tcp *kamajiv1a
 		VolumeSource: corev1.VolumeSource{
 			Secret: &corev1.SecretVolumeSource{
 				SecretName:  tcp.Status.Certificates.CA.SecretName,
-				DefaultMode: pointer.Int32Ptr(420),
+				DefaultMode: pointer.Int32(420),
 			},
 		},
 	}
@@ -188,7 +191,7 @@ func (d *Deployment) buildShareCAVolume(podSpec *corev1.PodSpec, tcp *kamajiv1al
 		VolumeSource: corev1.VolumeSource{
 			Secret: &corev1.SecretVolumeSource{
 				SecretName:  tcp.Status.Certificates.CA.SecretName,
-				DefaultMode: pointer.Int32Ptr(420),
+				DefaultMode: pointer.Int32(420),
 			},
 		},
 	}
@@ -204,7 +207,7 @@ func (d *Deployment) buildLocalShareCAVolume(podSpec *corev1.PodSpec, tcp *kamaj
 		VolumeSource: corev1.VolumeSource{
 			Secret: &corev1.SecretVolumeSource{
 				SecretName:  tcp.Status.Certificates.CA.SecretName,
-				DefaultMode: pointer.Int32Ptr(420),
+				DefaultMode: pointer.Int32(420),
 			},
 		},
 	}
@@ -220,7 +223,7 @@ func (d *Deployment) buildSchedulerVolume(podSpec *corev1.PodSpec, tcp *kamajiv1
 		VolumeSource: corev1.VolumeSource{
 			Secret: &corev1.SecretVolumeSource{
 				SecretName:  tcp.Status.KubeConfig.Scheduler.SecretName,
-				DefaultMode: pointer.Int32Ptr(420),
+				DefaultMode: pointer.Int32(420),
 			},
 		},
 	}
@@ -236,7 +239,7 @@ func (d *Deployment) buildControllerManagerVolume(podSpec *corev1.PodSpec, tcp *
 		VolumeSource: corev1.VolumeSource{
 			Secret: &corev1.SecretVolumeSource{
 				SecretName:  tcp.Status.KubeConfig.ControllerManager.SecretName,
-				DefaultMode: pointer.Int32Ptr(420),
+				DefaultMode: pointer.Int32(420),
 			},
 		},
 	}
@@ -259,7 +262,7 @@ func (d *Deployment) BuildScheduler(podSpec *corev1.PodSpec, tenantControlPlane
 	args["--authorization-kubeconfig"] = kubeconfig
 	args["--bind-address"] = "0.0.0.0"
 	args["--kubeconfig"] = kubeconfig
-	args["--leader-elect"] = "true" // nolint:goconst
+	args["--leader-elect"] = "true" //nolint:goconst
 
 	podSpec.Containers[schedulerIndex].Name = "kube-scheduler"
 	podSpec.Containers[schedulerIndex].Image = fmt.Sprintf("k8s.gcr.io/kube-scheduler:%s", tenantControlPlane.Spec.Kubernetes.Version)
@@ -286,6 +289,7 @@ func (d *Deployment) BuildScheduler(podSpec *corev1.PodSpec, tenantControlPlane
 		SuccessThreshold:    1,
 		FailureThreshold:    3,
 	}
+
 	podSpec.Containers[schedulerIndex].StartupProbe = &corev1.Probe{
 		ProbeHandler: corev1.ProbeHandler{
 			HTTPGet: &corev1.HTTPGetAction{
@@ -380,6 +384,7 @@ func (d *Deployment) buildControllerManager(podSpec *corev1.PodSpec, tenantContr
 			MountPath: "/usr/local/share/ca-certificates",
 		},
 	}
+
 	podSpec.Containers[controllerManagerIndex].LivenessProbe = &corev1.Probe{
 		ProbeHandler: corev1.ProbeHandler{
 			HTTPGet: &corev1.HTTPGetAction{
@@ -394,6 +399,7 @@ func (d *Deployment) buildControllerManager(podSpec *corev1.PodSpec, tenantContr
 		SuccessThreshold:    1,
 		FailureThreshold:    3,
 	}
+
 	podSpec.Containers[controllerManagerIndex].StartupProbe = &corev1.Probe{
 		ProbeHandler: corev1.ProbeHandler{
 			HTTPGet: &corev1.HTTPGetAction{
@@ -530,31 +536,43 @@ func (d *Deployment) buildKubeAPIServerCommand(tenantControlPlane *kamajiv1alpha
 		"--client-ca-file":                     path.Join(v1beta3.DefaultCertificatesDir, constants.CACertName),
 		"--enable-admission-plugins":           strings.Join(tenantControlPlane.Spec.Kubernetes.AdmissionControllers.ToSlice(), ","),
 		"--enable-bootstrap-token-auth":        "true",
-		"--etcd-servers":                       strings.Join(d.ETCDEndpoints, ","),
 		"--service-cluster-ip-range":           tenantControlPlane.Spec.NetworkProfile.ServiceCIDR,
 		"--kubelet-client-certificate":         path.Join(v1beta3.DefaultCertificatesDir, constants.APIServerKubeletClientCertName),
 		"--kubelet-client-key":                 path.Join(v1beta3.DefaultCertificatesDir, constants.APIServerKubeletClientKeyName),
 		"--kubelet-preferred-address-types":    "Hostname,InternalIP,ExternalIP",
 		"--proxy-client-cert-file":             path.Join(v1beta3.DefaultCertificatesDir, constants.FrontProxyClientCertName),
 		"--proxy-client-key-file":              path.Join(v1beta3.DefaultCertificatesDir, constants.FrontProxyClientKeyName),
-		"--requestheader-allowed-names":        "front-proxy-client",
+		"--requestheader-allowed-names":        constants.FrontProxyClientCertCommonName,
+		"--requestheader-client-ca-file":       path.Join(v1beta3.DefaultCertificatesDir, constants.FrontProxyCACertName),
 		"--requestheader-extra-headers-prefix": "X-Remote-Extra-",
 		"--requestheader-group-headers":        "X-Remote-Group",
 		"--requestheader-username-headers":     "X-Remote-User",
 		"--secure-port":                        fmt.Sprintf("%d", tenantControlPlane.Spec.NetworkProfile.Port),
-		"--service-account-issuer":             fmt.Sprintf("https://localhost:%d", tenantControlPlane.Spec.NetworkProfile.Port),
+		"--service-account-issuer":             "https://kubernetes.default.svc.cluster.local",
 		"--service-account-key-file":           path.Join(v1beta3.DefaultCertificatesDir, constants.ServiceAccountPublicKeyName),
 		"--service-account-signing-key-file":   path.Join(v1beta3.DefaultCertificatesDir, constants.ServiceAccountPrivateKeyName),
 		"--tls-cert-file":                      path.Join(v1beta3.DefaultCertificatesDir, constants.APIServerCertName),
 		"--tls-private-key-file":               path.Join(v1beta3.DefaultCertificatesDir, constants.APIServerKeyName),
 	}
 
-	if d.ETCDStorageType == kamajiv1alpha1.EtcdDriver {
-		desiredArgs["--etcd-cafile"] = path.Join(v1beta3.DefaultCertificatesDir, constants.EtcdCACertName)
-		desiredArgs["--etcd-certfile"] = path.Join(v1beta3.DefaultCertificatesDir, constants.APIServerEtcdClientCertName)
-		desiredArgs["--etcd-keyfile"] = path.Join(v1beta3.DefaultCertificatesDir, constants.APIServerEtcdClientKeyName)
+	switch d.DataStore.Spec.Driver {
+	case kamajiv1alpha1.KineMySQLDriver, kamajiv1alpha1.KinePostgreSQLDriver:
+		desiredArgs["--etcd-servers"] = "http://127.0.0.1:2379"
+	case kamajiv1alpha1.EtcdDriver:
+		httpsEndpoints := make([]string, 0, len(d.DataStore.Spec.Endpoints))
+
+		for _, ep := range d.DataStore.Spec.Endpoints {
+			httpsEndpoints = append(httpsEndpoints, fmt.Sprintf("https://%s", ep))
+		}
+
+		desiredArgs["--etcd-compaction-interval"] = "0"
 		desiredArgs["--etcd-prefix"] = fmt.Sprintf("/%s", tenantControlPlane.GetName())
+		desiredArgs["--etcd-servers"] = strings.Join(httpsEndpoints, ",")
+		desiredArgs["--etcd-cafile"] = "/etc/kubernetes/pki/etcd/ca.crt"
+		desiredArgs["--etcd-certfile"] = "/etc/kubernetes/pki/etcd/server.crt"
+		desiredArgs["--etcd-keyfile"] = "/etc/kubernetes/pki/etcd/server.key"
 	}
+
 	// Order matters, here: extraArgs could try to overwrite some arguments managed by Kamaji and that would be crucial.
 	// Adding as first element of the array of maps, we're sure that these overrides will be sanitized by our configuration.
 	return utilities.MergeMaps(extraArgs, current, desiredArgs)
@@ -579,15 +597,6 @@ func (d *Deployment) secretProjection(secretName, certKeyName, keyName string) *
 }
 
 func (d *Deployment) removeKineVolumes(podSpec *corev1.PodSpec) {
-	if found, index := utilities.HasNamedVolume(podSpec.Volumes, kineVolumeChmod); found {
-		var volumes []corev1.Volume
-
-		volumes = append(volumes, podSpec.Volumes[:index]...)
-		volumes = append(volumes, podSpec.Volumes[index+1:]...)
-
-		podSpec.Volumes = volumes
-	}
-
 	if found, index := utilities.HasNamedVolume(podSpec.Volumes, kineVolumeCertName); found {
 		var volumes []corev1.Volume
 
@@ -599,25 +608,25 @@ func (d *Deployment) removeKineVolumes(podSpec *corev1.PodSpec) {
 }
 
 func (d *Deployment) buildKineVolume(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.TenantControlPlane) {
-	if d.ETCDStorageType == kamajiv1alpha1.EtcdDriver {
-		d.removeKineVolumes(podSpec)
-
-		return
-	}
 	// Adding the volume for chmod'ed Kine certificates.
-	found, index := utilities.HasNamedVolume(podSpec.Volumes, kineVolumeChmod)
+	found, index := utilities.HasNamedVolume(podSpec.Volumes, dataStoreCerts)
 	if !found {
 		podSpec.Volumes = append(podSpec.Volumes, corev1.Volume{})
 		index = len(podSpec.Volumes) - 1
 	}
 
-	podSpec.Volumes[index].Name = kineVolumeChmod
+	podSpec.Volumes[index].Name = dataStoreCerts
 	podSpec.Volumes[index].VolumeSource = corev1.VolumeSource{
 		Secret: &corev1.SecretVolumeSource{
-			SecretName:  tcp.Status.Storage.Kine.Certificate.SecretName,
-			DefaultMode: pointer.Int32Ptr(420),
+			SecretName:  tcp.Status.Storage.Certificate.SecretName,
+			DefaultMode: pointer.Int32(420),
 		},
 	}
+	if d.DataStore.Spec.Driver == kamajiv1alpha1.EtcdDriver {
+		d.removeKineVolumes(podSpec)
+
+		return
+	}
 	// Adding the volume to read Kine certificates:
 	// these must be subsequently fixed with a chmod due to pg issues with private key.
 	if found, index = utilities.HasNamedVolume(podSpec.Volumes, kineVolumeCertName); !found {
@@ -646,7 +655,7 @@ func (d *Deployment) removeKineContainers(podSpec *corev1.PodSpec) {
 }
 
 func (d *Deployment) buildKine(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.TenantControlPlane) {
-	if d.ETCDStorageType == kamajiv1alpha1.EtcdDriver {
+	if d.DataStore.Spec.Driver == kamajiv1alpha1.EtcdDriver {
 		d.removeKineContainers(podSpec)
 
 		return
@@ -665,11 +674,11 @@ func (d *Deployment) buildKine(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.Tena
 		args = utilities.ArgsFromSliceToMap(tcp.Spec.ControlPlane.Deployment.ExtraArgs.Kine)
 	}
 
-	switch d.ETCDStorageType {
+	switch d.DataStore.Spec.Driver {
 	case kamajiv1alpha1.KineMySQLDriver:
-		args["--endpoint"] = "mysql://$(DB_USER):$(DB_PASSWORD)@tcp($(DB_HOST):$(DB_PORT))/$(DB_SCHEMA)"
+		args["--endpoint"] = "mysql://$(DB_USER):$(DB_PASSWORD)@tcp($(DB_CONNECTION_STRING))/$(DB_SCHEMA)"
 	case kamajiv1alpha1.KinePostgreSQLDriver:
-		args["--endpoint"] = "postgres://$(DB_USER):$(DB_PASSWORD)@$(DB_HOST):$(DB_PORT)/$(DB_SCHEMA)"
+		args["--endpoint"] = "postgres://$(DB_USER):$(DB_PASSWORD)@$(DB_CONNECTION_STRING)/$(DB_SCHEMA)"
 	}
 
 	args["--ca-file"] = "/certs/ca.crt"
@@ -690,7 +699,7 @@ func (d *Deployment) buildKine(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.Tena
 			},
 			VolumeMounts: []corev1.VolumeMount{
 				{
-					Name:      kineVolumeChmod,
+					Name:      dataStoreCerts,
 					ReadOnly:  true,
 					MountPath: "/kine",
 				},
@@ -726,7 +735,7 @@ func (d *Deployment) buildKine(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.Tena
 		{
 			SecretRef: &corev1.SecretEnvSource{
 				LocalObjectReference: corev1.LocalObjectReference{
-					Name: tcp.Status.Storage.Kine.Config.SecretName,
+					Name: tcp.Status.Storage.Config.SecretName,
 				},
 			},
 		},
@@ -765,6 +774,18 @@ func (d *Deployment) SetAnnotations(resource *appsv1.Deployment, annotations map
 	resource.SetAnnotations(annotations)
 }
 
+func (d *Deployment) SetTopologySpreadConstraints(spec *appsv1.DeploymentSpec, topologies []corev1.TopologySpreadConstraint) {
+	defaultSelector := spec.Selector
+
+	for index, topology := range topologies {
+		if topology.LabelSelector == nil {
+			topologies[index].LabelSelector = defaultSelector
+		}
+	}
+
+	spec.Template.Spec.TopologySpreadConstraints = topologies
+}
+
 // ResetKubeAPIServerFlags ensures that upon a change of the kube-apiserver extra flags the desired ones are properly
 // applied, also considering that the container could be lately patched by the konnectivity addon resources.
 func (d *Deployment) ResetKubeAPIServerFlags(resource *appsv1.Deployment, tcp *kamajiv1alpha1.TenantControlPlane) {

internal/config/config.go

@@ -41,6 +41,7 @@ func InitConfig() (*viper.Viper, error) {
 	flag.String("datastore", defaultDataStore, "The default DataStore that should be used by Kamaji to setup the required storage")
 
 	// Setup zap configuration
+
 	opts := zap.Options{
 		Development: true,
 	}

internal/constants/annotations.go

@@ -0,0 +1,10 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package constants
+
+const (
+	// Checksum is the annotation label that we use to store the checksum for the resource:
+	// it allows to check by comparing it if the resource has been changed and must be aligned with the reconciliation.
+	Checksum = "kamaji.clastix.io/checksum"
+)

internal/crypto/crypto.go

@@ -5,101 +5,31 @@ package crypto
 
 import (
 	"bytes"
-	"crypto/rand"
+	cryptorand "crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
+	"crypto/x509/pkix"
 	"encoding/pem"
 	"fmt"
+	"math/big"
+	mathrand "math/rand"
 	"time"
+
+	"github.com/pkg/errors"
 )
 
-const (
-	certBitSize = 2048
-)
-
-func GetCertificateAndKeyPair(template *x509.Certificate, caCert []byte, caPrivKey []byte) (*bytes.Buffer, *bytes.Buffer, error) {
-	caCertBytes, err := GetCertificate(caCert)
-	if err != nil {
-		return nil, nil, err
+// CheckPublicAndPrivateKeyValidity checks if the given bytes for the private and public keys are valid.
+func CheckPublicAndPrivateKeyValidity(publicKey []byte, privateKey []byte) (bool, error) {
+	if len(publicKey) == 0 || len(privateKey) == 0 {
+		return false, nil
 	}
 
-	caPrivKeyBytes, err := GetPrivateKey(caPrivKey)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	return GenerateCertificateKeyPairBytes(template, certBitSize, caCertBytes, caPrivKeyBytes)
-}
-
-func GetCertificate(cert []byte) (*x509.Certificate, error) {
-	pemContent, _ := pem.Decode(cert)
-	if pemContent == nil {
-		return nil, fmt.Errorf("no right PEM block")
-	}
-
-	return x509.ParseCertificate(pemContent.Bytes)
-}
-
-func GetPrivateKey(privKey []byte) (*rsa.PrivateKey, error) {
-	pemContent, _ := pem.Decode(privKey)
-	if pemContent == nil {
-		return nil, fmt.Errorf("no right PEM block")
-	}
-
-	return x509.ParsePKCS1PrivateKey(pemContent.Bytes)
-}
-
-func GetPublickKey(pubKey []byte) (*rsa.PublicKey, error) {
-	pemContent, _ := pem.Decode(pubKey)
-	if pemContent == nil {
-		return nil, fmt.Errorf("no right PEM block")
-	}
-
-	pub, err := x509.ParsePKIXPublicKey(pemContent.Bytes)
-	if err != nil {
-		return nil, err
-	}
-
-	return pub.(*rsa.PublicKey), nil // nolint:forcetypeassert
-}
-
-func GenerateCertificateKeyPairBytes(template *x509.Certificate, bitSize int, caCert *x509.Certificate, caKey *rsa.PrivateKey) (*bytes.Buffer, *bytes.Buffer, error) {
-	certPrivKey, err := rsa.GenerateKey(rand.Reader, bitSize)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	certBytes, err := x509.CreateCertificate(rand.Reader, template, caCert, &certPrivKey.PublicKey, caKey)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	certPEM := &bytes.Buffer{}
-	if err := pem.Encode(certPEM, &pem.Block{
-		Type:  "CERTIFICATE",
-		Bytes: certBytes,
-	}); err != nil {
-		return nil, nil, err
-	}
-
-	certPrivKeyPEM := &bytes.Buffer{}
-	if err := pem.Encode(certPrivKeyPEM, &pem.Block{
-		Type:  "RSA PRIVATE KEY",
-		Bytes: x509.MarshalPKCS1PrivateKey(certPrivKey),
-	}); err != nil {
-		return nil, nil, err
-	}
-
-	return certPEM, certPrivKeyPEM, nil
-}
-
-func IsValidKeyPairBytes(pubKeyBytes []byte, privKeyBytes []byte) (bool, error) {
-	privKey, err := GetPrivateKey(privKeyBytes)
+	pubKey, err := ParsePublicKeyBytes(publicKey)
 	if err != nil {
 		return false, err
 	}
 
-	pubKey, err := GetPublickKey(pubKeyBytes)
+	privKey, err := ParsePrivateKeyBytes(privateKey)
 	if err != nil {
 		return false, err
 	}
@@ -107,22 +37,134 @@ func IsValidKeyPairBytes(pubKeyBytes []byte, privKeyBytes []byte) (bool, error)
 	return checkPublicKeys(privKey.PublicKey, *pubKey), nil
 }
 
-func IsValidCertificateKeyPairBytes(certBytes []byte, privKeyBytes []byte) (bool, error) {
-	cert, err := GetCertificate(certBytes)
-	if err != nil {
-		return false, err
+// CheckCertificateAndPrivateKeyPairValidity checks if the certificate and private key pair are valid.
+func CheckCertificateAndPrivateKeyPairValidity(certificate []byte, privateKey []byte) (bool, error) {
+	switch {
+	case len(certificate) == 0, len(privateKey) == 0:
+		return false, nil
+	default:
+		return IsValidCertificateKeyPairBytes(certificate, privateKey)
 	}
-
-	privKey, err := GetPrivateKey(privKeyBytes)
-	if err != nil {
-		return false, err
-	}
-
-	return isValidCertificateKeyPairBytes(*cert, *privKey), nil
 }
 
-func isValidCertificateKeyPairBytes(cert x509.Certificate, privKey rsa.PrivateKey) bool {
-	return checkCertificateValidity(cert) && checkCertificateKeyPair(cert, privKey)
+// GenerateCertificatePrivateKeyPair starts from the Certificate Authority bytes a certificate using the provided
+// template, returning the bytes both for the certificate and its key.
+func GenerateCertificatePrivateKeyPair(template *x509.Certificate, caCertificate []byte, caPrivateKey []byte) (*bytes.Buffer, *bytes.Buffer, error) {
+	caCertBytes, err := ParseCertificateBytes(caCertificate)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	caPrivKeyBytes, err := ParsePrivateKeyBytes(caPrivateKey)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "provided CA private key for certificate generation cannot be parsed")
+	}
+
+	return generateCertificateKeyPairBytes(template, caCertBytes, caPrivKeyBytes)
+}
+
+// ParseCertificateBytes takes the certificate bytes returning a x509 certificate by parsing it.
+func ParseCertificateBytes(content []byte) (*x509.Certificate, error) {
+	pemContent, _ := pem.Decode(content)
+	if pemContent == nil {
+		return nil, fmt.Errorf("no right PEM block")
+	}
+
+	crt, err := x509.ParseCertificate(pemContent.Bytes)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot parse x509 Certificate")
+	}
+
+	return crt, nil
+}
+
+// ParsePrivateKeyBytes takes the private key bytes returning an RSA private key by parsing it.
+func ParsePrivateKeyBytes(content []byte) (*rsa.PrivateKey, error) {
+	pemContent, _ := pem.Decode(content)
+	if pemContent == nil {
+		return nil, fmt.Errorf("no right PEM block")
+	}
+
+	privateKey, err := x509.ParsePKCS1PrivateKey(pemContent.Bytes)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot parse PKCS1 Private Key")
+	}
+
+	return privateKey, nil
+}
+
+// ParsePublicKeyBytes takes the public key bytes returning an RSA public key by parsing it.
+func ParsePublicKeyBytes(content []byte) (*rsa.PublicKey, error) {
+	pemContent, _ := pem.Decode(content)
+	if pemContent == nil {
+		return nil, fmt.Errorf("no right PEM block")
+	}
+
+	publicKey, err := x509.ParsePKIXPublicKey(pemContent.Bytes)
+	if err != nil {
+		return nil, err
+	}
+
+	rsaPublicKey, ok := publicKey.(*rsa.PublicKey)
+	if !ok {
+		return nil, fmt.Errorf("expected *rsa.PublicKey, got %T", rsaPublicKey)
+	}
+
+	return rsaPublicKey, nil
+}
+
+// IsValidCertificateKeyPairBytes checks if the certificate matches the private key bounded to it.
+func IsValidCertificateKeyPairBytes(certificateBytes []byte, privateKeyBytes []byte) (bool, error) {
+	crt, err := ParseCertificateBytes(certificateBytes)
+	if err != nil {
+		return false, err
+	}
+
+	key, err := ParsePrivateKeyBytes(privateKeyBytes)
+	if err != nil {
+		return false, err
+	}
+
+	switch {
+	case !checkCertificateValidity(*crt):
+		return false, nil
+	case !checkPublicKeys(*crt.PublicKey.(*rsa.PublicKey), key.PublicKey): //nolint:forcetypeassert
+		return false, nil
+	default:
+		return true, nil
+	}
+}
+
+func generateCertificateKeyPairBytes(template *x509.Certificate, caCert *x509.Certificate, caKey *rsa.PrivateKey) (*bytes.Buffer, *bytes.Buffer, error) {
+	certPrivKey, err := rsa.GenerateKey(cryptorand.Reader, 2048)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "cannot generate an RSA key")
+	}
+
+	certBytes, err := x509.CreateCertificate(cryptorand.Reader, template, caCert, &certPrivKey.PublicKey, caKey)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "cannot create the certificate")
+	}
+
+	certPEM := &bytes.Buffer{}
+	if err = pem.Encode(certPEM, &pem.Block{
+		Type:    "CERTIFICATE",
+		Headers: nil,
+		Bytes:   certBytes,
+	}); err != nil {
+		return nil, nil, errors.Wrap(err, "cannot encode the generate certificate bytes")
+	}
+
+	certPrivKeyPEM := &bytes.Buffer{}
+	if err = pem.Encode(certPrivKeyPEM, &pem.Block{
+		Type:    "RSA PRIVATE KEY",
+		Headers: nil,
+		Bytes:   x509.MarshalPKCS1PrivateKey(certPrivKey),
+	}); err != nil {
+		return nil, nil, errors.Wrap(err, "cannot encode private key")
+	}
+
+	return certPEM, certPrivKeyPEM, nil
 }
 
 func checkCertificateValidity(cert x509.Certificate) bool {
@@ -131,13 +173,31 @@ func checkCertificateValidity(cert x509.Certificate) bool {
 	return now.Before(cert.NotAfter) && now.After(cert.NotBefore)
 }
 
-func checkCertificateKeyPair(cert x509.Certificate, privKey rsa.PrivateKey) bool {
-	return checkPublicKeys(*cert.PublicKey.(*rsa.PublicKey), privKey.PublicKey) // nolint:forcetypeassert
-}
-
 func checkPublicKeys(a rsa.PublicKey, b rsa.PublicKey) bool {
 	isN := a.N.Cmp(b.N) == 0
 	isE := a.E == b.E
 
 	return isN && isE
 }
+
+// NewCertificateTemplate returns the template that must be used to generate a certificate,
+// used to perform the authentication against the DataStore.
+func NewCertificateTemplate(commonName string) *x509.Certificate {
+	return &x509.Certificate{
+		PublicKeyAlgorithm: x509.RSA,
+		SerialNumber:       big.NewInt(mathrand.Int63()),
+		Subject: pkix.Name{
+			CommonName:   commonName,
+			Organization: []string{"system:masters"},
+		},
+		NotBefore:    time.Now(),
+		NotAfter:     time.Now().AddDate(10, 0, 0),
+		SubjectKeyId: []byte{1, 2, 3, 4, 6},
+		ExtKeyUsage: []x509.ExtKeyUsage{
+			x509.ExtKeyUsageClientAuth,
+			x509.ExtKeyUsageServerAuth,
+			x509.ExtKeyUsageCodeSigning,
+		},
+		KeyUsage: x509.KeyUsageDigitalSignature,
+	}
+}

internal/datastore/datastore.go

@@ -0,0 +1,56 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package datastore
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+)
+
+type ConnectionEndpoint struct {
+	Host string
+	Port int
+}
+
+func (r ConnectionEndpoint) String() string {
+	return fmt.Sprintf("%s:%d", r.Host, r.Port)
+}
+
+type ConnectionConfig struct {
+	User       string
+	Password   string
+	Endpoints  []ConnectionEndpoint
+	DBName     string
+	TLSConfig  *tls.Config
+	Parameters map[string][]string
+}
+
+func (config ConnectionConfig) getDataSourceNameUserPassword() string {
+	if config.User == "" {
+		return ""
+	}
+
+	if config.Password == "" {
+		return fmt.Sprintf("%s@", config.User)
+	}
+
+	return fmt.Sprintf("%s:%s@", config.User, config.Password)
+}
+
+type Connection interface {
+	CreateUser(ctx context.Context, user, password string) error
+	CreateDB(ctx context.Context, dbName string) error
+	GrantPrivileges(ctx context.Context, user, dbName string) error
+	UserExists(ctx context.Context, user string) (bool, error)
+	DBExists(ctx context.Context, dbName string) (bool, error)
+	GrantPrivilegesExists(ctx context.Context, user, dbName string) (bool, error)
+	DeleteUser(ctx context.Context, user string) error
+	DeleteDB(ctx context.Context, dbName string) error
+	RevokePrivileges(ctx context.Context, user, dbName string) error
+	GetConnectionString() string
+	Close() error
+	Check(ctx context.Context) error
+	Driver() string
+}

internal/datastore/errors/errors.go

@@ -0,0 +1,50 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package errors
+
+import "github.com/pkg/errors"
+
+func NewCreateUserError(err error) error {
+	return errors.Wrap(err, "cannot create user")
+}
+
+func NewGrantPrivilegesError(err error) error {
+	return errors.Wrap(err, "cannot grant privileges")
+}
+
+func NewCheckUserExistsError(err error) error {
+	return errors.Wrap(err, "cannot check if user exists")
+}
+
+func NewCheckGrantExistsError(err error) error {
+	return errors.Wrap(err, "cannot check if grant exists")
+}
+
+func NewDeleteUserError(err error) error {
+	return errors.Wrap(err, "cannot delete user")
+}
+
+func NewCannotDeleteDatabaseError(err error) error {
+	return errors.Wrap(err, "cannot delete database")
+}
+
+func NewCheckDatabaseExistError(err error) error {
+	return errors.Wrap(err, "cannot check if database exists")
+}
+
+func NewRevokePrivilegesError(err error) error {
+	return errors.Wrap(err, "cannot revoke privileges")
+}
+
+func NewCloseConnectionError(err error) error {
+	return errors.Wrap(err, "cannot close connection")
+}
+
+func NewCheckConnectionError(err error) error {
+	return errors.Wrap(err, "cannot check connection")
+}
+
+func NewCreateDBError(err error) error {
+	return errors.Wrap(err, "cannot create database")
+}

internal/datastore/etcd.go

@@ -0,0 +1,176 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package datastore
+
+import (
+	"context"
+	"fmt"
+
+	goerrors "github.com/pkg/errors"
+	"go.etcd.io/etcd/api/v3/authpb"
+	"go.etcd.io/etcd/api/v3/v3rpc/rpctypes"
+	etcdclient "go.etcd.io/etcd/client/v3"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/datastore/errors"
+)
+
+const (
+	// rangeEnd is the key following the last key of the range.
+	// If rangeEnd is ‘\0’, the range is all keys greater than or equal to the key argument
+	// source: https://etcd.io/docs/v3.5/learning/api/
+	rangeEnd = "\\0"
+)
+
+func NewETCDConnection(config ConnectionConfig) (Connection, error) {
+	endpoints := make([]string, 0, len(config.Endpoints))
+
+	for _, ep := range config.Endpoints {
+		endpoints = append(endpoints, ep.String())
+	}
+
+	cfg := etcdclient.Config{
+		Endpoints: endpoints,
+		TLS:       config.TLSConfig,
+	}
+
+	client, err := etcdclient.New(cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	return &EtcdClient{
+		Client: *client,
+	}, nil
+}
+
+type EtcdClient struct {
+	Client etcdclient.Client
+}
+
+func (e *EtcdClient) CreateUser(ctx context.Context, user, password string) error {
+	if _, err := e.Client.Auth.UserAddWithOptions(ctx, user, password, &etcdclient.UserAddOptions{NoPassword: true}); err != nil {
+		return errors.NewCreateUserError(err)
+	}
+
+	return nil
+}
+
+func (e *EtcdClient) CreateDB(context.Context, string) error {
+	return nil
+}
+
+func (e *EtcdClient) GrantPrivileges(ctx context.Context, user, dbName string) error {
+	if _, err := e.Client.Auth.RoleAdd(ctx, dbName); err != nil {
+		return errors.NewGrantPrivilegesError(err)
+	}
+
+	permission := etcdclient.PermissionType(authpb.READWRITE)
+	key := e.buildKey(dbName)
+	if _, err := e.Client.RoleGrantPermission(ctx, user, key, rangeEnd, permission); err != nil {
+		return errors.NewGrantPrivilegesError(err)
+	}
+
+	if _, err := e.Client.UserGrantRole(ctx, user, dbName); err != nil {
+		return errors.NewGrantPrivilegesError(err)
+	}
+
+	return nil
+}
+
+func (e *EtcdClient) UserExists(ctx context.Context, user string) (bool, error) {
+	if _, err := e.Client.UserGet(ctx, user); err != nil {
+		if goerrors.As(err, &rpctypes.ErrGRPCUserNotFound) {
+			return false, nil
+		}
+
+		return false, errors.NewCheckUserExistsError(err)
+	}
+
+	return true, nil
+}
+
+func (e *EtcdClient) DBExists(context.Context, string) (bool, error) {
+	return true, nil
+}
+
+func (e *EtcdClient) GrantPrivilegesExists(ctx context.Context, username, dbName string) (bool, error) {
+	_, err := e.Client.RoleGet(ctx, dbName)
+	if err != nil {
+		if goerrors.As(err, &rpctypes.ErrGRPCRoleNotFound) {
+			return false, nil
+		}
+
+		return false, errors.NewCheckGrantExistsError(err)
+	}
+
+	user, err := e.Client.UserGet(ctx, username)
+	if err != nil {
+		return false, errors.NewCheckGrantExistsError(err)
+	}
+
+	for _, i := range user.Roles {
+		if i == dbName {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+func (e *EtcdClient) DeleteUser(ctx context.Context, user string) error {
+	if _, err := e.Client.Auth.UserDelete(ctx, user); err != nil {
+		return errors.NewDeleteUserError(err)
+	}
+
+	return nil
+}
+
+func (e *EtcdClient) DeleteDB(ctx context.Context, dbName string) error {
+	withRange := etcdclient.WithRange(rangeEnd)
+	prefix := e.buildKey(dbName)
+	if _, err := e.Client.Delete(ctx, prefix, withRange); err != nil {
+		return errors.NewCannotDeleteDatabaseError(err)
+	}
+
+	return nil
+}
+
+func (e *EtcdClient) RevokePrivileges(ctx context.Context, user, dbName string) error {
+	if _, err := e.Client.Auth.RoleDelete(ctx, dbName); err != nil {
+		return errors.NewRevokePrivilegesError(err)
+	}
+
+	return nil
+}
+
+func (e *EtcdClient) GetConnectionString() string {
+	// There's no need for connection string in etcd client:
+	// it's not used by Kine
+	return ""
+}
+
+func (e *EtcdClient) Close() error {
+	if err := e.Client.Close(); err != nil {
+		return errors.NewCloseConnectionError(err)
+	}
+
+	return nil
+}
+
+func (e *EtcdClient) Check(ctx context.Context) error {
+	if _, err := e.Client.AuthStatus(ctx); err != nil {
+		return errors.NewCheckConnectionError(err)
+	}
+
+	return nil
+}
+
+func (e *EtcdClient) Driver() string {
+	return string(kamajiv1alpha1.EtcdDriver)
+}
+
+func (e *EtcdClient) buildKey(roleName string) string {
+	return fmt.Sprintf("/%s/", roleName)
+}

internal/datastore/mysql.go

@@ -1,15 +1,23 @@
 // Copyright 2022 Clastix Labs
 // SPDX-License-Identifier: Apache-2.0
 
-package sql
+package datastore
 
 import (
 	"context"
 	"database/sql"
 	"fmt"
+	"net/url"
 
-	"github.com/go-pg/pg/v10"
 	"github.com/go-sql-driver/mysql"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/datastore/errors"
+)
+
+const (
+	defaultProtocol = "tcp"
+	sqlErrorNoRows  = "sql: no rows in result set"
 )
 
 const (
@@ -25,36 +33,32 @@ const (
 )
 
 type MySQLConnection struct {
-	db   *sql.DB
-	host string
-	port int
+	db        *sql.DB
+	connector ConnectionEndpoint
 }
 
 func (c *MySQLConnection) Driver() string {
-	return "MySQL"
+	return string(kamajiv1alpha1.KineMySQLDriver)
 }
 
-func getPostgreSQLDB(config ConnectionConfig) (DBConnection, error) {
-	opt := &pg.Options{
-		Addr:      fmt.Sprintf("%s:%d", config.Host, config.Port),
-		Database:  config.DBName,
-		User:      config.User,
-		Password:  config.Password,
-		TLSConfig: config.TLSConfig,
+func NewMySQLConnection(config ConnectionConfig) (Connection, error) {
+	nameDB := fmt.Sprintf("%s(%s)", defaultProtocol, config.Endpoints[0].String())
+
+	var parameters string
+	if len(config.Parameters) > 0 {
+		parameters = url.Values(config.Parameters).Encode()
 	}
 
-	return &PostgreSQLConnection{db: pg.Connect(opt), port: config.Port, host: config.Host}, nil
-}
+	dsn := fmt.Sprintf("%s%s/%s?%s", config.getDataSourceNameUserPassword(), nameDB, config.DBName, parameters)
 
-func getMySQLDB(config ConnectionConfig) (DBConnection, error) {
-	tlsKey := "mysql"
-	dataSourceName := config.GetDataSourceName()
-	mysqlConfig, err := mysql.ParseDSN(dataSourceName)
+	mysqlConfig, err := mysql.ParseDSN(dsn)
 	if err != nil {
 		return nil, err
 	}
 
-	if err := mysql.RegisterTLSConfig(tlsKey, config.TLSConfig); err != nil {
+	tlsKey := "mysql"
+
+	if err = mysql.RegisterTLSConfig(tlsKey, config.TLSConfig); err != nil {
 		return nil, err
 	}
 
@@ -67,46 +71,58 @@ func getMySQLDB(config ConnectionConfig) (DBConnection, error) {
 		return nil, err
 	}
 
-	return &MySQLConnection{
-		db:   db,
-		host: config.Host,
-		port: config.Port,
-	}, nil
+	return &MySQLConnection{db: db, connector: config.Endpoints[0]}, nil
 }
 
-func (c *MySQLConnection) GetHost() string {
-	return c.host
-}
-
-func (c *MySQLConnection) GetPort() int {
-	return c.port
+func (c *MySQLConnection) GetConnectionString() string {
+	return c.connector.String()
 }
 
 func (c *MySQLConnection) Close() error {
-	return c.db.Close()
+	if err := c.db.Close(); err != nil {
+		return errors.NewCloseConnectionError(err)
+	}
+
+	return nil
 }
 
-func (c *MySQLConnection) Check() error {
-	return c.db.Ping()
+func (c *MySQLConnection) Check(ctx context.Context) error {
+	if err := c.db.PingContext(ctx); err != nil {
+		return errors.NewCheckConnectionError(err)
+	}
+
+	return nil
 }
 
 func (c *MySQLConnection) CreateUser(ctx context.Context, user, password string) error {
-	return c.mutate(ctx, mysqlCreateUserStatement, user, password)
+	if err := c.mutate(ctx, mysqlCreateUserStatement, user, password); err != nil {
+		return errors.NewCreateUserError(err)
+	}
+
+	return nil
 }
 
 func (c *MySQLConnection) CreateDB(ctx context.Context, dbName string) error {
-	return c.mutate(ctx, mysqlCreateDBStatement, dbName)
+	if err := c.mutate(ctx, mysqlCreateDBStatement, dbName); err != nil {
+		return errors.NewCreateDBError(err)
+	}
+
+	return nil
 }
 
 func (c *MySQLConnection) GrantPrivileges(ctx context.Context, user, dbName string) error {
-	return c.mutate(ctx, mysqlGrantPrivilegesStatement, user, dbName)
+	if err := c.mutate(ctx, mysqlGrantPrivilegesStatement, user, dbName); err != nil {
+		return errors.NewGrantPrivilegesError(err)
+	}
+
+	return nil
 }
 
 func (c *MySQLConnection) UserExists(ctx context.Context, user string) (bool, error) {
 	checker := func(row *sql.Row) (bool, error) {
 		var name string
 		if err := row.Scan(&name); err != nil {
-			if checkEmptyQueryResult(err) {
+			if c.checkEmptyQueryResult(err) {
 				return false, nil
 			}
 
@@ -116,14 +132,19 @@ func (c *MySQLConnection) UserExists(ctx context.Context, user string) (bool, er
 		return name == user, nil
 	}
 
-	return c.check(ctx, mysqlFetchUserStatement, checker, user)
+	ok, err := c.check(ctx, mysqlFetchUserStatement, checker, user)
+	if err != nil {
+		return false, errors.NewCheckUserExistsError(err)
+	}
+
+	return ok, nil
 }
 
 func (c *MySQLConnection) DBExists(ctx context.Context, dbName string) (bool, error) {
 	checker := func(row *sql.Row) (bool, error) {
 		var name string
 		if err := row.Scan(&name); err != nil {
-			if checkEmptyQueryResult(err) {
+			if c.checkEmptyQueryResult(err) {
 				return false, nil
 			}
 
@@ -133,14 +154,19 @@ func (c *MySQLConnection) DBExists(ctx context.Context, dbName string) (bool, er
 		return name == dbName, nil
 	}
 
-	return c.check(ctx, mysqlFetchDBStatement, checker, dbName)
+	ok, err := c.check(ctx, mysqlFetchDBStatement, checker, dbName)
+	if err != nil {
+		return false, errors.NewCheckDatabaseExistError(err)
+	}
+
+	return ok, nil
 }
 
 func (c *MySQLConnection) GrantPrivilegesExists(ctx context.Context, user, dbName string) (bool, error) {
 	statementShowGrantsStatement := fmt.Sprintf(mysqlShowGrantsStatement, user)
 	rows, err := c.db.Query(statementShowGrantsStatement)
 	if err != nil {
-		return false, err
+		return false, errors.NewGrantPrivilegesError(err)
 	}
 
 	expected := fmt.Sprintf(mysqlGrantPrivilegesStatement, user, dbName)
@@ -148,7 +174,7 @@ func (c *MySQLConnection) GrantPrivilegesExists(ctx context.Context, user, dbNam
 
 	for rows.Next() {
 		if err = rows.Scan(&grant); err != nil {
-			return false, err
+			return false, errors.NewGrantPrivilegesError(err)
 		}
 
 		if grant == expected {
@@ -160,15 +186,27 @@ func (c *MySQLConnection) GrantPrivilegesExists(ctx context.Context, user, dbNam
 }
 
 func (c *MySQLConnection) DeleteUser(ctx context.Context, user string) error {
-	return c.mutate(ctx, mysqlDropUserStatement, user)
+	if err := c.mutate(ctx, mysqlDropUserStatement, user); err != nil {
+		return errors.NewDeleteUserError(err)
+	}
+
+	return nil
 }
 
 func (c *MySQLConnection) DeleteDB(ctx context.Context, dbName string) error {
-	return c.mutate(ctx, mysqlDropDBStatement, dbName)
+	if err := c.mutate(ctx, mysqlDropDBStatement, dbName); err != nil {
+		return errors.NewCannotDeleteDatabaseError(err)
+	}
+
+	return nil
 }
 
 func (c *MySQLConnection) RevokePrivileges(ctx context.Context, user, dbName string) error {
-	return c.mutate(ctx, mysqlRevokePrivilegesStatement, user, dbName)
+	if err := c.mutate(ctx, mysqlRevokePrivilegesStatement, user, dbName); err != nil {
+		return errors.NewRevokePrivilegesError(err)
+	}
+
+	return nil
 }
 
 func (c *MySQLConnection) check(ctx context.Context, nonFilledStatement string, checker func(*sql.Row) (bool, error), args ...any) (bool, error) {
@@ -191,3 +229,7 @@ func (c *MySQLConnection) mutate(ctx context.Context, nonFilledStatement string,
 
 	return nil
 }
+
+func (c *MySQLConnection) checkEmptyQueryResult(err error) bool {
+	return err.Error() == sqlErrorNoRows
+}

internal/datastore/postgresql.go

@@ -1,7 +1,7 @@
 // Copyright 2022 Clastix Labs
 // SPDX-License-Identifier: Apache-2.0
 
-package sql
+package datastore
 
 import (
 	"context"
@@ -9,6 +9,9 @@ import (
 	"strings"
 
 	"github.com/go-pg/pg/v10"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/datastore/errors"
 )
 
 const (
@@ -24,19 +27,30 @@ const (
 )
 
 type PostgreSQLConnection struct {
-	db   *pg.DB
-	host string
-	port int
+	db         *pg.DB
+	connection ConnectionEndpoint
+}
+
+func NewPostgreSQLConnection(config ConnectionConfig) (Connection, error) {
+	opt := &pg.Options{
+		Addr:      config.Endpoints[0].String(),
+		Database:  config.DBName,
+		User:      config.User,
+		Password:  config.Password,
+		TLSConfig: config.TLSConfig,
+	}
+
+	return &PostgreSQLConnection{db: pg.Connect(opt), connection: config.Endpoints[0]}, nil
 }
 
 func (r *PostgreSQLConnection) Driver() string {
-	return "PostgreSQL"
+	return string(kamajiv1alpha1.KinePostgreSQLDriver)
 }
 
 func (r *PostgreSQLConnection) UserExists(ctx context.Context, user string) (bool, error) {
 	res, err := r.db.ExecContext(ctx, postgresqlUserExists, user)
 	if err != nil {
-		return false, err
+		return false, errors.NewCheckUserExistsError(err)
 	}
 
 	return res.RowsReturned() > 0, nil
@@ -45,7 +59,7 @@ func (r *PostgreSQLConnection) UserExists(ctx context.Context, user string) (boo
 func (r *PostgreSQLConnection) CreateUser(ctx context.Context, user, password string) error {
 	_, err := r.db.ExecContext(ctx, fmt.Sprintf(postgresqlCreateUserStatement, user), password)
 	if err != nil {
-		return err
+		return errors.NewCreateUserError(err)
 	}
 
 	return nil
@@ -54,7 +68,7 @@ func (r *PostgreSQLConnection) CreateUser(ctx context.Context, user, password st
 func (r *PostgreSQLConnection) DBExists(ctx context.Context, dbName string) (bool, error) {
 	rows, err := r.db.ExecContext(ctx, postgresqlFetchDBStatement, dbName)
 	if err != nil {
-		return false, err
+		return false, errors.NewCheckDatabaseExistError(err)
 	}
 
 	return rows.RowsReturned() > 0, nil
@@ -63,7 +77,7 @@ func (r *PostgreSQLConnection) DBExists(ctx context.Context, dbName string) (boo
 func (r *PostgreSQLConnection) CreateDB(ctx context.Context, dbName string) error {
 	_, err := r.db.ExecContext(ctx, fmt.Sprintf(postgresqlCreateDBStatement, dbName))
 	if err != nil {
-		return err
+		return errors.NewCreateDBError(err)
 	}
 
 	return nil
@@ -78,49 +92,60 @@ func (r *PostgreSQLConnection) GrantPrivilegesExists(ctx context.Context, user,
 			return false, nil
 		}
 
-		return false, err
+		return false, errors.NewCheckGrantExistsError(err)
 	}
 
 	return hasDatabasePrivilege == "t", nil
 }
 
 func (r *PostgreSQLConnection) GrantPrivileges(ctx context.Context, user, dbName string) error {
-	res, err := r.db.ExecContext(ctx, fmt.Sprintf(postgresqlGrantPrivilegesStatement, dbName, user))
-	_ = res
+	if _, err := r.db.ExecContext(ctx, fmt.Sprintf(postgresqlGrantPrivilegesStatement, dbName, user)); err != nil {
+		return errors.NewGrantPrivilegesError(err)
+	}
 
-	return err
+	return nil
 }
 
 func (r *PostgreSQLConnection) DeleteUser(ctx context.Context, user string) error {
-	_, err := r.db.ExecContext(ctx, fmt.Sprintf(postgresqlDropRoleStatement, user))
+	if _, err := r.db.ExecContext(ctx, fmt.Sprintf(postgresqlDropRoleStatement, user)); err != nil {
+		return errors.NewDeleteUserError(err)
+	}
 
-	return err
+	return nil
 }
 
 func (r *PostgreSQLConnection) DeleteDB(ctx context.Context, dbName string) error {
-	_, err := r.db.ExecContext(ctx, fmt.Sprintf(postgresqlDropDBStatement, dbName))
+	if _, err := r.db.ExecContext(ctx, fmt.Sprintf(postgresqlDropDBStatement, dbName)); err != nil {
+		return errors.NewCannotDeleteDatabaseError(err)
+	}
 
-	return err
+	return nil
 }
 
 func (r *PostgreSQLConnection) RevokePrivileges(ctx context.Context, user, dbName string) error {
-	_, err := r.db.ExecContext(ctx, fmt.Sprintf(postgresqlRevokePrivilegesStatement, dbName, user))
+	if _, err := r.db.ExecContext(ctx, fmt.Sprintf(postgresqlRevokePrivilegesStatement, dbName, user)); err != nil {
+		return errors.NewRevokePrivilegesError(err)
+	}
 
-	return err
+	return nil
 }
 
-func (r *PostgreSQLConnection) GetHost() string {
-	return r.host
-}
-
-func (r *PostgreSQLConnection) GetPort() int {
-	return r.port
+func (r *PostgreSQLConnection) GetConnectionString() string {
+	return r.connection.String()
 }
 
 func (r *PostgreSQLConnection) Close() error {
-	return r.db.Close()
+	if err := r.db.Close(); err != nil {
+		return errors.NewCloseConnectionError(err)
+	}
+
+	return nil
 }
 
-func (r *PostgreSQLConnection) Check() error {
-	return r.db.Ping(context.Background())
+func (r *PostgreSQLConnection) Check(ctx context.Context) error {
+	if err := r.db.Ping(ctx); err != nil {
+		return errors.NewCheckConnectionError(err)
+	}
+
+	return nil
 }

internal/etcd/api.go

@@ -1,177 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package etcd
-
-import (
-	"context"
-	"crypto/tls"
-	"crypto/x509"
-	"errors"
-	"fmt"
-	"time"
-
-	"go.etcd.io/etcd/api/v3/authpb"
-	"go.etcd.io/etcd/api/v3/v3rpc/rpctypes"
-	etcdclient "go.etcd.io/etcd/client/v3"
-	"google.golang.org/grpc/codes"
-)
-
-const (
-	etcdTimeout = 10 // seconds
-
-	//  rangeEnd is the key following the last key of the range.
-	//  If rangeEnd is ‘\0’, the range is all keys greater than or equal to the key argument
-	//  source: https://etcd.io/docs/v3.5/learning/api/
-	rangeEnd = "\\0"
-)
-
-func NewClient(config Config) (*etcdclient.Client, error) {
-	cert, err := tls.X509KeyPair(config.ETCDCertificate, config.ETCDPrivateKey)
-	if err != nil {
-		return nil, err
-	}
-
-	pool := x509.NewCertPool()
-	pool.AppendCertsFromPEM(config.ETCDCA)
-
-	cfg := etcdclient.Config{
-		Endpoints: config.Endpoints,
-		TLS: &tls.Config{ // nolint:gosec
-			Certificates: []tls.Certificate{cert},
-			RootCAs:      pool,
-		},
-	}
-
-	return etcdclient.New(cfg)
-}
-
-func GetUser(ctx context.Context, client *etcdclient.Client, user *User) error {
-	ctxWithTimeout, cancel := context.WithTimeout(ctx, etcdTimeout*time.Second)
-	defer cancel()
-
-	response, err := client.UserGet(ctxWithTimeout, user.Name)
-	if err != nil {
-		var etcdError rpctypes.EtcdError
-		if errors.As(err, &etcdError) && etcdError.Code() == codes.FailedPrecondition {
-			return nil
-		}
-
-		return err
-	}
-
-	user.Roles = response.Roles
-	user.Exists = true
-
-	return nil
-}
-
-func AddUser(ctx context.Context, client *etcdclient.Client, username string) error {
-	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
-	defer cancel()
-	opts := etcdclient.UserAddOptions{
-		NoPassword: true,
-	}
-	_, err := client.Auth.UserAddWithOptions(ctxWithTimeout, username, "", &opts)
-
-	return err
-}
-
-func RemoveUser(ctx context.Context, client *etcdclient.Client, username string) error {
-	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
-	defer cancel()
-
-	_, err := client.Auth.UserDelete(ctxWithTimeout, username)
-
-	return err
-}
-
-func GetRole(ctx context.Context, client *etcdclient.Client, role *Role) error {
-	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
-	defer cancel()
-
-	response, err := client.RoleGet(ctxWithTimeout, role.Name)
-	if err != nil {
-		var etcdError rpctypes.EtcdError
-		if errors.As(err, &etcdError) && etcdError.Code() == codes.FailedPrecondition {
-			return nil
-		}
-
-		return err
-	}
-
-	role.Exists = true
-	for _, perm := range response.Perm {
-		permission := Permission{
-			Type:     int(perm.PermType),
-			Key:      string(perm.Key),
-			RangeEnd: string(perm.RangeEnd),
-		}
-		role.Permissions = append(role.Permissions, permission)
-	}
-
-	return nil
-}
-
-func AddRole(ctx context.Context, client *etcdclient.Client, roleName string) error {
-	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
-	defer cancel()
-
-	_, err := client.Auth.RoleAdd(ctxWithTimeout, roleName)
-
-	return err
-}
-
-func RemoveRole(ctx context.Context, client *etcdclient.Client, roleName string) error {
-	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
-	defer cancel()
-
-	_, err := client.Auth.RoleDelete(ctxWithTimeout, roleName)
-
-	return err
-}
-
-func GrantUserRole(ctx context.Context, client *etcdclient.Client, user User, role Role) error {
-	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
-	defer cancel()
-
-	_, err := client.UserGrantRole(ctxWithTimeout, user.Name, role.Name)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func GrantRolePermission(ctx context.Context, client *etcdclient.Client, role Role) error {
-	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
-	defer cancel()
-
-	permission := etcdclient.PermissionType(authpb.READWRITE)
-	key := BuildKey(role.Name)
-	_, err := client.RoleGrantPermission(ctxWithTimeout, role.Name, key, rangeEnd, permission)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func CleanUpPrefix(ctx context.Context, client *etcdclient.Client, name string) error {
-	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
-	defer cancel()
-
-	withRange := etcdclient.WithRange(rangeEnd)
-	prefix := BuildKey(name)
-	_, err := client.Delete(ctxWithTimeout, prefix, withRange)
-
-	return err
-}
-
-func BuildKey(roleName string) string {
-	return fmt.Sprintf("/%s/", roleName)
-}
-
-func getContextWithTimeout(ctx context.Context) (context.Context, context.CancelFunc) {
-	return context.WithTimeout(ctx, etcdTimeout*time.Second)
-}

internal/etcd/certs.go

@@ -1,47 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package etcd
-
-import (
-	"bytes"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"math/big"
-	"math/rand"
-	"time"
-
-	"github.com/clastix/kamaji/internal/crypto"
-)
-
-func GetETCDCACertificateAndKeyPair(tenant string, caCert []byte, caPrivKey []byte) (*bytes.Buffer, *bytes.Buffer, error) {
-	template := getCertTemplate(tenant)
-
-	return crypto.GetCertificateAndKeyPair(template, caCert, caPrivKey)
-}
-
-func IsETCDCertificateAndKeyPairValid(cert []byte, privKey []byte) (bool, error) {
-	return crypto.IsValidCertificateKeyPairBytes(cert, privKey)
-}
-
-func getCertTemplate(tenant string) *x509.Certificate {
-	serialNumber := big.NewInt(rand.Int63())
-
-	return &x509.Certificate{
-		PublicKeyAlgorithm: x509.RSA,
-		SerialNumber:       serialNumber,
-		Subject: pkix.Name{
-			CommonName:   tenant,
-			Organization: []string{certOrganization},
-		},
-		NotBefore:    time.Now(),
-		NotAfter:     time.Now().AddDate(certExpirationDelayYears, 0, 0),
-		SubjectKeyId: []byte{1, 2, 3, 4, 6},
-		ExtKeyUsage: []x509.ExtKeyUsage{
-			x509.ExtKeyUsageClientAuth,
-			x509.ExtKeyUsageServerAuth,
-			x509.ExtKeyUsageCodeSigning,
-		},
-		KeyUsage: x509.KeyUsageDigitalSignature,
-	}
-}

internal/etcd/constant.go

@@ -1,9 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package etcd
-
-const (
-	certExpirationDelayYears = 10
-	certOrganization         = "system:masters"
-)

internal/etcd/types.go

@@ -1,71 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package etcd
-
-type Config struct {
-	ETCDCertificate []byte
-	ETCDPrivateKey  []byte
-	ETCDCA          []byte
-	Endpoints       []string
-}
-
-type Permission struct {
-	Type     int    `json:"type,omitempty"`
-	Key      string `json:"key,omitempty"`
-	RangeEnd string `json:"rangeEnd,omitempty"`
-}
-
-func (in *Permission) DeepCopyInto(out *Permission) {
-	*out = *in
-}
-
-func (in *Permission) DeepCopy() *Permission {
-	if in == nil {
-		return nil
-	}
-	out := new(Permission)
-	in.DeepCopyInto(out)
-
-	return out
-}
-
-type Role struct {
-	Name        string       `json:"name"`
-	Permissions []Permission `json:"permissions,omitempty"`
-	Exists      bool         `json:"exists"`
-}
-
-func (in *Role) DeepCopyInto(out *Role) {
-	*out = *in
-}
-
-func (in *Role) DeepCopy() *Role {
-	if in == nil {
-		return nil
-	}
-	out := new(Role)
-	in.DeepCopyInto(out)
-
-	return out
-}
-
-type User struct {
-	Name   string   `json:"name"`
-	Roles  []string `json:"roles,omitempty"`
-	Exists bool     `json:"exists"`
-}
-
-func (in *User) DeepCopyInto(out *User) {
-	*out = *in
-}
-
-func (in *User) DeepCopy() *User {
-	if in == nil {
-		return nil
-	}
-	out := new(User)
-	in.DeepCopyInto(out)
-
-	return out
-}

internal/kubeadm/addon.go

@@ -5,25 +5,13 @@ package kubeadm
 
 import (
 	"context"
-	"fmt"
-	"time"
+	"io"
 
-	"github.com/pkg/errors"
-	appsv1 "k8s.io/api/apps/v1"
-	corev1 "k8s.io/api/core/v1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
-	clientcmdapi "k8s.io/client-go/tools/clientcmd/api/v1"
-	"k8s.io/component-base/config/v1alpha1"
-	kubeproxyconfig "k8s.io/kube-proxy/config/v1alpha1"
-	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	"k8s.io/kubernetes/cmd/kubeadm/app/phases/addons/dns"
 	"k8s.io/kubernetes/cmd/kubeadm/app/phases/addons/proxy"
-	"k8s.io/kubernetes/cmd/kubeadm/app/util/apiclient"
-	"k8s.io/utils/pointer"
-
-	"github.com/clastix/kamaji/internal/utilities"
 )
 
 const (
@@ -34,7 +22,14 @@ const (
 )
 
 func AddCoreDNS(client kubernetes.Interface, config *Configuration) error {
-	return dns.EnsureDNSAddon(&config.InitConfiguration.ClusterConfiguration, client)
+	// We're passing the values from the parameters here because they wouldn't be hashed by the YAML encoder:
+	// the struct kubeadm.ClusterConfiguration hasn't struct tags, and it wouldn't be hashed properly.
+	if opts := config.Parameters.CoreDNSOptions; opts != nil {
+		config.InitConfiguration.DNS.ImageRepository = opts.Repository
+		config.InitConfiguration.DNS.ImageTag = opts.Tag
+	}
+
+	return dns.EnsureDNSAddon(&config.InitConfiguration.ClusterConfiguration, client, io.Discard, false)
 }
 
 func RemoveCoreDNSAddon(ctx context.Context, client kubernetes.Interface) error {
@@ -80,6 +75,7 @@ func removeCoreDNSDeployment(ctx context.Context, client kubernetes.Interface) e
 
 func removeCoreDNSConfigMap(ctx context.Context, client kubernetes.Interface) error {
 	name, _ := getCoreDNSConfigMapName(ctx)
+
 	opts := metav1.DeleteOptions{}
 
 	return client.CoreV1().ConfigMaps(kubeSystemNamespace).Delete(ctx, name, opts)
@@ -103,24 +99,15 @@ func getCoreDNSConfigMapName(ctx context.Context) (string, error) {
 	return coreDNSName, nil
 }
 
-func AddKubeProxy(client kubernetes.Interface, config *Configuration) error {
-	if err := proxy.CreateServiceAccount(client); err != nil {
-		return errors.Wrap(err, "error when creating kube-proxy service account")
-	}
+func AddKubeProxy(client kubernetes.Interface, config *Configuration) (err error) {
+	// This is a workaround since the function EnsureProxyAddon is picking repository and tag from the InitConfiguration
+	// struct, although is counterintuitive
+	config.InitConfiguration.ClusterConfiguration.CIImageRepository = config.Parameters.KubeProxyOptions.Repository
+	config.InitConfiguration.KubernetesVersion = config.Parameters.KubeProxyOptions.Tag
 
-	if err := createKubeProxyConfigMap(client, config); err != nil {
-		return err
-	}
+	err = proxy.EnsureProxyAddon(&config.InitConfiguration.ClusterConfiguration, &config.InitConfiguration.LocalAPIEndpoint, client, io.Discard, false)
 
-	if err := createKubeProxyAddon(client); err != nil {
-		return err
-	}
-
-	if err := proxy.CreateRBACRules(client); err != nil {
-		return errors.Wrap(err, "error when creating kube-proxy RBAC rules")
-	}
-
-	return nil
+	return
 }
 
 func RemoveKubeProxy(ctx context.Context, client kubernetes.Interface) error {
@@ -152,6 +139,7 @@ func RemoveKubeProxy(ctx context.Context, client kubernetes.Interface) error {
 
 func removeKubeProxyDaemonSet(ctx context.Context, client kubernetes.Interface) error {
 	name, _ := getKubeProxyDaemonSetName(ctx)
+
 	opts := metav1.DeleteOptions{}
 
 	return client.AppsV1().DaemonSets(kubeSystemNamespace).Delete(ctx, name, opts)
@@ -159,6 +147,7 @@ func removeKubeProxyDaemonSet(ctx context.Context, client kubernetes.Interface)
 
 func removeKubeProxyConfigMap(ctx context.Context, client kubernetes.Interface) error {
 	name, _ := getKubeProxyConfigMapName(ctx)
+
 	opts := metav1.DeleteOptions{}
 
 	return client.CoreV1().ConfigMaps(kubeSystemNamespace).Delete(ctx, name, opts)
@@ -167,6 +156,7 @@ func removeKubeProxyConfigMap(ctx context.Context, client kubernetes.Interface)
 func removeKubeProxyRBAC(ctx context.Context, client kubernetes.Interface) error {
 	// TODO: Currently, kube-proxy is installed using kubeadm phases, therefore, name is the same.
 	name, _ := getKubeProxyRBACName(ctx)
+
 	opts := metav1.DeleteOptions{}
 	var result error
 
@@ -211,246 +201,3 @@ func getKubeProxyConfigMapName(ctx context.Context) (string, error) {
 	// Implement a method for future approaches
 	return kubeProxyName, nil
 }
-
-func createKubeProxyConfigMap(client kubernetes.Interface, config *Configuration) error {
-	configConf, err := getKubeproxyConfigmapContent(config)
-	if err != nil {
-		return err
-	}
-
-	kubeconfigConf, err := getKubeproxyKubeconfigContent(config)
-	if err != nil {
-		return err
-	}
-
-	configMap := &corev1.ConfigMap{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      kubeadmconstants.KubeProxyConfigMap,
-			Namespace: "kube-system",
-			Labels: map[string]string{
-				"app": "kube-proxy",
-			},
-		},
-		Data: map[string]string{
-			kubeadmconstants.KubeProxyConfigMapKey: string(configConf),
-			"kubeconfig.conf":                      string(kubeconfigConf),
-		},
-	}
-
-	return apiclient.CreateOrUpdateConfigMap(client, configMap)
-}
-
-func createKubeProxyAddon(client kubernetes.Interface) error {
-	daemonSet := &appsv1.DaemonSet{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "kube-proxy",
-			Namespace: "kube-system",
-			Labels: map[string]string{
-				"k8s-app": "kube-proxy",
-			},
-		},
-		Spec: appsv1.DaemonSetSpec{
-			RevisionHistoryLimit: pointer.Int32(10),
-			Selector: &metav1.LabelSelector{
-				MatchLabels: map[string]string{
-					"k8s-app": "kube-proxy",
-				},
-			},
-			Template: corev1.PodTemplateSpec{
-				ObjectMeta: metav1.ObjectMeta{
-					Labels: map[string]string{
-						"k8s-app": "kube-proxy",
-					},
-				},
-				Spec: corev1.PodSpec{
-					Containers: []corev1.Container{
-						{
-							Command: []string{
-								"/usr/local/bin/kube-proxy",
-								"--config=/var/lib/kube-proxy/config.conf",
-								"--hostname-override=$(NODE_NAME)",
-							},
-							Env: []corev1.EnvVar{
-								{
-									Name: "NODE_NAME",
-									ValueFrom: &corev1.EnvVarSource{
-										FieldRef: &corev1.ObjectFieldSelector{
-											APIVersion: "v1",
-											FieldPath:  "spec.nodeName",
-										},
-									},
-								},
-							},
-							Image:           "k8s.gcr.io/kube-proxy:v1.21.2",
-							ImagePullPolicy: corev1.PullIfNotPresent,
-							Name:            "kube-proxy",
-							SecurityContext: &corev1.SecurityContext{
-								Privileged: pointer.Bool(true),
-							},
-							TerminationMessagePath:   "/dev/termination-log",
-							TerminationMessagePolicy: "File",
-							VolumeMounts: []corev1.VolumeMount{
-								{
-									MountPath: "/var/lib/kube-proxy",
-									Name:      "kube-proxy",
-								},
-								{
-									MountPath: "/run/xtables.lock",
-									Name:      "xtables-lock",
-								},
-								{
-									MountPath: "/lib/modules",
-									Name:      "lib-modules",
-									ReadOnly:  true,
-								},
-							},
-						},
-					},
-					DNSPolicy:   corev1.DNSClusterFirst,
-					HostNetwork: true,
-					NodeSelector: map[string]string{
-						"kubernetes.io/os": "linux",
-					},
-					Tolerations: []corev1.Toleration{
-						{Operator: corev1.TolerationOpExists},
-					},
-					PriorityClassName:             "system-node-critical",
-					RestartPolicy:                 corev1.RestartPolicyAlways,
-					SchedulerName:                 "default-scheduler",
-					ServiceAccountName:            "kube-proxy",
-					TerminationGracePeriodSeconds: pointer.Int64(30),
-					Volumes: []corev1.Volume{
-						{
-							Name: "kube-proxy",
-							VolumeSource: corev1.VolumeSource{
-								ConfigMap: &corev1.ConfigMapVolumeSource{
-									DefaultMode: pointer.Int32(420),
-									LocalObjectReference: corev1.LocalObjectReference{
-										Name: "kube-proxy",
-									},
-								},
-							},
-						},
-						{
-							Name: "xtables-lock",
-							VolumeSource: corev1.VolumeSource{
-								HostPath: &corev1.HostPathVolumeSource{
-									Path: "/run/xtables.lock",
-									Type: (*corev1.HostPathType)(pointer.String(string(corev1.HostPathFileOrCreate))),
-								},
-							},
-						},
-						{
-							Name: "lib-modules",
-							VolumeSource: corev1.VolumeSource{
-								HostPath: &corev1.HostPathVolumeSource{
-									Path: "/lib/modules",
-									Type: (*corev1.HostPathType)(pointer.String(string(corev1.HostPathUnset))),
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-
-	return apiclient.CreateOrUpdateDaemonSet(client, daemonSet)
-}
-
-func getKubeproxyConfigmapContent(config *Configuration) ([]byte, error) {
-	zeroDuration := metav1.Duration{Duration: 0}
-	oneSecondDuration := metav1.Duration{Duration: time.Second}
-	kubeProxyConfiguration := kubeproxyconfig.KubeProxyConfiguration{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       "KubeProxyConfiguration",
-			APIVersion: "kubeproxy.config.k8s.io/v1alpha1",
-		},
-		BindAddress:         "0.0.0.0",
-		BindAddressHardFail: false,
-		ClientConnection: v1alpha1.ClientConnectionConfiguration{
-			AcceptContentTypes: "",
-			Burst:              0,
-			ContentType:        "",
-			Kubeconfig:         "/var/lib/kube-proxy/kubeconfig.conf",
-			QPS:                0,
-		},
-		ClusterCIDR:      config.Parameters.TenantControlPlanePodCIDR,
-		ConfigSyncPeriod: zeroDuration,
-		Conntrack: kubeproxyconfig.KubeProxyConntrackConfiguration{
-			MaxPerCore:            pointer.Int32(0),
-			Min:                   nil,
-			TCPCloseWaitTimeout:   nil,
-			TCPEstablishedTimeout: nil,
-		},
-		DetectLocalMode:    "",
-		EnableProfiling:    false,
-		HealthzBindAddress: "",
-		HostnameOverride:   "",
-		IPTables: kubeproxyconfig.KubeProxyIPTablesConfiguration{
-			MasqueradeAll: false,
-			MasqueradeBit: nil,
-			MinSyncPeriod: oneSecondDuration,
-			SyncPeriod:    zeroDuration,
-		},
-		IPVS: kubeproxyconfig.KubeProxyIPVSConfiguration{
-			ExcludeCIDRs:  nil,
-			MinSyncPeriod: zeroDuration,
-			Scheduler:     "",
-			StrictARP:     false,
-			SyncPeriod:    zeroDuration,
-			TCPTimeout:    zeroDuration,
-			TCPFinTimeout: zeroDuration,
-			UDPTimeout:    zeroDuration,
-		},
-		MetricsBindAddress:          "",
-		Mode:                        "iptables",
-		NodePortAddresses:           nil,
-		OOMScoreAdj:                 nil,
-		PortRange:                   "",
-		ShowHiddenMetricsForVersion: "",
-		UDPIdleTimeout:              zeroDuration,
-		Winkernel: kubeproxyconfig.KubeProxyWinkernelConfiguration{
-			EnableDSR:   false,
-			NetworkName: "",
-			SourceVip:   "",
-		},
-	}
-
-	return utilities.EncondeToYaml(&kubeProxyConfiguration)
-}
-
-func getKubeproxyKubeconfigContent(config *Configuration) ([]byte, error) {
-	kubeconfig := clientcmdapi.Config{
-		APIVersion: "v1",
-		Kind:       "Config",
-		Clusters: []clientcmdapi.NamedCluster{
-			{
-				Name: "default",
-				Cluster: clientcmdapi.Cluster{
-					CertificateAuthority: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt",
-					Server:               fmt.Sprintf("https://%s:%d", config.Parameters.TenantControlPlaneAddress, config.Parameters.TenantControlPlanePort),
-				},
-			},
-		},
-		Contexts: []clientcmdapi.NamedContext{
-			{
-				Context: clientcmdapi.Context{
-					Cluster:   "default",
-					Namespace: "default",
-					AuthInfo:  "default",
-				},
-			},
-		},
-		AuthInfos: []clientcmdapi.NamedAuthInfo{
-			{
-				Name: "default",
-				AuthInfo: clientcmdapi.AuthInfo{
-					TokenFile: "/var/run/secrets/kubernetes.io/serviceaccount/token",
-				},
-			},
-		},
-	}
-
-	return utilities.EncondeToYaml(&kubeconfig)
-}

internal/kubeadm/certificates.go

@@ -7,7 +7,6 @@ import (
 	"crypto"
 	"crypto/x509"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -45,8 +44,8 @@ func GenerateCACertificatePrivateKeyPair(baseName string, config *Configuration)
 func GenerateCertificatePrivateKeyPair(baseName string, config *Configuration, ca CertificatePrivateKeyPair) (*CertificatePrivateKeyPair, error) {
 	defer deleteCertificateDirectory(config.InitConfiguration.CertificatesDir)
 
-	certificate, _ := cryptoKamaji.GetCertificate(ca.Certificate)
-	signer, _ := cryptoKamaji.GetPrivateKey(ca.PrivateKey)
+	certificate, _ := cryptoKamaji.ParseCertificateBytes(ca.Certificate)
+	signer, _ := cryptoKamaji.ParsePrivateKeyBytes(ca.PrivateKey)
 
 	kubeadmCert, err := getKubeadmCert(baseName)
 	if err != nil {
@@ -107,28 +106,6 @@ func GeneratePublicKeyPrivateKeyPair(baseName string, config *Configuration) (*P
 	return publicKeyPrivateKeyPair, err
 }
 
-func IsCertificatePrivateKeyPairValid(certificate []byte, privKey []byte) (bool, error) {
-	if len(certificate) == 0 {
-		return false, nil
-	}
-	if len(privKey) == 0 {
-		return false, nil
-	}
-
-	return cryptoKamaji.IsValidCertificateKeyPairBytes(certificate, privKey)
-}
-
-func IsPublicKeyPrivateKeyPairValid(pubKey []byte, privKey []byte) (bool, error) {
-	if len(pubKey) == 0 {
-		return false, nil
-	}
-	if len(privKey) == 0 {
-		return false, nil
-	}
-
-	return cryptoKamaji.IsValidKeyPairBytes(pubKey, privKey)
-}
-
 func initPhaseCertsSA(config *Configuration) error {
 	return certs.CreateServiceAccountKeyAndPublicKeyFiles(config.InitConfiguration.CertificatesDir, config.InitConfiguration.PublicKeyAlgorithm())
 }
@@ -147,7 +124,7 @@ func readCertificateFiles(name string, directory string, extensions ...string) (
 	for _, extension := range extensions {
 		fileName := fmt.Sprintf("%s.%s", name, extension)
 		path := filepath.Join(directory, fileName)
-		content, err := ioutil.ReadFile(path)
+		content, err := os.ReadFile(path)
 		if err != nil {
 			return nil, err
 		}
@@ -160,6 +137,6 @@ func readCertificateFiles(name string, directory string, extensions ...string) (
 func deleteCertificateDirectory(certificateDirectory string) {
 	if err := os.RemoveAll(certificateDirectory); err != nil {
 		// TODO(prometherion): we should log rather than printing to stdout
-		fmt.Printf("Error removing %s: %s", certificateDirectory, err.Error()) // nolint:forbidigo
+		fmt.Printf("Error removing %s: %s", certificateDirectory, err.Error()) //nolint:forbidigo
 	}
 }

internal/kubeadm/configuration.go

@@ -4,15 +4,14 @@
 package kubeadm
 
 import (
-	"encoding/json"
 	"fmt"
 	"strings"
-	"time"
 
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	bootstraptokenv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/bootstraptoken/v1"
 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
+	"k8s.io/kubernetes/cmd/kubeadm/app/util/config"
+
+	"github.com/clastix/kamaji/internal/utilities"
 )
 
 const (
@@ -21,128 +20,103 @@ const (
 	defaultKeyFile  = "/etc/kubernetes/pki/apiserver-etcd-client.key"
 )
 
-func CreateKubeadmInitConfiguration(params Parameters) Configuration {
-	config := kubeadmapi.InitConfiguration{
-		ClusterConfiguration: getKubeadmClusterConfiguration(params),
-		BootstrapTokens: []bootstraptokenv1.BootstrapToken{
-			{
-				Groups: []string{"system:bootstrappers:kubeadm:default-node-token"},
-				TTL:    &metav1.Duration{Duration: 48 * time.Hour},
-				Usages: []string{
-					"signing",
-					"authentication",
-				},
-			},
-		},
-		LocalAPIEndpoint: kubeadmapi.APIEndpoint{
-			AdvertiseAddress: params.TenantControlPlaneAddress,
-			BindPort:         params.TenantControlPlanePort,
-		},
-		NodeRegistration: kubeadmapi.NodeRegistrationOptions{
-			CRISocket: "unix:///run/containerd/containerd.sock",
-			Name:      params.TenantControlPlaneName,
-		},
+func CreateKubeadmInitConfiguration(params Parameters) (*Configuration, error) {
+	defaultConf, err := config.DefaultedStaticInitConfiguration()
+	if err != nil {
+		return nil, err
 	}
 
-	return Configuration{InitConfiguration: config}
-}
+	conf := defaultConf
+	// Due to unmarshaling error when GetKubeadmInitConfigurationFromMap function is issued,
+	// we have to store the ComponentConfigs to a null value.
+	conf.ClusterConfiguration.ComponentConfigs = nil
 
-func isHTTPS(url string) bool {
-	return strings.HasPrefix(url, "https")
-}
+	conf.LocalAPIEndpoint = kubeadmapi.APIEndpoint{
+		AdvertiseAddress: params.TenantControlPlaneAddress,
+		BindPort:         params.TenantControlPlanePort,
+	}
+	conf.NodeRegistration.Name = params.TenantControlPlaneName
 
-func getKubeadmClusterConfiguration(params Parameters) kubeadmapi.ClusterConfiguration {
 	caFile, certFile, keyFile := "", "", ""
-	if isHTTPS(params.ETCDs[0]) {
+	if strings.HasPrefix(params.ETCDs[0], "https") {
 		caFile, certFile, keyFile = defaultCAFile, defaultCertFile, defaultKeyFile
 	}
 
-	return kubeadmapi.ClusterConfiguration{
-		KubernetesVersion: params.TenantControlPlaneVersion,
-		ClusterName:       params.TenantControlPlaneName,
-		CertificatesDir:   "/etc/kubernetes/pki",
-		ImageRepository:   "k8s.gcr.io",
-		Networking: kubeadmapi.Networking{
-			DNSDomain:     "cluster.local",
-			PodSubnet:     params.TenantControlPlanePodCIDR,
-			ServiceSubnet: params.TenantControlPlaneServiceCIDR,
-		},
-		DNS: kubeadmapi.DNS{
-			Type: "CoreDNS",
-		},
-		ControlPlaneEndpoint: params.TenantControlPlaneEndpoint,
-		Etcd: kubeadmapi.Etcd{
-			External: &kubeadmapi.ExternalEtcd{
-				Endpoints: params.ETCDs,
-				CAFile:    caFile,
-				CertFile:  certFile,
-				KeyFile:   keyFile,
-			},
-		},
-		APIServer: kubeadmapi.APIServer{
-			CertSANs: append([]string{
-				"127.0.0.1",
-				"localhost",
-				params.TenantControlPlaneName,
-				fmt.Sprintf("%s.%s.svc", params.TenantControlPlaneName, params.TenantControlPlaneNamespace),
-				fmt.Sprintf("%s.%s.svc.cluster.local", params.TenantControlPlaneName, params.TenantControlPlaneNamespace),
-				params.TenantControlPlaneAddress,
-			}, params.TenantControlPlaneCertSANs...),
-			ControlPlaneComponent: kubeadmapi.ControlPlaneComponent{
-				ExtraArgs: map[string]string{
-					"etcd-compaction-interval": "0s",
-					"etcd-prefix":              fmt.Sprintf("/%s", params.TenantControlPlaneName),
-				},
-			},
+	conf.Etcd = kubeadmapi.Etcd{
+		External: &kubeadmapi.ExternalEtcd{
+			Endpoints: params.ETCDs,
+			CAFile:    caFile,
+			CertFile:  certFile,
+			KeyFile:   keyFile,
 		},
 	}
+	conf.Networking = kubeadmapi.Networking{
+		DNSDomain:     "cluster.local",
+		PodSubnet:     params.TenantControlPlanePodCIDR,
+		ServiceSubnet: params.TenantControlPlaneServiceCIDR,
+	}
+	conf.KubernetesVersion = params.TenantControlPlaneVersion
+	conf.ControlPlaneEndpoint = params.TenantControlPlaneEndpoint
+	conf.APIServer.CertSANs = append([]string{
+		"127.0.0.1",
+		"localhost",
+		params.TenantControlPlaneName,
+		fmt.Sprintf("%s.%s.svc", params.TenantControlPlaneName, params.TenantControlPlaneNamespace),
+		fmt.Sprintf("%s.%s.svc.cluster.local", params.TenantControlPlaneName, params.TenantControlPlaneNamespace),
+		params.TenantControlPlaneAddress,
+	}, params.TenantControlPlaneCertSANs...)
+	conf.APIServer.ControlPlaneComponent.ExtraArgs = map[string]string{
+		"etcd-compaction-interval": "0s",
+		"etcd-prefix":              fmt.Sprintf("/%s", params.TenantControlPlaneName),
+	}
+	conf.ClusterName = params.TenantControlPlaneName
+
+	return &Configuration{InitConfiguration: *conf}, nil
 }
 
 func GetKubeadmInitConfigurationMap(config Configuration) (map[string]string, error) {
-	initConfigurationString, err := getJSONStringFromStruct(config.InitConfiguration)
+	initConfigurationString, err := utilities.EncodeToJSON(&config.InitConfiguration)
 	if err != nil {
-		return map[string]string{}, err
+		return nil, err
 	}
 
-	clusterConfigurationString, err := getJSONStringFromStruct(config.InitConfiguration.ClusterConfiguration)
+	clusterConfigurationString, err := utilities.EncodeToJSON(&config.InitConfiguration.ClusterConfiguration)
 	if err != nil {
-		return map[string]string{}, err
+		return nil, err
 	}
 
 	return map[string]string{
-		kubeadmconstants.InitConfigurationKind:    initConfigurationString,
-		kubeadmconstants.ClusterConfigurationKind: clusterConfigurationString,
+		kubeadmconstants.InitConfigurationKind:    string(initConfigurationString),
+		kubeadmconstants.ClusterConfigurationKind: string(clusterConfigurationString),
 	}, nil
 }
 
-func GetKubeadmInitConfigurationFromMap(config map[string]string) (*Configuration, error) {
-	initConfigurationString, ok := config[kubeadmconstants.InitConfigurationKind]
+func GetKubeadmInitConfigurationFromMap(conf map[string]string) (*Configuration, error) {
+	initConfigurationString, ok := conf[kubeadmconstants.InitConfigurationKind]
 	if !ok {
 		return nil, fmt.Errorf("%s is not in the map", kubeadmconstants.InitConfigurationKind)
 	}
 
-	clusterConfigurationString, ok := config[kubeadmconstants.ClusterConfigurationKind]
+	clusterConfigurationString, ok := conf[kubeadmconstants.ClusterConfigurationKind]
 	if !ok {
 		return nil, fmt.Errorf("%s is not in the map", kubeadmconstants.ClusterConfigurationKind)
 	}
 
 	initConfiguration := kubeadmapi.InitConfiguration{}
-	if err := json.Unmarshal([]byte(initConfigurationString), &initConfiguration); err != nil {
+	if err := utilities.DecodeFromJSON(initConfigurationString, &initConfiguration); err != nil {
 		return nil, err
 	}
 
-	if err := json.Unmarshal([]byte(clusterConfigurationString), &initConfiguration.ClusterConfiguration); err != nil {
+	if err := utilities.DecodeFromJSON(clusterConfigurationString, &initConfiguration.ClusterConfiguration); err != nil {
 		return nil, err
 	}
+	// Due to some weird issues with unmarshaling of the ComponentConfigs struct,
+	// we have to extract the default value and assign it directly.
+	defaults, err := config.DefaultedStaticInitConfiguration()
+	if err != nil {
+		return nil, err
+	}
+	initConfiguration.ClusterConfiguration.ComponentConfigs = defaults.ComponentConfigs
 
 	return &Configuration{InitConfiguration: initConfiguration}, nil
 }
-
-func getJSONStringFromStruct(i interface{}) (string, error) {
-	b, err := json.Marshal(i)
-	if err != nil {
-		return "", err
-	}
-
-	return string(b), nil
-}

internal/kubeadm/kubeconfig.go

@@ -4,7 +4,6 @@
 package kubeadm
 
 import (
-	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
@@ -19,12 +18,12 @@ func buildCertificateDirectoryWithCA(ca CertificatePrivateKeyPair, directory str
 	}
 
 	certPath := path.Join(directory, kubeadmconstants.CACertName)
-	if err := ioutil.WriteFile(certPath, ca.Certificate, os.FileMode(0o600)); err != nil {
+	if err := os.WriteFile(certPath, ca.Certificate, os.FileMode(0o600)); err != nil {
 		return err
 	}
 
 	keyPath := path.Join(directory, kubeadmconstants.CAKeyName)
-	if err := ioutil.WriteFile(keyPath, ca.PrivateKey, os.FileMode(0o600)); err != nil {
+	if err := os.WriteFile(keyPath, ca.PrivateKey, os.FileMode(0o600)); err != nil {
 		return err
 	}
 
@@ -44,7 +43,7 @@ func CreateKubeconfig(kubeconfigName string, ca CertificatePrivateKeyPair, confi
 
 	path := filepath.Join(config.InitConfiguration.CertificatesDir, kubeconfigName)
 
-	return ioutil.ReadFile(path)
+	return os.ReadFile(path)
 }
 
 func IsKubeconfigValid(kubeconfigBytes []byte) bool {

internal/kubeadm/printers/discard.go

@@ -0,0 +1,38 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package printers
+
+import (
+	"io"
+
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+type Discard struct{}
+
+func (d Discard) PrintObj(obj runtime.Object, writer io.Writer) error {
+	return nil
+}
+
+func (d Discard) Fprintf(writer io.Writer, format string, args ...interface{}) (n int, err error) {
+	return
+}
+
+func (d Discard) Fprintln(writer io.Writer, args ...interface{}) (n int, err error) {
+	return
+}
+
+func (d Discard) Printf(format string, args ...interface{}) (n int, err error) {
+	return
+}
+
+func (d Discard) Println(args ...interface{}) (n int, err error) {
+	return
+}
+
+func (d Discard) Flush(writer io.Writer, last bool) {
+}
+
+func (d Discard) Close(writer io.Writer) {
+}

internal/kubeadm/types.go

@@ -5,30 +5,30 @@ package kubeadm
 
 import (
 	json "github.com/json-iterator/go"
+	clientcmdapiv1 "k8s.io/client-go/tools/clientcmd/api/v1"
 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 
-	kubeconfigutil "github.com/clastix/kamaji/internal/kubeconfig"
 	"github.com/clastix/kamaji/internal/utilities"
 )
 
 type Configuration struct {
 	InitConfiguration kubeadmapi.InitConfiguration
-	Kubeconfig        kubeconfigutil.Kubeconfig
+	Kubeconfig        clientcmdapiv1.Config
 	Parameters        Parameters
 }
 
 func (c *Configuration) Checksum() string {
-	initConfiguration, _ := utilities.EncondeToYaml(&c.InitConfiguration)
+	initConfiguration, _ := utilities.EncodeToYaml(&c.InitConfiguration)
 	kubeconfig, _ := json.Marshal(c.Kubeconfig)
 	parameters, _ := json.Marshal(c.Parameters)
 
-	data := map[string]string{
-		"InitConfiguration": string(initConfiguration),
-		"Kubeconfig":        string(kubeconfig),
-		"Parameters":        string(parameters),
+	data := map[string][]byte{
+		"InitConfiguration": initConfiguration,
+		"Kubeconfig":        kubeconfig,
+		"Parameters":        parameters,
 	}
 
-	return utilities.CalculateConfigMapChecksum(data)
+	return utilities.CalculateMapChecksum(data)
 }
 
 type Parameters struct {
@@ -46,6 +46,13 @@ type Parameters struct {
 	ETCDs                          []string
 	CertificatesDir                string
 	KubeconfigDir                  string
+	KubeProxyOptions               *AddonOptions
+	CoreDNSOptions                 *AddonOptions
+}
+
+type AddonOptions struct {
+	Repository string
+	Tag        string
 }
 
 type KubeletConfiguration struct {

internal/kubeadm/uploadconfig.go

@@ -4,13 +4,10 @@
 package kubeadm
 
 import (
-	"fmt"
-
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	k8sversion "k8s.io/apimachinery/pkg/util/version"
 	"k8s.io/client-go/kubernetes"
 	kubelettypes "k8s.io/kubelet/config/v1beta1"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
@@ -37,10 +34,7 @@ func UploadKubeletConfig(client kubernetes.Interface, config *Configuration) err
 		return err
 	}
 
-	configMapName, err := configMapName(config.Parameters.TenantControlPlaneVersion)
-	if err != nil {
-		return err
-	}
+	configMapName := kubeadmconstants.KubeletBaseConfigurationConfigMap
 
 	configMap := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
@@ -56,7 +50,7 @@ func UploadKubeletConfig(client kubernetes.Interface, config *Configuration) err
 		return err
 	}
 
-	if err := createConfigMapRBACRules(client, config.Parameters.TenantControlPlaneVersion); err != nil {
+	if err := createConfigMapRBACRules(client); err != nil {
 		return errors.Wrap(err, "error creating kubelet configuration configmap RBAC rules")
 	}
 
@@ -117,19 +111,11 @@ func getKubeletConfigmapContent(kubeletConfiguration KubeletConfiguration) ([]by
 		VolumeStatsAggPeriod:             zeroDuration,
 	}
 
-	return utilities.EncondeToYaml(&kc)
+	return utilities.EncodeToYaml(&kc)
 }
 
-func createConfigMapRBACRules(client kubernetes.Interface, kubernetesVersion string) error {
-	configMapName, err := configMapName(kubernetesVersion)
-	if err != nil {
-		return err
-	}
-
-	configMapRBACName, err := configMapRBACName(kubernetesVersion)
-	if err != nil {
-		return err
-	}
+func createConfigMapRBACRules(client kubernetes.Interface) error {
+	configMapRBACName := kubeadmconstants.KubeletBaseConfigMapRole
 
 	if err := apiclient.CreateOrUpdateRole(client, &rbacv1.Role{
 		ObjectMeta: metav1.ObjectMeta{
@@ -141,7 +127,7 @@ func createConfigMapRBACRules(client kubernetes.Interface, kubernetesVersion str
 				Verbs:         []string{"get"},
 				APIGroups:     []string{""},
 				Resources:     []string{"configmaps"},
-				ResourceNames: []string{configMapName},
+				ResourceNames: []string{kubeadmconstants.KubeletBaseConfigurationConfigMap},
 			},
 		},
 	}); err != nil {
@@ -170,21 +156,3 @@ func createConfigMapRBACRules(client kubernetes.Interface, kubernetesVersion str
 		},
 	})
 }
-
-func configMapName(kubernetesVersion string) (string, error) {
-	version, err := k8sversion.ParseSemantic(kubernetesVersion)
-	if err != nil {
-		return "", err
-	}
-
-	return kubeadmconstants.GetKubeletConfigMapName(version, true), nil
-}
-
-func configMapRBACName(kubernetesVersion string) (string, error) {
-	version, err := k8sversion.ParseSemantic(kubernetesVersion)
-	if err != nil {
-		return "", err
-	}
-
-	return fmt.Sprintf("%s%d.%d", kubeadmconstants.KubeletBaseConfigMapRolePrefix, version.Major(), version.Minor()), nil
-}

internal/kubeconfig/kubeconfig.go

@@ -1,28 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package kubeconfig
-
-import (
-	"bytes"
-
-	"k8s.io/apimachinery/pkg/util/yaml"
-	v1 "k8s.io/client-go/tools/clientcmd/api/v1"
-)
-
-type Kubeconfig v1.Config
-
-func GetKubeconfigFromBytesBuffer(buffer *bytes.Buffer) (*Kubeconfig, error) {
-	kubeconfig := &Kubeconfig{}
-	if err := yaml.NewYAMLOrJSONDecoder(buffer, buffer.Len()).Decode(kubeconfig); err != nil {
-		return nil, err
-	}
-
-	return kubeconfig, nil
-}
-
-func GetKubeconfigFromBytes(b []byte) (*Kubeconfig, error) {
-	buffer := bytes.NewBuffer(b)
-
-	return GetKubeconfigFromBytesBuffer(buffer)
-}

internal/resources/api_server_certificate.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	k8stypes "k8s.io/apimachinery/pkg/types"
@@ -15,8 +14,11 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
+	"github.com/clastix/kamaji/internal/crypto"
 	"github.com/clastix/kamaji/internal/kubeadm"
 	"github.com/clastix/kamaji/internal/utilities"
 )
@@ -24,12 +26,11 @@ import (
 type APIServerCertificate struct {
 	resource     *corev1.Secret
 	Client       client.Client
-	Log          logr.Logger
 	TmpDirectory string
 }
 
 func (r *APIServerCertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Certificates.APIServer.Checksum != r.resource.GetAnnotations()["checksum"]
+	return tenantControlPlane.Status.Certificates.APIServer.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *APIServerCertificate) ShouldCleanup(_ *kamajiv1alpha1.TenantControlPlane) bool {
@@ -74,20 +75,22 @@ func (r *APIServerCertificate) GetName() string {
 func (r *APIServerCertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.Certificates.APIServer.LastUpdate = metav1.Now()
 	tenantControlPlane.Status.Certificates.APIServer.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Certificates.APIServer.Checksum = r.resource.GetAnnotations()["checksum"]
+	tenantControlPlane.Status.Certificates.APIServer.Checksum = r.resource.GetAnnotations()[constants.Checksum]
 
 	return nil
 }
 
 func (r *APIServerCertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
-		if checksum := tenantControlPlane.Status.Certificates.APIServer.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()["checksum"] {
-			isValid, err := kubeadm.IsCertificatePrivateKeyPairValid(
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
+		if checksum := tenantControlPlane.Status.Certificates.APIServer.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()[constants.Checksum] {
+			isValid, err := crypto.CheckCertificateAndPrivateKeyPairValidity(
 				r.resource.Data[kubeadmconstants.APIServerCertName],
 				r.resource.Data[kubeadmconstants.APIServerKeyName],
 			)
 			if err != nil {
-				r.Log.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", kubeadmconstants.APIServerCertAndKeyBaseName, err.Error()))
+				logger.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", kubeadmconstants.APIServerCertAndKeyBaseName, err.Error()))
 			}
 			if isValid {
 				return nil
@@ -96,12 +99,16 @@ func (r *APIServerCertificate) mutate(ctx context.Context, tenantControlPlane *k
 
 		config, err := getStoredKubeadmConfiguration(ctx, r, tenantControlPlane)
 		if err != nil {
+			logger.Error(err, "cannot retrieve kubeadm configuration")
+
 			return err
 		}
 
 		namespacedName := k8stypes.NamespacedName{Namespace: tenantControlPlane.GetNamespace(), Name: tenantControlPlane.Status.Certificates.CA.SecretName}
 		secretCA := &corev1.Secret{}
 		if err = r.Client.Get(ctx, namespacedName, secretCA); err != nil {
+			logger.Error(err, "cannot retrieve CA secret")
+
 			return err
 		}
 
@@ -112,6 +119,8 @@ func (r *APIServerCertificate) mutate(ctx context.Context, tenantControlPlane *k
 		}
 		certificateKeyPair, err := kubeadm.GenerateCertificatePrivateKeyPair(kubeadmconstants.APIServerCertAndKeyBaseName, config, ca)
 		if err != nil {
+			logger.Error(err, "cannot generate certificate and private key")
+
 			return err
 		}
 
@@ -124,7 +133,7 @@ func (r *APIServerCertificate) mutate(ctx context.Context, tenantControlPlane *k
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
 		r.resource.SetAnnotations(annotations)
 
 		r.resource.SetLabels(utilities.MergeMaps(

internal/resources/api_server_kubelet_client_certificate.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	k8stypes "k8s.io/apimachinery/pkg/types"
@@ -15,8 +14,11 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
+	"github.com/clastix/kamaji/internal/crypto"
 	"github.com/clastix/kamaji/internal/kubeadm"
 	"github.com/clastix/kamaji/internal/utilities"
 )
@@ -24,12 +26,11 @@ import (
 type APIServerKubeletClientCertificate struct {
 	resource     *corev1.Secret
 	Client       client.Client
-	Log          logr.Logger
 	TmpDirectory string
 }
 
 func (r *APIServerKubeletClientCertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Certificates.APIServerKubeletClient.Checksum != r.resource.GetAnnotations()["checksum"]
+	return tenantControlPlane.Status.Certificates.APIServerKubeletClient.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *APIServerKubeletClientCertificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
@@ -74,20 +75,22 @@ func (r *APIServerKubeletClientCertificate) GetName() string {
 func (r *APIServerKubeletClientCertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.Certificates.APIServerKubeletClient.LastUpdate = metav1.Now()
 	tenantControlPlane.Status.Certificates.APIServerKubeletClient.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Certificates.APIServerKubeletClient.Checksum = r.resource.GetAnnotations()["checksum"]
+	tenantControlPlane.Status.Certificates.APIServerKubeletClient.Checksum = r.resource.GetAnnotations()[constants.Checksum]
 
 	return nil
 }
 
 func (r *APIServerKubeletClientCertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
-		if checksum := tenantControlPlane.Status.Certificates.APIServerKubeletClient.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()["checksum"] {
-			isValid, err := kubeadm.IsCertificatePrivateKeyPairValid(
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
+		if checksum := tenantControlPlane.Status.Certificates.APIServerKubeletClient.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()[constants.Checksum] {
+			isValid, err := crypto.CheckCertificateAndPrivateKeyPairValidity(
 				r.resource.Data[kubeadmconstants.APIServerKubeletClientCertName],
 				r.resource.Data[kubeadmconstants.APIServerKubeletClientKeyName],
 			)
 			if err != nil {
-				r.Log.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", kubeadmconstants.APIServerKubeletClientCertAndKeyBaseName, err.Error()))
+				logger.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", kubeadmconstants.APIServerKubeletClientCertAndKeyBaseName, err.Error()))
 			}
 			if isValid {
 				return nil
@@ -96,12 +99,17 @@ func (r *APIServerKubeletClientCertificate) mutate(ctx context.Context, tenantCo
 
 		config, err := getStoredKubeadmConfiguration(ctx, r, tenantControlPlane)
 		if err != nil {
+			logger.Error(err, "cannot retrieve kubeadm configuration")
+
 			return err
 		}
 
 		namespacedName := k8stypes.NamespacedName{Namespace: tenantControlPlane.GetNamespace(), Name: tenantControlPlane.Status.Certificates.CA.SecretName}
+
 		secretCA := &corev1.Secret{}
 		if err = r.Client.Get(ctx, namespacedName, secretCA); err != nil {
+			logger.Error(err, "cannot retrieve CA secret")
+
 			return err
 		}
 
@@ -112,6 +120,8 @@ func (r *APIServerKubeletClientCertificate) mutate(ctx context.Context, tenantCo
 		}
 		certificateKeyPair, err := kubeadm.GenerateCertificatePrivateKeyPair(kubeadmconstants.APIServerKubeletClientCertAndKeyBaseName, config, ca)
 		if err != nil {
+			logger.Error(err, "cannot generate certificate and private key")
+
 			return err
 		}
 
@@ -132,7 +142,7 @@ func (r *APIServerKubeletClientCertificate) mutate(ctx context.Context, tenantCo
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
 		r.resource.SetAnnotations(annotations)
 
 		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())

internal/resources/ca_certificate.go

@@ -7,15 +7,17 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
+	"github.com/clastix/kamaji/internal/crypto"
 	"github.com/clastix/kamaji/internal/kubeadm"
 	"github.com/clastix/kamaji/internal/utilities"
 )
@@ -23,13 +25,12 @@ import (
 type CACertificate struct {
 	resource     *corev1.Secret
 	Client       client.Client
-	Log          logr.Logger
 	TmpDirectory string
 }
 
 func (r *CACertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Status.Certificates.CA.SecretName != r.resource.GetName() ||
-		tenantControlPlane.Status.Certificates.CA.Checksum != r.resource.GetAnnotations()["checksum"]
+		tenantControlPlane.Status.Certificates.CA.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *CACertificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
@@ -74,20 +75,22 @@ func (r *CACertificate) GetName() string {
 func (r *CACertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.Certificates.CA.LastUpdate = metav1.Now()
 	tenantControlPlane.Status.Certificates.CA.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Certificates.CA.Checksum = r.resource.GetAnnotations()["checksum"]
+	tenantControlPlane.Status.Certificates.CA.Checksum = r.resource.GetAnnotations()[constants.Checksum]
 
 	return nil
 }
 
 func (r *CACertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
-		if checksum := tenantControlPlane.Status.Certificates.CA.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()["checksum"] {
-			isValid, err := kubeadm.IsCertificatePrivateKeyPairValid(
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
+		if checksum := tenantControlPlane.Status.Certificates.CA.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()[constants.Checksum] {
+			isValid, err := crypto.CheckCertificateAndPrivateKeyPairValidity(
 				r.resource.Data[kubeadmconstants.CACertName],
 				r.resource.Data[kubeadmconstants.CAKeyName],
 			)
 			if err != nil {
-				r.Log.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", kubeadmconstants.CACertAndKeyBaseName, err.Error()))
+				logger.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", kubeadmconstants.CACertAndKeyBaseName, err.Error()))
 			}
 			if isValid {
 				return nil
@@ -96,11 +99,15 @@ func (r *CACertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1
 
 		config, err := getStoredKubeadmConfiguration(ctx, r, tenantControlPlane)
 		if err != nil {
+			logger.Error(err, "cannot retrieve kubeadm configuration")
+
 			return err
 		}
 
 		ca, err := kubeadm.GenerateCACertificatePrivateKeyPair(kubeadmconstants.CACertAndKeyBaseName, config)
 		if err != nil {
+			logger.Error(err, "cannot generate certificate and private key")
+
 			return err
 		}
 
@@ -121,7 +128,7 @@ func (r *CACertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
 		r.resource.SetAnnotations(annotations)
 
 		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())

internal/resources/datastore/datastore_certificate.go

@@ -0,0 +1,162 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package datastore
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
+	"github.com/clastix/kamaji/internal/crypto"
+	"github.com/clastix/kamaji/internal/utilities"
+)
+
+type Certificate struct {
+	resource  *corev1.Secret
+	Client    client.Client
+	Name      string
+	DataStore kamajiv1alpha1.DataStore
+}
+
+func (r *Certificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	return tenantControlPlane.Status.Storage.Certificate.Checksum != r.resource.GetAnnotations()[constants.Checksum]
+}
+
+func (r *Certificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
+	return false
+}
+
+func (r *Certificate) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	return false, nil
+}
+
+func (r *Certificate) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	r.resource = &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      r.getPrefixedName(tenantControlPlane),
+			Namespace: tenantControlPlane.GetNamespace(),
+		},
+		Data: map[string][]byte{},
+	}
+
+	return nil
+}
+
+func (r *Certificate) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
+	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
+}
+
+func (r *Certificate) GetClient() client.Client {
+	return r.Client
+}
+
+func (r *Certificate) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
+}
+
+func (r *Certificate) GetName() string {
+	return "datastore-certificate"
+}
+
+func (r *Certificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	tenantControlPlane.Status.Storage.Certificate.SecretName = r.resource.GetName()
+	tenantControlPlane.Status.Storage.Certificate.Checksum = r.resource.GetAnnotations()[constants.Checksum]
+	tenantControlPlane.Status.Storage.Certificate.LastUpdate = metav1.Now()
+
+	return nil
+}
+
+func (r *Certificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
+	return func() error {
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
+		ca, err := r.DataStore.Spec.TLSConfig.CertificateAuthority.Certificate.GetContent(ctx, r.Client)
+		if err != nil {
+			logger.Error(err, "cannot retrieve CA certificate content")
+
+			return err
+		}
+
+		r.resource.Data["ca.crt"] = ca
+
+		if r.resource.GetAnnotations()[constants.Checksum] == utilities.CalculateMapChecksum(r.resource.Data) {
+			if r.DataStore.Spec.Driver == kamajiv1alpha1.EtcdDriver {
+				if isValid, _ := crypto.IsValidCertificateKeyPairBytes(r.resource.Data["server.crt"], r.resource.Data["server.key"]); isValid {
+					return nil
+				}
+			}
+		}
+
+		var crt, key *bytes.Buffer
+
+		switch r.DataStore.Spec.Driver {
+		case kamajiv1alpha1.EtcdDriver:
+			// When dealing with the etcd storage we cannot use the basic authentication, thus the generation of a
+			// certificate used for authentication is mandatory, along with the CA private key.
+			privateKey, err := r.DataStore.Spec.TLSConfig.CertificateAuthority.PrivateKey.GetContent(ctx, r.Client)
+			if err != nil {
+				logger.Error(err, "unable to retrieve CA private key content")
+
+				return err
+			}
+
+			crt, key, err = crypto.GenerateCertificatePrivateKeyPair(crypto.NewCertificateTemplate(tenantControlPlane.GetName()), ca, privateKey)
+			if err != nil {
+				logger.Error(err, "unable to generate certificate and private key")
+
+				return err
+			}
+		case kamajiv1alpha1.KineMySQLDriver, kamajiv1alpha1.KinePostgreSQLDriver:
+			// For the SQL drivers we just need to copy the certificate, since the basic authentication is used
+			// to connect to the desired schema and database.
+			crtBytes, err := r.DataStore.Spec.TLSConfig.ClientCertificate.Certificate.GetContent(ctx, r.Client)
+			if err != nil {
+				logger.Error(err, "unable to retrieve certificate content")
+
+				return err
+			}
+			crt = bytes.NewBuffer(crtBytes)
+
+			keyBytes, err := r.DataStore.Spec.TLSConfig.ClientCertificate.PrivateKey.GetContent(ctx, r.Client)
+			if err != nil {
+				logger.Error(err, "unable to retrieve private key content")
+
+				return err
+			}
+			key = bytes.NewBuffer(keyBytes)
+		default:
+			return fmt.Errorf("unrecognized driver for Certificate generation")
+		}
+
+		r.resource.Data["server.crt"] = crt.Bytes()
+		r.resource.Data["server.key"] = key.Bytes()
+
+		annotations := r.resource.GetAnnotations()
+		if annotations == nil {
+			annotations = map[string]string{}
+		}
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
+		r.resource.SetAnnotations(annotations)
+
+		r.resource.SetLabels(utilities.MergeMaps(
+			utilities.KamajiLabels(),
+			r.resource.GetLabels(),
+			map[string]string{
+				"kamaji.clastix.io/name":      tenantControlPlane.GetName(),
+				"kamaji.clastix.io/component": r.GetName(),
+			},
+		))
+
+		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
+	}
+}

internal/resources/datastore/datastore_setup.go

@@ -0,0 +1,255 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package datastore
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/datastore"
+	"github.com/clastix/kamaji/internal/resources/utils"
+)
+
+type SetupResource struct {
+	schema   string
+	user     string
+	password string
+}
+
+type Setup struct {
+	resource   SetupResource
+	Client     client.Client
+	Connection datastore.Connection
+	DataStore  kamajiv1alpha1.DataStore
+}
+
+func (r *Setup) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	return tenantControlPlane.Status.Storage.Driver != string(r.DataStore.Spec.Driver) &&
+		tenantControlPlane.Status.Storage.Setup.Checksum != tenantControlPlane.Status.Storage.Config.Checksum
+}
+
+func (r *Setup) ShouldCleanup(_ *kamajiv1alpha1.TenantControlPlane) bool {
+	return false
+}
+
+func (r *Setup) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	return false, nil
+}
+
+func (r *Setup) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
+	secret := &corev1.Secret{}
+	namespacedName := types.NamespacedName{
+		Namespace: tenantControlPlane.GetNamespace(),
+		Name:      tenantControlPlane.Status.Storage.Config.SecretName,
+	}
+	if err := r.Client.Get(ctx, namespacedName, secret); err != nil {
+		logger.Error(err, "cannot retrieve the DataStore Configuration secret")
+
+		return err
+	}
+
+	r.resource = SetupResource{
+		schema:   string(secret.Data["DB_SCHEMA"]),
+		user:     string(secret.Data["DB_USER"]),
+		password: string(secret.Data["DB_PASSWORD"]),
+	}
+
+	return nil
+}
+
+func (r *Setup) GetClient() client.Client {
+	return r.Client
+}
+
+func (r *Setup) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
+	if tenantControlPlane.Status.Storage.Setup.Checksum != "" &&
+		tenantControlPlane.Status.Storage.Setup.Checksum != tenantControlPlane.Status.Storage.Config.Checksum {
+		if err := r.Delete(ctx, tenantControlPlane); err != nil {
+			return controllerutil.OperationResultNone, err
+		}
+
+		return controllerutil.OperationResultUpdated, nil
+	}
+
+	reconcilationResult := controllerutil.OperationResultNone
+	var operationResult controllerutil.OperationResult
+	var err error
+
+	operationResult, err = r.createDB(ctx, tenantControlPlane)
+	if err != nil {
+		logger.Error(err, "unable to create the DataStore data")
+
+		return reconcilationResult, err
+	}
+	reconcilationResult = utils.UpdateOperationResult(reconcilationResult, operationResult)
+
+	operationResult, err = r.createUser(ctx, tenantControlPlane)
+	if err != nil {
+		logger.Error(err, "unable to create the DataStore user")
+
+		return reconcilationResult, err
+	}
+	reconcilationResult = utils.UpdateOperationResult(reconcilationResult, operationResult)
+
+	operationResult, err = r.createGrantPrivileges(ctx, tenantControlPlane)
+	if err != nil {
+		logger.Error(err, "unable to create the DataStore user privileges")
+
+		return reconcilationResult, err
+	}
+	reconcilationResult = utils.UpdateOperationResult(reconcilationResult, operationResult)
+
+	return reconcilationResult, nil
+}
+
+func (r *Setup) GetName() string {
+	return "datastore-setup"
+}
+
+func (r *Setup) Delete(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
+	if err := r.revokeGrantPrivileges(ctx, tenantControlPlane); err != nil {
+		logger.Error(err, "unable to revoke privileges")
+
+		return err
+	}
+
+	if err := r.deleteDB(ctx, tenantControlPlane); err != nil {
+		logger.Error(err, "unable to delete datastore data")
+
+		return err
+	}
+
+	if err := r.deleteUser(ctx, tenantControlPlane); err != nil {
+		logger.Error(err, "unable to delete user")
+
+		return err
+	}
+
+	return nil
+}
+
+func (r *Setup) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	tenantControlPlane.Status.Storage.Setup.Schema = r.resource.schema
+	tenantControlPlane.Status.Storage.Setup.User = r.resource.user
+	tenantControlPlane.Status.Storage.Setup.LastUpdate = metav1.Now()
+	tenantControlPlane.Status.Storage.Setup.Checksum = tenantControlPlane.Status.Storage.Config.Checksum
+
+	return nil
+}
+
+func (r *Setup) createDB(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	exists, err := r.Connection.DBExists(ctx, r.resource.schema)
+	if err != nil {
+		return controllerutil.OperationResultNone, errors.Wrap(err, "unable to check if datastore exists")
+	}
+
+	if exists {
+		return controllerutil.OperationResultNone, nil
+	}
+
+	if err := r.Connection.CreateDB(ctx, r.resource.schema); err != nil {
+		return controllerutil.OperationResultNone, errors.Wrap(err, "unable to create the datastore")
+	}
+
+	return controllerutil.OperationResultCreated, nil
+}
+
+func (r *Setup) deleteDB(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) error {
+	exists, err := r.Connection.DBExists(ctx, r.resource.schema)
+	if err != nil {
+		return errors.Wrap(err, "unable to check if datastore exists")
+	}
+
+	if !exists {
+		return nil
+	}
+
+	if err := r.Connection.DeleteDB(ctx, r.resource.schema); err != nil {
+		return errors.Wrap(err, "unable to delete the datastore")
+	}
+
+	return nil
+}
+
+func (r *Setup) createUser(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	exists, err := r.Connection.UserExists(ctx, r.resource.user)
+	if err != nil {
+		return controllerutil.OperationResultNone, errors.Wrap(err, "unable to check if user exists")
+	}
+
+	if exists {
+		return controllerutil.OperationResultNone, nil
+	}
+
+	if err := r.Connection.CreateUser(ctx, r.resource.user, r.resource.password); err != nil {
+		return controllerutil.OperationResultNone, errors.Wrap(err, "unable to create the user")
+	}
+
+	return controllerutil.OperationResultCreated, nil
+}
+
+func (r *Setup) deleteUser(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) error {
+	exists, err := r.Connection.UserExists(ctx, r.resource.user)
+	if err != nil {
+		return errors.Wrap(err, "unable to check if user exists")
+	}
+
+	if !exists {
+		return nil
+	}
+
+	if err := r.Connection.DeleteUser(ctx, r.resource.user); err != nil {
+		return errors.Wrap(err, "unable to remove the user")
+	}
+
+	return nil
+}
+
+func (r *Setup) createGrantPrivileges(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	exists, err := r.Connection.GrantPrivilegesExists(ctx, r.resource.user, r.resource.schema)
+	if err != nil {
+		return controllerutil.OperationResultNone, errors.Wrap(err, "unable to check if privileges exist")
+	}
+
+	if exists {
+		return controllerutil.OperationResultNone, nil
+	}
+
+	if err := r.Connection.GrantPrivileges(ctx, r.resource.user, r.resource.schema); err != nil {
+		return controllerutil.OperationResultNone, errors.Wrap(err, "unable to grant privileges")
+	}
+
+	return controllerutil.OperationResultCreated, nil
+}
+
+func (r *Setup) revokeGrantPrivileges(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) error {
+	exists, err := r.Connection.GrantPrivilegesExists(ctx, r.resource.user, r.resource.schema)
+	if err != nil {
+		return errors.Wrap(err, "unable to check if privileges exist")
+	}
+
+	if !exists {
+		return nil
+	}
+
+	if err := r.Connection.RevokePrivileges(ctx, r.resource.user, r.resource.schema); err != nil {
+		return errors.Wrap(err, "unable to revoke privileges")
+	}
+
+	return nil
+}

internal/resources/datastore/datastore_storage_config.go

@@ -0,0 +1,114 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package datastore
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
+	"github.com/clastix/kamaji/internal/utilities"
+)
+
+type Config struct {
+	resource   *corev1.Secret
+	Client     client.Client
+	ConnString string
+	DataStore  kamajiv1alpha1.DataStore
+}
+
+func (r *Config) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	return tenantControlPlane.Status.Storage.Config.Checksum != r.resource.GetAnnotations()[constants.Checksum] ||
+		tenantControlPlane.Status.Storage.DataStoreName != r.DataStore.GetName()
+}
+
+func (r *Config) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
+	return false
+}
+
+func (r *Config) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	return false, nil
+}
+
+func (r *Config) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	r.resource = &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      r.getPrefixedName(tenantControlPlane),
+			Namespace: tenantControlPlane.GetNamespace(),
+		},
+	}
+
+	return nil
+}
+
+func (r *Config) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
+	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
+}
+
+func (r *Config) GetClient() client.Client {
+	return r.Client
+}
+
+func (r *Config) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
+}
+
+func (r *Config) GetName() string {
+	return "datastore-config"
+}
+
+func (r *Config) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	tenantControlPlane.Status.Storage.Driver = string(r.DataStore.Spec.Driver)
+	tenantControlPlane.Status.Storage.DataStoreName = r.DataStore.GetName()
+	tenantControlPlane.Status.Storage.Config.SecretName = r.resource.GetName()
+	tenantControlPlane.Status.Storage.Config.Checksum = r.resource.GetAnnotations()[constants.Checksum]
+
+	return nil
+}
+
+func (r *Config) mutate(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
+	return func() error {
+		var password []byte
+
+		savedHash, ok := r.resource.GetAnnotations()[constants.Checksum]
+		switch {
+		case ok && savedHash == utilities.CalculateMapChecksum(r.resource.Data):
+			password = r.resource.Data["DB_PASSWORD"]
+		default:
+			password = []byte(uuid.New().String())
+		}
+
+		r.resource.Data = map[string][]byte{
+			"DB_CONNECTION_STRING": []byte(r.ConnString),
+			"DB_SCHEMA":            []byte(tenantControlPlane.GetName()),
+			"DB_USER":              []byte(tenantControlPlane.GetName()),
+			"DB_PASSWORD":          password,
+		}
+
+		annotations := r.resource.GetAnnotations()
+		if annotations == nil {
+			annotations = map[string]string{}
+		}
+
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
+		r.resource.SetAnnotations(annotations)
+
+		r.resource.SetLabels(utilities.MergeMaps(
+			utilities.KamajiLabels(),
+			map[string]string{
+				"kamaji.clastix.io/name":      tenantControlPlane.GetName(),
+				"kamaji.clastix.io/component": r.GetName(),
+			},
+		))
+
+		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
+	}
+}

internal/resources/etcd_ca_certificates.go

@@ -1,125 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package resources
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/go-logr/logr"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/etcd"
-	"github.com/clastix/kamaji/internal/utilities"
-)
-
-type ETCDCACertificatesResource struct {
-	resource  *corev1.Secret
-	Client    client.Client
-	Log       logr.Logger
-	Name      string
-	DataStore kamajiv1alpha1.DataStore
-}
-
-func (r *ETCDCACertificatesResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	if tenantControlPlane.Status.Certificates.ETCD == nil {
-		return true
-	}
-
-	return tenantControlPlane.Status.Certificates.ETCD.CA.Checksum != r.resource.GetAnnotations()["checksum"]
-}
-
-func (r *ETCDCACertificatesResource) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
-	return false
-}
-
-func (r *ETCDCACertificatesResource) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
-	return false, nil
-}
-
-func (r *ETCDCACertificatesResource) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	r.resource = &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      r.getPrefixedName(tenantControlPlane),
-			Namespace: tenantControlPlane.GetNamespace(),
-		},
-	}
-
-	return nil
-}
-
-func (r *ETCDCACertificatesResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
-}
-
-func (r *ETCDCACertificatesResource) GetName() string {
-	return r.Name
-}
-
-func (r *ETCDCACertificatesResource) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	if tenantControlPlane.Status.Certificates.ETCD == nil {
-		tenantControlPlane.Status.Certificates.ETCD = &kamajiv1alpha1.ETCDCertificatesStatus{}
-	}
-
-	tenantControlPlane.Status.Certificates.ETCD.CA.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Certificates.ETCD.CA.LastUpdate = metav1.Now()
-	tenantControlPlane.Status.Certificates.ETCD.CA.Checksum = r.resource.GetAnnotations()["checksum"]
-
-	return nil
-}
-
-func (r *ETCDCACertificatesResource) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
-}
-
-func (r *ETCDCACertificatesResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
-	return func() error {
-		if r.DataStore.Spec.TLSConfig.CertificateAuthority.PrivateKey == nil {
-			return fmt.Errorf("missing private key, cannot generate certificate for the given tenant control plane")
-		}
-
-		if etcdStatus := tenantControlPlane.Status.Certificates.ETCD; etcdStatus != nil && len(etcdStatus.CA.Checksum) > 0 && etcdStatus.CA.Checksum == r.resource.GetAnnotations()["checksum"] {
-			isValid, err := etcd.IsETCDCertificateAndKeyPairValid(r.resource.Data[kubeadmconstants.CACertName], r.resource.Data[kubeadmconstants.CAKeyName])
-			if err != nil {
-				r.Log.Info(fmt.Sprintf("etcd certificates are not valid: %s", err.Error()))
-			}
-
-			if isValid {
-				return nil
-			}
-		}
-
-		ca, err := r.DataStore.Spec.TLSConfig.CertificateAuthority.Certificate.GetContent(ctx, r.Client)
-		if err != nil {
-			return err
-		}
-
-		key, err := r.DataStore.Spec.TLSConfig.CertificateAuthority.PrivateKey.GetContent(ctx, r.Client)
-		if err != nil {
-			return err
-		}
-
-		r.resource.Data = map[string][]byte{
-			kubeadmconstants.CACertName: ca,
-			kubeadmconstants.CAKeyName:  key,
-		}
-
-		r.resource.SetLabels(utilities.KamajiLabels())
-
-		annotations := r.resource.GetAnnotations()
-		if annotations == nil {
-			annotations = map[string]string{}
-		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
-		r.resource.SetAnnotations(annotations)
-
-		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
-	}
-}

internal/resources/etcd_certificates.go

@@ -1,130 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package resources
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/go-logr/logr"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	k8stypes "k8s.io/apimachinery/pkg/types"
-	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/etcd"
-	"github.com/clastix/kamaji/internal/utilities"
-)
-
-type ETCDCertificatesResource struct {
-	resource *corev1.Secret
-	Client   client.Client
-	Log      logr.Logger
-	Name     string
-}
-
-func (r *ETCDCertificatesResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	if tenantControlPlane.Status.Certificates.ETCD == nil {
-		return true
-	}
-
-	return tenantControlPlane.Status.Certificates.ETCD.APIServer.Checksum != r.resource.GetAnnotations()["checksum"]
-}
-
-func (r *ETCDCertificatesResource) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
-	return false
-}
-
-func (r *ETCDCertificatesResource) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
-	return false, nil
-}
-
-func (r *ETCDCertificatesResource) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	r.resource = &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      r.getPrefixedName(tenantControlPlane),
-			Namespace: tenantControlPlane.GetNamespace(),
-		},
-	}
-
-	return nil
-}
-
-func (r *ETCDCertificatesResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
-}
-
-func (r *ETCDCertificatesResource) GetName() string {
-	return r.Name
-}
-
-func (r *ETCDCertificatesResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	if tenantControlPlane.Status.Certificates.ETCD == nil {
-		tenantControlPlane.Status.Certificates.ETCD = &kamajiv1alpha1.ETCDCertificatesStatus{}
-	}
-
-	tenantControlPlane.Status.Certificates.ETCD.APIServer.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Certificates.ETCD.APIServer.LastUpdate = metav1.Now()
-	tenantControlPlane.Status.Certificates.ETCD.APIServer.Checksum = r.resource.GetAnnotations()["checksum"]
-
-	return nil
-}
-
-func (r *ETCDCertificatesResource) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
-}
-
-func (r *ETCDCertificatesResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
-	return func() error {
-		if tenantControlPlane.Status.Certificates.ETCD == nil {
-			return fmt.Errorf("etcd is still synchronizing latest changes")
-		}
-
-		if checksum := tenantControlPlane.Status.Certificates.ETCD.APIServer.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()["checksum"] {
-			isValid, err := etcd.IsETCDCertificateAndKeyPairValid(r.resource.Data[kubeadmconstants.APIServerEtcdClientCertName], r.resource.Data[kubeadmconstants.APIServerEtcdClientKeyName])
-			if err != nil {
-				r.Log.Info(fmt.Sprintf("etcd certificates are not valid: %s", err.Error()))
-			}
-
-			if isValid {
-				return nil
-			}
-		}
-
-		etcdCASecretNamespacedName := k8stypes.NamespacedName{Namespace: tenantControlPlane.GetNamespace(), Name: tenantControlPlane.Status.Certificates.ETCD.CA.SecretName}
-		etcdCASecret := &corev1.Secret{}
-		if err := r.Client.Get(ctx, etcdCASecretNamespacedName, etcdCASecret); err != nil {
-			return err
-		}
-
-		cert, privKey, err := etcd.GetETCDCACertificateAndKeyPair(
-			tenantControlPlane.GetName(),
-			etcdCASecret.Data[kubeadmconstants.CACertName],
-			etcdCASecret.Data[kubeadmconstants.CAKeyName],
-		)
-		if err != nil {
-			return err
-		}
-
-		r.resource.Data = map[string][]byte{
-			kubeadmconstants.APIServerEtcdClientCertName: cert.Bytes(),
-			kubeadmconstants.APIServerEtcdClientKeyName:  privKey.Bytes(),
-		}
-
-		r.resource.SetLabels(utilities.KamajiLabels())
-
-		annotations := r.resource.GetAnnotations()
-		if annotations == nil {
-			annotations = map[string]string{}
-		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
-		r.resource.SetAnnotations(annotations)
-
-		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
-	}
-}

internal/resources/etcd_setup.go

@@ -1,273 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package resources
-
-import (
-	"context"
-
-	"github.com/go-logr/logr"
-	etcdclient "go.etcd.io/etcd/client/v3"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/etcd"
-)
-
-type etcdSetupResource struct {
-	role etcd.Role
-	user etcd.User
-}
-
-type ETCDSetupResource struct {
-	resource  *etcdSetupResource
-	Client    client.Client
-	Log       logr.Logger
-	DataStore kamajiv1alpha1.DataStore
-}
-
-func (r *ETCDSetupResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	if tenantControlPlane.Status.Storage.ETCD == nil {
-		return true
-	}
-
-	return tenantControlPlane.Status.Storage.ETCD.Role.Name != r.resource.role.Name ||
-		tenantControlPlane.Status.Storage.ETCD.User.Name != r.resource.user.Name
-}
-
-func (r *ETCDSetupResource) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
-	return false
-}
-
-func (r *ETCDSetupResource) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
-	return false, nil
-}
-
-func (r *ETCDSetupResource) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	r.resource = &etcdSetupResource{
-		role: etcd.Role{Name: tenantControlPlane.Name, Exists: false},
-		user: etcd.User{Name: tenantControlPlane.Name, Exists: false},
-	}
-
-	return nil
-}
-
-func (r *ETCDSetupResource) CreateOrUpdate(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return r.reconcile(ctx)
-}
-
-func (r *ETCDSetupResource) Delete(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	if err := r.Define(ctx, tenantControlPlane); err != nil {
-		return err
-	}
-
-	client, err := r.getETCDClient(ctx)
-	if err != nil {
-		return err
-	}
-
-	if err = r.deleteData(ctx, client, tenantControlPlane); err != nil {
-		return err
-	}
-
-	if err = r.deleteUser(ctx, client, tenantControlPlane); err != nil {
-		return err
-	}
-
-	if err = r.deleteRole(ctx, client, tenantControlPlane); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (r *ETCDSetupResource) GetName() string {
-	return "etcd-setup"
-}
-
-func (r *ETCDSetupResource) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	if tenantControlPlane.Status.Storage.ETCD == nil {
-		tenantControlPlane.Status.Storage.ETCD = &kamajiv1alpha1.ETCDStatus{}
-	}
-	tenantControlPlane.Status.Storage.ETCD.Role = r.resource.role
-	tenantControlPlane.Status.Storage.ETCD.User = r.resource.user
-
-	return nil
-}
-
-func (r *ETCDSetupResource) reconcile(ctx context.Context) (controllerutil.OperationResult, error) {
-	reconcilationResult := controllerutil.OperationResultNone
-	var operationResult controllerutil.OperationResult
-
-	client, err := r.getETCDClient(ctx)
-	if err != nil {
-		return reconcilationResult, err
-	}
-	defer client.Close()
-
-	operationResult, err = r.reconcileUser(ctx, client)
-	if err != nil {
-		return reconcilationResult, err
-	}
-	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
-
-	operationResult, err = r.reconcileRole(ctx, client)
-	if err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
-
-	operationResult, err = r.grantUserRole(ctx, client)
-	if err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
-
-	operationResult, err = r.grantRolePermissions(ctx, client)
-	if err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
-
-	return reconcilationResult, nil
-}
-
-func (r *ETCDSetupResource) getETCDClient(ctx context.Context) (*etcdclient.Client, error) {
-	ca, err := r.DataStore.Spec.TLSConfig.CertificateAuthority.Certificate.GetContent(ctx, r.Client)
-	if err != nil {
-		return nil, err
-	}
-
-	crt, err := r.DataStore.Spec.TLSConfig.ClientCertificate.Certificate.GetContent(ctx, r.Client)
-	if err != nil {
-		return nil, err
-	}
-
-	key, err := r.DataStore.Spec.TLSConfig.ClientCertificate.PrivateKey.GetContent(ctx, r.Client)
-	if err != nil {
-		return nil, err
-	}
-
-	config := etcd.Config{
-		ETCDCertificate: crt,
-		ETCDPrivateKey:  key,
-		ETCDCA:          ca,
-		Endpoints:       r.DataStore.Spec.Endpoints,
-	}
-
-	return etcd.NewClient(config)
-}
-
-func (r *ETCDSetupResource) reconcileUser(ctx context.Context, client *etcdclient.Client) (controllerutil.OperationResult, error) {
-	if err := etcd.GetUser(ctx, client, &r.resource.user); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	if !r.resource.user.Exists {
-		if err := etcd.AddUser(ctx, client, r.resource.user.Name); err != nil {
-			return controllerutil.OperationResultNone, err
-		}
-
-		return controllerutil.OperationResultCreated, nil
-	}
-
-	return controllerutil.OperationResultNone, nil
-}
-
-func (r *ETCDSetupResource) reconcileRole(ctx context.Context, client *etcdclient.Client) (controllerutil.OperationResult, error) {
-	if err := etcd.GetRole(ctx, client, &r.resource.role); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	if !r.resource.role.Exists {
-		if err := etcd.AddRole(ctx, client, r.resource.role.Name); err != nil {
-			return controllerutil.OperationResultNone, err
-		}
-
-		return controllerutil.OperationResultCreated, nil
-	}
-
-	return controllerutil.OperationResultNone, nil
-}
-
-func (r *ETCDSetupResource) grantUserRole(ctx context.Context, client *etcdclient.Client) (controllerutil.OperationResult, error) {
-	if err := etcd.GetUser(ctx, client, &r.resource.user); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	if len(r.resource.user.Roles) > 0 && isRole(r.resource.user.Roles, r.resource.role.Name) {
-		return controllerutil.OperationResultNone, nil
-	}
-
-	if err := etcd.GrantUserRole(ctx, client, r.resource.user, r.resource.role); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	return controllerutil.OperationResultUpdated, nil
-}
-
-func (r *ETCDSetupResource) grantRolePermissions(ctx context.Context, client *etcdclient.Client) (controllerutil.OperationResult, error) {
-	if err := etcd.GetRole(ctx, client, &r.resource.role); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	if len(r.resource.role.Permissions) > 0 && isPermission(r.resource.role.Permissions, r.resource.role.Name) {
-		return controllerutil.OperationResultNone, nil
-	}
-
-	if err := etcd.GrantRolePermission(ctx, client, r.resource.role); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	return controllerutil.OperationResultUpdated, nil
-}
-
-func (r *ETCDSetupResource) deleteData(ctx context.Context, client *etcdclient.Client, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	return etcd.CleanUpPrefix(ctx, client, tenantControlPlane.GetName())
-}
-
-func (r *ETCDSetupResource) deleteUser(ctx context.Context, client *etcdclient.Client, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	if err := etcd.GetUser(ctx, client, &r.resource.user); err != nil {
-		return err
-	}
-
-	if !r.resource.user.Exists {
-		return nil
-	}
-
-	return etcd.RemoveUser(ctx, client, tenantControlPlane.GetName())
-}
-
-func (r *ETCDSetupResource) deleteRole(ctx context.Context, client *etcdclient.Client, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	if err := etcd.GetRole(ctx, client, &r.resource.role); err != nil {
-		return err
-	}
-
-	if !r.resource.role.Exists {
-		return nil
-	}
-
-	return etcd.RemoveRole(ctx, client, tenantControlPlane.GetName())
-}
-
-func isRole(s []string, x string) bool {
-	for _, o := range s {
-		if o == x {
-			return true
-		}
-	}
-
-	return false
-}
-
-func isPermission(s []etcd.Permission, role string) bool {
-	key := etcd.BuildKey(role)
-	for _, o := range s {
-		if o.Key == key {
-			return true
-		}
-	}
-
-	return false
-}

internal/resources/front-proxy-client-certificate.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	k8stypes "k8s.io/apimachinery/pkg/types"
@@ -15,8 +14,11 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
+	"github.com/clastix/kamaji/internal/crypto"
 	"github.com/clastix/kamaji/internal/kubeadm"
 	"github.com/clastix/kamaji/internal/utilities"
 )
@@ -24,12 +26,11 @@ import (
 type FrontProxyClientCertificate struct {
 	resource     *corev1.Secret
 	Client       client.Client
-	Log          logr.Logger
 	TmpDirectory string
 }
 
 func (r *FrontProxyClientCertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Certificates.FrontProxyClient.Checksum != r.resource.GetAnnotations()["checksum"]
+	return tenantControlPlane.Status.Certificates.FrontProxyClient.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *FrontProxyClientCertificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
@@ -74,20 +75,22 @@ func (r *FrontProxyClientCertificate) GetName() string {
 func (r *FrontProxyClientCertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.Certificates.FrontProxyClient.LastUpdate = metav1.Now()
 	tenantControlPlane.Status.Certificates.FrontProxyClient.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Certificates.FrontProxyClient.Checksum = r.resource.GetAnnotations()["checksum"]
+	tenantControlPlane.Status.Certificates.FrontProxyClient.Checksum = r.resource.GetAnnotations()[constants.Checksum]
 
 	return nil
 }
 
 func (r *FrontProxyClientCertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
-		if checksum := tenantControlPlane.Status.Certificates.FrontProxyClient.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()["checksum"] {
-			isValid, err := kubeadm.IsCertificatePrivateKeyPairValid(
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
+		if checksum := tenantControlPlane.Status.Certificates.FrontProxyClient.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()[constants.Checksum] {
+			isValid, err := crypto.CheckCertificateAndPrivateKeyPairValidity(
 				r.resource.Data[kubeadmconstants.FrontProxyClientCertName],
 				r.resource.Data[kubeadmconstants.FrontProxyClientKeyName],
 			)
 			if err != nil {
-				r.Log.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", kubeadmconstants.FrontProxyClientCertAndKeyBaseName, err.Error()))
+				logger.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", kubeadmconstants.FrontProxyClientCertAndKeyBaseName, err.Error()))
 			}
 			if isValid {
 				return nil
@@ -96,12 +99,16 @@ func (r *FrontProxyClientCertificate) mutate(ctx context.Context, tenantControlP
 
 		config, err := getStoredKubeadmConfiguration(ctx, r, tenantControlPlane)
 		if err != nil {
+			logger.Error(err, "cannot retrieve kubeadm configuration")
+
 			return err
 		}
 
 		namespacedName := k8stypes.NamespacedName{Namespace: tenantControlPlane.GetNamespace(), Name: tenantControlPlane.Status.Certificates.FrontProxyCA.SecretName}
 		secretCA := &corev1.Secret{}
 		if err = r.Client.Get(ctx, namespacedName, secretCA); err != nil {
+			logger.Error(err, "cannot retrieve CA secret")
+
 			return err
 		}
 
@@ -112,6 +119,8 @@ func (r *FrontProxyClientCertificate) mutate(ctx context.Context, tenantControlP
 		}
 		certificateKeyPair, err := kubeadm.GenerateCertificatePrivateKeyPair(kubeadmconstants.FrontProxyClientCertAndKeyBaseName, config, ca)
 		if err != nil {
+			logger.Error(err, "cannot generate certificate and private key")
+
 			return err
 		}
 
@@ -132,7 +141,7 @@ func (r *FrontProxyClientCertificate) mutate(ctx context.Context, tenantControlP
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
 		r.resource.SetAnnotations(annotations)
 
 		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())

internal/resources/front_proxy_ca_certificate.go

@@ -7,15 +7,17 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
+	"github.com/clastix/kamaji/internal/crypto"
 	"github.com/clastix/kamaji/internal/kubeadm"
 	"github.com/clastix/kamaji/internal/utilities"
 )
@@ -23,12 +25,11 @@ import (
 type FrontProxyCACertificate struct {
 	resource     *corev1.Secret
 	Client       client.Client
-	Log          logr.Logger
 	TmpDirectory string
 }
 
 func (r *FrontProxyCACertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Certificates.FrontProxyCA.Checksum != r.resource.GetAnnotations()["checksum"]
+	return tenantControlPlane.Status.Certificates.FrontProxyCA.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *FrontProxyCACertificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
@@ -73,20 +74,22 @@ func (r *FrontProxyCACertificate) GetName() string {
 func (r *FrontProxyCACertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.Certificates.FrontProxyCA.LastUpdate = metav1.Now()
 	tenantControlPlane.Status.Certificates.FrontProxyCA.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Certificates.FrontProxyCA.Checksum = r.resource.GetAnnotations()["checksum"]
+	tenantControlPlane.Status.Certificates.FrontProxyCA.Checksum = r.resource.GetAnnotations()[constants.Checksum]
 
 	return nil
 }
 
 func (r *FrontProxyCACertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
-		if checksum := tenantControlPlane.Status.Certificates.FrontProxyCA.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()["checksum"] {
-			isValid, err := kubeadm.IsCertificatePrivateKeyPairValid(
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
+		if checksum := tenantControlPlane.Status.Certificates.FrontProxyCA.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()[constants.Checksum] {
+			isValid, err := crypto.CheckCertificateAndPrivateKeyPairValidity(
 				r.resource.Data[kubeadmconstants.FrontProxyCACertName],
 				r.resource.Data[kubeadmconstants.FrontProxyCAKeyName],
 			)
 			if err != nil {
-				r.Log.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", kubeadmconstants.FrontProxyCACertAndKeyBaseName, err.Error()))
+				logger.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", kubeadmconstants.FrontProxyCACertAndKeyBaseName, err.Error()))
 			}
 			if isValid {
 				return nil
@@ -95,11 +98,15 @@ func (r *FrontProxyCACertificate) mutate(ctx context.Context, tenantControlPlane
 
 		config, err := getStoredKubeadmConfiguration(ctx, r, tenantControlPlane)
 		if err != nil {
+			logger.Error(err, "cannot retrieve kubeadm configuration")
+
 			return err
 		}
 
 		ca, err := kubeadm.GenerateCACertificatePrivateKeyPair(kubeadmconstants.FrontProxyCACertAndKeyBaseName, config)
 		if err != nil {
+			logger.Error(err, "cannot generate certificate and private key")
+
 			return err
 		}
 
@@ -120,7 +127,7 @@ func (r *FrontProxyCACertificate) mutate(ctx context.Context, tenantControlPlane
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
 		r.resource.SetAnnotations(annotations)
 
 		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())

internal/resources/k8s_deployment_resource.go

@@ -5,12 +5,18 @@ package resources
 
 import (
 	"context"
+	"crypto/md5"
+	"fmt"
+	"sort"
 
 	"github.com/pkg/errors"
 	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
 	builder "github.com/clastix/kamaji/internal/builders/controlplane"
@@ -20,8 +26,7 @@ import (
 type KubernetesDeploymentResource struct {
 	resource           *appsv1.Deployment
 	Client             client.Client
-	DataStoreDriver    kamajiv1alpha1.Driver
-	ETCDEndpoints      []string
+	DataStore          kamajiv1alpha1.DataStore
 	Name               string
 	KineContainerImage string
 }
@@ -57,15 +62,18 @@ func (r *KubernetesDeploymentResource) Define(_ context.Context, tenantControlPl
 
 func (r *KubernetesDeploymentResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
 		address, _, err := tenantControlPlane.AssignedControlPlaneAddress()
 		if err != nil {
-			return errors.Wrap(err, "cannot create TenantControlPlane Deployment")
+			logger.Error(err, "cannot retrieve Tenant Control Plane address")
+
+			return err
 		}
 
 		d := builder.Deployment{
 			Address:            address,
-			ETCDEndpoints:      r.ETCDEndpoints,
-			ETCDStorageType:    r.DataStoreDriver,
+			DataStore:          r.DataStore,
 			KineContainerImage: r.KineContainerImage,
 		}
 		d.SetLabels(r.resource, utilities.MergeMaps(utilities.CommonLabels(tenantControlPlane.GetName()), tenantControlPlane.Spec.ControlPlane.Deployment.AdditionalMetadata.Labels))
@@ -73,6 +81,7 @@ func (r *KubernetesDeploymentResource) mutate(ctx context.Context, tenantControl
 		d.SetTemplateLabels(&r.resource.Spec.Template, r.deploymentTemplateLabels(ctx, tenantControlPlane))
 		d.SetStrategy(&r.resource.Spec)
 		d.SetSelector(&r.resource.Spec, tenantControlPlane)
+		d.SetTopologySpreadConstraints(&r.resource.Spec, tenantControlPlane.Spec.ControlPlane.Deployment.TopologySpreadConstraints)
 		d.SetReplicas(&r.resource.Spec, tenantControlPlane)
 		d.ResetKubeAPIServerFlags(r.resource, tenantControlPlane)
 		d.SetContainers(&r.resource.Spec.Template.Spec, tenantControlPlane, address)
@@ -105,6 +114,7 @@ func (r *KubernetesDeploymentResource) UpdateTenantControlPlaneStatus(_ context.
 
 	tenantControlPlane.Status.Kubernetes.Deployment = kamajiv1alpha1.KubernetesDeploymentStatus{
 		DeploymentStatus: r.resource.Status,
+		Selector:         metav1.FormatLabelSelector(r.resource.Spec.Selector),
 		Name:             r.resource.GetName(),
 		Namespace:        r.resource.GetNamespace(),
 		LastUpdate:       metav1.Now(),
@@ -114,10 +124,10 @@ func (r *KubernetesDeploymentResource) UpdateTenantControlPlaneStatus(_ context.
 }
 
 func (r *KubernetesDeploymentResource) deploymentTemplateLabels(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (labels map[string]string) {
-	hash := func(ctx context.Context, namespace, secretName string) (hash string) {
-		hash, _ = utilities.SecretHashValue(ctx, r.Client, namespace, secretName)
+	hash := func(ctx context.Context, namespace, secretName string) string {
+		h, _ := r.SecretHashValue(ctx, r.Client, namespace, secretName)
 
-		return
+		return h
 	}
 
 	labels = map[string]string{
@@ -132,11 +142,6 @@ func (r *KubernetesDeploymentResource) deploymentTemplateLabels(ctx context.Cont
 		"component.kamaji.clastix.io/scheduler-kubeconfig":                  hash(ctx, tenantControlPlane.GetNamespace(), tenantControlPlane.Status.KubeConfig.Scheduler.SecretName),
 	}
 
-	if r.DataStoreDriver == kamajiv1alpha1.EtcdDriver {
-		labels["component.kamaji.clastix.io/etcd-ca-certificates"] = hash(ctx, tenantControlPlane.GetNamespace(), tenantControlPlane.Status.Certificates.ETCD.CA.SecretName)
-		labels["component.kamaji.clastix.io/etcd-certificates"] = hash(ctx, tenantControlPlane.GetNamespace(), tenantControlPlane.Status.Certificates.ETCD.APIServer.SecretName)
-	}
-
 	return labels
 }
 
@@ -165,3 +170,33 @@ func (r *KubernetesDeploymentResource) isProvisioning(tenantControlPlane *kamaji
 func (r *KubernetesDeploymentResource) isNotReady() bool {
 	return r.resource.Status.ReadyReplicas == 0
 }
+
+// SecretHashValue function returns the md5 value for the secret of the given name and namespace.
+func (r *KubernetesDeploymentResource) SecretHashValue(ctx context.Context, client client.Client, namespace, name string) (string, error) {
+	secret := &corev1.Secret{}
+	if err := client.Get(ctx, types.NamespacedName{Namespace: namespace, Name: name}, secret); err != nil {
+		return "", errors.Wrap(err, "cannot retrieve *corev1.Secret for resource version retrieval")
+	}
+
+	return r.HashValue(*secret), nil
+}
+
+// HashValue function returns the md5 value for the given secret.
+func (r *KubernetesDeploymentResource) HashValue(secret corev1.Secret) string {
+	// Go access map values in random way, it means we have to sort them.
+	keys := make([]string, 0, len(secret.Data))
+
+	for k := range secret.Data {
+		keys = append(keys, k)
+	}
+
+	sort.Strings(keys)
+	// Generating MD5 of Secret values, sorted by key
+	h := md5.New()
+
+	for _, key := range keys {
+		h.Write(secret.Data[key])
+	}
+
+	return fmt.Sprintf("%x", h.Sum(nil))
+}

internal/resources/k8s_ingress_resource.go

@@ -13,6 +13,7 @@ import (
 	"k8s.io/utils/pointer"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
 	"github.com/clastix/kamaji/internal/utilities"
@@ -34,8 +35,12 @@ func (r *KubernetesIngressResource) ShouldCleanup(tenantControlPlane *kamajiv1al
 }
 
 func (r *KubernetesIngressResource) CleanUp(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
 	if err := r.Client.Delete(ctx, r.resource); err != nil {
 		if !k8serrors.IsNotFound(err) {
+			logger.Error(err, "cannot cleanup resource")
+
 			return false, err
 		}
 

internal/resources/k8s_service_resource.go

@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
 	"github.com/clastix/kamaji/internal/utilities"
@@ -22,7 +23,6 @@ import (
 type KubernetesServiceResource struct {
 	resource *corev1.Service
 	Client   client.Client
-	Name     string
 }
 
 func (r *KubernetesServiceResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
@@ -40,6 +40,8 @@ func (r *KubernetesServiceResource) CleanUp(context.Context, *kamajiv1alpha1.Ten
 }
 
 func (r *KubernetesServiceResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
 	tenantControlPlane.Status.Kubernetes.Service.ServiceStatus = r.resource.Status
 	tenantControlPlane.Status.Kubernetes.Service.Name = r.resource.GetName()
 	tenantControlPlane.Status.Kubernetes.Service.Namespace = r.resource.GetNamespace()
@@ -47,6 +49,8 @@ func (r *KubernetesServiceResource) UpdateTenantControlPlaneStatus(ctx context.C
 
 	address, err := tenantControlPlane.DeclaredControlPlaneAddress(ctx, r.Client)
 	if err != nil {
+		logger.Error(err, "cannot retrieve Tenant Control Plane address")
+
 		return err
 	}
 
@@ -63,8 +67,6 @@ func (r *KubernetesServiceResource) Define(_ context.Context, tenantControlPlane
 		},
 	}
 
-	r.Name = "service"
-
 	return nil
 }
 
@@ -124,5 +126,5 @@ func (r *KubernetesServiceResource) mutate(ctx context.Context, tenantControlPla
 }
 
 func (r *KubernetesServiceResource) GetName() string {
-	return r.Name
+	return "service"
 }

internal/resources/konnectivity/agent.go

@@ -15,8 +15,10 @@ import (
 	"k8s.io/utils/pointer"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
 	"github.com/clastix/kamaji/internal/utilities"
 )
 
@@ -27,12 +29,11 @@ const (
 type Agent struct {
 	resource     *appsv1.DaemonSet
 	Client       client.Client
-	Name         string
 	tenantClient client.Client
 }
 
 func (r *Agent) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Addons.Konnectivity.Agent.Checksum != r.resource.GetAnnotations()["checksum"]
+	return tenantControlPlane.Status.Addons.Konnectivity.Agent.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *Agent) ShouldCleanup(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
@@ -51,7 +52,9 @@ func (r *Agent) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.
 	return true, nil
 }
 
-func (r *Agent) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *Agent) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (err error) {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
 	r.resource = &appsv1.DaemonSet{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      AgentName,
@@ -59,13 +62,12 @@ func (r *Agent) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.T
 		},
 	}
 
-	client, err := utilities.GetTenantClient(ctx, r.Client, tenantControlPlane)
-	if err != nil {
+	if r.tenantClient, err = utilities.GetTenantClient(ctx, r.Client, tenantControlPlane); err != nil {
+		logger.Error(err, "unable to retrieve the Tenant Control Plane client")
+
 		return err
 	}
 
-	r.tenantClient = client
-
 	return nil
 }
 
@@ -74,7 +76,7 @@ func (r *Agent) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1
 }
 
 func (r *Agent) GetName() string {
-	return r.Name
+	return "konnectivity-agent"
 }
 
 func (r *Agent) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
@@ -82,24 +84,26 @@ func (r *Agent) UpdateTenantControlPlaneStatus(ctx context.Context, tenantContro
 		tenantControlPlane.Status.Addons.Konnectivity.Agent = kamajiv1alpha1.ExternalKubernetesObjectStatus{
 			Name:       r.resource.GetName(),
 			Namespace:  r.resource.GetNamespace(),
-			Checksum:   r.resource.GetAnnotations()["checksum"],
+			Checksum:   r.resource.GetAnnotations()[constants.Checksum],
 			LastUpdate: metav1.Now(),
 		}
-		tenantControlPlane.Status.Addons.Konnectivity.Enabled = true
 
 		return nil
 	}
 
-	tenantControlPlane.Status.Addons.Konnectivity.Enabled = false
 	tenantControlPlane.Status.Addons.Konnectivity.Agent = kamajiv1alpha1.ExternalKubernetesObjectStatus{}
 
 	return nil
 }
 
 func (r *Agent) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
-	return func() (err error) {
+	return func() error {
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
 		address, _, err := tenantControlPlane.AssignedControlPlaneAddress()
 		if err != nil {
+			logger.Error(err, "unable to retrieve the Tenant Control Plane address")
+
 			return err
 		}
 
@@ -198,12 +202,12 @@ func (r *Agent) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.T
 		c.SetAnnotations(nil)
 		c.SetResourceVersion("")
 
-		yaml, _ := utilities.EncondeToYaml(c)
+		yaml, _ := utilities.EncodeToYaml(c)
 		annotations := r.resource.GetAnnotations()
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.MD5Checksum(yaml)
+		annotations[constants.Checksum] = utilities.MD5Checksum(yaml)
 		r.resource.SetAnnotations(annotations)
 
 		return nil

internal/resources/konnectivity/certificate_resource.go

@@ -4,16 +4,9 @@
 package konnectivity
 
 import (
-	"bytes"
 	"context"
-	"crypto/x509"
-	"crypto/x509/pkix"
 	"fmt"
-	"math/big"
-	"math/rand"
-	"time"
 
-	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -22,8 +15,10 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
 	"github.com/clastix/kamaji/internal/crypto"
 	"github.com/clastix/kamaji/internal/kubeadm"
 	"github.com/clastix/kamaji/internal/utilities"
@@ -32,21 +27,23 @@ import (
 type CertificateResource struct {
 	resource *corev1.Secret
 	Client   client.Client
-	Log      logr.Logger
-	Name     string
 }
 
 func (r *CertificateResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Addons.Konnectivity.Certificate.Checksum != r.resource.GetAnnotations()["checksum"]
+	return tenantControlPlane.Status.Addons.Konnectivity.Certificate.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *CertificateResource) ShouldCleanup(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Spec.Addons.Konnectivity == nil
 }
 
-func (r *CertificateResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *CertificateResource) CleanUp(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
 	if err := r.Client.Delete(ctx, r.resource); err != nil {
 		if !k8serrors.IsNotFound(err) {
+			logger.Error(err, "cannot delete the required resource")
+
 			return false, err
 		}
 
@@ -56,10 +53,10 @@ func (r *CertificateResource) CleanUp(ctx context.Context, tenantControlPlane *k
 	return true, nil
 }
 
-func (r *CertificateResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *CertificateResource) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      r.getPrefixedName(tenantControlPlane),
+			Name:      utilities.AddTenantPrefix(r.GetName(), tenantControlPlane),
 			Namespace: tenantControlPlane.GetNamespace(),
 		},
 	}
@@ -67,43 +64,36 @@ func (r *CertificateResource) Define(ctx context.Context, tenantControlPlane *ka
 	return nil
 }
 
-func (r *CertificateResource) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
-}
-
 func (r *CertificateResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
 	return controllerutil.CreateOrUpdate(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
 }
 
 func (r *CertificateResource) GetName() string {
-	return r.Name
+	return "konnectivity-certificate"
 }
 
 func (r *CertificateResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	if tenantControlPlane.Spec.Addons.Konnectivity != nil {
 		tenantControlPlane.Status.Addons.Konnectivity.Certificate.LastUpdate = metav1.Now()
 		tenantControlPlane.Status.Addons.Konnectivity.Certificate.SecretName = r.resource.GetName()
-		tenantControlPlane.Status.Addons.Konnectivity.Certificate.Checksum = r.resource.GetAnnotations()["checksum"]
-		tenantControlPlane.Status.Addons.Konnectivity.Enabled = true
+		tenantControlPlane.Status.Addons.Konnectivity.Certificate.Checksum = r.resource.GetAnnotations()[constants.Checksum]
 
 		return nil
 	}
 
 	tenantControlPlane.Status.Addons.Konnectivity.Certificate = kamajiv1alpha1.CertificatePrivateKeyPairStatus{}
-	tenantControlPlane.Status.Addons.Konnectivity.Enabled = false
 
 	return nil
 }
 
 func (r *CertificateResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
-		if checksum := tenantControlPlane.Status.Certificates.CA.Checksum; len(checksum) > 0 && checksum == utilities.CalculateConfigMapChecksum(r.resource.StringData) {
-			isValid, err := isCertificateAndKeyPairValid(
-				r.resource.Data[corev1.TLSCertKey],
-				r.resource.Data[corev1.TLSPrivateKeyKey],
-			)
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
+		if checksum := tenantControlPlane.Status.Addons.Konnectivity.Certificate.Checksum; len(checksum) > 0 && checksum == utilities.CalculateMapChecksum(r.resource.Data) {
+			isValid, err := crypto.IsValidCertificateKeyPairBytes(r.resource.Data[corev1.TLSCertKey], r.resource.Data[corev1.TLSPrivateKeyKey])
 			if err != nil {
-				r.Log.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", konnectivityCertAndKeyBaseName, err.Error()))
+				logger.Info(fmt.Sprintf("%s certificate-private_key pair is not valid: %s", konnectivityCertAndKeyBaseName, err.Error()))
 			}
 			if isValid {
 				return nil
@@ -113,6 +103,8 @@ func (r *CertificateResource) mutate(ctx context.Context, tenantControlPlane *ka
 		namespacedName := k8stypes.NamespacedName{Namespace: tenantControlPlane.GetNamespace(), Name: tenantControlPlane.Status.Certificates.CA.SecretName}
 		secretCA := &corev1.Secret{}
 		if err := r.Client.Get(ctx, namespacedName, secretCA); err != nil {
+			logger.Error(err, "cannot retrieve the CA secret")
+
 			return err
 		}
 
@@ -121,8 +113,11 @@ func (r *CertificateResource) mutate(ctx context.Context, tenantControlPlane *ka
 			Certificate: secretCA.Data[kubeadmconstants.CACertName],
 			PrivateKey:  secretCA.Data[kubeadmconstants.CAKeyName],
 		}
-		cert, privKey, err := getCertificateAndKeyPair(ca.Certificate, ca.PrivateKey)
+
+		cert, privKey, err := crypto.GenerateCertificatePrivateKeyPair(crypto.NewCertificateTemplate(CertCommonName), ca.Certificate, ca.PrivateKey)
 		if err != nil {
+			logger.Error(err, "unable to generate certificate and private key")
+
 			return err
 		}
 
@@ -144,41 +139,9 @@ func (r *CertificateResource) mutate(ctx context.Context, tenantControlPlane *ka
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
 		r.resource.SetAnnotations(annotations)
 
 		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
 	}
 }
-
-func getCertificateAndKeyPair(caCert []byte, caPrivKey []byte) (*bytes.Buffer, *bytes.Buffer, error) {
-	template := getCertTemplate()
-
-	return crypto.GetCertificateAndKeyPair(template, caCert, caPrivKey)
-}
-
-func isCertificateAndKeyPairValid(cert []byte, privKey []byte) (bool, error) {
-	return crypto.IsValidCertificateKeyPairBytes(cert, privKey)
-}
-
-func getCertTemplate() *x509.Certificate {
-	serialNumber := big.NewInt(rand.Int63())
-
-	return &x509.Certificate{
-		PublicKeyAlgorithm: x509.RSA,
-		SerialNumber:       serialNumber,
-		Subject: pkix.Name{
-			CommonName:   CertCommonName,
-			Organization: []string{certOrganization},
-		},
-		NotBefore:    time.Now(),
-		NotAfter:     time.Now().AddDate(certExpirationDelayYears, 0, 0),
-		SubjectKeyId: []byte{1, 2, 3, 4, 6},
-		ExtKeyUsage: []x509.ExtKeyUsage{
-			x509.ExtKeyUsageClientAuth,
-			x509.ExtKeyUsageServerAuth,
-			x509.ExtKeyUsageCodeSigning,
-		},
-		KeyUsage: x509.KeyUsageDigitalSignature,
-	}
-}

internal/resources/konnectivity/cluster_role_binding_resource.go

@@ -11,30 +11,35 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
 	"github.com/clastix/kamaji/internal/utilities"
 )
 
 type ClusterRoleBindingResource struct {
 	resource     *rbacv1.ClusterRoleBinding
 	Client       client.Client
-	Name         string
 	tenantClient client.Client
 }
 
-func (r *ClusterRoleBindingResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *ClusterRoleBindingResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Status.Addons.Konnectivity.ClusterRoleBinding.Name != r.resource.GetName() ||
-		tenantControlPlane.Status.Addons.Konnectivity.ClusterRoleBinding.Checksum != r.resource.ObjectMeta.GetAnnotations()["checksum"]
+		tenantControlPlane.Status.Addons.Konnectivity.ClusterRoleBinding.Checksum != r.resource.ObjectMeta.GetAnnotations()[constants.Checksum]
 }
 
 func (r *ClusterRoleBindingResource) ShouldCleanup(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Spec.Addons.Konnectivity == nil
 }
 
-func (r *ClusterRoleBindingResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *ClusterRoleBindingResource) CleanUp(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
 	if err := r.tenantClient.Delete(ctx, r.resource); err != nil {
 		if !k8serrors.IsNotFound(err) {
+			logger.Error(err, "cannot delete the requeste resource")
+
 			return false, err
 		}
 
@@ -44,49 +49,49 @@ func (r *ClusterRoleBindingResource) CleanUp(ctx context.Context, tenantControlP
 	return true, nil
 }
 
-func (r *ClusterRoleBindingResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *ClusterRoleBindingResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (err error) {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
 	r.resource = &rbacv1.ClusterRoleBinding{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: CertCommonName,
 		},
 	}
 
-	client, err := utilities.GetTenantClient(ctx, r.Client, tenantControlPlane)
-	if err != nil {
+	if r.tenantClient, err = utilities.GetTenantClient(ctx, r.Client, tenantControlPlane); err != nil {
+		logger.Error(err, "cannot get Tenant Control Plane client")
+
 		return err
 	}
 
-	r.tenantClient = client
-
 	return nil
 }
 
-func (r *ClusterRoleBindingResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return controllerutil.CreateOrUpdate(ctx, r.tenantClient, r.resource, r.mutate(ctx, tenantControlPlane))
+func (r *ClusterRoleBindingResource) CreateOrUpdate(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	return controllerutil.CreateOrUpdate(ctx, r.tenantClient, r.resource, r.mutate())
 }
 
 func (r *ClusterRoleBindingResource) GetName() string {
-	return r.Name
+	return "konnectivity-clusterrolebinding"
 }
 
-func (r *ClusterRoleBindingResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *ClusterRoleBindingResource) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	if tenantControlPlane.Spec.Addons.Konnectivity != nil {
 		tenantControlPlane.Status.Addons.Konnectivity.Enabled = true
 		tenantControlPlane.Status.Addons.Konnectivity.ClusterRoleBinding = kamajiv1alpha1.ExternalKubernetesObjectStatus{
 			Name:     r.resource.GetName(),
-			Checksum: r.resource.GetAnnotations()["checksum"],
+			Checksum: r.resource.GetAnnotations()[constants.Checksum],
 		}
 
 		return nil
 	}
 
 	tenantControlPlane.Status.Addons.Konnectivity.ClusterRoleBinding = kamajiv1alpha1.ExternalKubernetesObjectStatus{}
-	tenantControlPlane.Status.Addons.Konnectivity.Enabled = false
 
 	return nil
 }
 
-func (r *ClusterRoleBindingResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
+func (r *ClusterRoleBindingResource) mutate() controllerutil.MutateFn {
 	return func() error {
 		r.resource.SetLabels(utilities.MergeMaps(
 			utilities.KamajiLabels(),
@@ -115,8 +120,8 @@ func (r *ClusterRoleBindingResource) mutate(ctx context.Context, tenantControlPl
 			annotations = map[string]string{}
 		}
 
-		yaml, _ := utilities.EncondeToYaml(r.resource)
-		annotations["checksum"] = utilities.MD5Checksum(yaml)
+		yaml, _ := utilities.EncodeToYaml(r.resource)
+		annotations[constants.Checksum] = utilities.MD5Checksum(yaml)
 
 		return nil
 	}

internal/resources/konnectivity/constants.go

@@ -9,8 +9,6 @@ const (
 
 	agentTokenName                  = "konnectivity-agent-token"
 	apiServerAPIVersion             = "apiserver.k8s.io/v1beta1"
-	certExpirationDelayYears        = 10
-	certOrganization                = "system:master"
 	defaultClusterName              = "kubernetes"
 	defaultUDSName                  = "/run/konnectivity/konnectivity-server.socket"
 	egressSelectorConfigurationKind = "EgressSelectorConfiguration"

internal/resources/konnectivity/deployment_resource.go

@@ -18,7 +18,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/types"
 	"github.com/clastix/kamaji/internal/utilities"
 )
 
@@ -33,23 +32,23 @@ const (
 )
 
 type KubernetesDeploymentResource struct {
-	resource        *appsv1.Deployment
-	Client          client.Client
-	ETCDStorageType types.ETCDStorageType
-	ETCDEndpoints   []string
-	Name            string
+	resource *appsv1.Deployment
+	Client   client.Client
 }
 
-func (r *KubernetesDeploymentResource) isStatusEqual(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return r.resource.Status.String() == tenantControlPlane.Status.Kubernetes.Deployment.DeploymentStatus.String()
-}
-
-func (r *KubernetesDeploymentResource) ShouldStatusBeUpdated(context.Context, *kamajiv1alpha1.TenantControlPlane) bool {
-	return false
+func (r *KubernetesDeploymentResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	switch {
+	case tenantControlPlane.Spec.Addons.Konnectivity == nil && tenantControlPlane.Status.Addons.Konnectivity.Enabled:
+		fallthrough
+	case tenantControlPlane.Spec.Addons.Konnectivity != nil && !tenantControlPlane.Status.Addons.Konnectivity.Enabled:
+		return true
+	default:
+		return false
+	}
 }
 
 func (r *KubernetesDeploymentResource) ShouldCleanup(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Spec.Addons.Konnectivity == nil
+	return tenantControlPlane.Spec.Addons.Konnectivity == nil && tenantControlPlane.Status.Addons.Konnectivity.Enabled
 }
 
 func (r *KubernetesDeploymentResource) CleanUp(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (bool, error) {
@@ -79,7 +78,7 @@ func (r *KubernetesDeploymentResource) CleanUp(ctx context.Context, _ *kamajiv1a
 			}
 
 			for _, volumeName := range []string{konnectivityUDSVolume, egressSelectorConfigurationVolume} {
-				if volumeFound, volumeIndex := utilities.HasNamedVolume(r.resource.Spec.Template.Spec.Volumes, egressSelectorConfigurationVolume); volumeFound {
+				if volumeFound, volumeIndex := utilities.HasNamedVolume(r.resource.Spec.Template.Spec.Volumes, volumeName); volumeFound {
 					logger.Info("removing Konnectivity volume " + volumeName)
 
 					var volumes []corev1.Volume
@@ -90,6 +89,19 @@ func (r *KubernetesDeploymentResource) CleanUp(ctx context.Context, _ *kamajiv1a
 					r.resource.Spec.Template.Spec.Volumes = volumes
 				}
 			}
+
+			for _, volumeMountName := range []string{konnectivityUDSVolume, egressSelectorConfigurationVolume, konnectivityServerKubeconfigVolume} {
+				if ok, i := utilities.HasNamedVolumeMount(r.resource.Spec.Template.Spec.Containers[index].VolumeMounts, volumeMountName); ok {
+					logger.Info("removing Konnectivity volume mount " + volumeMountName)
+
+					var volumesMounts []corev1.VolumeMount
+
+					volumesMounts = append(volumesMounts, r.resource.Spec.Template.Spec.Containers[index].VolumeMounts[:i]...)
+					volumesMounts = append(volumesMounts, r.resource.Spec.Template.Spec.Containers[index].VolumeMounts[i+1:]...)
+
+					r.resource.Spec.Template.Spec.Containers[index].VolumeMounts = volumesMounts
+				}
+			}
 		}
 
 		return nil
@@ -98,7 +110,7 @@ func (r *KubernetesDeploymentResource) CleanUp(ctx context.Context, _ *kamajiv1a
 	return res == controllerutil.OperationResultUpdated, err
 }
 
-func (r *KubernetesDeploymentResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubernetesDeploymentResource) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      tenantControlPlane.GetName(),
@@ -109,7 +121,7 @@ func (r *KubernetesDeploymentResource) Define(ctx context.Context, tenantControl
 	return nil
 }
 
-func (r *KubernetesDeploymentResource) syncContainer(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubernetesDeploymentResource) syncContainer(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) {
 	found, index := utilities.HasNamedContainer(r.resource.Spec.Template.Spec.Containers, konnectivityServerName)
 	if !found {
 		r.resource.Spec.Template.Spec.Containers = append(r.resource.Spec.Template.Spec.Containers, corev1.Container{})
@@ -180,7 +192,7 @@ func (r *KubernetesDeploymentResource) syncContainer(tenantControlPlane *kamajiv
 			ReadOnly:  true,
 		},
 		{
-			Name:      "konnectivity-uds",
+			Name:      konnectivityUDSVolume,
 			MountPath: konnectivityServerPath,
 			ReadOnly:  false,
 		},
@@ -194,8 +206,6 @@ func (r *KubernetesDeploymentResource) syncContainer(tenantControlPlane *kamajiv
 	if resources := tenantControlPlane.Spec.Addons.Konnectivity.Resources; resources != nil {
 		r.resource.Spec.Template.Spec.Containers[index].Resources = *resources
 	}
-
-	return nil
 }
 
 func (r *KubernetesDeploymentResource) mutate(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
@@ -210,15 +220,13 @@ func (r *KubernetesDeploymentResource) mutate(_ context.Context, tenantControlPl
 			return fmt.Errorf("the Deployment resource is not ready to be mangled for Konnectivity server enrichment")
 		}
 
-		if err = r.syncContainer(tenantControlPlane); err != nil {
-			return errors.Wrap(err, "cannot sync konnectivity-server container")
-		}
+		r.syncContainer(tenantControlPlane)
+
 		if err = r.patchKubeAPIServerContainer(); err != nil {
 			return errors.Wrap(err, "cannot sync patch kube-apiserver container")
 		}
-		if err = r.syncVolumes(tenantControlPlane); err != nil {
-			return errors.Wrap(err, "cannot patch required konnectivity volumes")
-		}
+
+		r.syncVolumes(tenantControlPlane)
 
 		return nil
 	}
@@ -229,10 +237,12 @@ func (r *KubernetesDeploymentResource) CreateOrUpdate(ctx context.Context, tenan
 }
 
 func (r *KubernetesDeploymentResource) GetName() string {
-	return r.Name
+	return "konnectivity-deployment"
 }
 
-func (r *KubernetesDeploymentResource) UpdateTenantControlPlaneStatus(context.Context, *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubernetesDeploymentResource) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	tenantControlPlane.Status.Addons.Konnectivity.Enabled = tenantControlPlane.Spec.Addons.Konnectivity != nil
+
 	return nil
 }
 
@@ -247,9 +257,7 @@ func (r *KubernetesDeploymentResource) patchKubeAPIServerContainer() error {
 	// Adding the egress selector config file flag
 	args := utilities.ArgsFromSliceToMap(r.resource.Spec.Template.Spec.Containers[index].Args)
 
-	if utilities.ArgsAddFlagValue(args, "--egress-selector-config-file", konnectivityEgressSelectorConfigurationPath) {
-		// LOG
-	}
+	utilities.ArgsAddFlagValue(args, "--egress-selector-config-file", konnectivityEgressSelectorConfigurationPath)
 
 	r.resource.Spec.Template.Spec.Containers[index].Args = utilities.ArgsFromMapToSlice(args)
 
@@ -276,7 +284,7 @@ func (r *KubernetesDeploymentResource) patchKubeAPIServerContainer() error {
 	return nil
 }
 
-func (r *KubernetesDeploymentResource) syncVolumes(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubernetesDeploymentResource) syncVolumes(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) {
 	found, index := false, 0
 	// Defining volumes for the UDS socket
 	found, index = utilities.HasNamedVolume(r.resource.Spec.Template.Spec.Volumes, konnectivityUDSVolume)
@@ -304,7 +312,7 @@ func (r *KubernetesDeploymentResource) syncVolumes(tenantControlPlane *kamajiv1a
 			LocalObjectReference: corev1.LocalObjectReference{
 				Name: tenantControlPlane.Status.Addons.Konnectivity.ConfigMap.Name,
 			},
-			DefaultMode: pointer.Int32Ptr(420),
+			DefaultMode: pointer.Int32(420),
 		},
 	}
 	// Defining volume for the Konnectivity kubeconfig
@@ -318,9 +326,7 @@ func (r *KubernetesDeploymentResource) syncVolumes(tenantControlPlane *kamajiv1a
 	r.resource.Spec.Template.Spec.Volumes[index].VolumeSource = corev1.VolumeSource{
 		Secret: &corev1.SecretVolumeSource{
 			SecretName:  tenantControlPlane.Status.Addons.Konnectivity.Kubeconfig.SecretName,
-			DefaultMode: pointer.Int32Ptr(420),
+			DefaultMode: pointer.Int32(420),
 		},
 	}
-
-	return nil
 }

internal/resources/konnectivity/egress_selector_configuration_resource.go

@@ -1,5 +1,6 @@
 // Copyright 2022 Clastix Labs
 // SPDX-License-Identifier: Apache-2.0
+
 package konnectivity
 
 import (
@@ -12,21 +13,22 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
 	"github.com/clastix/kamaji/internal/utilities"
 )
 
 type EgressSelectorConfigurationResource struct {
 	resource *corev1.ConfigMap
 	Client   client.Client
-	Name     string
 }
 
 func (r *EgressSelectorConfigurationResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      r.getPrefixedName(tenantControlPlane),
+			Name:      utilities.AddTenantPrefix(r.GetName(), tenantControlPlane),
 			Namespace: tenantControlPlane.GetNamespace(),
 		},
 	}
@@ -39,8 +41,12 @@ func (r *EgressSelectorConfigurationResource) ShouldCleanup(tenantControlPlane *
 }
 
 func (r *EgressSelectorConfigurationResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
 	if err := r.Client.Delete(ctx, r.resource); err != nil {
 		if !k8serrors.IsNotFound(err) {
+			logger.Error(err, "cannot delete the requested resource")
+
 			return false, err
 		}
 
@@ -55,29 +61,27 @@ func (r *EgressSelectorConfigurationResource) CreateOrUpdate(ctx context.Context
 }
 
 func (r *EgressSelectorConfigurationResource) GetName() string {
-	return r.Name
+	return "konnectivity-egress-selector-configuration"
 }
 
 func (r *EgressSelectorConfigurationResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Addons.Konnectivity.ConfigMap.Checksum != r.resource.GetAnnotations()["checksum"]
+	return tenantControlPlane.Status.Addons.Konnectivity.ConfigMap.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *EgressSelectorConfigurationResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	if tenantControlPlane.Spec.Addons.Konnectivity != nil {
-		tenantControlPlane.Status.Addons.Konnectivity.Enabled = true
 		tenantControlPlane.Status.Addons.Konnectivity.ConfigMap.Name = r.resource.GetName()
-		tenantControlPlane.Status.Addons.Konnectivity.ConfigMap.Checksum = r.resource.GetAnnotations()["checksum"]
+		tenantControlPlane.Status.Addons.Konnectivity.ConfigMap.Checksum = r.resource.GetAnnotations()[constants.Checksum]
 
 		return nil
 	}
 
-	tenantControlPlane.Status.Addons.Konnectivity.Enabled = false
 	tenantControlPlane.Status.Addons.Konnectivity.ConfigMap = kamajiv1alpha1.KonnectivityConfigMap{}
 
 	return nil
 }
 
-func (r *EgressSelectorConfigurationResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) func() error {
+func (r *EgressSelectorConfigurationResource) mutate(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) func() error {
 	return func() error {
 		r.resource.SetLabels(utilities.MergeMaps(r.resource.GetLabels(), utilities.KamajiLabels()))
 
@@ -101,7 +105,7 @@ func (r *EgressSelectorConfigurationResource) mutate(ctx context.Context, tenant
 			},
 		}
 
-		yamlConfiguration, err := utilities.EncondeToYaml(configuration)
+		yamlConfiguration, err := utilities.EncodeToYaml(configuration)
 		if err != nil {
 			return err
 		}
@@ -114,12 +118,8 @@ func (r *EgressSelectorConfigurationResource) mutate(ctx context.Context, tenant
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.MD5Checksum(yamlConfiguration)
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
 
 		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
 	}
 }
-
-func (r *EgressSelectorConfigurationResource) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
-}

internal/resources/konnectivity/kubeconfig_resource.go

@@ -16,28 +16,32 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
 	"github.com/clastix/kamaji/internal/utilities"
 )
 
 type KubeconfigResource struct {
 	resource *corev1.Secret
 	Client   client.Client
-	Name     string
 }
 
-func (r *KubeconfigResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Addons.Konnectivity.Kubeconfig.Checksum != r.resource.GetAnnotations()["checksum"]
+func (r *KubeconfigResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	return tenantControlPlane.Status.Addons.Konnectivity.Kubeconfig.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *KubeconfigResource) ShouldCleanup(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Spec.Addons.Konnectivity == nil
 }
 
-func (r *KubeconfigResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *KubeconfigResource) CleanUp(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	logger := log.FromContext(ctx, "resource", r.GetName())
 	if err := r.Client.Delete(ctx, r.resource); err != nil {
 		if !k8serrors.IsNotFound(err) {
+			logger.Error(err, "cannot delete the requested resourece")
+
 			return false, err
 		}
 
@@ -47,10 +51,10 @@ func (r *KubeconfigResource) CleanUp(ctx context.Context, tenantControlPlane *ka
 	return true, nil
 }
 
-func (r *KubeconfigResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubeconfigResource) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      r.getPrefixedName(tenantControlPlane),
+			Name:      utilities.AddTenantPrefix(r.GetName(), tenantControlPlane),
 			Namespace: tenantControlPlane.GetNamespace(),
 		},
 	}
@@ -58,29 +62,23 @@ func (r *KubeconfigResource) Define(ctx context.Context, tenantControlPlane *kam
 	return nil
 }
 
-func (r *KubeconfigResource) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
-}
-
 func (r *KubeconfigResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
 	return controllerutil.CreateOrUpdate(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
 }
 
 func (r *KubeconfigResource) GetName() string {
-	return r.Name
+	return "konnectivity-kubeconfig"
 }
 
-func (r *KubeconfigResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubeconfigResource) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	if tenantControlPlane.Spec.Addons.Konnectivity != nil {
 		tenantControlPlane.Status.Addons.Konnectivity.Kubeconfig.LastUpdate = metav1.Now()
 		tenantControlPlane.Status.Addons.Konnectivity.Kubeconfig.SecretName = r.resource.GetName()
-		tenantControlPlane.Status.Addons.Konnectivity.Kubeconfig.Checksum = r.resource.GetAnnotations()["checksum"]
-		tenantControlPlane.Status.Addons.Konnectivity.Enabled = true
+		tenantControlPlane.Status.Addons.Konnectivity.Kubeconfig.Checksum = r.resource.GetAnnotations()[constants.Checksum]
 
 		return nil
 	}
 
-	tenantControlPlane.Status.Addons.Konnectivity.Enabled = false
 	tenantControlPlane.Status.Addons.Konnectivity.Kubeconfig = kamajiv1alpha1.KubeconfigStatus{}
 
 	return nil
@@ -88,19 +86,25 @@ func (r *KubeconfigResource) UpdateTenantControlPlaneStatus(ctx context.Context,
 
 func (r *KubeconfigResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
-		if checksum := tenantControlPlane.Status.Addons.Konnectivity.Certificate.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()["checksum"] {
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
+		if checksum := tenantControlPlane.Status.Addons.Konnectivity.Certificate.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()[constants.Checksum] {
 			return nil
 		}
 
 		caNamespacedName := k8stypes.NamespacedName{Namespace: tenantControlPlane.GetNamespace(), Name: tenantControlPlane.Status.Certificates.CA.SecretName}
 		secretCA := &corev1.Secret{}
 		if err := r.Client.Get(ctx, caNamespacedName, secretCA); err != nil {
+			logger.Error(err, "cannot retrieve the CA secret")
+
 			return err
 		}
 
 		certificateNamespacedName := k8stypes.NamespacedName{Namespace: tenantControlPlane.GetNamespace(), Name: tenantControlPlane.Status.Addons.Konnectivity.Certificate.SecretName}
 		secretCertificate := &corev1.Secret{}
 		if err := r.Client.Get(ctx, certificateNamespacedName, secretCertificate); err != nil {
+			logger.Error(err, "cannot retrieve the Konnectivity Certificate secret")
+
 			return err
 		}
 
@@ -124,7 +128,7 @@ func (r *KubeconfigResource) mutate(ctx context.Context, tenantControlPlane *kam
 				{
 					Name: clusterName,
 					Cluster: clientcmdapiv1.Cluster{
-						Server:                   r.getServer(*tenantControlPlane),
+						Server:                   fmt.Sprintf("https://%s:%d", "localhost", tenantControlPlane.Spec.NetworkProfile.Port),
 						CertificateAuthorityData: secretCA.Data[kubeadmconstants.CACertName],
 					},
 				},
@@ -141,8 +145,10 @@ func (r *KubeconfigResource) mutate(ctx context.Context, tenantControlPlane *kam
 			CurrentContext: contextName,
 		}
 
-		kubeconfigBytes, err := utilities.EncondeToYaml(kubeconfig)
+		kubeconfigBytes, err := utilities.EncodeToYaml(kubeconfig)
 		if err != nil {
+			logger.Error(err, "cannot encode to YAML the kubeconfig")
+
 			return err
 		}
 
@@ -154,7 +160,7 @@ func (r *KubeconfigResource) mutate(ctx context.Context, tenantControlPlane *kam
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
 		r.resource.SetLabels(utilities.MergeMaps(
 			utilities.KamajiLabels(),
 			map[string]string{
@@ -166,7 +172,3 @@ func (r *KubeconfigResource) mutate(ctx context.Context, tenantControlPlane *kam
 		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
 	}
 }
-
-func (r *KubeconfigResource) getServer(tenantControlPlane kamajiv1alpha1.TenantControlPlane) string {
-	return fmt.Sprintf("https://%s:%d", "localhost", tenantControlPlane.Spec.NetworkProfile.Port)
-}

internal/resources/konnectivity/service_account_resource.go

@@ -11,29 +11,34 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
 	"github.com/clastix/kamaji/internal/utilities"
 )
 
 type ServiceAccountResource struct {
 	resource     *corev1.ServiceAccount
 	Client       client.Client
-	Name         string
 	tenantClient client.Client
 }
 
-func (r *ServiceAccountResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Addons.Konnectivity.ServiceAccount.Checksum != r.resource.GetAnnotations()["checksum"]
+func (r *ServiceAccountResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	return tenantControlPlane.Status.Addons.Konnectivity.ServiceAccount.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *ServiceAccountResource) ShouldCleanup(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Spec.Addons.Konnectivity == nil
 }
 
-func (r *ServiceAccountResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *ServiceAccountResource) CleanUp(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
 	if err := r.tenantClient.Delete(ctx, r.resource); err != nil {
 		if !k8serrors.IsNotFound(err) {
+			logger.Error(err, "cannot delete the requested resource")
+
 			return false, err
 		}
 
@@ -43,51 +48,50 @@ func (r *ServiceAccountResource) CleanUp(ctx context.Context, tenantControlPlane
 	return true, nil
 }
 
-func (r *ServiceAccountResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *ServiceAccountResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (err error) {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
 	r.resource = &corev1.ServiceAccount{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      "konnectivity-agent",
+			Name:      AgentName,
 			Namespace: agentNamespace,
 		},
 	}
 
-	client, err := utilities.GetTenantClient(ctx, r.Client, tenantControlPlane)
-	if err != nil {
+	if r.tenantClient, err = utilities.GetTenantClient(ctx, r.Client, tenantControlPlane); err != nil {
+		logger.Error(err, "cannot generate tenant client")
+
 		return err
 	}
 
-	r.tenantClient = client
-
 	return nil
 }
 
-func (r *ServiceAccountResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return controllerutil.CreateOrUpdate(ctx, r.tenantClient, r.resource, r.mutate(ctx, tenantControlPlane))
+func (r *ServiceAccountResource) CreateOrUpdate(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	return controllerutil.CreateOrUpdate(ctx, r.tenantClient, r.resource, r.mutate())
 }
 
 func (r *ServiceAccountResource) GetName() string {
-	return r.Name
+	return "konnectivity-sa"
 }
 
-func (r *ServiceAccountResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *ServiceAccountResource) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	if tenantControlPlane.Spec.Addons.Konnectivity != nil {
 		tenantControlPlane.Status.Addons.Konnectivity.ServiceAccount = kamajiv1alpha1.ExternalKubernetesObjectStatus{
 			Name:      r.resource.GetName(),
 			Namespace: r.resource.GetNamespace(),
-			Checksum:  r.resource.GetAnnotations()["checksum"],
+			Checksum:  r.resource.GetAnnotations()[constants.Checksum],
 		}
-		tenantControlPlane.Status.Addons.Konnectivity.Enabled = true
 
 		return nil
 	}
 
-	tenantControlPlane.Status.Addons.Konnectivity.Enabled = false
 	tenantControlPlane.Status.Addons.Konnectivity.ServiceAccount = kamajiv1alpha1.ExternalKubernetesObjectStatus{}
 
 	return nil
 }
 
-func (r *ServiceAccountResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
+func (r *ServiceAccountResource) mutate() controllerutil.MutateFn {
 	return func() error {
 		r.resource.SetLabels(utilities.MergeMaps(
 			utilities.KamajiLabels(),
@@ -101,13 +105,13 @@ func (r *ServiceAccountResource) mutate(ctx context.Context, tenantControlPlane
 		c.SetAnnotations(nil)
 		c.SetResourceVersion("")
 
-		yaml, _ := utilities.EncondeToYaml(c)
+		yaml, _ := utilities.EncodeToYaml(c)
 
 		annotations := r.resource.GetAnnotations()
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.MD5Checksum(yaml)
+		annotations[constants.Checksum] = utilities.MD5Checksum(yaml)
 		r.resource.SetAnnotations(annotations)
 
 		return nil

internal/resources/konnectivity/service_resource.go

@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
 	"github.com/clastix/kamaji/internal/utilities"
@@ -20,7 +21,6 @@ import (
 type ServiceResource struct {
 	resource *corev1.Service
 	Client   client.Client
-	Name     string
 }
 
 func (r *ServiceResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
@@ -71,7 +71,9 @@ func (r *ServiceResource) ShouldCleanup(tenantControlPlane *kamajiv1alpha1.Tenan
 	return tenantControlPlane.Spec.Addons.Konnectivity == nil
 }
 
-func (r *ServiceResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *ServiceResource) CleanUp(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
 	res, err := utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, func() error {
 		for index, port := range r.resource.Spec.Ports {
 			if port.Name == "konnectivity-server" {
@@ -88,8 +90,13 @@ func (r *ServiceResource) CleanUp(ctx context.Context, tenantControlPlane *kamaj
 
 		return nil
 	})
+	if err != nil {
+		logger.Error(err, "unable to cleanup the resource")
 
-	return res == controllerutil.OperationResultUpdated, err
+		return false, err
+	}
+
+	return res == controllerutil.OperationResultUpdated, nil
 }
 
 func (r *ServiceResource) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
@@ -98,13 +105,11 @@ func (r *ServiceResource) UpdateTenantControlPlaneStatus(_ context.Context, tena
 		tenantControlPlane.Status.Addons.Konnectivity.Service.Namespace = r.resource.GetNamespace()
 		tenantControlPlane.Status.Addons.Konnectivity.Service.Port = r.resource.Spec.Ports[1].Port
 		tenantControlPlane.Status.Addons.Konnectivity.Service.ServiceStatus = r.resource.Status
-		tenantControlPlane.Status.Addons.Konnectivity.Enabled = true
 
 		return nil
 	}
 
 	tenantControlPlane.Status.Addons.Konnectivity.Service = kamajiv1alpha1.KubernetesServiceStatus{}
-	tenantControlPlane.Status.Addons.Konnectivity.Enabled = false
 
 	return nil
 }
@@ -125,7 +130,7 @@ func (r *ServiceResource) CreateOrUpdate(ctx context.Context, tenantControlPlane
 }
 
 func (r *ServiceResource) mutate(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) func() error {
-	return func() (err error) {
+	return func() error {
 		switch len(r.resource.Spec.Ports) {
 		case 0:
 			return fmt.Errorf("current state of the Service is not ready to be mangled for Konnectivity")
@@ -143,5 +148,5 @@ func (r *ServiceResource) mutate(_ context.Context, tenantControlPlane *kamajiv1
 }
 
 func (r *ServiceResource) GetName() string {
-	return r.Name
+	return "konnectivity-service"
 }

internal/resources/kubeadm_addons.go

@@ -7,11 +7,11 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/go-logr/logr"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	clientset "k8s.io/client-go/kubernetes"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
 	"github.com/clastix/kamaji/internal/kubeadm"
@@ -31,7 +31,6 @@ func (d KubeadmAddon) String() string {
 
 type KubeadmAddonResource struct {
 	Client                client.Client
-	Log                   logr.Logger
 	Name                  string
 	KubeadmAddon          KubeadmAddon
 	kubeadmConfigChecksum string
@@ -60,27 +59,35 @@ func (r *KubeadmAddonResource) ShouldStatusBeUpdated(_ context.Context, tenantCo
 }
 
 func (r *KubeadmAddonResource) ShouldCleanup(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	spec, err := r.getSpec(tenantControlPlane)
+	ok, err := r.getSpec(tenantControlPlane)
 	if err != nil {
 		return false
 	}
 
-	return spec == nil
+	return ok
 }
 
 func (r *KubeadmAddonResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
-	client, err := utilities.GetTenantRESTClient(ctx, r.Client, tenantControlPlane)
+	logger := log.FromContext(ctx, "resource", r.GetName(), "addon", r.KubeadmAddon.String())
+
+	client, err := utilities.GetTenantClientSet(ctx, r.Client, tenantControlPlane)
 	if err != nil {
+		logger.Error(err, "cannot generate Tenant client")
+
 		return false, err
 	}
 
 	fun, err := r.getRemoveAddonFunction()
 	if err != nil {
+		logger.Error(err, "cannot get the remove addon function")
+
 		return false, err
 	}
 
 	if err := fun(ctx, client); err != nil {
 		if !k8serrors.IsNotFound(err) {
+			logger.Error(err, "error while performing clean-up")
+
 			return false, err
 		}
 
@@ -129,9 +136,13 @@ func (r *KubeadmAddonResource) GetName() string {
 	return r.Name
 }
 
-func (r *KubeadmAddonResource) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubeadmAddonResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	logger := log.FromContext(ctx, "resource", r.GetName(), "addon", r.KubeadmAddon.String())
+
 	status, err := r.GetStatus(tenantControlPlane)
 	if err != nil {
+		logger.Error(err, "cannot update Tenant Control Plane status")
+
 		return err
 	}
 
@@ -151,17 +162,19 @@ func (r *KubeadmAddonResource) GetStatus(tenantControlPlane *kamajiv1alpha1.Tena
 	}
 }
 
-func (r *KubeadmAddonResource) getSpec(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (*kamajiv1alpha1.AddonSpec, error) {
+func (r *KubeadmAddonResource) getSpec(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	switch r.KubeadmAddon {
 	case AddonCoreDNS:
-		return tenantControlPlane.Spec.Addons.CoreDNS, nil
+		return tenantControlPlane.Spec.Addons.CoreDNS == nil, nil
 	case AddonKubeProxy:
-		return tenantControlPlane.Spec.Addons.KubeProxy, nil
+		return tenantControlPlane.Spec.Addons.KubeProxy == nil, nil
 	default:
-		return nil, fmt.Errorf("%s has no spec", r.KubeadmAddon)
+		return false, fmt.Errorf("%s has no spec", r.KubeadmAddon)
 	}
 }
 
 func (r *KubeadmAddonResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return KubeadmPhaseCreate(ctx, r, tenantControlPlane)
+	logger := log.FromContext(ctx, "resource", r.GetName(), "addon", r.KubeadmAddon.String())
+
+	return KubeadmPhaseCreate(ctx, r, logger, tenantControlPlane)
 }

internal/resources/kubeadm_config.go

@@ -12,8 +12,10 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
 	"github.com/clastix/kamaji/internal/kubeadm"
 	"github.com/clastix/kamaji/internal/utilities"
 )
@@ -26,7 +28,7 @@ type KubeadmConfigResource struct {
 }
 
 func (r *KubeadmConfigResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.KubeadmConfig.Checksum != r.resource.GetAnnotations()["checksum"]
+	return tenantControlPlane.Status.KubeadmConfig.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *KubeadmConfigResource) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
@@ -53,7 +55,7 @@ func (r *KubeadmConfigResource) getPrefixedName(tenantControlPlane *kamajiv1alph
 }
 
 func (r *KubeadmConfigResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(tenantControlPlane))
+	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
 }
 
 func (r *KubeadmConfigResource) GetName() string {
@@ -62,7 +64,7 @@ func (r *KubeadmConfigResource) GetName() string {
 
 func (r *KubeadmConfigResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.KubeadmConfig.LastUpdate = metav1.Now()
-	tenantControlPlane.Status.KubeadmConfig.Checksum = r.resource.GetAnnotations()["checksum"]
+	tenantControlPlane.Status.KubeadmConfig.Checksum = r.resource.GetAnnotations()[constants.Checksum]
 	tenantControlPlane.Status.KubeadmConfig.ConfigmapName = r.resource.GetName()
 
 	return nil
@@ -76,10 +78,14 @@ func (r *KubeadmConfigResource) getControlPlaneEndpoint(ingress *kamajiv1alpha1.
 	return fmt.Sprintf("%s:%d", address, port)
 }
 
-func (r *KubeadmConfigResource) mutate(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
+func (r *KubeadmConfigResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
 		address, port, err := tenantControlPlane.AssignedControlPlaneAddress()
 		if err != nil {
+			logger.Error(err, "cannot retrieve Tenant Control Plane address")
+
 			return err
 		}
 
@@ -99,19 +105,21 @@ func (r *KubeadmConfigResource) mutate(tenantControlPlane *kamajiv1alpha1.Tenant
 			CertificatesDir:               r.TmpDirectory,
 		}
 
-		config := kubeadm.CreateKubeadmInitConfiguration(params)
-		data, err := kubeadm.GetKubeadmInitConfigurationMap(config)
+		config, err := kubeadm.CreateKubeadmInitConfiguration(params)
 		if err != nil {
 			return err
 		}
+		if r.resource.Data, err = kubeadm.GetKubeadmInitConfigurationMap(*config); err != nil {
+			logger.Error(err, "cannot retrieve kubeadm init configuration")
 
-		r.resource.Data = data
+			return err
+		}
 
 		annotations := r.resource.GetAnnotations()
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(data)
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
 		r.resource.SetAnnotations(annotations)
 
 		if err := ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme()); err != nil {

internal/resources/kubeadm_phases.go

@@ -7,14 +7,15 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/go-logr/logr"
 	clientset "k8s.io/client-go/kubernetes"
 	bootstraptokenv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/bootstraptoken/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
 	"github.com/clastix/kamaji/internal/kubeadm"
+	"github.com/clastix/kamaji/internal/resources/utils"
 )
 
 type kubeadmPhase int
@@ -31,7 +32,6 @@ func (d kubeadmPhase) String() string {
 
 type KubeadmPhase struct {
 	Client   client.Client
-	Log      logr.Logger
 	Name     string
 	Phase    kubeadmPhase
 	checksum string
@@ -104,7 +104,7 @@ func enrichBootstrapToken(bootstrapToken *bootstraptokenv1.BootstrapToken) {
 	}
 
 	if bootstrapToken.Token.ID == "" {
-		bootstrapToken.Token.ID = fmt.Sprintf("%s.%s", randomString(6), randomString(16))
+		bootstrapToken.Token.ID = fmt.Sprintf("%s.%s", utils.RandomString(6), utils.RandomString(16))
 	}
 }
 
@@ -120,9 +120,13 @@ func (r *KubeadmPhase) GetName() string {
 	return r.Name
 }
 
-func (r *KubeadmPhase) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubeadmPhase) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	logger := log.FromContext(ctx, "resource", r.GetName(), "phase", r.Phase.String())
+
 	status, err := r.GetStatus(tenantControlPlane)
 	if err != nil {
+		logger.Error(err, "unable to update the status")
+
 		return err
 	}
 
@@ -145,5 +149,7 @@ func (r *KubeadmPhase) GetStatus(tenantControlPlane *kamajiv1alpha1.TenantContro
 }
 
 func (r *KubeadmPhase) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return KubeadmPhaseCreate(ctx, r, tenantControlPlane)
+	logger := log.FromContext(ctx, "resource", r.GetName(), "phase", r.Phase.String())
+
+	return KubeadmPhaseCreate(ctx, r, logger, tenantControlPlane)
 }

internal/resources/kubeadm_upgrade.go

@@ -14,6 +14,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/kubeadm/printers"
 	kamajiupgrade "github.com/clastix/kamaji/internal/upgrade"
 	"github.com/clastix/kamaji/internal/utilities"
 )
@@ -64,14 +65,14 @@ func (k *KubernetesUpgrade) CreateOrUpdate(ctx context.Context, tenantControlPla
 		return controllerutil.OperationResultNone, nil
 	}
 	// Checking if the upgrade is allowed, or not
-	restClient, err := utilities.GetTenantRESTClient(ctx, k.Client, tenantControlPlane)
+	clientSet, err := utilities.GetTenantClientSet(ctx, k.Client, tenantControlPlane)
 	if err != nil {
 		return controllerutil.OperationResultNone, errors.Wrap(err, "cannot create REST client required for Kubernetes upgrade plan")
 	}
 
-	versionGetter := kamajiupgrade.NewKamajiKubeVersionGetter(restClient)
+	versionGetter := kamajiupgrade.NewKamajiKubeVersionGetter(clientSet)
 
-	if _, err = upgrade.GetAvailableUpgrades(versionGetter, false, false, true, restClient, ""); err != nil {
+	if _, err = upgrade.GetAvailableUpgrades(versionGetter, false, false, true, clientSet, "", &printers.Discard{}); err != nil {
 		return controllerutil.OperationResultNone, errors.Wrap(err, "cannot retrieve available Upgrades for Kubernetes upgrade plan")
 	}
 
@@ -123,7 +124,7 @@ func (k *KubernetesUpgrade) isUpgradable() error {
 		return nil
 	}
 	// Following minor release upgrades are allowed
-	if newK8sVersion.Minor() > oldK8sVersion.WithMinor(oldK8sVersion.Minor()+1).Minor() {
+	if newK8sVersion.Minor() == oldK8sVersion.Minor()+1 {
 		return nil
 	}
 

internal/resources/kubeadm_utils.go

@@ -6,6 +6,7 @@ package resources
 import (
 	"context"
 
+	"github.com/go-logr/logr"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
@@ -13,19 +14,25 @@ import (
 	"github.com/clastix/kamaji/internal/utilities"
 )
 
-func KubeadmPhaseCreate(ctx context.Context, r KubeadmPhaseResource, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+func KubeadmPhaseCreate(ctx context.Context, r KubeadmPhaseResource, logger logr.Logger, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
 	config, err := getStoredKubeadmConfiguration(ctx, r, tenantControlPlane)
 	if err != nil {
+		logger.Error(err, "cannot retrieve kubeadm configuration")
+
 		return controllerutil.OperationResultNone, err
 	}
 
-	kubeconfig, err := utilities.GetKubeconfig(ctx, r.GetClient(), tenantControlPlane)
+	kubeconfig, err := utilities.GetTenantKubeconfig(ctx, r.GetClient(), tenantControlPlane)
 	if err != nil {
+		logger.Error(err, "cannot retrieve kubeconfig configuration")
+
 		return controllerutil.OperationResultNone, err
 	}
 
 	address, _, err := tenantControlPlane.AssignedControlPlaneAddress()
 	if err != nil {
+		logger.Error(err, "cannot retrieve Tenant Control Plane address")
+
 		return controllerutil.OperationResultNone, err
 	}
 
@@ -41,10 +48,41 @@ func KubeadmPhaseCreate(ctx context.Context, r KubeadmPhaseResource, tenantContr
 		TenantControlPlaneCGroupDriver: tenantControlPlane.Spec.Kubernetes.Kubelet.CGroupFS.String(),
 	}
 
+	// If CoreDNS addon is enabled and with an override, adding these to the kubeadm init configuration
+	if coreDNS := tenantControlPlane.Spec.Addons.CoreDNS; coreDNS != nil {
+		config.Parameters.CoreDNSOptions = &kubeadm.AddonOptions{}
+
+		if len(coreDNS.ImageRepository) > 0 {
+			config.Parameters.CoreDNSOptions.Repository = coreDNS.ImageRepository
+		}
+
+		if len(coreDNS.ImageRepository) > 0 {
+			config.Parameters.CoreDNSOptions.Tag = coreDNS.ImageTag
+		}
+	}
+	// If the kube-proxy addon is enabled and with overrides, adding it to the kubeadm parameters
+	if kubeProxy := tenantControlPlane.Spec.Addons.KubeProxy; kubeProxy != nil {
+		config.Parameters.KubeProxyOptions = &kubeadm.AddonOptions{}
+
+		if len(kubeProxy.ImageRepository) > 0 {
+			config.Parameters.KubeProxyOptions.Repository = kubeProxy.ImageRepository
+		} else {
+			config.Parameters.KubeProxyOptions.Repository = "k8s.gcr.io"
+		}
+
+		if len(kubeProxy.ImageTag) > 0 {
+			config.Parameters.KubeProxyOptions.Tag = kubeProxy.ImageTag
+		} else {
+			config.Parameters.KubeProxyOptions.Tag = tenantControlPlane.Spec.Kubernetes.Version
+		}
+	}
+
 	checksum := config.Checksum()
 
 	status, err := r.GetStatus(tenantControlPlane)
 	if err != nil {
+		logger.Error(err, "cannot retrieve status")
+
 		return controllerutil.OperationResultNone, err
 	}
 
@@ -54,16 +92,22 @@ func KubeadmPhaseCreate(ctx context.Context, r KubeadmPhaseResource, tenantContr
 		return controllerutil.OperationResultNone, nil
 	}
 
-	client, err := utilities.GetTenantRESTClient(ctx, r.GetClient(), tenantControlPlane)
+	client, err := utilities.GetTenantClientSet(ctx, r.GetClient(), tenantControlPlane)
 	if err != nil {
+		logger.Error(err, "cannot generate tenant client")
+
 		return controllerutil.OperationResultNone, err
 	}
 
 	fun, err := r.GetKubeadmFunction()
 	if err != nil {
+		logger.Error(err, "cannot retrieve kubeadm function")
+
 		return controllerutil.OperationResultNone, err
 	}
 	if err = fun(client, config); err != nil {
+		logger.Error(err, "kubeadm function failed")
+
 		return controllerutil.OperationResultNone, err
 	}
 

internal/resources/kubeconfig.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	k8stypes "k8s.io/apimachinery/pkg/types"
@@ -15,8 +14,10 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
 	"github.com/clastix/kamaji/internal/kubeadm"
 	"github.com/clastix/kamaji/internal/utilities"
 )
@@ -31,21 +32,20 @@ const (
 type KubeconfigResource struct {
 	resource           *corev1.Secret
 	Client             client.Client
-	Log                logr.Logger
 	Name               string
 	KubeConfigFileName string
 	TmpDirectory       string
 }
 
-func (r *KubeconfigResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *KubeconfigResource) ShouldStatusBeUpdated(context.Context, *kamajiv1alpha1.TenantControlPlane) bool {
 	return false
 }
 
-func (r *KubeconfigResource) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *KubeconfigResource) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
 	return false
 }
 
-func (r *KubeconfigResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *KubeconfigResource) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	return false, nil
 }
 
@@ -77,14 +77,18 @@ func (r *KubeconfigResource) GetName() string {
 }
 
 func (r *KubeconfigResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	logger := log.FromContext(ctx, "resource", r.GetName())
+
 	status, err := r.getKubeconfigStatus(tenantControlPlane)
 	if err != nil {
+		logger.Error(err, "cannot retrieve status")
+
 		return err
 	}
 
 	status.LastUpdate = metav1.Now()
 	status.SecretName = r.resource.GetName()
-	status.Checksum = r.resource.Annotations["checksum"]
+	status.Checksum = r.resource.Annotations[constants.Checksum]
 
 	return nil
 }
@@ -107,27 +111,35 @@ func (r *KubeconfigResource) CreateOrUpdate(ctx context.Context, tenantControlPl
 }
 
 func (r *KubeconfigResource) checksum(apiServerCertificatesSecret *corev1.Secret, kubeadmChecksum string) string {
-	return utilities.CalculateConfigMapChecksum(map[string]string{
-		"ca-cert-checksum": string(apiServerCertificatesSecret.Data[kubeadmconstants.CACertName]),
-		"ca-key-checksum":  string(apiServerCertificatesSecret.Data[kubeadmconstants.CAKeyName]),
-		"kubeadmconfig":    kubeadmChecksum,
+	return utilities.CalculateMapChecksum(map[string][]byte{
+		"ca-cert-checksum": apiServerCertificatesSecret.Data[kubeadmconstants.CACertName],
+		"ca-key-checksum":  apiServerCertificatesSecret.Data[kubeadmconstants.CAKeyName],
+		"kubeadmconfig":    []byte(kubeadmChecksum),
 	})
 }
 
 func (r *KubeconfigResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
 		config, err := getStoredKubeadmConfiguration(ctx, r, tenantControlPlane)
 		if err != nil {
+			logger.Error(err, "cannot retrieve kubeadm configuration")
+
 			return err
 		}
 
 		if err = r.customizeConfig(config); err != nil {
+			logger.Error(err, "cannot customize the configuration")
+
 			return err
 		}
 
 		apiServerCertificatesSecretNamespacedName := k8stypes.NamespacedName{Namespace: tenantControlPlane.GetNamespace(), Name: tenantControlPlane.Status.Certificates.CA.SecretName}
 		apiServerCertificatesSecret := &corev1.Secret{}
 		if err := r.Client.Get(ctx, apiServerCertificatesSecretNamespacedName, apiServerCertificatesSecret); err != nil {
+			logger.Error(err, "cannot retrieve the CA")
+
 			return err
 		}
 
@@ -135,17 +147,18 @@ func (r *KubeconfigResource) mutate(ctx context.Context, tenantControlPlane *kam
 
 		status, err := r.getKubeconfigStatus(tenantControlPlane)
 		if err != nil {
+			logger.Error(err, "cannot retrieve status")
+
 			return err
 		}
 
-		if status.Checksum == checksum {
-			if kubeadm.IsKubeconfigValid(r.resource.Data[r.KubeConfigFileName]) {
-				return nil
-			}
+		if status.Checksum == checksum && kubeadm.IsKubeconfigValid(r.resource.Data[r.KubeConfigFileName]) {
+			return nil
 		}
 
 		kubeconfig, err := kubeadm.CreateKubeconfig(
 			r.KubeConfigFileName,
+
 			kubeadm.CertificatePrivateKeyPair{
 				Certificate: apiServerCertificatesSecret.Data[kubeadmconstants.CACertName],
 				PrivateKey:  apiServerCertificatesSecret.Data[kubeadmconstants.CAKeyName],
@@ -153,6 +166,8 @@ func (r *KubeconfigResource) mutate(ctx context.Context, tenantControlPlane *kam
 			config,
 		)
 		if err != nil {
+			logger.Error(err, "cannot create a valid kubeconfig")
+
 			return err
 		}
 		r.resource.Data = map[string][]byte{
@@ -168,7 +183,7 @@ func (r *KubeconfigResource) mutate(ctx context.Context, tenantControlPlane *kam
 		))
 
 		r.resource.SetAnnotations(map[string]string{
-			"checksum": checksum,
+			constants.Checksum: checksum,
 		})
 
 		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())

internal/resources/resource.go

@@ -27,6 +27,7 @@ type Resource interface {
 }
 
 type DeleteableResource interface {
+	GetName() string
 	Define(context.Context, *kamajiv1alpha1.TenantControlPlane) error
 	Delete(context.Context, *kamajiv1alpha1.TenantControlPlane) error
 }

internal/resources/sa_certificate.go

@@ -7,15 +7,17 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/constants"
+	"github.com/clastix/kamaji/internal/crypto"
 	"github.com/clastix/kamaji/internal/kubeadm"
 	"github.com/clastix/kamaji/internal/utilities"
 )
@@ -23,13 +25,13 @@ import (
 type SACertificate struct {
 	resource     *corev1.Secret
 	Client       client.Client
-	Log          logr.Logger
 	Name         string
 	TmpDirectory string
 }
 
 func (r *SACertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Certificates.SA.SecretName != r.resource.GetName()
+	return tenantControlPlane.Status.Certificates.SA.SecretName != r.resource.GetName() ||
+		tenantControlPlane.Status.Certificates.SA.Checksum != r.resource.GetAnnotations()[constants.Checksum]
 }
 
 func (r *SACertificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
@@ -71,23 +73,22 @@ func (r *SACertificate) GetName() string {
 	return "sa-certificate"
 }
 
-func (r *SACertificate) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *SACertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.Certificates.SA.LastUpdate = metav1.Now()
 	tenantControlPlane.Status.Certificates.SA.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Certificates.SA.Checksum = r.resource.GetAnnotations()["checksum"]
+	tenantControlPlane.Status.Certificates.SA.Checksum = r.resource.GetAnnotations()[constants.Checksum]
 
 	return nil
 }
 
 func (r *SACertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
-		if checksum := tenantControlPlane.Status.Certificates.SA.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()["checksum"] {
-			isValid, err := kubeadm.IsPublicKeyPrivateKeyPairValid(
-				r.resource.Data[kubeadmconstants.ServiceAccountPublicKeyName],
-				r.resource.Data[kubeadmconstants.ServiceAccountPrivateKeyName],
-			)
+		logger := log.FromContext(ctx, "resource", r.GetName())
+
+		if checksum := tenantControlPlane.Status.Certificates.SA.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()[constants.Checksum] {
+			isValid, err := crypto.CheckPublicAndPrivateKeyValidity(r.resource.Data[kubeadmconstants.ServiceAccountPublicKeyName], r.resource.Data[kubeadmconstants.ServiceAccountPrivateKeyName])
 			if err != nil {
-				r.Log.Info(fmt.Sprintf("%s public_key-private_key pair is not valid: %s", kubeadmconstants.ServiceAccountKeyBaseName, err.Error()))
+				logger.Info(fmt.Sprintf("%s public_key-private_key pair is not valid: %s", kubeadmconstants.ServiceAccountKeyBaseName, err.Error()))
 			}
 			if isValid {
 				return nil
@@ -96,11 +97,15 @@ func (r *SACertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1
 
 		config, err := getStoredKubeadmConfiguration(ctx, r, tenantControlPlane)
 		if err != nil {
+			logger.Error(err, "cannot retrieve kubadm configuration")
+
 			return err
 		}
 
 		sa, err := kubeadm.GeneratePublicKeyPrivateKeyPair(kubeadmconstants.ServiceAccountKeyBaseName, config)
 		if err != nil {
+			logger.Error(err, "cannot generate certificate and private key")
+
 			return err
 		}
 
@@ -121,7 +126,7 @@ func (r *SACertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1
 		if annotations == nil {
 			annotations = map[string]string{}
 		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
+		annotations[constants.Checksum] = utilities.CalculateMapChecksum(r.resource.Data)
 		r.resource.SetAnnotations(annotations)
 
 		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())

internal/resources/sql_certificate.go

@@ -1,123 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package resources
-
-import (
-	"context"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/types"
-	"github.com/clastix/kamaji/internal/utilities"
-)
-
-type SQLCertificate struct {
-	resource    *corev1.Secret
-	Client      client.Client
-	Name        string
-	StorageType types.ETCDStorageType
-	DataStore   kamajiv1alpha1.DataStore
-}
-
-func (r *SQLCertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Storage.Kine.Certificate.Checksum != r.resource.GetAnnotations()["checksum"]
-}
-
-func (r *SQLCertificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
-	return false
-}
-
-func (r *SQLCertificate) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
-	return false, nil
-}
-
-func (r *SQLCertificate) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	r.resource = &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      r.getPrefixedName(tenantControlPlane),
-			Namespace: tenantControlPlane.GetNamespace(),
-		},
-		Data: map[string][]byte{},
-	}
-
-	return nil
-}
-
-func (r *SQLCertificate) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
-}
-
-func (r *SQLCertificate) GetClient() client.Client {
-	return r.Client
-}
-
-func (r *SQLCertificate) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
-}
-
-func (r *SQLCertificate) GetName() string {
-	return r.Name
-}
-
-func (r *SQLCertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	if tenantControlPlane.Status.Storage.Kine == nil {
-		tenantControlPlane.Status.Storage.Kine = &kamajiv1alpha1.KineStatus{}
-	}
-
-	tenantControlPlane.Status.Storage.Kine.Certificate.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Storage.Kine.Certificate.Checksum = r.resource.GetAnnotations()["checksum"]
-	tenantControlPlane.Status.Storage.Kine.Certificate.LastUpdate = metav1.Now()
-
-	return nil
-}
-
-func (r *SQLCertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
-	return func() error {
-		ca, err := r.DataStore.Spec.TLSConfig.CertificateAuthority.Certificate.GetContent(ctx, r.Client)
-		if err != nil {
-			return nil
-		}
-
-		crt, err := r.DataStore.Spec.TLSConfig.ClientCertificate.Certificate.GetContent(ctx, r.Client)
-		if err != nil {
-			return nil
-		}
-
-		key, err := r.DataStore.Spec.TLSConfig.ClientCertificate.PrivateKey.GetContent(ctx, r.Client)
-		if err != nil {
-			return nil
-		}
-
-		r.resource.Data = map[string][]byte{
-			"ca.crt":     ca,
-			"server.crt": crt,
-			"server.key": key,
-		}
-
-		annotations := r.resource.GetAnnotations()
-		if annotations == nil {
-			annotations = map[string]string{}
-		}
-
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
-
-		r.resource.SetAnnotations(annotations)
-
-		r.resource.SetLabels(utilities.MergeMaps(
-			utilities.KamajiLabels(),
-			r.resource.GetLabels(),
-			map[string]string{
-				"kamaji.clastix.io/name":      tenantControlPlane.GetName(),
-				"kamaji.clastix.io/component": r.GetName(),
-			},
-		))
-
-		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
-	}
-}

internal/resources/sql_setup.go

@@ -1,245 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package resources
-
-import (
-	"context"
-	"fmt"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/sql"
-)
-
-type sqlSetupResource struct {
-	schema   string
-	user     string
-	password string
-}
-
-type SQLSetup struct {
-	resource     sqlSetupResource
-	Client       client.Client
-	DBConnection sql.DBConnection
-	Driver       string
-}
-
-func (r *SQLSetup) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	if tenantControlPlane.Status.Storage.Kine == nil {
-		return true
-	}
-
-	return tenantControlPlane.Status.Storage.Kine.Driver != r.Driver &&
-		tenantControlPlane.Status.Storage.Kine.Setup.Checksum != tenantControlPlane.Status.Storage.Kine.Config.Checksum
-}
-
-func (r *SQLSetup) ShouldCleanup(_ *kamajiv1alpha1.TenantControlPlane) bool {
-	return false
-}
-
-func (r *SQLSetup) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
-	return false, nil
-}
-
-func (r *SQLSetup) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	secret := &corev1.Secret{}
-	namespacedName := types.NamespacedName{
-		Namespace: tenantControlPlane.GetNamespace(),
-		Name:      tenantControlPlane.Status.Storage.Kine.Config.SecretName,
-	}
-	if err := r.Client.Get(ctx, namespacedName, secret); err != nil {
-		return err
-	}
-
-	r.resource = sqlSetupResource{
-		schema:   string(secret.Data["DB_SCHEMA"]),
-		user:     string(secret.Data["DB_USER"]),
-		password: string(secret.Data["DB_PASSWORD"]),
-	}
-
-	return nil
-}
-
-func (r *SQLSetup) GetClient() client.Client {
-	return r.Client
-}
-
-func (r *SQLSetup) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	if tenantControlPlane.Status.Storage.Kine.Setup.Checksum != "" &&
-		tenantControlPlane.Status.Storage.Kine.Setup.Checksum != tenantControlPlane.Status.Storage.Kine.Config.Checksum {
-		if err := r.Delete(ctx, tenantControlPlane); err != nil {
-			return controllerutil.OperationResultNone, err
-		}
-
-		return controllerutil.OperationResultUpdated, nil
-	}
-
-	reconcilationResult := controllerutil.OperationResultNone
-	var operationResult controllerutil.OperationResult
-	var err error
-
-	operationResult, err = r.createDB(ctx, tenantControlPlane)
-	if err != nil {
-		return reconcilationResult, err
-	}
-	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
-
-	operationResult, err = r.createUser(ctx, tenantControlPlane)
-	if err != nil {
-		return reconcilationResult, err
-	}
-	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
-
-	operationResult, err = r.createGrantPrivileges(ctx, tenantControlPlane)
-	if err != nil {
-		return reconcilationResult, err
-	}
-	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
-
-	return reconcilationResult, nil
-}
-
-func (r *SQLSetup) GetName() string {
-	return "sql-setup"
-}
-
-func (r *SQLSetup) Delete(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	if err := r.Define(ctx, tenantControlPlane); err != nil {
-		return err
-	}
-
-	if err := r.revokeGrantPrivileges(ctx, tenantControlPlane); err != nil {
-		return err
-	}
-
-	if err := r.deleteDB(ctx, tenantControlPlane); err != nil {
-		return err
-	}
-
-	if err := r.deleteUser(ctx, tenantControlPlane); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (r *SQLSetup) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	if tenantControlPlane.Status.Storage.Kine == nil {
-		return fmt.Errorf("sql configuration is not ready")
-	}
-
-	tenantControlPlane.Status.Storage.Kine.Setup.Schema = r.resource.schema
-	tenantControlPlane.Status.Storage.Kine.Setup.User = r.resource.user
-	tenantControlPlane.Status.Storage.Kine.Setup.LastUpdate = metav1.Now()
-	tenantControlPlane.Status.Storage.Kine.Setup.Checksum = tenantControlPlane.Status.Storage.Kine.Config.Checksum
-
-	return nil
-}
-
-func (r *SQLSetup) createDB(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	exists, err := r.DBConnection.DBExists(ctx, r.resource.schema)
-	if err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	if exists {
-		return controllerutil.OperationResultNone, nil
-	}
-
-	if err := r.DBConnection.CreateDB(ctx, r.resource.schema); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	return controllerutil.OperationResultCreated, nil
-}
-
-func (r *SQLSetup) deleteDB(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) error {
-	exists, err := r.DBConnection.DBExists(ctx, r.resource.schema)
-	if err != nil {
-		return err
-	}
-
-	if !exists {
-		return nil
-	}
-
-	if err := r.DBConnection.DeleteDB(ctx, r.resource.schema); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (r *SQLSetup) createUser(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	exists, err := r.DBConnection.UserExists(ctx, r.resource.user)
-	if err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	if exists {
-		return controllerutil.OperationResultNone, nil
-	}
-
-	if err := r.DBConnection.CreateUser(ctx, r.resource.user, r.resource.password); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	return controllerutil.OperationResultCreated, nil
-}
-
-func (r *SQLSetup) deleteUser(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) error {
-	exists, err := r.DBConnection.UserExists(ctx, r.resource.user)
-	if err != nil {
-		return err
-	}
-
-	if !exists {
-		return nil
-	}
-
-	if err := r.DBConnection.DeleteUser(ctx, r.resource.user); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (r *SQLSetup) createGrantPrivileges(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	exists, err := r.DBConnection.GrantPrivilegesExists(ctx, r.resource.user, r.resource.schema)
-	if err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	if exists {
-		return controllerutil.OperationResultNone, nil
-	}
-
-	if err := r.DBConnection.GrantPrivileges(ctx, r.resource.user, r.resource.schema); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	return controllerutil.OperationResultCreated, nil
-}
-
-func (r *SQLSetup) revokeGrantPrivileges(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) error {
-	exists, err := r.DBConnection.GrantPrivilegesExists(ctx, r.resource.user, r.resource.schema)
-	if err != nil {
-		return err
-	}
-
-	if !exists {
-		return nil
-	}
-
-	if err := r.DBConnection.RevokePrivileges(ctx, r.resource.user, r.resource.schema); err != nil {
-		return err
-	}
-
-	return nil
-}

internal/resources/sql_storage_config.go

@@ -1,123 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package resources
-
-import (
-	"context"
-	"strconv"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/utilities"
-)
-
-type SQLStorageConfig struct {
-	resource *corev1.Secret
-	Client   client.Client
-	Name     string
-	Host     string
-	Port     int
-	Driver   string
-}
-
-func (r *SQLStorageConfig) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	if tenantControlPlane.Status.Storage.Kine == nil {
-		return true
-	}
-
-	return tenantControlPlane.Status.Storage.Kine.Config.Checksum != r.resource.GetAnnotations()["checksum"] ||
-		tenantControlPlane.Status.Storage.Kine.Driver != r.Driver
-}
-
-func (r *SQLStorageConfig) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
-	return false
-}
-
-func (r *SQLStorageConfig) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
-	return false, nil
-}
-
-func (r *SQLStorageConfig) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	r.resource = &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      r.getPrefixedName(tenantControlPlane),
-			Namespace: tenantControlPlane.GetNamespace(),
-		},
-	}
-
-	return nil
-}
-
-func (r *SQLStorageConfig) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
-}
-
-func (r *SQLStorageConfig) GetClient() client.Client {
-	return r.Client
-}
-
-func (r *SQLStorageConfig) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
-}
-
-func (r *SQLStorageConfig) GetName() string {
-	return r.Name
-}
-
-func (r *SQLStorageConfig) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	if tenantControlPlane.Status.Storage.Kine == nil {
-		tenantControlPlane.Status.Storage.Kine = &kamajiv1alpha1.KineStatus{}
-	}
-
-	tenantControlPlane.Status.Storage.Kine.Driver = r.Driver
-	tenantControlPlane.Status.Storage.Kine.Config.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Storage.Kine.Config.Checksum = r.resource.GetAnnotations()["checksum"]
-
-	return nil
-}
-
-func (r *SQLStorageConfig) mutate(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
-	return func() error {
-		var password []byte
-
-		savedHash, ok := r.resource.GetAnnotations()["checksum"]
-		switch {
-		case ok && savedHash == utilities.CalculateConfigMapChecksum(r.resource.StringData):
-			password = r.resource.Data["DB_PASSWORD"]
-		default:
-			password = []byte(utilities.GenerateUUIDString())
-		}
-
-		r.resource.Data = map[string][]byte{
-			"DB_HOST":     []byte(r.Host),
-			"DB_PORT":     []byte(strconv.Itoa(r.Port)),
-			"DB_SCHEMA":   []byte(tenantControlPlane.GetName()),
-			"DB_USER":     []byte(tenantControlPlane.GetName()),
-			"DB_PASSWORD": password,
-		}
-
-		annotations := r.resource.GetAnnotations()
-		if annotations == nil {
-			annotations = map[string]string{}
-		}
-
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
-		r.resource.SetAnnotations(annotations)
-
-		r.resource.SetLabels(utilities.MergeMaps(
-			utilities.KamajiLabels(),
-			map[string]string{
-				"kamaji.clastix.io/name":      tenantControlPlane.GetName(),
-				"kamaji.clastix.io/component": r.GetName(),
-			},
-		))
-
-		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
-	}
-}

internal/resources/utils/utils.go

@@ -1,7 +1,7 @@
 // Copyright 2022 Clastix Labs
 // SPDX-License-Identifier: Apache-2.0
 
-package resources
+package utils
 
 import (
 	"math/rand"
@@ -12,7 +12,7 @@ import (
 
 var letters = []byte("abcdefghijklmnopqrstuvwxyz")
 
-func updateOperationResult(current controllerutil.OperationResult, op controllerutil.OperationResult) controllerutil.OperationResult {
+func UpdateOperationResult(current controllerutil.OperationResult, op controllerutil.OperationResult) controllerutil.OperationResult {
 	if current == controllerutil.OperationResultCreated || op == controllerutil.OperationResultCreated {
 		return controllerutil.OperationResultCreated
 	}
@@ -32,7 +32,7 @@ func updateOperationResult(current controllerutil.OperationResult, op controller
 	return controllerutil.OperationResultNone
 }
 
-func randomString(n int) string {
+func RandomString(n int) string {
 	rand.Seed(time.Now().UnixNano())
 	b := make([]byte, n)
 	for i := range b {

internal/sql/constants.go

@@ -1,10 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package sql
-
-const (
-	defaultProtocol = "tcp"
-	firstPort       = 1024
-	sqlErrorNoRows  = "sql: no rows in result set"
-)

internal/sql/sql.go

@@ -1,110 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package sql
-
-import (
-	"context"
-	"crypto/tls"
-	"fmt"
-	"net/url"
-)
-
-type Driver int
-
-const (
-	MySQL Driver = iota
-	PostgreSQL
-)
-
-func (d Driver) ToString() string {
-	switch d {
-	case MySQL:
-		return "mysql"
-	case PostgreSQL:
-		return "postgresql"
-	default:
-		return ""
-	}
-}
-
-type ConnectionConfig struct {
-	SQLDriver  Driver
-	User       string
-	Password   string
-	Host       string
-	Port       int
-	DBName     string
-	TLSConfig  *tls.Config
-	Parameters map[string][]string
-}
-
-func (config ConnectionConfig) GetDataSourceName() string {
-	userPassword := config.getDataSourceNameUserPassword()
-	db := config.getDataSourceNameDB()
-	dataSourceName := fmt.Sprintf("%s%s/%s?%s", userPassword, db, config.DBName, config.formatParameters())
-
-	return dataSourceName
-}
-
-func (config ConnectionConfig) getDataSourceNameUserPassword() string {
-	if config.User == "" {
-		return ""
-	}
-
-	if config.Password == "" {
-		return fmt.Sprintf("%s@", config.User)
-	}
-
-	return fmt.Sprintf("%s:%s@", config.User, config.Password)
-}
-
-func (config ConnectionConfig) getDataSourceNameDB() string {
-	if config.Host == "" || config.Port < firstPort {
-		return ""
-	}
-
-	return fmt.Sprintf("%s(%s:%d)", defaultProtocol, config.Host, config.Port)
-}
-
-func (config ConnectionConfig) formatParameters() string {
-	if len(config.Parameters) == 0 {
-		return ""
-	}
-
-	values := url.Values(config.Parameters)
-
-	return values.Encode()
-}
-
-type DBConnection interface {
-	CreateUser(ctx context.Context, user, password string) error
-	CreateDB(ctx context.Context, dbName string) error
-	GrantPrivileges(ctx context.Context, user, dbName string) error
-	UserExists(ctx context.Context, user string) (bool, error)
-	DBExists(ctx context.Context, dbName string) (bool, error)
-	GrantPrivilegesExists(ctx context.Context, user, dbName string) (bool, error)
-	DeleteUser(ctx context.Context, user string) error
-	DeleteDB(ctx context.Context, dbName string) error
-	RevokePrivileges(ctx context.Context, user, dbName string) error
-	GetHost() string
-	GetPort() int
-	Close() error
-	Check() error
-	Driver() string
-}
-
-func GetDBConnection(config ConnectionConfig) (DBConnection, error) {
-	switch config.SQLDriver {
-	case MySQL:
-		return getMySQLDB(config)
-	case PostgreSQL:
-		return getPostgreSQLDB(config)
-	default:
-		return nil, fmt.Errorf("%s is not a valid driver", config.SQLDriver.ToString())
-	}
-}
-
-func checkEmptyQueryResult(err error) bool {
-	return err.Error() == sqlErrorNoRows
-}

internal/types/etcd_storage.go

@@ -1,45 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package types
-
-import (
-	"fmt"
-
-	"github.com/spf13/viper"
-)
-
-type ETCDStorageType int
-
-const (
-	ETCD ETCDStorageType = iota
-	KineMySQL
-	KinePostgreSQL
-)
-
-var etcdStorageTypeString = map[string]ETCDStorageType{"etcd": ETCD, "kine-mysql": KineMySQL, "kine-postgresql": KinePostgreSQL}
-
-func (s ETCDStorageType) String() string {
-	return [...]string{"etcd", "kine-mysql", "kine-postgresql"}[s]
-}
-
-// ParseETCDStorageType returns the ETCDStorageType given a string representation of the type.
-func ParseETCDStorageType(s string) ETCDStorageType {
-	if storageType, ok := etcdStorageTypeString[s]; ok {
-		return storageType
-	}
-
-	panic(fmt.Errorf("unsupported storage type %s", s))
-}
-
-// ParseETCDEndpoint returns the default ETCD endpoints used to interact with the Tenant Control Plane backing storage.
-func ParseETCDEndpoint(conf *viper.Viper) string {
-	switch ParseETCDStorageType(conf.GetString("etcd-storage-type")) {
-	case ETCD:
-		return conf.GetString("etcd-endpoints")
-	case KineMySQL, KinePostgreSQL:
-		return "127.0.0.1:2379"
-	default:
-		panic("unsupported storage type")
-	}
-}

internal/upgrade/kube_version_getter.go

@@ -18,7 +18,7 @@ type kamajiKubeVersionGetter struct {
 	upgrade.VersionGetter
 }
 
-func NewKamajiKubeVersionGetter(restClient *kubernetes.Clientset) upgrade.VersionGetter {
+func NewKamajiKubeVersionGetter(restClient kubernetes.Interface) upgrade.VersionGetter {
 	kubeVersionGetter := upgrade.NewOfflineVersionGetter(upgrade.NewKubeVersionGetter(restClient), KubeadmVersion)
 
 	return &kamajiKubeVersionGetter{VersionGetter: kubeVersionGetter}