chore(gh): trigger helm release on tag

.github/workflows/ci.yaml

@@ -18,7 +18,7 @@ jobs:
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v2.3.0
         with:
-          version: v1.49.0
+          version: v1.45.2
           only-new-issues: false
           args: --timeout 5m --config .golangci.yml
   diff:

.golangci.yml

@@ -27,10 +27,6 @@ linters:
     - exhaustivestruct
     - wsl
     - exhaustive
-    - nosprintfhostport
-    - nonamedreturns
-    - interfacebloat
-    - exhaustruct
     - lll
     - gosec
     - gomoddirectives

Makefile

@@ -98,7 +98,6 @@ kustomize: ## Download kustomize locally if necessary.
 manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
 	$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
 	cp config/crd/bases/kamaji.clastix.io_tenantcontrolplanes.yaml charts/kamaji/crds/tenantcontrolplane.yaml
-	cp config/crd/bases/kamaji.clastix.io_datastores.yaml charts/kamaji/crds/datastore.yaml
 
 generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
 	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."

PROJECT

@@ -16,12 +16,4 @@ resources:
   kind: TenantControlPlane
   path: github.com/clastix/kamaji/api/v1alpha1
   version: v1alpha1
-- api:
-    crdVersion: v1
-    namespaced: false
-  domain: clastix.io
-  group: kamaji
-  kind: DataStore
-  path: github.com/clastix/kamaji/api/v1alpha1
-  version: v1alpha1
 version: "3"

api/v1alpha1/datastore_funcs.go

@@ -1,39 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	"context"
-	"fmt"
-
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/types"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-)
-
-// GetContent is the resolver for the container of the Secret.
-// The bare content has priority over the external reference.
-func (in *ContentRef) GetContent(ctx context.Context, client client.Client) ([]byte, error) {
-	if content := in.Content; len(content) > 0 {
-		return content, nil
-	}
-
-	secretRef := in.SecretRef
-
-	if secretRef == nil {
-		return nil, fmt.Errorf("no bare content and no external Secret reference")
-	}
-
-	secret, namespacedName := &corev1.Secret{}, types.NamespacedName{Name: secretRef.Name, Namespace: secretRef.Namespace}
-	if err := client.Get(ctx, namespacedName, secret); err != nil {
-		return nil, err
-	}
-
-	v, ok := secret.Data[secretRef.KeyPath]
-	if !ok {
-		return nil, fmt.Errorf("secret %s does not have key %s", namespacedName.String(), secretRef.KeyPath)
-	}
-
-	return v, nil
-}

api/v1alpha1/datastore_types.go

@@ -1,104 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package v1alpha1
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-type Driver string //+kubebuilder:validation:Enum=etcd;MySQL;PostgreSQL
-
-var (
-	EtcdDriver           Driver = "etcd"
-	KineMySQLDriver      Driver = "MySQL"
-	KinePostgreSQLDriver Driver = "PostgreSQL"
-)
-
-// DataStoreSpec defines the desired state of DataStore.
-type DataStoreSpec struct {
-	// The driver to use to connect to the shared datastore.
-	Driver Driver `json:"driver"`
-	// List of the endpoints to connect to the shared datastore.
-	// No need for protocol, just bare IP/FQDN and port.
-	Endpoints []string `json:"endpoints"` //+kubebuilder:validation:MinLength=1
-	// In case of authentication enabled for the given data store, specifies the username and password pair.
-	// This value is optional.
-	BasicAuth *BasicAuth `json:"basicAuth,omitempty"`
-	// Defines the TLS/SSL configuration required to connect to the data store in a secure way.
-	TLSConfig TLSConfig `json:"tlsConfig"`
-}
-
-// TLSConfig contains the information used to connect to the data store using a secured connection.
-type TLSConfig struct {
-	// Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference.
-	// The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.
-	CertificateAuthority CertKeyPair `json:"certificateAuthority"`
-	// Specifies the SSL/TLS key and private key pair used to connect to the data store.
-	ClientCertificate ClientCertificate `json:"clientCertificate"`
-}
-
-type ClientCertificate struct {
-	Certificate ContentRef `json:"certificate"`
-	PrivateKey  ContentRef `json:"privateKey"`
-}
-
-type CertKeyPair struct {
-	Certificate ContentRef  `json:"certificate"`
-	PrivateKey  *ContentRef `json:"privateKey,omitempty"`
-}
-
-// BasicAuth contains the required information to perform the connection using user credentials to the data store.
-type BasicAuth struct {
-	Username ContentRef `json:"username"`
-	Password ContentRef `json:"password"`
-}
-
-type ContentRef struct {
-	// Bare content of the file, base64 encoded.
-	// It has precedence over the SecretReference value.
-	Content   []byte           `json:"content,omitempty"`
-	SecretRef *SecretReference `json:"secretReference,omitempty"`
-}
-
-type SecretReference struct {
-	corev1.SecretReference `json:",inline"`
-	// Name of the key for the given Secret reference where the content is stored.
-	// This value is mandatory.
-	KeyPath string `json:"keyPath"`
-}
-
-// DataStoreStatus defines the observed state of DataStore.
-type DataStoreStatus struct {
-	// List of the Tenant Control Planes, namespaced named, using this data store.
-	UsedBy []string `json:"usedBy,omitempty"`
-}
-
-//+kubebuilder:object:root=true
-//+kubebuilder:subresource:status
-//+kubebuilder:resource:scope=Cluster
-//+kubebuilder:printcolumn:name="Driver",type="string",JSONPath=".spec.driver",description="Kamaji data store driver"
-//+kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="Age"
-
-// DataStore is the Schema for the datastores API.
-type DataStore struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   DataStoreSpec   `json:"spec,omitempty"`
-	Status DataStoreStatus `json:"status,omitempty"`
-}
-
-//+kubebuilder:object:root=true
-
-// DataStoreList contains a list of DataStore.
-type DataStoreList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []DataStore `json:"items"`
-}
-
-func init() {
-	SchemeBuilder.Register(&DataStore{}, &DataStoreList{})
-}

api/v1alpha1/groupversion_info.go

@@ -2,9 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Package v1alpha1 contains API Schema definitions for the kamaji v1alpha1 API group
-// +kubebuilder:object:generate=true
-// +groupName=kamaji.clastix.io
-//nolint
+//+kubebuilder:object:generate=true
+//+groupName=kamaji.clastix.io
 package v1alpha1
 
 import (

api/v1alpha1/tenantcontrolplane_status.go

@@ -8,6 +8,8 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/clastix/kamaji/internal/etcd"
 )
 
 // APIServerCertificatesStatus defines the observed state of ETCD Certificate for API server.
@@ -44,7 +46,7 @@ type PublicKeyPrivateKeyPairStatus struct {
 	Checksum   string      `json:"checksum,omitempty"`
 }
 
-// CertificatesStatus defines the observed state of ETCD TLSConfig.
+// CertificatesStatus defines the observed state of ETCD Certificates.
 type CertificatesStatus struct {
 	CA                     CertificatePrivateKeyPairStatus `json:"ca,omitempty"`
 	APIServer              CertificatePrivateKeyPairStatus `json:"apiServer,omitempty"`
@@ -55,30 +57,41 @@ type CertificatesStatus struct {
 	ETCD                   *ETCDCertificatesStatus         `json:"etcd,omitempty"`
 }
 
-type DataStoreCertificateStatus struct {
+// ETCDStatus defines the observed state of ETCDStatus.
+type ETCDStatus struct {
+	Role etcd.Role `json:"role,omitempty"`
+	User etcd.User `json:"user,omitempty"`
+}
+
+type SQLCertificateStatus struct {
 	SecretName string      `json:"secretName,omitempty"`
 	Checksum   string      `json:"checksum,omitempty"`
 	LastUpdate metav1.Time `json:"lastUpdate,omitempty"`
 }
 
-type DataStoreConfigStatus struct {
+type SQLConfigStatus struct {
 	SecretName string `json:"secretName,omitempty"`
 	Checksum   string `json:"checksum,omitempty"`
 }
 
-type DataStoreSetupStatus struct {
+type SQLSetupStatus struct {
 	Schema     string      `json:"schema,omitempty"`
 	User       string      `json:"user,omitempty"`
 	LastUpdate metav1.Time `json:"lastUpdate,omitempty"`
 	Checksum   string      `json:"checksum,omitempty"`
 }
 
+type KineStatus struct {
+	Driver      string               `json:"driver,omitempty"`
+	Config      SQLConfigStatus      `json:"config,omitempty"`
+	Setup       SQLSetupStatus       `json:"setup,omitempty"`
+	Certificate SQLCertificateStatus `json:"certificate,omitempty"`
+}
+
 // StorageStatus defines the observed state of StorageStatus.
 type StorageStatus struct {
-	Driver      string                     `json:"driver,omitempty"`
-	Config      DataStoreConfigStatus      `json:"config,omitempty"`
-	Setup       DataStoreSetupStatus       `json:"setup,omitempty"`
-	Certificate DataStoreCertificateStatus `json:"certificate,omitempty"`
+	ETCD *ETCDStatus `json:"etcd,omitempty"`
+	Kine *KineStatus `json:"kine,omitempty"`
 }
 
 // KubeconfigStatus contains information about the generated kubeconfig.
@@ -150,8 +163,9 @@ type AddonStatus struct {
 
 // AddonsStatus defines the observed state of the different Addons.
 type AddonsStatus struct {
-	CoreDNS      AddonStatus        `json:"coreDNS,omitempty"`
-	KubeProxy    AddonStatus        `json:"kubeProxy,omitempty"`
+	CoreDNS   AddonStatus `json:"coreDNS,omitempty"`
+	KubeProxy AddonStatus `json:"kubeProxy,omitempty"`
+
 	Konnectivity KonnectivityStatus `json:"konnectivity,omitempty"`
 }
 

api/v1alpha1/zz_generated.deepcopy.go

@@ -156,44 +156,6 @@ func (in AdmissionControllers) DeepCopy() AdmissionControllers {
 	return *out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BasicAuth) DeepCopyInto(out *BasicAuth) {
-	*out = *in
-	in.Username.DeepCopyInto(&out.Username)
-	in.Password.DeepCopyInto(&out.Password)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BasicAuth.
-func (in *BasicAuth) DeepCopy() *BasicAuth {
-	if in == nil {
-		return nil
-	}
-	out := new(BasicAuth)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CertKeyPair) DeepCopyInto(out *CertKeyPair) {
-	*out = *in
-	in.Certificate.DeepCopyInto(&out.Certificate)
-	if in.PrivateKey != nil {
-		in, out := &in.PrivateKey, &out.PrivateKey
-		*out = new(ContentRef)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertKeyPair.
-func (in *CertKeyPair) DeepCopy() *CertKeyPair {
-	if in == nil {
-		return nil
-	}
-	out := new(CertKeyPair)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CertificatePrivateKeyPairStatus) DeepCopyInto(out *CertificatePrivateKeyPairStatus) {
 	*out = *in
@@ -236,48 +198,6 @@ func (in *CertificatesStatus) DeepCopy() *CertificatesStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ClientCertificate) DeepCopyInto(out *ClientCertificate) {
-	*out = *in
-	in.Certificate.DeepCopyInto(&out.Certificate)
-	in.PrivateKey.DeepCopyInto(&out.PrivateKey)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientCertificate.
-func (in *ClientCertificate) DeepCopy() *ClientCertificate {
-	if in == nil {
-		return nil
-	}
-	out := new(ClientCertificate)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ContentRef) DeepCopyInto(out *ContentRef) {
-	*out = *in
-	if in.Content != nil {
-		in, out := &in.Content, &out.Content
-		*out = make([]byte, len(*in))
-		copy(*out, *in)
-	}
-	if in.SecretRef != nil {
-		in, out := &in.SecretRef, &out.SecretRef
-		*out = new(SecretReference)
-		**out = **in
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ContentRef.
-func (in *ContentRef) DeepCopy() *ContentRef {
-	if in == nil {
-		return nil
-	}
-	out := new(ContentRef)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ControlPlane) DeepCopyInto(out *ControlPlane) {
 	*out = *in
@@ -365,158 +285,6 @@ func (in *ControlPlaneExtraArgs) DeepCopy() *ControlPlaneExtraArgs {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStore) DeepCopyInto(out *DataStore) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStore.
-func (in *DataStore) DeepCopy() *DataStore {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStore)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *DataStore) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreCertificateStatus) DeepCopyInto(out *DataStoreCertificateStatus) {
-	*out = *in
-	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreCertificateStatus.
-func (in *DataStoreCertificateStatus) DeepCopy() *DataStoreCertificateStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreCertificateStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreConfigStatus) DeepCopyInto(out *DataStoreConfigStatus) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreConfigStatus.
-func (in *DataStoreConfigStatus) DeepCopy() *DataStoreConfigStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreConfigStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreList) DeepCopyInto(out *DataStoreList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]DataStore, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreList.
-func (in *DataStoreList) DeepCopy() *DataStoreList {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *DataStoreList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreSetupStatus) DeepCopyInto(out *DataStoreSetupStatus) {
-	*out = *in
-	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreSetupStatus.
-func (in *DataStoreSetupStatus) DeepCopy() *DataStoreSetupStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreSetupStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreSpec) DeepCopyInto(out *DataStoreSpec) {
-	*out = *in
-	if in.Endpoints != nil {
-		in, out := &in.Endpoints, &out.Endpoints
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.BasicAuth != nil {
-		in, out := &in.BasicAuth, &out.BasicAuth
-		*out = new(BasicAuth)
-		(*in).DeepCopyInto(*out)
-	}
-	in.TLSConfig.DeepCopyInto(&out.TLSConfig)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreSpec.
-func (in *DataStoreSpec) DeepCopy() *DataStoreSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataStoreStatus) DeepCopyInto(out *DataStoreStatus) {
-	*out = *in
-	if in.UsedBy != nil {
-		in, out := &in.UsedBy, &out.UsedBy
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataStoreStatus.
-func (in *DataStoreStatus) DeepCopy() *DataStoreStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(DataStoreStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *DeploymentSpec) DeepCopyInto(out *DeploymentSpec) {
 	*out = *in
@@ -576,6 +344,23 @@ func (in *ETCDCertificatesStatus) DeepCopy() *ETCDCertificatesStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ETCDStatus) DeepCopyInto(out *ETCDStatus) {
+	*out = *in
+	in.Role.DeepCopyInto(&out.Role)
+	in.User.DeepCopyInto(&out.User)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ETCDStatus.
+func (in *ETCDStatus) DeepCopy() *ETCDStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ETCDStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ExternalKubernetesObjectStatus) DeepCopyInto(out *ExternalKubernetesObjectStatus) {
 	*out = *in
@@ -608,6 +393,24 @@ func (in *IngressSpec) DeepCopy() *IngressSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KineStatus) DeepCopyInto(out *KineStatus) {
+	*out = *in
+	out.Config = in.Config
+	in.Setup.DeepCopyInto(&out.Setup)
+	in.Certificate.DeepCopyInto(&out.Certificate)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KineStatus.
+func (in *KineStatus) DeepCopy() *KineStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(KineStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *KonnectivityConfigMap) DeepCopyInto(out *KonnectivityConfigMap) {
 	*out = *in
@@ -919,17 +722,48 @@ func (in *PublicKeyPrivateKeyPairStatus) DeepCopy() *PublicKeyPrivateKeyPairStat
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SecretReference) DeepCopyInto(out *SecretReference) {
+func (in *SQLCertificateStatus) DeepCopyInto(out *SQLCertificateStatus) {
 	*out = *in
-	out.SecretReference = in.SecretReference
+	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretReference.
-func (in *SecretReference) DeepCopy() *SecretReference {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SQLCertificateStatus.
+func (in *SQLCertificateStatus) DeepCopy() *SQLCertificateStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(SecretReference)
+	out := new(SQLCertificateStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SQLConfigStatus) DeepCopyInto(out *SQLConfigStatus) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SQLConfigStatus.
+func (in *SQLConfigStatus) DeepCopy() *SQLConfigStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(SQLConfigStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SQLSetupStatus) DeepCopyInto(out *SQLSetupStatus) {
+	*out = *in
+	in.LastUpdate.DeepCopyInto(&out.LastUpdate)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SQLSetupStatus.
+func (in *SQLSetupStatus) DeepCopy() *SQLSetupStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(SQLSetupStatus)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -953,9 +787,16 @@ func (in *ServiceSpec) DeepCopy() *ServiceSpec {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *StorageStatus) DeepCopyInto(out *StorageStatus) {
 	*out = *in
-	out.Config = in.Config
-	in.Setup.DeepCopyInto(&out.Setup)
-	in.Certificate.DeepCopyInto(&out.Certificate)
+	if in.ETCD != nil {
+		in, out := &in.ETCD, &out.ETCD
+		*out = new(ETCDStatus)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Kine != nil {
+		in, out := &in.Kine, &out.Kine
+		*out = new(KineStatus)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StorageStatus.
@@ -968,23 +809,6 @@ func (in *StorageStatus) DeepCopy() *StorageStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TLSConfig) DeepCopyInto(out *TLSConfig) {
-	*out = *in
-	in.CertificateAuthority.DeepCopyInto(&out.CertificateAuthority)
-	in.ClientCertificate.DeepCopyInto(&out.ClientCertificate)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig.
-func (in *TLSConfig) DeepCopy() *TLSConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(TLSConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TenantControlPlane) DeepCopyInto(out *TenantControlPlane) {
 	*out = *in

charts/kamaji/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.3.0
+version: 0.1.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/kamaji/README.md

@@ -1,6 +1,6 @@
 # kamaji
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.1.0](https://img.shields.io/badge/AppVersion-0.1.0-informational?style=flat-square)
+![Version: 0.1.1](https://img.shields.io/badge/Version-0.1.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.1.0](https://img.shields.io/badge/AppVersion-0.1.0-informational?style=flat-square)
 
 Kamaji is a tool aimed to build and operate a Managed Kubernetes Service with a fraction of the operational burden. With Kamaji, you can deploy and operate hundreds of Kubernetes clusters as a hyper-scaler.
 
@@ -68,27 +68,6 @@ Here the values you can override:
 |-----|------|---------|-------------|
 | affinity | object | `{}` | Kubernetes affinity rules to apply to Kamaji controller pods |
 | configPath | string | `"./kamaji.yaml"` | Configuration file path alternative. (default "./kamaji.yaml") |
-| datastore.basicAuth.passwordSecret.keyPath | string | `nil` | The Secret key where the data is stored. |
-| datastore.basicAuth.passwordSecret.name | string | `nil` | The name of the Secret containing the password used to connect to the relational database. |
-| datastore.basicAuth.passwordSecret.namespace | string | `nil` | The namespace of the Secret containing the password used to connect to the relational database. |
-| datastore.basicAuth.usernameSecret.keyPath | string | `nil` | The Secret key where the data is stored. |
-| datastore.basicAuth.usernameSecret.name | string | `nil` | The name of the Secret containing the username used to connect to the relational database. |
-| datastore.basicAuth.usernameSecret.namespace | string | `nil` | The namespace of the Secret containing the username used to connect to the relational database. |
-| datastore.driver | string | `"etcd"` | (string) The Kamaji Datastore driver, supported: etcd, MySQL, PostgreSQL (defaults=etcd). |
-| datastore.endpoints | list | `[]` | (array) List of endpoints of the selected Datastore. When letting the Chart install the etcd datastore, this field is populated automatically. |
-| datastore.nameOverride | string | `nil` | The Datastore name override, if empty defaults to `default` |
-| datastore.tlsConfig.certificateAuthority.certificate.keyPath | string | `nil` | Key of the Secret which contains the content of the certificate. |
-| datastore.tlsConfig.certificateAuthority.certificate.name | string | `nil` | Name of the Secret containing the CA required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.certificateAuthority.certificate.namespace | string | `nil` | Namespace of the Secret containing the CA required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.certificateAuthority.privateKey.keyPath | string | `nil` | Key of the Secret which contains the content of the private key. |
-| datastore.tlsConfig.certificateAuthority.privateKey.name | string | `nil` | Name of the Secret containing the CA private key required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.certificateAuthority.privateKey.namespace | string | `nil` | Namespace of the Secret containing the CA private key required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.clientCertificate.certificate.keyPath | string | `nil` | Key of the Secret which contains the content of the certificate. |
-| datastore.tlsConfig.clientCertificate.certificate.name | string | `nil` | Name of the Secret containing the client certificate required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.clientCertificate.certificate.namespace | string | `nil` | Namespace of the Secret containing the client certificate required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.clientCertificate.privateKey.keyPath | string | `nil` | Key of the Secret which contains the content of the private key. |
-| datastore.tlsConfig.clientCertificate.privateKey.name | string | `nil` | Name of the Secret containing the client certificate private key required to establish the mandatory SSL/TLS connection to the datastore. |
-| datastore.tlsConfig.clientCertificate.privateKey.namespace | string | `nil` | Namespace of the Secret containing the client certificate private key required to establish the mandatory SSL/TLS connection to the datastore. |
 | etcd.compactionInterval | int | `0` | ETCD Compaction interval (e.g. "5m0s"). (default: "0" (disabled)) |
 | etcd.deploy | bool | `true` | Install an etcd with enabled multi-tenancy along with Kamaji |
 | etcd.image | object | `{"pullPolicy":"IfNotPresent","repository":"quay.io/coreos/etcd","tag":"v3.5.4"}` | Install specific etcd image |
@@ -133,9 +112,3 @@ Here the values you can override:
 | serviceAccount.name | string | `"kamaji-controller-manager"` |  |
 | temporaryDirectoryPath | string | `"/tmp/kamaji"` | Directory which will be used to work with temporary files. (default "/tmp/kamaji") |
 | tolerations | list | `[]` | Kubernetes node taints that the Kamaji controller pods would tolerate |
-
-## Installing and managing etcd as DataStore
-
-Kamaji supports multiple data store, although `etcd` is the default one: thus, an initial cluster will be created upon the Chart installation.
-
-The `DataStore` resource can be configured with the proper values in case of overrides when using a different driver, otherwise all the required data will be inherited by the Chart values.

charts/kamaji/README.md.gotmpl

@@ -54,9 +54,3 @@ If you only need to make minor customizations, you can specify them on the comma
 Here the values you can override:
 
 {{ template "chart.valuesSection" . }}
-
-## Installing and managing etcd as DataStore
-
-Kamaji supports multiple data store, although `etcd` is the default one: thus, an initial cluster will be created upon the Chart installation.
-
-The `DataStore` resource can be configured with the proper values in case of overrides when using a different driver, otherwise all the required data will be inherited by the Chart values.

charts/kamaji/crds/datastore.yaml

@@ -1,269 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.6.1
-  creationTimestamp: null
-  name: datastores.kamaji.clastix.io
-spec:
-  group: kamaji.clastix.io
-  names:
-    kind: DataStore
-    listKind: DataStoreList
-    plural: datastores
-    singular: datastore
-  scope: Cluster
-  versions:
-  - additionalPrinterColumns:
-    - description: Kamaji data store driver
-      jsonPath: .spec.driver
-      name: Driver
-      type: string
-    - description: Age
-      jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: DataStore is the Schema for the datastores API.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: DataStoreSpec defines the desired state of DataStore.
-            properties:
-              basicAuth:
-                description: In case of authentication enabled for the given data
-                  store, specifies the username and password pair. This value is optional.
-                properties:
-                  password:
-                    properties:
-                      content:
-                        description: Bare content of the file, base64 encoded. It
-                          has precedence over the SecretReference value.
-                        format: byte
-                        type: string
-                      secretReference:
-                        properties:
-                          keyPath:
-                            description: Name of the key for the given Secret reference
-                              where the content is stored. This value is mandatory.
-                            type: string
-                          name:
-                            description: Name is unique within a namespace to reference
-                              a secret resource.
-                            type: string
-                          namespace:
-                            description: Namespace defines the space within which
-                              the secret name must be unique.
-                            type: string
-                        required:
-                        - keyPath
-                        type: object
-                    type: object
-                  username:
-                    properties:
-                      content:
-                        description: Bare content of the file, base64 encoded. It
-                          has precedence over the SecretReference value.
-                        format: byte
-                        type: string
-                      secretReference:
-                        properties:
-                          keyPath:
-                            description: Name of the key for the given Secret reference
-                              where the content is stored. This value is mandatory.
-                            type: string
-                          name:
-                            description: Name is unique within a namespace to reference
-                              a secret resource.
-                            type: string
-                          namespace:
-                            description: Namespace defines the space within which
-                              the secret name must be unique.
-                            type: string
-                        required:
-                        - keyPath
-                        type: object
-                    type: object
-                required:
-                - password
-                - username
-                type: object
-              driver:
-                description: The driver to use to connect to the shared datastore.
-                type: string
-              endpoints:
-                description: List of the endpoints to connect to the shared datastore.
-                  No need for protocol, just bare IP/FQDN and port.
-                items:
-                  type: string
-                type: array
-              tlsConfig:
-                description: Defines the TLS/SSL configuration required to connect
-                  to the data store in a secure way.
-                properties:
-                  certificateAuthority:
-                    description: Retrieve the Certificate Authority certificate and
-                      private key, such as bare content of the file, or a SecretReference.
-                      The key reference is required since etcd authentication is based
-                      on certificates, and Kamaji is responsible in creating this.
-                    properties:
-                      certificate:
-                        properties:
-                          content:
-                            description: Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: Name of the key for the given Secret
-                                  reference where the content is stored. This value
-                                  is mandatory.
-                                type: string
-                              name:
-                                description: Name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: Namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                        type: object
-                      privateKey:
-                        properties:
-                          content:
-                            description: Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: Name of the key for the given Secret
-                                  reference where the content is stored. This value
-                                  is mandatory.
-                                type: string
-                              name:
-                                description: Name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: Namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                        type: object
-                    required:
-                    - certificate
-                    type: object
-                  clientCertificate:
-                    description: Specifies the SSL/TLS key and private key pair used
-                      to connect to the data store.
-                    properties:
-                      certificate:
-                        properties:
-                          content:
-                            description: Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: Name of the key for the given Secret
-                                  reference where the content is stored. This value
-                                  is mandatory.
-                                type: string
-                              name:
-                                description: Name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: Namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                        type: object
-                      privateKey:
-                        properties:
-                          content:
-                            description: Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: Name of the key for the given Secret
-                                  reference where the content is stored. This value
-                                  is mandatory.
-                                type: string
-                              name:
-                                description: Name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: Namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                        type: object
-                    required:
-                    - certificate
-                    - privateKey
-                    type: object
-                required:
-                - certificateAuthority
-                - clientCertificate
-                type: object
-            required:
-            - driver
-            - endpoints
-            - tlsConfig
-            type: object
-          status:
-            description: DataStoreStatus defines the observed state of DataStore.
-            properties:
-              usedBy:
-                description: List of the Tenant Control Planes, namespaced named,
-                  using this data store.
-                items:
-                  type: string
-                type: array
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

charts/kamaji/crds/tenantcontrolplane.yaml

@@ -1287,36 +1287,78 @@ spec:
                 description: Storage Status contains information about Kubernetes
                   storage system
                 properties:
-                  certificate:
+                  etcd:
+                    description: ETCDStatus defines the observed state of ETCDStatus.
                     properties:
-                      checksum:
-                        type: string
-                      lastUpdate:
-                        format: date-time
-                        type: string
-                      secretName:
-                        type: string
-                    type: object
-                  config:
-                    properties:
-                      checksum:
-                        type: string
-                      secretName:
-                        type: string
-                    type: object
-                  driver:
-                    type: string
-                  setup:
-                    properties:
-                      checksum:
-                        type: string
-                      lastUpdate:
-                        format: date-time
-                        type: string
-                      schema:
-                        type: string
+                      role:
+                        properties:
+                          exists:
+                            type: boolean
+                          name:
+                            type: string
+                          permissions:
+                            items:
+                              properties:
+                                key:
+                                  type: string
+                                rangeEnd:
+                                  type: string
+                                type:
+                                  type: integer
+                              type: object
+                            type: array
+                        required:
+                        - exists
+                        - name
+                        type: object
                       user:
+                        properties:
+                          exists:
+                            type: boolean
+                          name:
+                            type: string
+                          roles:
+                            items:
+                              type: string
+                            type: array
+                        required:
+                        - exists
+                        - name
+                        type: object
+                    type: object
+                  kine:
+                    properties:
+                      certificate:
+                        properties:
+                          checksum:
+                            type: string
+                          lastUpdate:
+                            format: date-time
+                            type: string
+                          secretName:
+                            type: string
+                        type: object
+                      config:
+                        properties:
+                          checksum:
+                            type: string
+                          secretName:
+                            type: string
+                        type: object
+                      driver:
                         type: string
+                      setup:
+                        properties:
+                          checksum:
+                            type: string
+                          lastUpdate:
+                            format: date-time
+                            type: string
+                          schema:
+                            type: string
+                          user:
+                            type: string
+                        type: object
                     type: object
                 type: object
             type: object

charts/kamaji/templates/_helpers_datastore.tpl

@@ -1,90 +0,0 @@
-{{/*
-Create a default fully qualified datastore name.
-*/}}
-{{- define "datastore.fullname" -}}
-{{- default "default" .Values.datastore.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "datastore.labels" -}}
-kamaji.clastix.io/datastore: {{ .Values.datastore.driver }}
-helm.sh/chart: {{ include "kamaji.chart" . }}
-{{ include "kamaji.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Datastore endpoints, in case of ETCD, retrieving the one provided by the chart.
-*/}}
-{{- define "datastore.endpoints" -}}
-{{- if eq .Values.datastore.driver "etcd" }}
-{{ include "etcd.endpoints" . }}
-{{- else }}
-{{ .Values.datastore.endpoints }}
-{{- end }}
-{{- end }}
-
-{{/*
-The Certificate Authority section for the DataSource object.
-*/}}
-{{- define "datastore.certificateAuthority" -}}
-{{- if eq .Values.datastore.driver "etcd" }}
-certificate:
-  secretReference:
-    name: {{ include "etcd.caSecretName" . }}
-    namespace: {{ include "etcd.caSecretNamespace" . }}
-    keyPath: ca.crt
-privateKey:
-  secretReference:
-    name: {{ include "etcd.caSecretName" . }}
-    namespace: {{ include "etcd.caSecretNamespace" . }}
-    keyPath: ca.key
-{{- else }}
-certificate:
-  secretReference:
-    name: {{ .Values.datastore.tlsConfig.certificateAuthority.certificate.name }}
-    namespace: {{ .Values.datastore.tlsConfig.certificateAuthority.certificate.namespace }}
-    keyPath: {{ .Values.datastore.tlsConfig.certificateAuthority.certificate.keyPath }}
-{{- if .Values.datastore.tlsConfig.certificateAuthority.privateKey.name }}
-privateKey:
-  secretReference:
-    name: {{ .Values.datastore.tlsConfig.certificateAuthority.privateKey.name }}
-    namespace: {{ .Values.datastore.tlsConfig.certificateAuthority.privateKey.namespace }}
-    keyPath: {{ .Values.datastore.tlsConfig.certificateAuthority.privateKey.keyPath }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-The Client Certificate section for the DataSource object.
-*/}}
-{{- define "datastore.clientCertificate" -}}
-{{- if eq .Values.datastore.driver "etcd" }}
-certificate:
-    secretReference:
-      name: {{ include "etcd.clientSecretName" . }}
-      namespace: {{ include "etcd.clientSecretNamespace" . }}
-      keyPath: tls.crt
-privateKey:
-    secretReference:
-      name: {{ include "etcd.clientSecretName" . }}
-      namespace: {{ include "etcd.clientSecretNamespace" . }}
-      keyPath: tls.key
-{{- else }}
-certificate:
-  secretReference:
-    name: {{ .Values.datastore.tlsConfig.clientCertificate.certificate.name }}
-    namespace: {{ .Values.datastore.tlsConfig.clientCertificate.certificate.namespace }}
-    keyPath: {{ .Values.datastore.tlsConfig.clientCertificate.certificate.keyPath }}
-privateKey:
-  secretReference:
-    name: {{ .Values.datastore.tlsConfig.clientCertificate.privateKey.name }}
-    namespace: {{ .Values.datastore.tlsConfig.clientCertificate.privateKey.namespace }}
-    keyPath: {{ .Values.datastore.tlsConfig.clientCertificate.privateKey.keyPath }}
-{{- end }}
-{{- end }}

charts/kamaji/templates/_helpers_etcd.tpl

@@ -99,7 +99,7 @@ Comma separated list of etcd endpoints, using the overrides in case of unmanaged
 {{- $list := list -}}
 {{- if .Values.etcd.deploy }}
     {{- range $count := until 3 -}}
-        {{- $list = append $list (printf "%s-%d.%s.%s.svc.cluster.local:%d" "etcd" $count ( include "etcd.serviceName" . ) $.Release.Namespace (int $.Values.etcd.port) ) -}}
+        {{- $list = append $list (printf "https://%s-%d.%s.%s.svc.cluster.local:%d" "etcd" $count ( include "etcd.serviceName" . ) $.Release.Namespace (int $.Values.etcd.port) ) -}}
     {{- end }}
 {{- else if .Values.etcd.overrides.endpoints }}
     {{- range $v := .Values.etcd.overrides.endpoints -}}
@@ -108,7 +108,7 @@ Comma separated list of etcd endpoints, using the overrides in case of unmanaged
 {{- else if not .Values.etcd.overrides.endpoints }}
     {{- fail "A valid .Values.etcd.overrides.endpoints required!" }}
 {{- end }}
-{{- $list | toYaml }}
+{{- join "," $list -}}
 {{- end }}
 
 {{/*

charts/kamaji/templates/controller.yaml

@@ -40,11 +40,16 @@ spec:
           protocol: TCP
       - args:
         - --config-file={{ .Values.configPath }}
+        - --etcd-ca-secret-name={{ include "etcd.caSecretName" . }}
+        - --etcd-ca-secret-namespace={{ include "etcd.caSecretNamespace" . }}
+        - --etcd-client-secret-name={{ include "etcd.clientSecretName" . }}
+        - --etcd-client-secret-namespace={{ include "etcd.clientSecretNamespace" . }}
+        - --etcd-compaction-interval={{ .Values.etcd.compactionInterval }}
+        - --etcd-endpoints={{ include "etcd.endpoints" . }}
         - --health-probe-bind-address={{ .Values.healthProbeBindAddress }}
         - --leader-elect
         - --metrics-bind-address={{ .Values.metricsBindAddress }}
         - --tmp-directory={{ .Values.temporaryDirectoryPath }}
-        - --datastore={{ include "datastore.fullname" . }}
         {{- if .Values.loggingDevel.enable }}
         - --zap-devel
         {{- end }}

charts/kamaji/templates/datastore.yaml

@@ -1,19 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: {{ include "datastore.fullname" . }}
-  labels:
-    {{- include "datastore.labels" . | nindent 4 }}
-spec:
-  driver: {{ .Values.datastore.driver }}
-  endpoints:
-    {{- include "datastore.endpoints" . | indent 4 }}
-{{- if (and .Values.datastore.basicAuth.usernameSecret.name .Values.datastore.basicAuth.passwordSecret.name) }}
-  basicAuth:
-    {{- .Values.datastore.basicAuth | toYaml | nindent 4 }}
-{{- end }}
-  tlsConfig:
-    certificateAuthority:
-      {{- include "datastore.certificateAuthority" . | indent 6 }}
-    clientCertificate:
-      {{- include "datastore.clientCertificate" . | indent 6 }}

charts/kamaji/templates/rbac.yaml

@@ -102,32 +102,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-    - kamaji.clastix.io
-  resources:
-    - datastores
-  verbs:
-    - create
-    - delete
-    - get
-    - list
-    - patch
-    - update
-    - watch
-- apiGroups:
-    - kamaji.clastix.io
-  resources:
-    - datastores/finalizers
-  verbs:
-    - update
-- apiGroups:
-    - kamaji.clastix.io
-  resources:
-    - datastores/status
-  verbs:
-    - get
-    - patch
-    - update
 - apiGroups:
   - kamaji.clastix.io
   resources:

charts/kamaji/values.yaml

@@ -154,57 +154,3 @@ temporaryDirectoryPath: "/tmp/kamaji"
 loggingDevel:
   # -- (string) Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error) (default false)
   enable: false
-
-datastore:
-  # -- (string) The Datastore name override, if empty defaults to `default`
-  nameOverride:
-  # -- (string) The Kamaji Datastore driver, supported: etcd, MySQL, PostgreSQL (defaults=etcd).
-  driver: etcd
-  # -- (array) List of endpoints of the selected Datastore. When letting the Chart install the etcd datastore, this field is populated automatically.
-  endpoints: []
-  basicAuth:
-    usernameSecret:
-      # -- The name of the Secret containing the username used to connect to the relational database.
-      name:
-      # -- The namespace of the Secret containing the username used to connect to the relational database.
-      namespace:
-      # -- The Secret key where the data is stored.
-      keyPath:
-    passwordSecret:
-      # -- The name of the Secret containing the password used to connect to the relational database.
-      name:
-      # -- The namespace of the Secret containing the password used to connect to the relational database.
-      namespace:
-      # -- The Secret key where the data is stored.
-      keyPath:
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        # -- Name of the Secret containing the CA required to establish the mandatory SSL/TLS connection to the datastore.
-        name:
-        # -- Namespace of the Secret containing the CA required to establish the mandatory SSL/TLS connection to the datastore.
-        namespace:
-        # -- Key of the Secret which contains the content of the certificate.
-        keyPath:
-      privateKey:
-        # -- Name of the Secret containing the CA private key required to establish the mandatory SSL/TLS connection to the datastore.
-        name:
-        # -- Namespace of the Secret containing the CA private key required to establish the mandatory SSL/TLS connection to the datastore.
-        namespace:
-        # -- Key of the Secret which contains the content of the private key.
-        keyPath:
-    clientCertificate:
-      certificate:
-        # -- Name of the Secret containing the client certificate required to establish the mandatory SSL/TLS connection to the datastore.
-        name:
-        # -- Namespace of the Secret containing the client certificate required to establish the mandatory SSL/TLS connection to the datastore.
-        namespace:
-        # -- Key of the Secret which contains the content of the certificate.
-        keyPath:
-      privateKey:
-        # -- Name of the Secret containing the client certificate private key required to establish the mandatory SSL/TLS connection to the datastore.
-        name:
-        # -- Namespace of the Secret containing the client certificate private key required to establish the mandatory SSL/TLS connection to the datastore.
-        namespace:
-        # -- Key of the Secret which contains the content of the private key.
-        keyPath:

config/crd/bases/kamaji.clastix.io_datastores.yaml

@@ -1,269 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.6.1
-  creationTimestamp: null
-  name: datastores.kamaji.clastix.io
-spec:
-  group: kamaji.clastix.io
-  names:
-    kind: DataStore
-    listKind: DataStoreList
-    plural: datastores
-    singular: datastore
-  scope: Cluster
-  versions:
-  - additionalPrinterColumns:
-    - description: Kamaji data store driver
-      jsonPath: .spec.driver
-      name: Driver
-      type: string
-    - description: Age
-      jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: DataStore is the Schema for the datastores API.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: DataStoreSpec defines the desired state of DataStore.
-            properties:
-              basicAuth:
-                description: In case of authentication enabled for the given data
-                  store, specifies the username and password pair. This value is optional.
-                properties:
-                  password:
-                    properties:
-                      content:
-                        description: Bare content of the file, base64 encoded. It
-                          has precedence over the SecretReference value.
-                        format: byte
-                        type: string
-                      secretReference:
-                        properties:
-                          keyPath:
-                            description: Name of the key for the given Secret reference
-                              where the content is stored. This value is mandatory.
-                            type: string
-                          name:
-                            description: Name is unique within a namespace to reference
-                              a secret resource.
-                            type: string
-                          namespace:
-                            description: Namespace defines the space within which
-                              the secret name must be unique.
-                            type: string
-                        required:
-                        - keyPath
-                        type: object
-                    type: object
-                  username:
-                    properties:
-                      content:
-                        description: Bare content of the file, base64 encoded. It
-                          has precedence over the SecretReference value.
-                        format: byte
-                        type: string
-                      secretReference:
-                        properties:
-                          keyPath:
-                            description: Name of the key for the given Secret reference
-                              where the content is stored. This value is mandatory.
-                            type: string
-                          name:
-                            description: Name is unique within a namespace to reference
-                              a secret resource.
-                            type: string
-                          namespace:
-                            description: Namespace defines the space within which
-                              the secret name must be unique.
-                            type: string
-                        required:
-                        - keyPath
-                        type: object
-                    type: object
-                required:
-                - password
-                - username
-                type: object
-              driver:
-                description: The driver to use to connect to the shared datastore.
-                type: string
-              endpoints:
-                description: List of the endpoints to connect to the shared datastore.
-                  No need for protocol, just bare IP/FQDN and port.
-                items:
-                  type: string
-                type: array
-              tlsConfig:
-                description: Defines the TLS/SSL configuration required to connect
-                  to the data store in a secure way.
-                properties:
-                  certificateAuthority:
-                    description: Retrieve the Certificate Authority certificate and
-                      private key, such as bare content of the file, or a SecretReference.
-                      The key reference is required since etcd authentication is based
-                      on certificates, and Kamaji is responsible in creating this.
-                    properties:
-                      certificate:
-                        properties:
-                          content:
-                            description: Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: Name of the key for the given Secret
-                                  reference where the content is stored. This value
-                                  is mandatory.
-                                type: string
-                              name:
-                                description: Name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: Namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                        type: object
-                      privateKey:
-                        properties:
-                          content:
-                            description: Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: Name of the key for the given Secret
-                                  reference where the content is stored. This value
-                                  is mandatory.
-                                type: string
-                              name:
-                                description: Name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: Namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                        type: object
-                    required:
-                    - certificate
-                    type: object
-                  clientCertificate:
-                    description: Specifies the SSL/TLS key and private key pair used
-                      to connect to the data store.
-                    properties:
-                      certificate:
-                        properties:
-                          content:
-                            description: Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: Name of the key for the given Secret
-                                  reference where the content is stored. This value
-                                  is mandatory.
-                                type: string
-                              name:
-                                description: Name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: Namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                        type: object
-                      privateKey:
-                        properties:
-                          content:
-                            description: Bare content of the file, base64 encoded.
-                              It has precedence over the SecretReference value.
-                            format: byte
-                            type: string
-                          secretReference:
-                            properties:
-                              keyPath:
-                                description: Name of the key for the given Secret
-                                  reference where the content is stored. This value
-                                  is mandatory.
-                                type: string
-                              name:
-                                description: Name is unique within a namespace to
-                                  reference a secret resource.
-                                type: string
-                              namespace:
-                                description: Namespace defines the space within which
-                                  the secret name must be unique.
-                                type: string
-                            required:
-                            - keyPath
-                            type: object
-                        type: object
-                    required:
-                    - certificate
-                    - privateKey
-                    type: object
-                required:
-                - certificateAuthority
-                - clientCertificate
-                type: object
-            required:
-            - driver
-            - endpoints
-            - tlsConfig
-            type: object
-          status:
-            description: DataStoreStatus defines the observed state of DataStore.
-            properties:
-              usedBy:
-                description: List of the Tenant Control Planes, namespaced named,
-                  using this data store.
-                items:
-                  type: string
-                type: array
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

config/crd/bases/kamaji.clastix.io_tenantcontrolplanes.yaml

@@ -1287,36 +1287,78 @@ spec:
                 description: Storage Status contains information about Kubernetes
                   storage system
                 properties:
-                  certificate:
+                  etcd:
+                    description: ETCDStatus defines the observed state of ETCDStatus.
                     properties:
-                      checksum:
-                        type: string
-                      lastUpdate:
-                        format: date-time
-                        type: string
-                      secretName:
-                        type: string
-                    type: object
-                  config:
-                    properties:
-                      checksum:
-                        type: string
-                      secretName:
-                        type: string
-                    type: object
-                  driver:
-                    type: string
-                  setup:
-                    properties:
-                      checksum:
-                        type: string
-                      lastUpdate:
-                        format: date-time
-                        type: string
-                      schema:
-                        type: string
+                      role:
+                        properties:
+                          exists:
+                            type: boolean
+                          name:
+                            type: string
+                          permissions:
+                            items:
+                              properties:
+                                key:
+                                  type: string
+                                rangeEnd:
+                                  type: string
+                                type:
+                                  type: integer
+                              type: object
+                            type: array
+                        required:
+                        - exists
+                        - name
+                        type: object
                       user:
+                        properties:
+                          exists:
+                            type: boolean
+                          name:
+                            type: string
+                          roles:
+                            items:
+                              type: string
+                            type: array
+                        required:
+                        - exists
+                        - name
+                        type: object
+                    type: object
+                  kine:
+                    properties:
+                      certificate:
+                        properties:
+                          checksum:
+                            type: string
+                          lastUpdate:
+                            format: date-time
+                            type: string
+                          secretName:
+                            type: string
+                        type: object
+                      config:
+                        properties:
+                          checksum:
+                            type: string
+                          secretName:
+                            type: string
+                        type: object
+                      driver:
                         type: string
+                      setup:
+                        properties:
+                          checksum:
+                            type: string
+                          lastUpdate:
+                            format: date-time
+                            type: string
+                          schema:
+                            type: string
+                          user:
+                            type: string
+                        type: object
                     type: object
                 type: object
             type: object

config/crd/patches/cainjection_in_datastores.yaml

@@ -1,7 +0,0 @@
-# The following patch adds a directive for certmanager to inject CA into the CRD
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
-  name: datastores.kamaji.clastix.io

config/crd/patches/webhook_in_datastores.yaml

@@ -1,16 +0,0 @@
-# The following patch enables a conversion webhook for the CRD
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: datastores.kamaji.clastix.io
-spec:
-  conversion:
-    strategy: Webhook
-    webhook:
-      clientConfig:
-        service:
-          namespace: system
-          name: webhook-service
-          path: /convert
-      conversionReviewVersions:
-      - v1

config/default/kustomization.yaml

@@ -16,7 +16,6 @@ bases:
 - ../crd
 - ../rbac
 - ../manager
-- ../samples
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
 # crd/kustomization.yaml
 #- ../webhook

config/install.yaml

@@ -1048,36 +1048,78 @@ spec:
               storage:
                 description: Storage Status contains information about Kubernetes storage system
                 properties:
-                  certificate:
+                  etcd:
+                    description: ETCDStatus defines the observed state of ETCDStatus.
                     properties:
-                      checksum:
-                        type: string
-                      lastUpdate:
-                        format: date-time
-                        type: string
-                      secretName:
-                        type: string
-                    type: object
-                  config:
-                    properties:
-                      checksum:
-                        type: string
-                      secretName:
-                        type: string
-                    type: object
-                  driver:
-                    type: string
-                  setup:
-                    properties:
-                      checksum:
-                        type: string
-                      lastUpdate:
-                        format: date-time
-                        type: string
-                      schema:
-                        type: string
+                      role:
+                        properties:
+                          exists:
+                            type: boolean
+                          name:
+                            type: string
+                          permissions:
+                            items:
+                              properties:
+                                key:
+                                  type: string
+                                rangeEnd:
+                                  type: string
+                                type:
+                                  type: integer
+                              type: object
+                            type: array
+                        required:
+                        - exists
+                        - name
+                        type: object
                       user:
+                        properties:
+                          exists:
+                            type: boolean
+                          name:
+                            type: string
+                          roles:
+                            items:
+                              type: string
+                            type: array
+                        required:
+                        - exists
+                        - name
+                        type: object
+                    type: object
+                  kine:
+                    properties:
+                      certificate:
+                        properties:
+                          checksum:
+                            type: string
+                          lastUpdate:
+                            format: date-time
+                            type: string
+                          secretName:
+                            type: string
+                        type: object
+                      config:
+                        properties:
+                          checksum:
+                            type: string
+                          secretName:
+                            type: string
+                        type: object
+                      driver:
                         type: string
+                      setup:
+                        properties:
+                          checksum:
+                            type: string
+                          lastUpdate:
+                            format: date-time
+                            type: string
+                          schema:
+                            type: string
+                          user:
+                            type: string
+                        type: object
                     type: object
                 type: object
             type: object
@@ -1191,26 +1233,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores/status
-  verbs:
-  - get
-  - patch
-  - update
 - apiGroups:
   - kamaji.clastix.io
   resources:
@@ -1416,39 +1438,3 @@ spec:
         runAsNonRoot: true
       serviceAccountName: kamaji-controller-manager
       terminationGracePeriodSeconds: 10
----
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: kamaji-etcd
-  namespace: kamaji-system
-spec:
-  basicAuth: null
-  driver: etcd
-  endpoints:
-  - etcd-0.etcd.kamaji-system.svc:2379
-  - etcd-1.etcd.kamaji-system.svc:2379
-  - etcd-2.etcd.kamaji-system.svc:2379
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          keyPath: ca.crt
-          name: etcd-certs
-          namespace: kamaji-system
-      privateKey:
-        secretReference:
-          keyPath: ca.key
-          name: etcd-certs
-          namespace: kamaji-system
-    clientCertificate:
-      certificate:
-        secretReference:
-          keyPath: tls.crt
-          name: root-client-certs
-          namespace: kamaji-system
-      privateKey:
-        secretReference:
-          keyPath: tls.key
-          name: root-client-certs
-          namespace: kamaji-system

config/rbac/datastore_editor_role.yaml

@@ -1,24 +0,0 @@
-# permissions for end users to edit datastores.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: datastore-editor-role
-rules:
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores/status
-  verbs:
-  - get

config/rbac/datastore_viewer_role.yaml

@@ -1,20 +0,0 @@
-# permissions for end users to view datastores.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: datastore-viewer-role
-rules:
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores/status
-  verbs:
-  - get

config/rbac/role.yaml

@@ -54,26 +54,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - kamaji.clastix.io
-  resources:
-  - datastores/status
-  verbs:
-  - get
-  - patch
-  - update
 - apiGroups:
   - kamaji.clastix.io
   resources:

config/samples/kamaji_v1alpha1_datastore_etcd.yaml

@@ -1,34 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: etcd
-spec:
-  driver: etcd
-  endpoints:
-    - etcd-0.etcd.kamaji-system.svc:2379
-    - etcd-1.etcd.kamaji-system.svc:2379
-    - etcd-2.etcd.kamaji-system.svc:2379
-  basicAuth: null
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: etcd-certs
-          namespace: kamaji-system
-          keyPath: "ca.crt"
-      privateKey:
-        secretReference:
-          name: etcd-certs
-          namespace: kamaji-system
-          keyPath: "ca.key"
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: root-client-certs
-          namespace: kamaji-system
-          keyPath: "tls.crt"
-      privateKey:
-        secretReference:
-          name: root-client-certs
-          namespace: kamaji-system
-          keyPath: "tls.key"

config/samples/kamaji_v1alpha1_datastore_mysql.yaml

@@ -1,34 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: mysql
-spec:
-  driver: MySQL
-  endpoints:
-    - mariadb.kamaji-system.svc:3306
-  basicAuth:
-    username:
-      content: cm9vdA==
-    password:
-      secretReference:
-        name: mysql-config
-        namespace: kamaji-system
-        keyPath: MYSQL_ROOT_PASSWORD
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: mysql-config
-          namespace: kamaji-system
-          keyPath: "ca.crt"
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: mysql-config
-          namespace: kamaji-system
-          keyPath: "server.crt"
-      privateKey:
-        secretReference:
-          name: mysql-config
-          namespace: kamaji-system
-          keyPath: "server.key"

config/samples/kamaji_v1alpha1_datastore_postgresql.yaml

@@ -1,37 +0,0 @@
-apiVersion: kamaji.clastix.io/v1alpha1
-kind: DataStore
-metadata:
-  name: postgresql
-spec:
-  driver: PostgreSQL
-  endpoints:
-    - postgresql-rw.kamaji-system.svc:5432
-  basicAuth:
-    username:
-      secretReference:
-        name: postgresql-superuser
-        namespace: kamaji-system
-        keyPath: username
-    password:
-      secretReference:
-        name: postgresql-superuser
-        namespace: kamaji-system
-        keyPath: password
-  tlsConfig:
-    certificateAuthority:
-      certificate:
-        secretReference:
-          name: postgresql-ca
-          namespace: kamaji-system
-          keyPath: ca.crt
-    clientCertificate:
-      certificate:
-        secretReference:
-          name: postgres-root-cert
-          namespace: kamaji-system
-          keyPath: tls.crt
-      privateKey:
-        secretReference:
-          name: postgres-root-cert
-          namespace: kamaji-system
-          keyPath: tls.key

config/samples/kustomization.yaml

@@ -1,4 +1,4 @@
 ## Append samples you want in your CSV to this file as resources ##
 resources:
-- kamaji_v1alpha1_datastore_etcd.yaml
+- kamaji_v1alpha1_tenantcontrolplane.yaml
 #+kubebuilder:scaffold:manifestskustomizesamples

controllers/datastore_controller.go

@@ -1,96 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package controllers
-
-import (
-	"context"
-
-	"github.com/pkg/errors"
-	k8serrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/util/sets"
-	controllerruntime "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/builder"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/event"
-	"sigs.k8s.io/controller-runtime/pkg/predicate"
-	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-)
-
-type DataStore struct {
-	client client.Client
-	// TenantControlPlaneTrigger is the channel used to communicate across the controllers:
-	// if a Data Source is updated we have to be sure that the reconciliation of the certificates content
-	// for each Tenant Control Plane is put in place properly.
-	TenantControlPlaneTrigger TenantControlPlaneChannel
-	// ResourceName is the DataStore object that should be watched for changes.
-	ResourceName string
-}
-
-//+kubebuilder:rbac:groups=kamaji.clastix.io,resources=datastores,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups=kamaji.clastix.io,resources=datastores/status,verbs=get;update;patch
-
-func (r *DataStore) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) {
-	ds := kamajiv1alpha1.DataStore{}
-	if err := r.client.Get(ctx, request.NamespacedName, &ds); err != nil {
-		if k8serrors.IsNotFound(err) {
-			return reconcile.Result{}, nil
-		}
-
-		return reconcile.Result{}, err
-	}
-	// A Data Source can trigger several Tenant Control Planes and requires a minimum validation:
-	// we have to ensure the data provided by the Data Source is valid and referencing an existing Secret object.
-	if _, err := ds.Spec.TLSConfig.CertificateAuthority.Certificate.GetContent(ctx, r.client); err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "invalid Certificate Authority data")
-	}
-
-	if _, err := ds.Spec.TLSConfig.ClientCertificate.Certificate.GetContent(ctx, r.client); err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "invalid Client Certificate data")
-	}
-
-	if _, err := ds.Spec.TLSConfig.ClientCertificate.PrivateKey.GetContent(ctx, r.client); err != nil {
-		return reconcile.Result{}, errors.Wrap(err, "invalid Client Certificate data")
-	}
-
-	tcpList := kamajiv1alpha1.TenantControlPlaneList{}
-
-	if err := r.client.List(ctx, &tcpList); err != nil {
-		return reconcile.Result{}, err
-	}
-	// Updating the status with the list of Tenant Control Plane using the following Data Source
-	tcpSets := sets.NewString()
-	for _, tcp := range tcpList.Items {
-		tcpSets.Insert(getNamespacedName(tcp.GetNamespace(), tcp.GetName()).String())
-	}
-
-	ds.Status.UsedBy = tcpSets.List()
-
-	if err := r.client.Status().Update(ctx, &ds); err != nil {
-		return reconcile.Result{}, err
-	}
-	// Triggering the reconciliation of the Tenant Control Plane upon a Secret change
-	for _, i := range tcpList.Items {
-		tcp := i
-
-		r.TenantControlPlaneTrigger <- event.GenericEvent{Object: &tcp}
-	}
-
-	return reconcile.Result{}, nil
-}
-
-func (r *DataStore) InjectClient(client client.Client) error {
-	r.client = client
-
-	return nil
-}
-
-func (r *DataStore) SetupWithManager(mgr controllerruntime.Manager) error {
-	return controllerruntime.NewControllerManagedBy(mgr).
-		For(&kamajiv1alpha1.DataStore{}, builder.WithPredicates(predicate.NewPredicateFuncs(func(object client.Object) bool {
-			return object.GetName() == r.ResourceName
-		}))).
-		Complete(r)
-}

controllers/resources.go

@@ -1,10 +1,10 @@
 // Copyright 2022 Clastix Labs
 // SPDX-License-Identifier: Apache-2.0
-
 package controllers
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/go-logr/logr"
 	"github.com/google/uuid"
@@ -12,10 +12,14 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/datastore"
 	"github.com/clastix/kamaji/internal/resources"
-	ds "github.com/clastix/kamaji/internal/resources/datastore"
 	"github.com/clastix/kamaji/internal/resources/konnectivity"
+	"github.com/clastix/kamaji/internal/sql"
+	"github.com/clastix/kamaji/internal/types"
+)
+
+const (
+	separator = ","
 )
 
 type GroupResourceBuilderConfiguration struct {
@@ -23,8 +27,7 @@ type GroupResourceBuilderConfiguration struct {
 	log                 logr.Logger
 	tcpReconcilerConfig TenantControlPlaneReconcilerConfig
 	tenantControlPlane  kamajiv1alpha1.TenantControlPlane
-	Connection          datastore.Connection
-	DataStore           kamajiv1alpha1.DataStore
+	DBConnection        sql.DBConnection
 }
 
 type GroupDeleteableResourceBuilderConfiguration struct {
@@ -32,7 +35,7 @@ type GroupDeleteableResourceBuilderConfiguration struct {
 	log                 logr.Logger
 	tcpReconcilerConfig TenantControlPlaneReconcilerConfig
 	tenantControlPlane  kamajiv1alpha1.TenantControlPlane
-	connection          datastore.Connection
+	DBConnection        sql.DBConnection
 }
 
 // GetResources returns a list of resources that will be used to provide tenant control planes
@@ -50,39 +53,57 @@ func GetDeletableResources(config GroupDeleteableResourceBuilderConfiguration) [
 }
 
 func getDefaultResources(config GroupResourceBuilderConfiguration) []resources.Resource {
-	resources := append(getUpgradeResources(config.client), getKubernetesServiceResources(config.client)...)
-	resources = append(resources, getKubeadmConfigResources(config.client, getTmpDirectory(config.tcpReconcilerConfig.TmpBaseDirectory, config.tenantControlPlane), config.DataStore)...)
+	resources := append(getUpgradeResources(config.client, config.tenantControlPlane), getKubernetesServiceResources(config.client, config.tenantControlPlane)...)
+	resources = append(resources, getKubeadmConfigResources(config.client, config.tcpReconcilerConfig, config.tenantControlPlane)...)
 	resources = append(resources, getKubernetesCertificatesResources(config.client, config.log, config.tcpReconcilerConfig, config.tenantControlPlane)...)
 	resources = append(resources, getKubeconfigResources(config.client, config.log, config.tcpReconcilerConfig, config.tenantControlPlane)...)
-	resources = append(resources, getKubernetesStorageResources(config.client, config.Connection, config.DataStore)...)
-	resources = append(resources, getInternalKonnectivityResources(config.client, config.log)...)
-	resources = append(resources, getKubernetesDeploymentResources(config.client, config.tcpReconcilerConfig, config.DataStore)...)
-	resources = append(resources, getKubernetesIngressResources(config.client)...)
-	resources = append(resources, getKubeadmPhaseResources(config.client, config.log)...)
-	resources = append(resources, getKubeadmAddonResources(config.client, config.log)...)
-	resources = append(resources, getExternalKonnectivityResources(config.client)...)
+	resources = append(resources, getKubernetesStorageResources(config.client, config.log, config.tcpReconcilerConfig, config.DBConnection, config.tenantControlPlane)...)
+	resources = append(resources, getInternalKonnectivityResources(config.client, config.log, config.tcpReconcilerConfig, config.tenantControlPlane)...)
+	resources = append(resources, getKubernetesDeploymentResources(config.client, config.tcpReconcilerConfig, config.tenantControlPlane)...)
+	resources = append(resources, getKubernetesIngressResources(config.client, config.tenantControlPlane)...)
+	resources = append(resources, getKubeadmPhaseResources(config.client, config.log, config.tenantControlPlane)...)
+	resources = append(resources, getKubeadmAddonResources(config.client, config.log, config.tenantControlPlane)...)
+	resources = append(resources, getExternalKonnectivityResources(config.client, config.log, config.tcpReconcilerConfig, config.tenantControlPlane)...)
 
 	return resources
 }
 
 func getDefaultDeleteableResources(config GroupDeleteableResourceBuilderConfiguration) []resources.DeleteableResource {
-	return []resources.DeleteableResource{
-		&ds.Setup{
-			Client:     config.client,
-			Connection: config.connection,
-		},
+	switch config.tcpReconcilerConfig.ETCDStorageType {
+	case types.ETCD:
+		return []resources.DeleteableResource{
+			&resources.ETCDSetupResource{
+				Name:                  "etcd-setup",
+				Client:                config.client,
+				Log:                   config.log,
+				ETCDClientCertsSecret: getNamespacedName(config.tcpReconcilerConfig.ETCDClientSecretNamespace, config.tcpReconcilerConfig.ETCDClientSecretName),
+				ETCDCACertsSecret:     getNamespacedName(config.tcpReconcilerConfig.ETCDCASecretNamespace, config.tcpReconcilerConfig.ETCDCASecretName),
+				Endpoints:             getArrayFromString(config.tcpReconcilerConfig.ETCDEndpoints),
+			},
+		}
+	case types.KineMySQL, types.KinePostgreSQL:
+		return []resources.DeleteableResource{
+			&resources.SQLSetup{
+				Client:       config.client,
+				Name:         "sql-setup",
+				DBConnection: config.DBConnection,
+			},
+		}
+	default:
+		return []resources.DeleteableResource{}
 	}
 }
 
-func getUpgradeResources(c client.Client) []resources.Resource {
+func getUpgradeResources(c client.Client, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubernetesUpgrade{
+			Name:   "upgrade",
 			Client: c,
 		},
 	}
 }
 
-func getKubernetesServiceResources(c client.Client) []resources.Resource {
+func getKubernetesServiceResources(c client.Client, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubernetesServiceResource{
 			Client: c,
@@ -90,21 +111,14 @@ func getKubernetesServiceResources(c client.Client) []resources.Resource {
 	}
 }
 
-func getKubeadmConfigResources(c client.Client, tmpDirectory string, dataStore kamajiv1alpha1.DataStore) []resources.Resource {
-	var endpoints []string
-
-	switch dataStore.Spec.Driver {
-	case kamajiv1alpha1.EtcdDriver:
-		endpoints = dataStore.Spec.Endpoints
-	default:
-		endpoints = []string{"127.0.0.1:2379"}
-	}
-
+func getKubeadmConfigResources(c client.Client, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubeadmConfigResource{
-			ETCDs:        endpoints,
-			Client:       c,
-			TmpDirectory: tmpDirectory,
+			Name:                   "kubeadmconfig",
+			ETCDs:                  getArrayFromString(tcpReconcilerConfig.ETCDEndpoints),
+			ETCDCompactionInterval: tcpReconcilerConfig.ETCDCompactionInterval,
+			Client:                 c,
+			TmpDirectory:           getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 	}
 }
@@ -112,31 +126,37 @@ func getKubeadmConfigResources(c client.Client, tmpDirectory string, dataStore k
 func getKubernetesCertificatesResources(c client.Client, log logr.Logger, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&resources.CACertificate{
+			Name:         "ca",
 			Client:       c,
 			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.FrontProxyCACertificate{
+			Name:         "front-proxy-ca-certificate",
 			Client:       c,
 			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.SACertificate{
+			Name:         "sa-certificate",
 			Client:       c,
 			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.APIServerCertificate{
+			Name:         "api-server-certificate",
 			Client:       c,
 			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.APIServerKubeletClientCertificate{
+			Name:         "api-server-kubelet-client-certificate",
 			Client:       c,
 			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
 		},
 		&resources.FrontProxyClientCertificate{
+			Name:         "front-proxy-client-certificate",
 			Client:       c,
 			Log:          log,
 			TmpDirectory: getTmpDirectory(tcpReconcilerConfig.TmpBaseDirectory, tenantControlPlane),
@@ -170,36 +190,72 @@ func getKubeconfigResources(c client.Client, log logr.Logger, tcpReconcilerConfi
 	}
 }
 
-func getKubernetesStorageResources(c client.Client, dbConnection datastore.Connection, datastore kamajiv1alpha1.DataStore) []resources.Resource {
-	return []resources.Resource{
-		&ds.Config{
-			Client:     c,
-			ConnString: dbConnection.GetConnectionString(),
-			Driver:     dbConnection.Driver(),
-		},
-		&ds.Setup{
-			Client:     c,
-			Connection: dbConnection,
-			DataStore:  datastore,
-		},
-		&ds.Certificate{
-			Client:    c,
-			DataStore: datastore,
-		},
+func getKubernetesStorageResources(c client.Client, log logr.Logger, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, dbConnection sql.DBConnection, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
+	switch tcpReconcilerConfig.ETCDStorageType {
+	case types.ETCD:
+		return []resources.Resource{
+			&resources.ETCDCACertificatesResource{
+				Name:                  "etcd-ca-certificates",
+				Client:                c,
+				Log:                   log,
+				ETCDCASecretName:      tcpReconcilerConfig.ETCDCASecretName,
+				ETCDCASecretNamespace: tcpReconcilerConfig.ETCDCASecretNamespace,
+			},
+			&resources.ETCDCertificatesResource{
+				Name:   "etcd-certificates",
+				Client: c,
+				Log:    log,
+			},
+			&resources.ETCDSetupResource{
+				Name:                  "etcd-setup",
+				Client:                c,
+				Log:                   log,
+				ETCDClientCertsSecret: getNamespacedName(tcpReconcilerConfig.ETCDClientSecretNamespace, tcpReconcilerConfig.ETCDClientSecretName),
+				ETCDCACertsSecret:     getNamespacedName(tcpReconcilerConfig.ETCDCASecretNamespace, tcpReconcilerConfig.ETCDCASecretName),
+				Endpoints:             getArrayFromString(tcpReconcilerConfig.ETCDEndpoints),
+			},
+		}
+	case types.KineMySQL, types.KinePostgreSQL:
+		return []resources.Resource{
+			&resources.SQLStorageConfig{
+				Client: c,
+				Name:   "sql-config",
+				Host:   dbConnection.GetHost(),
+				Port:   dbConnection.GetPort(),
+				Driver: dbConnection.Driver(),
+			},
+			&resources.SQLSetup{
+				Client:       c,
+				Name:         "sql-setup",
+				DBConnection: dbConnection,
+				Driver:       dbConnection.Driver(),
+			},
+			&resources.SQLCertificate{
+				Client:                   c,
+				Name:                     "sql-certificate",
+				StorageType:              tcpReconcilerConfig.ETCDStorageType,
+				SQLConfigSecretName:      tcpReconcilerConfig.KineSecretName,
+				SQLConfigSecretNamespace: tcpReconcilerConfig.KineSecretNamespace,
+			},
+		}
+	default:
+		return []resources.Resource{}
 	}
 }
 
-func getKubernetesDeploymentResources(c client.Client, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, dataStore kamajiv1alpha1.DataStore) []resources.Resource {
+func getKubernetesDeploymentResources(c client.Client, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubernetesDeploymentResource{
-			Client:             c,
-			DataStore:          dataStore,
-			KineContainerImage: tcpReconcilerConfig.KineContainerImage,
+			Client:                 c,
+			ETCDEndpoints:          getArrayFromString(tcpReconcilerConfig.ETCDEndpoints),
+			ETCDCompactionInterval: tcpReconcilerConfig.ETCDCompactionInterval,
+			ETCDStorageType:        tcpReconcilerConfig.ETCDStorageType,
+			KineContainerImage:     tcpReconcilerConfig.KineContainerImage,
 		},
 	}
 }
 
-func getKubernetesIngressResources(c client.Client) []resources.Resource {
+func getKubernetesIngressResources(c client.Client, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubernetesIngressResource{
 			Client: c,
@@ -207,7 +263,7 @@ func getKubernetesIngressResources(c client.Client) []resources.Resource {
 	}
 }
 
-func getKubeadmPhaseResources(c client.Client, log logr.Logger) []resources.Resource {
+func getKubeadmPhaseResources(c client.Client, log logr.Logger, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubeadmPhase{
 			Name:   "upload-config-kubeadm",
@@ -230,7 +286,7 @@ func getKubeadmPhaseResources(c client.Client, log logr.Logger) []resources.Reso
 	}
 }
 
-func getKubeadmAddonResources(c client.Client, log logr.Logger) []resources.Resource {
+func getKubeadmAddonResources(c client.Client, log logr.Logger, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&resources.KubeadmAddonResource{
 			Name:         "coredns",
@@ -247,7 +303,7 @@ func getKubeadmAddonResources(c client.Client, log logr.Logger) []resources.Reso
 	}
 }
 
-func getExternalKonnectivityResources(c client.Client) []resources.Resource {
+func getExternalKonnectivityResources(c client.Client, log logr.Logger, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&konnectivity.ServiceAccountResource{
 			Client: c,
@@ -272,7 +328,7 @@ func getExternalKonnectivityResources(c client.Client) []resources.Resource {
 	}
 }
 
-func getInternalKonnectivityResources(c client.Client, log logr.Logger) []resources.Resource {
+func getInternalKonnectivityResources(c client.Client, log logr.Logger, tcpReconcilerConfig TenantControlPlaneReconcilerConfig, tenantControlPlane kamajiv1alpha1.TenantControlPlane) []resources.Resource {
 	return []resources.Resource{
 		&konnectivity.EgressSelectorConfigurationResource{
 			Client: c,
@@ -290,6 +346,13 @@ func getInternalKonnectivityResources(c client.Client, log logr.Logger) []resour
 	}
 }
 
+func getArrayFromString(s string) []string {
+	var a []string
+	a = append(a, strings.Split(s, separator)...)
+
+	return a
+}
+
 func getNamespacedName(namespace string, name string) k8stypes.NamespacedName {
 	return k8stypes.NamespacedName{Namespace: namespace, Name: name}
 }

controllers/storage.go

@@ -8,97 +8,78 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
-	"net"
-	"strconv"
+	"strings"
 
 	"github.com/pkg/errors"
+	corev1 "k8s.io/api/core/v1"
+	k8stypes "k8s.io/apimachinery/pkg/types"
 
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/datastore"
+	"github.com/clastix/kamaji/internal/sql"
+	"github.com/clastix/kamaji/internal/types"
 )
 
-func (r *TenantControlPlaneReconciler) getStorageConnection(ctx context.Context, ds kamajiv1alpha1.DataStore) (datastore.Connection, error) {
-	ca, err := ds.Spec.TLSConfig.CertificateAuthority.Certificate.GetContent(ctx, r.Client)
-	if err != nil {
+func (r *TenantControlPlaneReconciler) getStorageConnection(ctx context.Context) (sql.DBConnection, error) {
+	var driver sql.Driver
+	var dbName string
+
+	// TODO: https://github.com/clastix/kamaji/issues/67
+	switch r.Config.ETCDStorageType {
+	case types.ETCD:
+		return nil, nil
+	case types.KineMySQL:
+		driver = sql.MySQL
+		dbName = "mysql"
+	case types.KinePostgreSQL:
+		driver = sql.PostgreSQL
+	default:
+		return nil, nil
+	}
+
+	secret := &corev1.Secret{}
+	namespacedName := k8stypes.NamespacedName{Namespace: r.Config.KineSecretNamespace, Name: r.Config.KineSecretName}
+	if err := r.Client.Get(ctx, namespacedName, secret); err != nil {
 		return nil, err
 	}
 
-	crt, err := ds.Spec.TLSConfig.ClientCertificate.Certificate.GetContent(ctx, r.Client)
-	if err != nil {
-		return nil, err
+	if t := "kamaji.clastix.io/kine"; string(secret.Type) != t {
+		return nil, fmt.Errorf("expecting a secret of type %s", t)
 	}
 
-	key, err := ds.Spec.TLSConfig.ClientCertificate.PrivateKey.GetContent(ctx, r.Client)
-	if err != nil {
-		return nil, err
+	keys := []string{"ca.crt", "server.crt", "server.key", "username", "password"}
+
+	if secret.Data == nil {
+		return nil, fmt.Errorf("the Kine secret %s/%s is missing all the required keys (%s)", secret.GetNamespace(), secret.GetName(), strings.Join(keys, ","))
+	}
+
+	for _, key := range keys {
+		if _, ok := secret.Data[key]; !ok {
+			return nil, fmt.Errorf("missing required key %s for the Kine secret %s/%s", key, secret.GetNamespace(), secret.GetName())
+		}
 	}
 
 	rootCAs := x509.NewCertPool()
-	if ok := rootCAs.AppendCertsFromPEM(ca); !ok {
+	if ok := rootCAs.AppendCertsFromPEM(secret.Data["ca.crt"]); !ok {
 		return nil, fmt.Errorf("error create root CA for the DB connector")
 	}
 
-	certificate, err := tls.X509KeyPair(crt, key)
+	certificate, err := tls.X509KeyPair(secret.Data["server.crt"], secret.Data["server.key"])
 	if err != nil {
 		return nil, errors.Wrap(err, "cannot retrieve x.509 key pair from the Kine Secret")
 	}
 
-	var user, password string
-	if auth := ds.Spec.BasicAuth; auth != nil {
-		u, err := auth.Username.GetContent(ctx, r.Client)
-		if err != nil {
-			return nil, err
-		}
-		user = string(u)
-
-		p, err := auth.Password.GetContent(ctx, r.Client)
-		if err != nil {
-			return nil, err
-		}
-		password = string(p)
-	}
-
-	eps := make([]datastore.ConnectionEndpoint, 0, len(ds.Spec.Endpoints))
-
-	for _, ep := range ds.Spec.Endpoints {
-		host, stringPort, err := net.SplitHostPort(ep)
-		if err != nil {
-			return nil, errors.Wrap(err, "cannot retrieve host-port pair from DataStore endpoints")
-		}
-
-		port, err := strconv.Atoi(stringPort)
-		if err != nil {
-			return nil, errors.Wrap(err, "cannot convert port from string for the given DataStore")
-		}
-
-		eps = append(eps, datastore.ConnectionEndpoint{
-			Host: host,
-			Port: port,
-		})
-	}
-
-	cc := datastore.ConnectionConfig{
-		User:      user,
-		Password:  password,
-		Endpoints: eps,
-		TLSConfig: &tls.Config{
-			RootCAs:      rootCAs,
-			Certificates: []tls.Certificate{certificate},
+	return sql.GetDBConnection(
+		sql.ConnectionConfig{
+			SQLDriver: driver,
+			User:      string(secret.Data["username"]),
+			Password:  string(secret.Data["password"]),
+			Host:      r.Config.KineHost,
+			Port:      r.Config.KinePort,
+			DBName:    dbName,
+			TLSConfig: &tls.Config{
+				ServerName:   r.Config.KineHost,
+				RootCAs:      rootCAs,
+				Certificates: []tls.Certificate{certificate},
+			},
 		},
-	}
-
-	switch ds.Spec.Driver {
-	case kamajiv1alpha1.KineMySQLDriver:
-		cc.TLSConfig.ServerName = cc.Endpoints[0].Host
-
-		return datastore.NewMySQLConnection(cc)
-	case kamajiv1alpha1.KinePostgreSQLDriver:
-		cc.TLSConfig.ServerName = cc.Endpoints[0].Host
-		//nolint:contextcheck
-		return datastore.NewPostgreSQLConnection(cc)
-	case kamajiv1alpha1.EtcdDriver:
-		return datastore.NewETCDConnection(cc)
-	default:
-		return nil, fmt.Errorf("%s is not a valid driver", ds.Spec.Driver)
-	}
+	)
 }

controllers/tcp_channel.go

@@ -1,8 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package controllers
-
-import "sigs.k8s.io/controller-runtime/pkg/event"
-
-type TenantControlPlaneChannel chan event.GenericEvent

controllers/tenantcontrolplane_controller.go

@@ -7,25 +7,22 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/pkg/errors"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	k8stypes "k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/util/workqueue"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-	"sigs.k8s.io/controller-runtime/pkg/event"
-	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/source"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
 	kamajierrors "github.com/clastix/kamaji/internal/errors"
 	"github.com/clastix/kamaji/internal/resources"
+	"github.com/clastix/kamaji/internal/sql"
+	"github.com/clastix/kamaji/internal/types"
 )
 
 const (
@@ -35,26 +32,36 @@ const (
 // TenantControlPlaneReconciler reconciles a TenantControlPlane object.
 type TenantControlPlaneReconciler struct {
 	client.Client
-	Scheme      *runtime.Scheme
-	Config      TenantControlPlaneReconcilerConfig
-	TriggerChan TenantControlPlaneChannel
+	Scheme *runtime.Scheme
+	Config TenantControlPlaneReconcilerConfig
 }
 
 // TenantControlPlaneReconcilerConfig gives the necessary configuration for TenantControlPlaneReconciler.
 type TenantControlPlaneReconcilerConfig struct {
-	DataStoreName      string
-	KineContainerImage string
-	TmpBaseDirectory   string
+	ETCDStorageType           types.ETCDStorageType
+	ETCDCASecretName          string
+	ETCDCASecretNamespace     string
+	ETCDClientSecretName      string
+	ETCDClientSecretNamespace string
+	ETCDEndpoints             string
+	ETCDCompactionInterval    string
+	TmpBaseDirectory          string
+	DBConnection              sql.DBConnection
+	KineSecretName            string
+	KineSecretNamespace       string
+	KineHost                  string
+	KinePort                  int
+	KineContainerImage        string
 }
 
 //+kubebuilder:rbac:groups=kamaji.clastix.io,resources=tenantcontrolplanes,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=kamaji.clastix.io,resources=tenantcontrolplanes/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=kamaji.clastix.io,resources=tenantcontrolplanes/finalizers,verbs=update
-//+kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=get;list;watch;create;update;patch;delete
 
 func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	log := log.FromContext(ctx)
@@ -75,16 +82,17 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 		return ctrl.Result{}, nil
 	}
 
-	ds := kamajiv1alpha1.DataStore{}
-	if err = r.Client.Get(ctx, k8stypes.NamespacedName{Name: r.Config.DataStoreName}, &ds); err != nil {
-		return ctrl.Result{}, errors.Wrap(err, "cannot retrieve kamajiv1alpha.DataStore object")
-	}
-
-	dsConnection, err := r.getStorageConnection(ctx, ds)
+	dbConnection, err := r.getStorageConnection(ctx)
 	if err != nil {
 		return ctrl.Result{}, err
 	}
-	defer dsConnection.Close()
+	defer func() {
+		// TODO: Currently, etcd is not accessed using this dbConnection. For that reason we need this check
+		// Check: https://github.com/clastix/kamaji/issues/67
+		if dbConnection != nil {
+			dbConnection.Close()
+		}
+	}()
 
 	if markedToBeDeleted {
 		log.Info("marked for deletion, performing clean-up")
@@ -94,12 +102,12 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 			log:                 log,
 			tcpReconcilerConfig: r.Config,
 			tenantControlPlane:  *tenantControlPlane,
-			connection:          dsConnection,
+			DBConnection:        dbConnection,
 		}
 		registeredDeletableResources := GetDeletableResources(groupDeleteableResourceBuilderConfiguration)
 
 		for _, resource := range registeredDeletableResources {
-			if err = resources.HandleDeletion(ctx, resource, tenantControlPlane); err != nil {
+			if err := resources.HandleDeletion(ctx, resource, tenantControlPlane); err != nil {
 				return ctrl.Result{}, err
 			}
 		}
@@ -107,7 +115,7 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 		if hasFinalizer {
 			log.Info("removing finalizer")
 
-			if err = r.RemoveFinalizer(ctx, tenantControlPlane); err != nil {
+			if err := r.RemoveFinalizer(ctx, tenantControlPlane); err != nil {
 				return ctrl.Result{}, err
 			}
 		}
@@ -126,8 +134,7 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 		log:                 log,
 		tcpReconcilerConfig: r.Config,
 		tenantControlPlane:  *tenantControlPlane,
-		DataStore:           ds,
-		Connection:          dsConnection,
+		DBConnection:        dbConnection,
 	}
 	registeredResources := GetResources(groupResourceBuilderConfiguration)
 
@@ -164,14 +171,6 @@ func (r *TenantControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.R
 // SetupWithManager sets up the controller with the Manager.
 func (r *TenantControlPlaneReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
-		Watches(&source.Channel{Source: r.TriggerChan}, handler.Funcs{GenericFunc: func(genericEvent event.GenericEvent, limitingInterface workqueue.RateLimitingInterface) {
-			limitingInterface.AddRateLimited(ctrl.Request{
-				NamespacedName: k8stypes.NamespacedName{
-					Namespace: genericEvent.Object.GetNamespace(),
-					Name:      genericEvent.Object.GetName(),
-				},
-			})
-		}}).
 		For(&kamajiv1alpha1.TenantControlPlane{}).
 		Owns(&corev1.Secret{}).
 		Owns(&corev1.ConfigMap{}).

deploy/kine/README.md

@@ -7,20 +7,41 @@ This can help in overcoming the `etcd` limitation regarding scalability and clus
 
 ## Kamaji additional CLI flags
 
-Kamaji read the data store configuration from a cluster-scoped resource named `DataStore`, containing all tha required details to secure a connection using a specific driver. 
-
-- [Example of a `etcd` DataStore](./../../config/samples/kamaji_v1alpha1_datastore_etcd.yaml)
-- [Example of a `MySQL` DataStore](./../../config/samples/kamaji_v1alpha1_datastore_mysql.yaml)
-- [Example of a `PostgreSQL` DataStore](./../../config/samples/kamaji_v1alpha1_datastore_postgresql.yaml)
-
-Once the datastore is running, and the `DataStore` has been created with the required details, we need to provide information about it to Kamaji by using the following flag and pointing to the resource name:
+Once a compatible database is running, we need to provide information about it to Kamaji by using the following flags:
 
 ```
---datastore={.metadata.name}
+--etcd-storage-type={kine-mysql,kine-postgresql}
+--kine-host=<database host>
+--kine-port=<database port>
+--kine-secret-name=<secret name>
+--kine-secret-namespace=<secret namespace>
 ```
 
+## Kine Secret
+
+The Kine Secret must be configured as follows:
+
+```yaml
+apiVersion: v1
+data:
+  ca.crt: "content of the Certificate Authority for SSL connection"
+  password: "password of the super user"
+  server.crt: "content of the certificate for SSL connection"
+  server.key: "content of the private key for SSL connection"
+  username: "username of the super user"
+kind: Secret
+metadata:
+  name: kine-secret
+  namespace: kamaji-system
+type: kamaji.clastix.io/kine
+```
+
+> Please, pay attention to the type `kamaji.clastix.io/kine`: this check is enforced at the code level to ensure the required data is provided.
+
+> Actually, the `kine` integration expects a secured connection to the database since the sensitivity data of the Tenant.
+
 ## Drivers
 
 Further details on the setup for each driver are available here:
 - [MySQL/MariaDB](../deploy/kine/mysql/README.md)
-- [PostgreSQL](../deploy/kine/postgresql/README.md)
+- [PostgreSQL](../deploy/kine/postgresql/README.md)

deploy/kine/mysql/Makefile

@@ -1,6 +1,6 @@
 ROOT_DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
 
-mariadb: mariadb-certificates mariadb-secret mariadb-deployment
+mariadb: mariadb-certificates mariadb-secret mariadb-kine-secret mariadb-deployment
 
 mariadb-certificates:
 	rm -rf $(ROOT_DIR)/certs && mkdir $(ROOT_DIR)/certs
@@ -22,6 +22,15 @@ mariadb-secret:
 		--from-literal=MYSQL_ROOT_PASSWORD=root \
 		--dry-run=client -o yaml | kubectl apply -f -
 
+mariadb-kine-secret:
+	@\
+		CA=$$(cat $(ROOT_DIR)/certs/ca.crt | base64 | tr -d '\n') \
+		CRT=$$(cat $(ROOT_DIR)/certs/server.crt | base64 | tr -d '\n') \
+		KEY=$$(cat $(ROOT_DIR)/certs/server.key | base64 | tr -d '\n') \
+		ROOT_USERNAME=$$(echo -n root | base64) \
+		ROOT_PASSWORD=$$(kubectl -n kamaji-system get secret mysql-config -o jsonpath='{.data.MYSQL_ROOT_PASSWORD}') \
+		envsubst < $(ROOT_DIR)/../secret.yaml | kubectl -n kamaji-system apply -f -
+
 mariadb-deployment:
 	@kubectl -n kamaji-system apply -f $(ROOT_DIR)/mariadb.yaml
 

deploy/kine/mysql/README.md

@@ -59,6 +59,14 @@ $ make mariadb-secrets
 Previous certificates and MySQL configuration have to be available in order to be used.
 They will be under the secret `kamaji-system:mysql-config`, used by the MySQL/MariaDB instance.
 
+## Kine Secret
+
+```bash
+$ make mariadb-kine-secret
+```
+
+Organize the required Kine data such as username, password, CA, certificate, and private key to be stored in the Kamaji desired format.
+
 ## Deployment
 
 ```bash

deploy/kine/postgresql/Makefile

@@ -1,6 +1,6 @@
 ROOT_DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
 
-postgresql: cnpg-setup cnpg-deploy postgresql-secret
+postgresql: cnpg-setup cnpg-deploy postgresql-secret postgresql-kine-secret
 
 cnpg-setup:
 	@kubectl apply -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-1.16.0.yaml
@@ -21,6 +21,15 @@ postgresql-secret: cnpg
     		--cnpg-cluster postgresql \
     		--cnpg-user $$(kubectl -n kamaji-system get secret postgresql-superuser -o jsonpath='{.data.username}' | base64 -d)
 
+postgresql-kine-secret:
+	@\
+		CA=$$(kubectl -n kamaji-system get secret postgresql-ca -o jsonpath='{.data.ca\.crt}') \
+		CRT=$$(kubectl -n kamaji-system get secret postgres-root-cert -o jsonpath='{.data.tls\.crt}') \
+		KEY=$$(kubectl -n kamaji-system get secret postgres-root-cert -o jsonpath='{.data.tls\.key}') \
+		ROOT_USERNAME=$$(kubectl -n kamaji-system get secret postgresql-superuser -o jsonpath='{.data.username}' ) \
+		ROOT_PASSWORD=$$(kubectl -n kamaji-system get secret postgresql-superuser -o jsonpath='{.data.password}' ) \
+		envsubst < $(ROOT_DIR)/../secret.yaml | kubectl -n kamaji-system apply -f -
+
 postgresql-destroy:
 	@kubectl delete -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-1.16.0.yaml --ignore-not-found && \
 	kubectl delete secret postgres-root-cert --ignore-not-found && \

deploy/kine/postgresql/README.md

@@ -1,7 +1,6 @@
 # PostgreSQL as Kubernetes Storage
 
-Kamaji offers the possibility of having a different storage system than `etcd` thanks to [kine](https://github.com/k3s-io/kine).
-One of the implementations is [PostgreSQL](https://www.postgresql.org/).
+Kamaji offers the possibility of having a different storage system than `etcd` thanks to [kine](https://github.com/k3s-io/kine). One of the implementations is [PostgreSQL](https://www.postgresql.org/).
 
 Kamaji project is developed using [kind](https://kind.sigs.k8s.io), therefore, a PostgreSQL instance must be deployed in advance into the local kubernetes cluster in order to be used as storage for the tenants.
 For the sake of simplicity, the [cloudnative-pg](https://cloudnative-pg.io/) Operator will be used to simplify the setup of it.
@@ -35,6 +34,7 @@ validatingwebhookconfiguration.admissionregistration.k8s.io/cnpg-validating-webh
 deployment "cnpg-controller-manager" successfully rolled out
 cluster.postgresql.cnpg.io/postgresql unchanged
 secret/postgres-root-cert created
+secret/kine-secret created
 ```
 
 ## Operator setup
@@ -55,13 +55,15 @@ $ make postgresql-secret
 
 This target will download locally the `kubectl-cnpg` utility to generate an SSL certificate required to secure the connection to the PostgreSQL instance.
 
-## Certificate generation
+## Kine Secret generation
 
 ```bash
-$ make postgresql-secret
+$ make postgresql-kine-secret
 ```
 
-Generate the Certificate required to connect to the DataStore.
+Generate the Kine secret required for Kamaji.
+
+> Requires the generation of the `postgresql-secret`
 
 ## Teardown
 

deploy/kine/secret.yaml

@@ -0,0 +1,14 @@
+# secret.yaml is the Secret object that Kamaji is expecting to user to connect to the Kine SQL datastore:
+# certificates keys are required, username and password are optional.
+apiVersion: v1
+kind: Secret
+data:
+  ca.crt: ${CA}
+  server.crt: ${CRT}
+  server.key: ${KEY}
+  username: ${ROOT_USERNAME}
+  password: ${ROOT_PASSWORD}
+metadata:
+  creationTimestamp: null
+  name: kine-secret
+type: kamaji.clastix.io/kine

docs/getting-started-with-kamaji.md

@@ -57,7 +57,9 @@ Kamaji offers the possibility of using a different storage system than `ETCD` fo
 
 Read it more in the provided [guide](../deploy/kine/README.md).
 
-Assuming you adjusted the [Kamaji manifest](../config/install.yaml) to connect to Kine and compatible database using the proper driver, you can now install it.
+
+
+Assuming you adjusted the [Kamaji manifest](./config/install.yaml) to connect to Kine and compatible database using the proper driver, you can now install it.
 
 ### Install Kamaji
 

docs/reference.md

@@ -15,30 +15,49 @@ This is easily explained in this way:
 Available flags are the following:
 
 ```
---config-file string                 Configuration file alternative. (default "kamaji.yaml")
---datastore string                   The default DataStore that should be used by Kamaji to setup the required storage (default "etcd")
+--config-file string                 Configuration file alternative. (default "./kamaji.yaml")
+--etcd-ca-secret-name                Name of the secret which contains CA's certificate and private key. (default: "etcd-certs")
+--etcd-ca-secret-namespace           Namespace of the secret which contains CA's certificate and private key. (default: "kamaji")
+--etcd-client-secret-name            Name of the secret which contains ETCD client certificates. (default: "root-client-certs")
+--etcd-client-secret-namespace       Name of the namespace where the secret which contains ETCD client certificates is. (default: "kamaji")
+--etcd-compaction-interval           ETCD Compaction interval (i.e. "5m0s"). (default: "0" (disabled))
+--etcd-endpoints                     Comma-separated list with ETCD endpoints (i.e. https://etcd-0.etcd.kamaji.svc.cluster.local,https://etcd-1.etcd.kamaji.svc.cluster.local,https://etcd-2.etcd.kamaji.svc.cluster.local)
+--etcd-storage-type                  ETCD Storage type (i.e. "etcd", "kine-mysql", "kine-postgresql"). (default: "etcd")
 --health-probe-bind-address string   The address the probe endpoint binds to. (default ":8081")
---kine-image string                  Container image along with tag to use for the Kine sidecar container (used only if etcd-storage-type is set to one of kine strategies) (default "rancher/kine:v0.9.2-amd64")
+--kine-port int                      Port where the DB used by Kine is listening to.
+--kine-host string                   Host where the DB used by Kine is working.
+--kine-secret-name                   Name of the secret which contains the Kine configuration. (default: "kine-secret")
+--kine-secret-name                   Name of the namespace where the secret which contains the Kine configuration. (default: "kamaji-system")
 --kubeconfig string                  Paths to a kubeconfig. Only required if out-of-cluster.
 --leader-elect                       Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
 --metrics-bind-address string        The address the metric endpoint binds to. (default ":8080")
---tmp-directory string               Directory which will be used to work with temporary files. (default "/tmp/kamaji")
+--tmp-directory                      Directory which will be used to work with temporary files. (default "/tmp/kamaji")
 --zap-devel                          Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error) (default true)
 --zap-encoder encoder                Zap log encoding (one of 'json' or 'console')
 --zap-log-level level                Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', or any integer value > 0 which corresponds to custom debug levels of increasing verbosity
 --zap-stacktrace-level level         Zap Level at and above which stacktraces are captured (one of 'info', 'error', 'panic').
---zap-time-encoding time-encoding    Zap time encoding (one of 'epoch', 'millis', 'nano', 'iso8601', 'rfc3339' or 'rfc3339nano'). Defaults to 'epoch'.
 ```
 
 Available environment variables are:
 
-| Environment variable                 | Description                                                                                                            |
-|--------------------------------------|------------------------------------------------------------------------------------------------------------------------|
-| `KAMAJI_DATASTORE`                   | Name of the DataStore resource with driver definition and settings. (default "etcd")                                   |
-| `KAMAJI_METRICS_BIND_ADDRESS`        | The address the metric endpoint binds to. (default ":8080")                                                            |
-| `KAMAJI_HEALTH_PROBE_BIND_ADDRESS`   | The address the probe endpoint binds to. (default ":8081")                                                             |
-| `KAMAJI_LEADER_ELECTION`             | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.  |
-| `KAMAJI_TMP_DIRECTORY`               | Directory which will be used to work with temporary files. (default "/tmp/kamaji")                                     |
+| Environment variable               | Description                                                  |
+| ---------------------------------- | ------------------------------------------------------------ |
+| `KAMAJI_ETCD_CA_SECRET_NAME`      | Name of the secret which contains CA's certificate and private key. (default: "etcd-certs")  |
+| `KAMAJI_ETCD_CA_SECRET_NAMESPACE`      | Namespace of the secret which contains CA's certificate and private key. (default: "kamaji")  |
+| `KAMAJI_ETCD_CLIENT_SECRET_NAME`      | Name of the secret which contains ETCD client certificates. (default: "root-client-certs")  |
+| `KAMAJI_ETCD_CLIENT_SECRET_NAMESPACE`      | Name of the namespace where the secret which contains ETCD client certificates is. (default: "kamaji")  |
+| `KAMAJI_ETCD_COMPACTION_INTERVAL`      | ETCD Compaction interval (i.e. "5m0s"). (default: "0" (disabled))  |
+| `KAMAJI_ETCD_ENDPOINTS`      | Comma-separated list with ETCD endpoints (i.e. etcd-server-1:2379,etcd-server-2:2379). (default: "etcd-server:2379")  |
+| `KAMAJI_ETCD_STORAGE_TYPE`      | ETCD Storage type (i.e. "etcd", "kine-mysql"). (default: "etcd")  |
+| `KAMAJI_ETCD_SERVERS`      | Comma-separated list with ETCD servers (i.e. etcd-0.etcd.kamaji.svc.cluster.local,etcd-1.etcd.kamaji.svc.cluster.local,etcd-2.etcd.kamaji.svc.cluster.local)  |
+| `KAMAJI_METRICS_BIND_ADDRESS`      | The address the metric endpoint binds to. (default ":8080")  |
+| `KAMAJI_HEALTH_PROBE_BIND_ADDRESS` | The address the probe endpoint binds to. (default ":8081")   |
+| `KAMAJI_KINE_MYSQL_HOST` | Host where MySQL is running(default "localhost")   |
+| `KAMAJI_KINE_MYSQL_PORT` | Port where MySQL is running (default: 3306)   |
+| `KAMAJI_KINE_MYSQL_SECRET_NAME` | Name of the secret where the necessary configuration and certificates are. (default: "mysql-config")   |
+| `KAMAJI_KINE_MYSQL_SECRET_NAMESPACE` | Name of the namespace of the secret where the necessary configuration and certificates are. (default: "kamaji-system")   |
+| `KAMAJI_LEADER_ELECTION`           | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. |
+| `KAMAJI_TMP_DIRECTORY`           | Directory which will be used to work with temporary files. (default "/tmp/kamaji") |
 
 
 ## Build and deploy
@@ -111,4 +130,3 @@ addons:
         memory: 128Mi
     serverImage: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-server
     agentImage: us.gcr.io/k8s-artifacts-prod/kas-network-proxy/proxy-agent
-```

e2e/suite_test.go

@@ -55,6 +55,7 @@ var _ = BeforeSuite(func() {
 	Expect(err).NotTo(HaveOccurred())
 
 	//+kubebuilder:scaffold:scheme
+
 	k8sClient, err = client.New(cfg, client.Options{Scheme: scheme.Scheme})
 	Expect(err).NotTo(HaveOccurred())
 	Expect(k8sClient).NotTo(BeNil())

e2e/tenant_control_plane_ready_test.go

@@ -18,6 +18,7 @@ import (
 var _ = Describe("Deploy a TenantControlPlane resource", func() {
 	// Fill TenantControlPlane object
 	tcp := kamajiv1alpha1.TenantControlPlane{
+		TypeMeta: metav1.TypeMeta{},
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "tcp-clusterip",
 			Namespace: "default",

e2e/utils_test.go

@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"os/exec"
 
 	. "github.com/onsi/ginkgo"
@@ -96,7 +96,7 @@ func PrintKamajiLogs() {
 
 		defer podLogs.Close()
 
-		podBytes, err := io.ReadAll(podLogs)
+		podBytes, err := ioutil.ReadAll(podLogs)
 		Expect(err).ToNot(HaveOccurred())
 
 		_, _ = fmt.Fprintln(GinkgoWriter, "DEBUG: retrieving Kamaji Pod logs")

e2e/worker_kubeadm_join_test.go

@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"strings"
 	"time"
@@ -36,6 +37,7 @@ var _ = Describe("starting a kind worker with kubeadm", func() {
 
 	JustBeforeEach(func() {
 		tcp = kamajiv1alpha1.TenantControlPlane{
+			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "worker-nodes-join",
 				Namespace: "default",
@@ -82,7 +84,7 @@ var _ = Describe("starting a kind worker with kubeadm", func() {
 		})
 		Expect(err).ToNot(HaveOccurred())
 
-		kubeconfigFile, err = os.CreateTemp("", "kamaji")
+		kubeconfigFile, err = ioutil.TempFile("", "kamaji")
 		Expect(err).ToNot(HaveOccurred())
 	})
 

e2e/worker_tcp_change_port_test.go

@@ -6,6 +6,7 @@ package e2e
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"time"
 
@@ -65,7 +66,7 @@ var _ = Describe("validating kubeconfig", func() {
 
 		var err error
 
-		kubeconfigFile, err = os.CreateTemp("", "kamaji")
+		kubeconfigFile, err = ioutil.TempFile("", "kamaji")
 		Expect(err).ToNot(HaveOccurred())
 	})
 

internal/builders/controlplane/deployment.go

@@ -18,6 +18,7 @@ import (
 	"k8s.io/utils/pointer"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/types"
 	"github.com/clastix/kamaji/internal/utilities"
 )
 
@@ -27,6 +28,7 @@ const (
 	apiServerIndex orderedIndex = iota
 	schedulerIndex
 	controllerManagerIndex
+	kineIndex
 )
 
 const (
@@ -37,19 +39,22 @@ const (
 	usrLocalShareCACertificates
 	schedulerKubeconfig
 	controllerManagerKubeconfig
+	kineConfig
+	kineCerts
 )
 
 const (
 	apiServerFlagsAnnotation = "kube-apiserver.kamaji.clastix.io/args"
-	kineContainerName        = "kine"
-	dataStoreCerts           = "kine-config"
+	kineVolumeName           = "kine-config"
 	kineVolumeCertName       = "kine-certs"
 )
 
 type Deployment struct {
-	Address            string
-	KineContainerImage string
-	DataStore          kamajiv1alpha1.DataStore
+	Address                string
+	ETCDEndpoints          []string
+	ETCDCompactionInterval string
+	ETCDStorageType        types.ETCDStorageType
+	KineContainerImage     string
 }
 
 func (d *Deployment) SetContainers(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.TenantControlPlane, address string) {
@@ -114,24 +119,19 @@ func (d *Deployment) buildPKIVolume(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1
 		},
 	}
 
-	if d.DataStore.Spec.Driver == kamajiv1alpha1.EtcdDriver {
+	if d.ETCDStorageType == types.ETCD {
+		sources = append(sources, corev1.VolumeProjection{
+			Secret: d.secretProjection(tcp.Status.Certificates.ETCD.APIServer.SecretName, constants.APIServerEtcdClientCertName, constants.APIServerEtcdClientKeyName),
+		})
 		sources = append(sources, corev1.VolumeProjection{
 			Secret: &corev1.SecretProjection{
 				LocalObjectReference: corev1.LocalObjectReference{
-					Name: tcp.Status.Storage.Certificate.SecretName,
+					Name: tcp.Status.Certificates.ETCD.CA.SecretName,
 				},
 				Items: []corev1.KeyToPath{
 					{
-						Key:  "ca.crt",
-						Path: "etcd/ca.crt",
-					},
-					{
-						Key:  "server.crt",
-						Path: "etcd/server.crt",
-					},
-					{
-						Key:  "server.key",
-						Path: "etcd/server.key",
+						Key:  constants.CACertName,
+						Path: constants.EtcdCACertName,
 					},
 				},
 			},
@@ -262,7 +262,7 @@ func (d *Deployment) BuildScheduler(podSpec *corev1.PodSpec, tenantControlPlane
 	args["--authorization-kubeconfig"] = kubeconfig
 	args["--bind-address"] = "0.0.0.0"
 	args["--kubeconfig"] = kubeconfig
-	args["--leader-elect"] = "true" //nolint:goconst
+	args["--leader-elect"] = "true" // nolint:goconst
 
 	podSpec.Containers[schedulerIndex].Name = "kube-scheduler"
 	podSpec.Containers[schedulerIndex].Image = fmt.Sprintf("k8s.gcr.io/kube-scheduler:%s", tenantControlPlane.Spec.Kubernetes.Version)
@@ -289,7 +289,6 @@ func (d *Deployment) BuildScheduler(podSpec *corev1.PodSpec, tenantControlPlane
 		SuccessThreshold:    1,
 		FailureThreshold:    3,
 	}
-
 	podSpec.Containers[schedulerIndex].StartupProbe = &corev1.Probe{
 		ProbeHandler: corev1.ProbeHandler{
 			HTTPGet: &corev1.HTTPGetAction{
@@ -384,7 +383,6 @@ func (d *Deployment) buildControllerManager(podSpec *corev1.PodSpec, tenantContr
 			MountPath: "/usr/local/share/ca-certificates",
 		},
 	}
-
 	podSpec.Containers[controllerManagerIndex].LivenessProbe = &corev1.Probe{
 		ProbeHandler: corev1.ProbeHandler{
 			HTTPGet: &corev1.HTTPGetAction{
@@ -399,7 +397,6 @@ func (d *Deployment) buildControllerManager(podSpec *corev1.PodSpec, tenantContr
 		SuccessThreshold:    1,
 		FailureThreshold:    3,
 	}
-
 	podSpec.Containers[controllerManagerIndex].StartupProbe = &corev1.Probe{
 		ProbeHandler: corev1.ProbeHandler{
 			HTTPGet: &corev1.HTTPGetAction{
@@ -536,6 +533,7 @@ func (d *Deployment) buildKubeAPIServerCommand(tenantControlPlane *kamajiv1alpha
 		"--client-ca-file":                     path.Join(v1beta3.DefaultCertificatesDir, constants.CACertName),
 		"--enable-admission-plugins":           strings.Join(tenantControlPlane.Spec.Kubernetes.AdmissionControllers.ToSlice(), ","),
 		"--enable-bootstrap-token-auth":        "true",
+		"--etcd-servers":                       strings.Join(d.ETCDEndpoints, ","),
 		"--service-cluster-ip-range":           tenantControlPlane.Spec.NetworkProfile.ServiceCIDR,
 		"--kubelet-client-certificate":         path.Join(v1beta3.DefaultCertificatesDir, constants.APIServerKubeletClientCertName),
 		"--kubelet-client-key":                 path.Join(v1beta3.DefaultCertificatesDir, constants.APIServerKubeletClientKeyName),
@@ -554,23 +552,13 @@ func (d *Deployment) buildKubeAPIServerCommand(tenantControlPlane *kamajiv1alpha
 		"--tls-private-key-file":               path.Join(v1beta3.DefaultCertificatesDir, constants.APIServerKeyName),
 	}
 
-	switch d.DataStore.Spec.Driver {
-	case kamajiv1alpha1.KineMySQLDriver, kamajiv1alpha1.KinePostgreSQLDriver:
-		desiredArgs["--etcd-servers"] = "http://127.0.0.1:2379"
-	case kamajiv1alpha1.EtcdDriver:
-		httpsEndpoints := make([]string, 0, len(d.DataStore.Spec.Endpoints))
-
-		for _, ep := range d.DataStore.Spec.Endpoints {
-			httpsEndpoints = append(httpsEndpoints, fmt.Sprintf("https://%s", ep))
-		}
-
+	if d.ETCDStorageType == types.ETCD {
+		desiredArgs["--etcd-compaction-interval"] = d.ETCDCompactionInterval
+		desiredArgs["--etcd-cafile"] = path.Join(v1beta3.DefaultCertificatesDir, constants.EtcdCACertName)
+		desiredArgs["--etcd-certfile"] = path.Join(v1beta3.DefaultCertificatesDir, constants.APIServerEtcdClientCertName)
+		desiredArgs["--etcd-keyfile"] = path.Join(v1beta3.DefaultCertificatesDir, constants.APIServerEtcdClientKeyName)
 		desiredArgs["--etcd-prefix"] = fmt.Sprintf("/%s", tenantControlPlane.GetName())
-		desiredArgs["--etcd-servers"] = strings.Join(httpsEndpoints, ",")
-		desiredArgs["--etcd-cafile"] = "/etc/kubernetes/pki/etcd/ca.crt"
-		desiredArgs["--etcd-certfile"] = "/etc/kubernetes/pki/etcd/server.crt"
-		desiredArgs["--etcd-keyfile"] = "/etc/kubernetes/pki/etcd/server.key"
 	}
-
 	// Order matters, here: extraArgs could try to overwrite some arguments managed by Kamaji and that would be crucial.
 	// Adding as first element of the array of maps, we're sure that these overrides will be sanitized by our configuration.
 	return utilities.MergeMaps(extraArgs, current, desiredArgs)
@@ -594,7 +582,18 @@ func (d *Deployment) secretProjection(secretName, certKeyName, keyName string) *
 	}
 }
 
-func (d *Deployment) removeKineVolumes(podSpec *corev1.PodSpec) {
+func (d *Deployment) buildKineVolume(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.TenantControlPlane) {
+	// Kine is expecting an additional volume for its configuration, and it must be removed before proceeding with the
+	// customized storage that is idempotent
+	if found, index := utilities.HasNamedVolume(podSpec.Volumes, kineVolumeName); found {
+		var volumes []corev1.Volume
+
+		volumes = append(volumes, podSpec.Volumes[:index]...)
+		volumes = append(volumes, podSpec.Volumes[index+1:]...)
+
+		podSpec.Volumes = volumes
+	}
+
 	if found, index := utilities.HasNamedVolume(podSpec.Volumes, kineVolumeCertName); found {
 		var volumes []corev1.Volume
 
@@ -603,44 +602,37 @@ func (d *Deployment) removeKineVolumes(podSpec *corev1.PodSpec) {
 
 		podSpec.Volumes = volumes
 	}
-}
 
-func (d *Deployment) buildKineVolume(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.TenantControlPlane) {
-	// Adding the volume for chmod'ed Kine certificates.
-	found, index := utilities.HasNamedVolume(podSpec.Volumes, dataStoreCerts)
-	if !found {
-		podSpec.Volumes = append(podSpec.Volumes, corev1.Volume{})
-		index = len(podSpec.Volumes) - 1
-	}
+	if d.ETCDStorageType == types.KineMySQL || d.ETCDStorageType == types.KinePostgreSQL {
+		if index := int(kineConfig) + 1; len(podSpec.Volumes) < index {
+			podSpec.Volumes = append(podSpec.Volumes, corev1.Volume{})
+		}
+		// Adding the volume to read Kine certificates:
+		// these must be subsequently fixed with a chmod due to pg issues with private key.
+		podSpec.Volumes[kineConfig].Name = kineVolumeName
+		podSpec.Volumes[kineConfig].VolumeSource = corev1.VolumeSource{
+			Secret: &corev1.SecretVolumeSource{
+				SecretName:  tcp.Status.Storage.Kine.Certificate.SecretName,
+				DefaultMode: pointer.Int32Ptr(420),
+			},
+		}
+		// Adding the Volume for the certificates with fixed permission
+		if index := int(kineCerts) + 1; len(podSpec.Volumes) < index {
+			podSpec.Volumes = append(podSpec.Volumes, corev1.Volume{})
+		}
 
-	podSpec.Volumes[index].Name = dataStoreCerts
-	podSpec.Volumes[index].VolumeSource = corev1.VolumeSource{
-		Secret: &corev1.SecretVolumeSource{
-			SecretName:  tcp.Status.Storage.Certificate.SecretName,
-			DefaultMode: pointer.Int32Ptr(420),
-		},
-	}
-	if d.DataStore.Spec.Driver == kamajiv1alpha1.EtcdDriver {
-		d.removeKineVolumes(podSpec)
-
-		return
-	}
-	// Adding the volume to read Kine certificates:
-	// these must be subsequently fixed with a chmod due to pg issues with private key.
-	if found, index = utilities.HasNamedVolume(podSpec.Volumes, kineVolumeCertName); !found {
-		podSpec.Volumes = append(podSpec.Volumes, corev1.Volume{})
-		index = len(podSpec.Volumes) - 1
-	}
-
-	podSpec.Volumes[index].Name = kineVolumeCertName
-	podSpec.Volumes[index].VolumeSource = corev1.VolumeSource{
-		EmptyDir: &corev1.EmptyDirVolumeSource{},
+		podSpec.Volumes[kineCerts].Name = kineVolumeCertName
+		podSpec.Volumes[kineCerts].VolumeSource = corev1.VolumeSource{
+			EmptyDir: &corev1.EmptyDirVolumeSource{},
+		}
 	}
 }
 
-func (d *Deployment) removeKineContainers(podSpec *corev1.PodSpec) {
-	found, index := utilities.HasNamedContainer(podSpec.Containers, kineContainerName)
-	if found {
+func (d *Deployment) buildKine(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.TenantControlPlane) {
+	const kineContainerName = "kine"
+	// Kine is expecting an additional container, and it must be removed before proceeding with the additional one
+	// in order to make this function idempotent.
+	if found, index := utilities.HasNamedContainer(podSpec.Containers, kineContainerName); found {
 		var containers []corev1.Container
 
 		containers = append(containers, podSpec.Containers[:index]...)
@@ -648,22 +640,13 @@ func (d *Deployment) removeKineContainers(podSpec *corev1.PodSpec) {
 
 		podSpec.Containers = containers
 	}
-
-	podSpec.InitContainers = nil
-}
-
-func (d *Deployment) buildKine(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.TenantControlPlane) {
-	if d.DataStore.Spec.Driver == kamajiv1alpha1.EtcdDriver {
-		d.removeKineContainers(podSpec)
-
+	// In case of bare ETCD we exit without mangling the PodSpec resource.
+	if d.ETCDStorageType == types.ETCD {
 		return
 	}
-	// Kine is expecting an additional container, and it must be removed before proceeding with the additional one
-	// in order to make this function idempotent.
-	found, index := utilities.HasNamedContainer(podSpec.Containers, kineContainerName)
-	if !found {
+
+	if index := int(kineIndex) + 1; len(podSpec.Containers) < index {
 		podSpec.Containers = append(podSpec.Containers, corev1.Container{})
-		index = len(podSpec.Containers) - 1
 	}
 
 	args := map[string]string{}
@@ -672,11 +655,11 @@ func (d *Deployment) buildKine(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.Tena
 		args = utilities.ArgsFromSliceToMap(tcp.Spec.ControlPlane.Deployment.ExtraArgs.Kine)
 	}
 
-	switch d.DataStore.Spec.Driver {
-	case kamajiv1alpha1.KineMySQLDriver:
-		args["--endpoint"] = "mysql://$(DB_USER):$(DB_PASSWORD)@tcp($(DB_CONNECTION_STRING))/$(DB_SCHEMA)"
-	case kamajiv1alpha1.KinePostgreSQLDriver:
-		args["--endpoint"] = "postgres://$(DB_USER):$(DB_PASSWORD)@$(DB_CONNECTION_STRING)/$(DB_SCHEMA)"
+	switch d.ETCDStorageType {
+	case types.KineMySQL:
+		args["--endpoint"] = "mysql://$(DB_USER):$(DB_PASSWORD)@tcp($(DB_HOST):$(DB_PORT))/$(DB_SCHEMA)"
+	case types.KinePostgreSQL:
+		args["--endpoint"] = "postgres://$(DB_USER):$(DB_PASSWORD)@$(DB_HOST):$(DB_PORT)/$(DB_SCHEMA)"
 	}
 
 	args["--ca-file"] = "/certs/ca.crt"
@@ -697,7 +680,7 @@ func (d *Deployment) buildKine(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.Tena
 			},
 			VolumeMounts: []corev1.VolumeMount{
 				{
-					Name:      dataStoreCerts,
+					Name:      kineVolumeName,
 					ReadOnly:  true,
 					MountPath: "/kine",
 				},
@@ -710,42 +693,42 @@ func (d *Deployment) buildKine(podSpec *corev1.PodSpec, tcp *kamajiv1alpha1.Tena
 		},
 	}
 
-	podSpec.Containers[index].Name = kineContainerName
-	podSpec.Containers[index].Image = d.KineContainerImage
-	podSpec.Containers[index].Command = []string{"/bin/kine"}
-	podSpec.Containers[index].Args = utilities.ArgsFromMapToSlice(args)
-	podSpec.Containers[index].VolumeMounts = []corev1.VolumeMount{
+	podSpec.Containers[kineIndex].Name = kineContainerName
+	podSpec.Containers[kineIndex].Image = d.KineContainerImage
+	podSpec.Containers[kineIndex].Command = []string{"/bin/kine"}
+	podSpec.Containers[kineIndex].Args = utilities.ArgsFromMapToSlice(args)
+	podSpec.Containers[kineIndex].VolumeMounts = []corev1.VolumeMount{
 		{
 			Name:      kineVolumeCertName,
 			MountPath: "/certs",
 			ReadOnly:  false,
 		},
 	}
-	podSpec.Containers[index].TerminationMessagePath = corev1.TerminationMessagePathDefault
-	podSpec.Containers[index].TerminationMessagePolicy = corev1.TerminationMessageReadFile
-	podSpec.Containers[index].Env = []corev1.EnvVar{
+	podSpec.Containers[kineIndex].TerminationMessagePath = corev1.TerminationMessagePathDefault
+	podSpec.Containers[kineIndex].TerminationMessagePolicy = corev1.TerminationMessageReadFile
+	podSpec.Containers[kineIndex].Env = []corev1.EnvVar{
 		{
 			Name:  "GODEBUG",
 			Value: "x509ignoreCN=0",
 		},
 	}
-	podSpec.Containers[index].EnvFrom = []corev1.EnvFromSource{
+	podSpec.Containers[kineIndex].EnvFrom = []corev1.EnvFromSource{
 		{
 			SecretRef: &corev1.SecretEnvSource{
 				LocalObjectReference: corev1.LocalObjectReference{
-					Name: tcp.Status.Storage.Config.SecretName,
+					Name: tcp.Status.Storage.Kine.Config.SecretName,
 				},
 			},
 		},
 	}
-	podSpec.Containers[index].Ports = []corev1.ContainerPort{
+	podSpec.Containers[kineIndex].Ports = []corev1.ContainerPort{
 		{
 			ContainerPort: 2379,
 			Name:          "server",
 			Protocol:      corev1.ProtocolTCP,
 		},
 	}
-	podSpec.Containers[index].ImagePullPolicy = corev1.PullAlways
+	podSpec.Containers[kineIndex].ImagePullPolicy = corev1.PullAlways
 }
 
 func (d *Deployment) SetSelector(deploymentSpec *appsv1.DeploymentSpec, tcp *kamajiv1alpha1.TenantControlPlane) {

internal/config/config.go

@@ -21,10 +21,18 @@ var (
 )
 
 const (
-	envPrefix           = "KAMAJI"
-	defaultTmpDirectory = "/tmp/kamaji"
-	defaultKineImage    = "rancher/kine:v0.9.2-amd64"
-	defaultDataStore    = "etcd"
+	envPrefix                        = "KAMAJI"
+	defaultETCDStorageType           = "etcd"
+	defaultETCDCASecretName          = "etcd-certs"
+	defaultETCDCASecretNamespace     = "kamaji-system"
+	defaultETCDEndpoints             = "etcd-server:2379"
+	defaultETCDCompactionInterval    = "0"
+	defaultETCDClientSecretName      = "root-client-certs"
+	defaultETCDClientSecretNamespace = "kamaji-system"
+	defaultTmpDirectory              = "/tmp/kamaji"
+	defaultKineSecretName            = "kine-secret"
+	defaultKineSecretNamespace       = "kamaji-system"
+	defaultKineImage                 = "rancher/kine:v0.9.2-amd64"
 )
 
 func InitConfig() (*viper.Viper, error) {
@@ -36,12 +44,21 @@ func InitConfig() (*viper.Viper, error) {
 	flag.String("health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
 	flag.Bool("leader-elect", false, "Enable leader election for controller manager. "+
 		"Enabling this will ensure there is only one active controller manager.")
+	flag.String("etcd-storage-type", defaultETCDStorageType, "Type of storage for ETCD (i.e etcd, kine-mysql, kine-psql)")
+	flag.String("etcd-ca-secret-name", defaultETCDCASecretName, "Name of the secret which contains CA's certificate and private key.")
+	flag.String("etcd-ca-secret-namespace", defaultETCDCASecretNamespace, "Namespace of the secret which contains CA's certificate and private key.")
+	flag.String("etcd-client-secret-name", defaultETCDClientSecretName, "Name of the secret which contains ETCD client certificates")
+	flag.String("etcd-client-secret-namespace", defaultETCDClientSecretNamespace, "Name of the namespace where the secret which contains ETCD client certificates is")
+	flag.String("etcd-endpoints", defaultETCDEndpoints, "Comma-separated list with ETCD endpoints (i.e. https://etcd-0.etcd.kamaji-system.svc.cluster.local,https://etcd-1.etcd.kamaji-system.svc.cluster.local,https://etcd-2.etcd.kamaji-system.svc.cluster.local)")
+	flag.String("etcd-compaction-interval", defaultETCDCompactionInterval, "ETCD Compaction interval (i.e. \"5m0s\"). (default: \"0\" (disabled))")
 	flag.String("tmp-directory", defaultTmpDirectory, "Directory which will be used to work with temporary files.")
+	flag.String("kine-secret-name", defaultKineSecretName, "Name of the secret which contains the Kine configuration.")
+	flag.String("kine-secret-namespace", defaultKineSecretNamespace, "Name of the namespace where the secret which contains the Kine configuration.")
+	flag.String("kine-host", "", "Host where the DB used by Kine is working.")
+	flag.Int("kine-port", 0, "Port where the DB used by Kine is listening to.")
 	flag.String("kine-image", defaultKineImage, "Container image along with tag to use for the Kine sidecar container (used only if etcd-storage-type is set to one of kine strategies)")
-	flag.String("datastore", defaultDataStore, "The default DataStore that should be used by Kamaji to setup the required storage")
 
 	// Setup zap configuration
-
 	opts := zap.Options{
 		Development: true,
 	}
@@ -67,13 +84,43 @@ func InitConfig() (*viper.Viper, error) {
 	if err := config.BindEnv("leader-elect", fmt.Sprintf("%s_LEADER_ELECTION", envPrefix)); err != nil {
 		return nil, err
 	}
+	if err := config.BindEnv("etcd-storage-type", fmt.Sprintf("%s_ETCD_STORAGE_TYPE", envPrefix)); err != nil {
+		return nil, err
+	}
+	if err := config.BindEnv("etcd-ca-secret-name", fmt.Sprintf("%s_ETCD_CA_SECRET_NAME", envPrefix)); err != nil {
+		return nil, err
+	}
+	if err := config.BindEnv("etcd-ca-secret-namespace", fmt.Sprintf("%s_ETCD_CA_SECRET_NAMESPACE", envPrefix)); err != nil {
+		return nil, err
+	}
+	if err := config.BindEnv("etcd-client-secret-name", fmt.Sprintf("%s_ETCD_CLIENT_SECRET_NAME", envPrefix)); err != nil {
+		return nil, err
+	}
+	if err := config.BindEnv("etcd-client-secret-namespace", fmt.Sprintf("%s_ETCD_CLIENT_SECRET_NAMESPACE", envPrefix)); err != nil {
+		return nil, err
+	}
+	if err := config.BindEnv("etcd-endpoints", fmt.Sprintf("%s_ETCD_ENDPOINTS", envPrefix)); err != nil {
+		return nil, err
+	}
+	if err := config.BindEnv("etcd-compaction-interval", fmt.Sprintf("%s_ETCD_COMPACTION_INTERVAL", envPrefix)); err != nil {
+		return nil, err
+	}
 	if err := config.BindEnv("tmp-directory", fmt.Sprintf("%s_TMP_DIRECTORY", envPrefix)); err != nil {
 		return nil, err
 	}
-	if err := config.BindEnv("kine-image", fmt.Sprintf("%s_KINE_IMAGE", envPrefix)); err != nil {
+	if err := config.BindEnv("kine-secret-name", fmt.Sprintf("%s_KINE_SECRET_NAME", envPrefix)); err != nil {
 		return nil, err
 	}
-	if err := config.BindEnv("datastore", fmt.Sprintf("%s_DATASTORE", envPrefix)); err != nil {
+	if err := config.BindEnv("kine-secret-namespace", fmt.Sprintf("%s_KINE_SECRET_NAMESPACE", envPrefix)); err != nil {
+		return nil, err
+	}
+	if err := config.BindEnv("kine-host", fmt.Sprintf("%s_KINE_HOST", envPrefix)); err != nil {
+		return nil, err
+	}
+	if err := config.BindEnv("kine-port", fmt.Sprintf("%s_KINE_PORT", envPrefix)); err != nil {
+		return nil, err
+	}
+	if err := config.BindEnv("kine-image", fmt.Sprintf("%s_KINE_IMAGE", envPrefix)); err != nil {
 		return nil, err
 	}
 

internal/crypto/crypto.go

@@ -60,7 +60,7 @@ func GetPublickKey(pubKey []byte) (*rsa.PublicKey, error) {
 		return nil, err
 	}
 
-	return pub.(*rsa.PublicKey), nil //nolint:forcetypeassert
+	return pub.(*rsa.PublicKey), nil // nolint:forcetypeassert
 }
 
 func GenerateCertificateKeyPairBytes(template *x509.Certificate, bitSize int, caCert *x509.Certificate, caKey *rsa.PrivateKey) (*bytes.Buffer, *bytes.Buffer, error) {
@@ -76,18 +76,16 @@ func GenerateCertificateKeyPairBytes(template *x509.Certificate, bitSize int, ca
 
 	certPEM := &bytes.Buffer{}
 	if err := pem.Encode(certPEM, &pem.Block{
-		Type:    "CERTIFICATE",
-		Headers: nil,
-		Bytes:   certBytes,
+		Type:  "CERTIFICATE",
+		Bytes: certBytes,
 	}); err != nil {
 		return nil, nil, err
 	}
 
 	certPrivKeyPEM := &bytes.Buffer{}
 	if err := pem.Encode(certPrivKeyPEM, &pem.Block{
-		Type:    "RSA PRIVATE KEY",
-		Headers: nil,
-		Bytes:   x509.MarshalPKCS1PrivateKey(certPrivKey),
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(certPrivKey),
 	}); err != nil {
 		return nil, nil, err
 	}
@@ -134,7 +132,7 @@ func checkCertificateValidity(cert x509.Certificate) bool {
 }
 
 func checkCertificateKeyPair(cert x509.Certificate, privKey rsa.PrivateKey) bool {
-	return checkPublicKeys(*cert.PublicKey.(*rsa.PublicKey), privKey.PublicKey) //nolint:forcetypeassert
+	return checkPublicKeys(*cert.PublicKey.(*rsa.PublicKey), privKey.PublicKey) // nolint:forcetypeassert
 }
 
 func checkPublicKeys(a rsa.PublicKey, b rsa.PublicKey) bool {

internal/datastore/datastore.go

@@ -1,56 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package datastore
-
-import (
-	"context"
-	"crypto/tls"
-	"fmt"
-)
-
-type ConnectionEndpoint struct {
-	Host string
-	Port int
-}
-
-func (r ConnectionEndpoint) String() string {
-	return fmt.Sprintf("%s:%d", r.Host, r.Port)
-}
-
-type ConnectionConfig struct {
-	User       string
-	Password   string
-	Endpoints  []ConnectionEndpoint
-	DBName     string
-	TLSConfig  *tls.Config
-	Parameters map[string][]string
-}
-
-func (config ConnectionConfig) getDataSourceNameUserPassword() string {
-	if config.User == "" {
-		return ""
-	}
-
-	if config.Password == "" {
-		return fmt.Sprintf("%s@", config.User)
-	}
-
-	return fmt.Sprintf("%s:%s@", config.User, config.Password)
-}
-
-type Connection interface {
-	CreateUser(ctx context.Context, user, password string) error
-	CreateDB(ctx context.Context, dbName string) error
-	GrantPrivileges(ctx context.Context, user, dbName string) error
-	UserExists(ctx context.Context, user string) (bool, error)
-	DBExists(ctx context.Context, dbName string) (bool, error)
-	GrantPrivilegesExists(ctx context.Context, user, dbName string) (bool, error)
-	DeleteUser(ctx context.Context, user string) error
-	DeleteDB(ctx context.Context, dbName string) error
-	RevokePrivileges(ctx context.Context, user, dbName string) error
-	GetConnectionString() string
-	Close() error
-	Check(ctx context.Context) error
-	Driver() string
-}

internal/datastore/etcd.go

@@ -1,171 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package datastore
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/pkg/errors"
-	"go.etcd.io/etcd/api/v3/authpb"
-	"go.etcd.io/etcd/api/v3/v3rpc/rpctypes"
-	etcdclient "go.etcd.io/etcd/client/v3"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-)
-
-const (
-	// rangeEnd is the key following the last key of the range.
-	// If rangeEnd is ‘\0’, the range is all keys greater than or equal to the key argument
-	// source: https://etcd.io/docs/v3.5/learning/api/
-	rangeEnd = "\\0"
-)
-
-func NewETCDConnection(config ConnectionConfig) (Connection, error) {
-	endpoints := make([]string, 0, len(config.Endpoints))
-
-	for _, ep := range config.Endpoints {
-		endpoints = append(endpoints, ep.String())
-	}
-
-	cfg := etcdclient.Config{
-		Endpoints: endpoints,
-		TLS:       config.TLSConfig,
-	}
-
-	client, err := etcdclient.New(cfg)
-	if err != nil {
-		return nil, err
-	}
-
-	return &EtcdClient{
-		Client: *client,
-	}, nil
-}
-
-type EtcdClient struct {
-	Client etcdclient.Client
-}
-
-func (e *EtcdClient) CreateUser(ctx context.Context, user, password string) error {
-	_, err := e.Client.Auth.UserAddWithOptions(ctx, user, password, &etcdclient.UserAddOptions{
-		NoPassword: true,
-	})
-
-	return err
-}
-
-func (e *EtcdClient) CreateDB(ctx context.Context, dbName string) error {
-	return nil
-}
-
-func (e *EtcdClient) GrantPrivileges(ctx context.Context, user, dbName string) error {
-	_, err := e.Client.Auth.RoleAdd(ctx, dbName)
-	if err != nil {
-		return err
-	}
-
-	permission := etcdclient.PermissionType(authpb.READWRITE)
-	key := e.buildKey(dbName)
-	if _, err = e.Client.RoleGrantPermission(ctx, user, key, rangeEnd, permission); err != nil {
-		return err
-	}
-
-	if _, err = e.Client.UserGrantRole(ctx, user, dbName); err != nil {
-		return err
-	}
-
-	return err
-}
-
-func (e *EtcdClient) UserExists(ctx context.Context, user string) (bool, error) {
-	_, err := e.Client.UserGet(ctx, user)
-	if err != nil {
-		if errors.As(err, &rpctypes.ErrGRPCUserNotFound) {
-			return false, nil
-		}
-
-		return false, err
-	}
-
-	return true, nil
-}
-
-func (e *EtcdClient) DBExists(_ context.Context, dbName string) (bool, error) {
-	return true, nil
-}
-
-func (e *EtcdClient) GrantPrivilegesExists(ctx context.Context, username, dbName string) (bool, error) {
-	_, err := e.Client.RoleGet(ctx, dbName)
-	if err != nil {
-		if errors.As(err, &rpctypes.ErrGRPCRoleNotFound) {
-			return false, nil
-		}
-
-		return false, err
-	}
-
-	user, err := e.Client.UserGet(ctx, username)
-	if err != nil {
-		return false, err
-	}
-
-	for _, i := range user.Roles {
-		if i == dbName {
-			return true, nil
-		}
-	}
-
-	return false, nil
-}
-
-func (e *EtcdClient) DeleteUser(ctx context.Context, user string) error {
-	_, err := e.Client.Auth.UserDelete(ctx, user)
-
-	return err
-}
-
-func (e *EtcdClient) DeleteDB(ctx context.Context, dbName string) error {
-	withRange := etcdclient.WithRange(rangeEnd)
-	prefix := e.buildKey(dbName)
-	_, err := e.Client.Delete(ctx, prefix, withRange)
-
-	return err
-}
-
-func (e *EtcdClient) RevokePrivileges(ctx context.Context, user, dbName string) error {
-	_, err := e.Client.Auth.RoleDelete(ctx, dbName)
-
-	return err
-}
-
-func (e *EtcdClient) GetConnectionString() string {
-	// There's no need for connection string in etcd client:
-	// it's not used by Kine
-	return ""
-}
-
-func (e *EtcdClient) Close() error {
-	return e.Client.Close()
-}
-
-func (e *EtcdClient) Check(ctx context.Context) error {
-	_, err := e.Client.AuthStatus(ctx)
-
-	return err
-}
-
-func (e *EtcdClient) Driver() string {
-	return string(kamajiv1alpha1.EtcdDriver)
-}
-
-func (e *EtcdClient) buildKey(roleName string) string {
-	return fmt.Sprintf("/%s/", roleName)
-}
-
-type Permission struct {
-	Type     int    `json:"type,omitempty"`
-	Key      string `json:"key,omitempty"`
-	RangeEnd string `json:"rangeEnd,omitempty"`
-}

internal/etcd/api.go

@@ -0,0 +1,177 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package etcd
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"time"
+
+	"go.etcd.io/etcd/api/v3/authpb"
+	"go.etcd.io/etcd/api/v3/v3rpc/rpctypes"
+	etcdclient "go.etcd.io/etcd/client/v3"
+	"google.golang.org/grpc/codes"
+)
+
+const (
+	etcdTimeout = 10 // seconds
+
+	//  rangeEnd is the key following the last key of the range.
+	//  If rangeEnd is ‘\0’, the range is all keys greater than or equal to the key argument
+	//  source: https://etcd.io/docs/v3.5/learning/api/
+	rangeEnd = "\\0"
+)
+
+func NewClient(config Config) (*etcdclient.Client, error) {
+	cert, err := tls.X509KeyPair(config.ETCDCertificate, config.ETCDPrivateKey)
+	if err != nil {
+		return nil, err
+	}
+
+	pool := x509.NewCertPool()
+	pool.AppendCertsFromPEM(config.ETCDCA)
+
+	cfg := etcdclient.Config{
+		Endpoints: config.Endpoints,
+		TLS: &tls.Config{ // nolint:gosec
+			Certificates: []tls.Certificate{cert},
+			RootCAs:      pool,
+		},
+	}
+
+	return etcdclient.New(cfg)
+}
+
+func GetUser(ctx context.Context, client *etcdclient.Client, user *User) error {
+	ctxWithTimeout, cancel := context.WithTimeout(ctx, etcdTimeout*time.Second)
+	defer cancel()
+
+	response, err := client.UserGet(ctxWithTimeout, user.Name)
+	if err != nil {
+		var etcdError rpctypes.EtcdError
+		if errors.As(err, &etcdError) && etcdError.Code() == codes.FailedPrecondition {
+			return nil
+		}
+
+		return err
+	}
+
+	user.Roles = response.Roles
+	user.Exists = true
+
+	return nil
+}
+
+func AddUser(ctx context.Context, client *etcdclient.Client, username string) error {
+	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
+	defer cancel()
+	opts := etcdclient.UserAddOptions{
+		NoPassword: true,
+	}
+	_, err := client.Auth.UserAddWithOptions(ctxWithTimeout, username, "", &opts)
+
+	return err
+}
+
+func RemoveUser(ctx context.Context, client *etcdclient.Client, username string) error {
+	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
+	defer cancel()
+
+	_, err := client.Auth.UserDelete(ctxWithTimeout, username)
+
+	return err
+}
+
+func GetRole(ctx context.Context, client *etcdclient.Client, role *Role) error {
+	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
+	defer cancel()
+
+	response, err := client.RoleGet(ctxWithTimeout, role.Name)
+	if err != nil {
+		var etcdError rpctypes.EtcdError
+		if errors.As(err, &etcdError) && etcdError.Code() == codes.FailedPrecondition {
+			return nil
+		}
+
+		return err
+	}
+
+	role.Exists = true
+	for _, perm := range response.Perm {
+		permission := Permission{
+			Type:     int(perm.PermType),
+			Key:      string(perm.Key),
+			RangeEnd: string(perm.RangeEnd),
+		}
+		role.Permissions = append(role.Permissions, permission)
+	}
+
+	return nil
+}
+
+func AddRole(ctx context.Context, client *etcdclient.Client, roleName string) error {
+	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
+	defer cancel()
+
+	_, err := client.Auth.RoleAdd(ctxWithTimeout, roleName)
+
+	return err
+}
+
+func RemoveRole(ctx context.Context, client *etcdclient.Client, roleName string) error {
+	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
+	defer cancel()
+
+	_, err := client.Auth.RoleDelete(ctxWithTimeout, roleName)
+
+	return err
+}
+
+func GrantUserRole(ctx context.Context, client *etcdclient.Client, user User, role Role) error {
+	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
+	defer cancel()
+
+	_, err := client.UserGrantRole(ctxWithTimeout, user.Name, role.Name)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func GrantRolePermission(ctx context.Context, client *etcdclient.Client, role Role) error {
+	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
+	defer cancel()
+
+	permission := etcdclient.PermissionType(authpb.READWRITE)
+	key := BuildKey(role.Name)
+	_, err := client.RoleGrantPermission(ctxWithTimeout, role.Name, key, rangeEnd, permission)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func CleanUpPrefix(ctx context.Context, client *etcdclient.Client, name string) error {
+	ctxWithTimeout, cancel := getContextWithTimeout(ctx)
+	defer cancel()
+
+	withRange := etcdclient.WithRange(rangeEnd)
+	prefix := BuildKey(name)
+	_, err := client.Delete(ctxWithTimeout, prefix, withRange)
+
+	return err
+}
+
+func BuildKey(roleName string) string {
+	return fmt.Sprintf("/%s/", roleName)
+}
+
+func getContextWithTimeout(ctx context.Context) (context.Context, context.CancelFunc) {
+	return context.WithTimeout(ctx, etcdTimeout*time.Second)
+}

internal/etcd/types.go

@@ -0,0 +1,71 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package etcd
+
+type Config struct {
+	ETCDCertificate []byte
+	ETCDPrivateKey  []byte
+	ETCDCA          []byte
+	Endpoints       []string
+}
+
+type Permission struct {
+	Type     int    `json:"type,omitempty"`
+	Key      string `json:"key,omitempty"`
+	RangeEnd string `json:"rangeEnd,omitempty"`
+}
+
+func (in *Permission) DeepCopyInto(out *Permission) {
+	*out = *in
+}
+
+func (in *Permission) DeepCopy() *Permission {
+	if in == nil {
+		return nil
+	}
+	out := new(Permission)
+	in.DeepCopyInto(out)
+
+	return out
+}
+
+type Role struct {
+	Name        string       `json:"name"`
+	Permissions []Permission `json:"permissions,omitempty"`
+	Exists      bool         `json:"exists"`
+}
+
+func (in *Role) DeepCopyInto(out *Role) {
+	*out = *in
+}
+
+func (in *Role) DeepCopy() *Role {
+	if in == nil {
+		return nil
+	}
+	out := new(Role)
+	in.DeepCopyInto(out)
+
+	return out
+}
+
+type User struct {
+	Name   string   `json:"name"`
+	Roles  []string `json:"roles,omitempty"`
+	Exists bool     `json:"exists"`
+}
+
+func (in *User) DeepCopyInto(out *User) {
+	*out = *in
+}
+
+func (in *User) DeepCopy() *User {
+	if in == nil {
+		return nil
+	}
+	out := new(User)
+	in.DeepCopyInto(out)
+
+	return out
+}

internal/kubeadm/addon.go

@@ -80,7 +80,6 @@ func removeCoreDNSDeployment(ctx context.Context, client kubernetes.Interface) e
 
 func removeCoreDNSConfigMap(ctx context.Context, client kubernetes.Interface) error {
 	name, _ := getCoreDNSConfigMapName(ctx)
-
 	opts := metav1.DeleteOptions{}
 
 	return client.CoreV1().ConfigMaps(kubeSystemNamespace).Delete(ctx, name, opts)
@@ -153,7 +152,6 @@ func RemoveKubeProxy(ctx context.Context, client kubernetes.Interface) error {
 
 func removeKubeProxyDaemonSet(ctx context.Context, client kubernetes.Interface) error {
 	name, _ := getKubeProxyDaemonSetName(ctx)
-
 	opts := metav1.DeleteOptions{}
 
 	return client.AppsV1().DaemonSets(kubeSystemNamespace).Delete(ctx, name, opts)
@@ -161,7 +159,6 @@ func removeKubeProxyDaemonSet(ctx context.Context, client kubernetes.Interface)
 
 func removeKubeProxyConfigMap(ctx context.Context, client kubernetes.Interface) error {
 	name, _ := getKubeProxyConfigMapName(ctx)
-
 	opts := metav1.DeleteOptions{}
 
 	return client.CoreV1().ConfigMaps(kubeSystemNamespace).Delete(ctx, name, opts)
@@ -170,7 +167,6 @@ func removeKubeProxyConfigMap(ctx context.Context, client kubernetes.Interface)
 func removeKubeProxyRBAC(ctx context.Context, client kubernetes.Interface) error {
 	// TODO: Currently, kube-proxy is installed using kubeadm phases, therefore, name is the same.
 	name, _ := getKubeProxyRBACName(ctx)
-
 	opts := metav1.DeleteOptions{}
 	var result error
 
@@ -365,7 +361,6 @@ func createKubeProxyAddon(client kubernetes.Interface) error {
 func getKubeproxyConfigmapContent(config *Configuration) ([]byte, error) {
 	zeroDuration := metav1.Duration{Duration: 0}
 	oneSecondDuration := metav1.Duration{Duration: time.Second}
-
 	kubeProxyConfiguration := kubeproxyconfig.KubeProxyConfiguration{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "KubeProxyConfiguration",

internal/kubeadm/certificates.go

@@ -7,6 +7,7 @@ import (
 	"crypto"
 	"crypto/x509"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -146,7 +147,7 @@ func readCertificateFiles(name string, directory string, extensions ...string) (
 	for _, extension := range extensions {
 		fileName := fmt.Sprintf("%s.%s", name, extension)
 		path := filepath.Join(directory, fileName)
-		content, err := os.ReadFile(path)
+		content, err := ioutil.ReadFile(path)
 		if err != nil {
 			return nil, err
 		}
@@ -159,6 +160,6 @@ func readCertificateFiles(name string, directory string, extensions ...string) (
 func deleteCertificateDirectory(certificateDirectory string) {
 	if err := os.RemoveAll(certificateDirectory); err != nil {
 		// TODO(prometherion): we should log rather than printing to stdout
-		fmt.Printf("Error removing %s: %s", certificateDirectory, err.Error()) //nolint:forbidigo
+		fmt.Printf("Error removing %s: %s", certificateDirectory, err.Error()) // nolint:forbidigo
 	}
 }

internal/kubeadm/configuration.go

@@ -90,7 +90,7 @@ func getKubeadmClusterConfiguration(params Parameters) kubeadmapi.ClusterConfigu
 			}, params.TenantControlPlaneCertSANs...),
 			ControlPlaneComponent: kubeadmapi.ControlPlaneComponent{
 				ExtraArgs: map[string]string{
-					"etcd-compaction-interval": "0s",
+					"etcd-compaction-interval": params.ETCDCompactionInterval,
 					"etcd-prefix":              fmt.Sprintf("/%s", params.TenantControlPlaneName),
 				},
 			},

internal/kubeadm/kubeconfig.go

@@ -4,6 +4,7 @@
 package kubeadm
 
 import (
+	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
@@ -18,12 +19,12 @@ func buildCertificateDirectoryWithCA(ca CertificatePrivateKeyPair, directory str
 	}
 
 	certPath := path.Join(directory, kubeadmconstants.CACertName)
-	if err := os.WriteFile(certPath, ca.Certificate, os.FileMode(0o600)); err != nil {
+	if err := ioutil.WriteFile(certPath, ca.Certificate, os.FileMode(0o600)); err != nil {
 		return err
 	}
 
 	keyPath := path.Join(directory, kubeadmconstants.CAKeyName)
-	if err := os.WriteFile(keyPath, ca.PrivateKey, os.FileMode(0o600)); err != nil {
+	if err := ioutil.WriteFile(keyPath, ca.PrivateKey, os.FileMode(0o600)); err != nil {
 		return err
 	}
 
@@ -43,7 +44,7 @@ func CreateKubeconfig(kubeconfigName string, ca CertificatePrivateKeyPair, confi
 
 	path := filepath.Join(config.InitConfiguration.CertificatesDir, kubeconfigName)
 
-	return os.ReadFile(path)
+	return ioutil.ReadFile(path)
 }
 
 func IsKubeconfigValid(kubeconfigBytes []byte) bool {

internal/kubeadm/types.go

@@ -44,6 +44,7 @@ type Parameters struct {
 	TenantControlPlaneVersion      string
 	TenantControlPlaneCGroupDriver string
 	ETCDs                          []string
+	ETCDCompactionInterval         string
 	CertificatesDir                string
 	KubeconfigDir                  string
 }

internal/resources/api_server_certificate.go

@@ -25,22 +25,23 @@ type APIServerCertificate struct {
 	resource     *corev1.Secret
 	Client       client.Client
 	Log          logr.Logger
+	Name         string
 	TmpDirectory string
 }
 
-func (r *APIServerCertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *APIServerCertificate) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Status.Certificates.APIServer.Checksum != r.resource.GetAnnotations()["checksum"]
 }
 
-func (r *APIServerCertificate) ShouldCleanup(_ *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *APIServerCertificate) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
 	return false
 }
 
-func (r *APIServerCertificate) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *APIServerCertificate) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	return false, nil
 }
 
-func (r *APIServerCertificate) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *APIServerCertificate) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      r.getPrefixedName(tenantControlPlane),
@@ -52,7 +53,7 @@ func (r *APIServerCertificate) Define(_ context.Context, tenantControlPlane *kam
 }
 
 func (r *APIServerCertificate) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
 }
 
 func (r *APIServerCertificate) GetClient() client.Client {
@@ -68,10 +69,10 @@ func (r *APIServerCertificate) CreateOrUpdate(ctx context.Context, tenantControl
 }
 
 func (r *APIServerCertificate) GetName() string {
-	return "api-server-certificate"
+	return r.Name
 }
 
-func (r *APIServerCertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *APIServerCertificate) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.Certificates.APIServer.LastUpdate = metav1.Now()
 	tenantControlPlane.Status.Certificates.APIServer.SecretName = r.resource.GetName()
 	tenantControlPlane.Status.Certificates.APIServer.Checksum = r.resource.GetAnnotations()["checksum"]

internal/resources/api_server_kubelet_client_certificate.go

@@ -25,22 +25,23 @@ type APIServerKubeletClientCertificate struct {
 	resource     *corev1.Secret
 	Client       client.Client
 	Log          logr.Logger
+	Name         string
 	TmpDirectory string
 }
 
-func (r *APIServerKubeletClientCertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *APIServerKubeletClientCertificate) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Status.Certificates.APIServerKubeletClient.Checksum != r.resource.GetAnnotations()["checksum"]
 }
 
-func (r *APIServerKubeletClientCertificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
+func (r *APIServerKubeletClientCertificate) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
 	return false
 }
 
-func (r *APIServerKubeletClientCertificate) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *APIServerKubeletClientCertificate) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	return false, nil
 }
 
-func (r *APIServerKubeletClientCertificate) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *APIServerKubeletClientCertificate) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      r.getPrefixedName(tenantControlPlane),
@@ -52,7 +53,7 @@ func (r *APIServerKubeletClientCertificate) Define(_ context.Context, tenantCont
 }
 
 func (r *APIServerKubeletClientCertificate) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
 }
 
 func (r *APIServerKubeletClientCertificate) GetClient() client.Client {
@@ -68,10 +69,10 @@ func (r *APIServerKubeletClientCertificate) CreateOrUpdate(ctx context.Context,
 }
 
 func (r *APIServerKubeletClientCertificate) GetName() string {
-	return "api-server-kubelet-client-certificate"
+	return r.Name
 }
 
-func (r *APIServerKubeletClientCertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *APIServerKubeletClientCertificate) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.Certificates.APIServerKubeletClient.LastUpdate = metav1.Now()
 	tenantControlPlane.Status.Certificates.APIServerKubeletClient.SecretName = r.resource.GetName()
 	tenantControlPlane.Status.Certificates.APIServerKubeletClient.Checksum = r.resource.GetAnnotations()["checksum"]
@@ -100,7 +101,6 @@ func (r *APIServerKubeletClientCertificate) mutate(ctx context.Context, tenantCo
 		}
 
 		namespacedName := k8stypes.NamespacedName{Namespace: tenantControlPlane.GetNamespace(), Name: tenantControlPlane.Status.Certificates.CA.SecretName}
-
 		secretCA := &corev1.Secret{}
 		if err = r.Client.Get(ctx, namespacedName, secretCA); err != nil {
 			return err

internal/resources/ca_certificate.go

@@ -24,23 +24,24 @@ type CACertificate struct {
 	resource     *corev1.Secret
 	Client       client.Client
 	Log          logr.Logger
+	Name         string
 	TmpDirectory string
 }
 
-func (r *CACertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *CACertificate) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Status.Certificates.CA.SecretName != r.resource.GetName() ||
 		tenantControlPlane.Status.Certificates.CA.Checksum != r.resource.GetAnnotations()["checksum"]
 }
 
-func (r *CACertificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
+func (r *CACertificate) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
 	return false
 }
 
-func (r *CACertificate) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *CACertificate) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	return false, nil
 }
 
-func (r *CACertificate) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *CACertificate) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      r.getPrefixedName(tenantControlPlane),
@@ -52,7 +53,7 @@ func (r *CACertificate) Define(_ context.Context, tenantControlPlane *kamajiv1al
 }
 
 func (r *CACertificate) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
 }
 
 func (r *CACertificate) GetClient() client.Client {
@@ -68,10 +69,10 @@ func (r *CACertificate) CreateOrUpdate(ctx context.Context, tenantControlPlane *
 }
 
 func (r *CACertificate) GetName() string {
-	return "ca"
+	return r.Name
 }
 
-func (r *CACertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *CACertificate) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.Certificates.CA.LastUpdate = metav1.Now()
 	tenantControlPlane.Status.Certificates.CA.SecretName = r.resource.GetName()
 	tenantControlPlane.Status.Certificates.CA.Checksum = r.resource.GetAnnotations()["checksum"]

internal/resources/datastore/datastore_certificate.go

@@ -1,148 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package datastore
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/etcd"
-	"github.com/clastix/kamaji/internal/utilities"
-)
-
-type Certificate struct {
-	resource  *corev1.Secret
-	Client    client.Client
-	Name      string
-	DataStore kamajiv1alpha1.DataStore
-}
-
-func (r *Certificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Storage.Certificate.Checksum != r.resource.GetAnnotations()["checksum"]
-}
-
-func (r *Certificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
-	return false
-}
-
-func (r *Certificate) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
-	return false, nil
-}
-
-func (r *Certificate) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	r.resource = &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      r.getPrefixedName(tenantControlPlane),
-			Namespace: tenantControlPlane.GetNamespace(),
-		},
-		Data: map[string][]byte{},
-	}
-
-	return nil
-}
-
-func (r *Certificate) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
-}
-
-func (r *Certificate) GetClient() client.Client {
-	return r.Client
-}
-
-func (r *Certificate) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
-}
-
-func (r *Certificate) GetName() string {
-	return "datastore-certificate"
-}
-
-func (r *Certificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	tenantControlPlane.Status.Storage.Certificate.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Storage.Certificate.Checksum = r.resource.GetAnnotations()["checksum"]
-	tenantControlPlane.Status.Storage.Certificate.LastUpdate = metav1.Now()
-
-	return nil
-}
-
-func (r *Certificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
-	return func() error {
-		ca, err := r.DataStore.Spec.TLSConfig.CertificateAuthority.Certificate.GetContent(ctx, r.Client)
-		if err != nil {
-			return err
-		}
-
-		r.resource.Data["ca.crt"] = ca
-
-		if r.resource.GetAnnotations()["checksum"] == utilities.CalculateConfigMapChecksum(r.resource.StringData) {
-			if r.DataStore.Spec.Driver == kamajiv1alpha1.EtcdDriver {
-				if isValid, _ := etcd.IsETCDCertificateAndKeyPairValid(r.resource.Data["server.crt"], r.resource.Data["server.key"]); isValid {
-					return nil
-				}
-			}
-		}
-
-		var crt, key *bytes.Buffer
-
-		switch r.DataStore.Spec.Driver {
-		case kamajiv1alpha1.EtcdDriver:
-			// When dealing with the etcd storage we cannot use the basic authentication, thus the generation of a
-			// certificate used for authentication is mandatory, along with the CA private key.
-			privateKey, err := r.DataStore.Spec.TLSConfig.CertificateAuthority.PrivateKey.GetContent(ctx, r.Client)
-			if err != nil {
-				return err
-			}
-
-			crt, key, err = etcd.GetETCDCACertificateAndKeyPair(tenantControlPlane.GetName(), ca, privateKey)
-			if err != nil {
-				return err
-			}
-		case kamajiv1alpha1.KineMySQLDriver, kamajiv1alpha1.KinePostgreSQLDriver:
-			// For the SQL drivers we just need to copy the certificate, since the basic authentication is used
-			// to connect to the desired schema and database.
-			crtBytes, err := r.DataStore.Spec.TLSConfig.ClientCertificate.Certificate.GetContent(ctx, r.Client)
-			if err != nil {
-				return err
-			}
-			crt = bytes.NewBuffer(crtBytes)
-
-			keyBytes, err := r.DataStore.Spec.TLSConfig.ClientCertificate.PrivateKey.GetContent(ctx, r.Client)
-			if err != nil {
-				return err
-			}
-			key = bytes.NewBuffer(keyBytes)
-		default:
-			return fmt.Errorf("unrecognized driver for Certificate generation")
-		}
-
-		r.resource.Data["server.crt"] = crt.Bytes()
-		r.resource.Data["server.key"] = key.Bytes()
-
-		annotations := r.resource.GetAnnotations()
-		if annotations == nil {
-			annotations = map[string]string{}
-		}
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
-		r.resource.SetAnnotations(annotations)
-
-		r.resource.SetLabels(utilities.MergeMaps(
-			utilities.KamajiLabels(),
-			r.resource.GetLabels(),
-			map[string]string{
-				"kamaji.clastix.io/name":      tenantControlPlane.GetName(),
-				"kamaji.clastix.io/component": r.GetName(),
-			},
-		))
-
-		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
-	}
-}

internal/resources/datastore/datastore_setup.go

@@ -1,237 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package datastore
-
-import (
-	"context"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/datastore"
-	"github.com/clastix/kamaji/internal/resources/utils"
-)
-
-type SetupResource struct {
-	schema   string
-	user     string
-	password string
-}
-
-type Setup struct {
-	resource   SetupResource
-	Client     client.Client
-	Connection datastore.Connection
-	DataStore  kamajiv1alpha1.DataStore
-}
-
-func (r *Setup) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Storage.Driver != string(r.DataStore.Spec.Driver) &&
-		tenantControlPlane.Status.Storage.Setup.Checksum != tenantControlPlane.Status.Storage.Config.Checksum
-}
-
-func (r *Setup) ShouldCleanup(_ *kamajiv1alpha1.TenantControlPlane) bool {
-	return false
-}
-
-func (r *Setup) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
-	return false, nil
-}
-
-func (r *Setup) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	secret := &corev1.Secret{}
-	namespacedName := types.NamespacedName{
-		Namespace: tenantControlPlane.GetNamespace(),
-		Name:      tenantControlPlane.Status.Storage.Config.SecretName,
-	}
-	if err := r.Client.Get(ctx, namespacedName, secret); err != nil {
-		return err
-	}
-
-	r.resource = SetupResource{
-		schema:   string(secret.Data["DB_SCHEMA"]),
-		user:     string(secret.Data["DB_USER"]),
-		password: string(secret.Data["DB_PASSWORD"]),
-	}
-
-	return nil
-}
-
-func (r *Setup) GetClient() client.Client {
-	return r.Client
-}
-
-func (r *Setup) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	if tenantControlPlane.Status.Storage.Setup.Checksum != "" &&
-		tenantControlPlane.Status.Storage.Setup.Checksum != tenantControlPlane.Status.Storage.Config.Checksum {
-		if err := r.Delete(ctx, tenantControlPlane); err != nil {
-			return controllerutil.OperationResultNone, err
-		}
-
-		return controllerutil.OperationResultUpdated, nil
-	}
-
-	reconcilationResult := controllerutil.OperationResultNone
-	var operationResult controllerutil.OperationResult
-	var err error
-
-	operationResult, err = r.createDB(ctx, tenantControlPlane)
-	if err != nil {
-		return reconcilationResult, err
-	}
-	reconcilationResult = utils.UpdateOperationResult(reconcilationResult, operationResult)
-
-	operationResult, err = r.createUser(ctx, tenantControlPlane)
-	if err != nil {
-		return reconcilationResult, err
-	}
-	reconcilationResult = utils.UpdateOperationResult(reconcilationResult, operationResult)
-
-	operationResult, err = r.createGrantPrivileges(ctx, tenantControlPlane)
-	if err != nil {
-		return reconcilationResult, err
-	}
-	reconcilationResult = utils.UpdateOperationResult(reconcilationResult, operationResult)
-
-	return reconcilationResult, nil
-}
-
-func (r *Setup) GetName() string {
-	return "datastore-setup"
-}
-
-func (r *Setup) Delete(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	if err := r.Define(ctx, tenantControlPlane); err != nil {
-		return err
-	}
-
-	if err := r.revokeGrantPrivileges(ctx, tenantControlPlane); err != nil {
-		return err
-	}
-
-	if err := r.deleteDB(ctx, tenantControlPlane); err != nil {
-		return err
-	}
-
-	if err := r.deleteUser(ctx, tenantControlPlane); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (r *Setup) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	tenantControlPlane.Status.Storage.Setup.Schema = r.resource.schema
-	tenantControlPlane.Status.Storage.Setup.User = r.resource.user
-	tenantControlPlane.Status.Storage.Setup.LastUpdate = metav1.Now()
-	tenantControlPlane.Status.Storage.Setup.Checksum = tenantControlPlane.Status.Storage.Config.Checksum
-
-	return nil
-}
-
-func (r *Setup) createDB(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	exists, err := r.Connection.DBExists(ctx, r.resource.schema)
-	if err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	if exists {
-		return controllerutil.OperationResultNone, nil
-	}
-
-	if err := r.Connection.CreateDB(ctx, r.resource.schema); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	return controllerutil.OperationResultCreated, nil
-}
-
-func (r *Setup) deleteDB(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) error {
-	exists, err := r.Connection.DBExists(ctx, r.resource.schema)
-	if err != nil {
-		return err
-	}
-
-	if !exists {
-		return nil
-	}
-
-	if err := r.Connection.DeleteDB(ctx, r.resource.schema); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (r *Setup) createUser(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	exists, err := r.Connection.UserExists(ctx, r.resource.user)
-	if err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	if exists {
-		return controllerutil.OperationResultNone, nil
-	}
-
-	if err := r.Connection.CreateUser(ctx, r.resource.user, r.resource.password); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	return controllerutil.OperationResultCreated, nil
-}
-
-func (r *Setup) deleteUser(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) error {
-	exists, err := r.Connection.UserExists(ctx, r.resource.user)
-	if err != nil {
-		return err
-	}
-
-	if !exists {
-		return nil
-	}
-
-	if err := r.Connection.DeleteUser(ctx, r.resource.user); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (r *Setup) createGrantPrivileges(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	exists, err := r.Connection.GrantPrivilegesExists(ctx, r.resource.user, r.resource.schema)
-	if err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	if exists {
-		return controllerutil.OperationResultNone, nil
-	}
-
-	if err := r.Connection.GrantPrivileges(ctx, r.resource.user, r.resource.schema); err != nil {
-		return controllerutil.OperationResultNone, err
-	}
-
-	return controllerutil.OperationResultCreated, nil
-}
-
-func (r *Setup) revokeGrantPrivileges(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) error {
-	exists, err := r.Connection.GrantPrivilegesExists(ctx, r.resource.user, r.resource.schema)
-	if err != nil {
-		return err
-	}
-
-	if !exists {
-		return nil
-	}
-
-	if err := r.Connection.RevokePrivileges(ctx, r.resource.user, r.resource.schema); err != nil {
-		return err
-	}
-
-	return nil
-}

internal/resources/datastore/datastore_storage_config.go

@@ -1,111 +0,0 @@
-// Copyright 2022 Clastix Labs
-// SPDX-License-Identifier: Apache-2.0
-
-package datastore
-
-import (
-	"context"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-	"github.com/clastix/kamaji/internal/utilities"
-)
-
-type Config struct {
-	resource   *corev1.Secret
-	Client     client.Client
-	ConnString string
-	Driver     string
-}
-
-func (r *Config) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
-	return tenantControlPlane.Status.Storage.Config.Checksum != r.resource.GetAnnotations()["checksum"] ||
-		tenantControlPlane.Status.Storage.Driver != r.Driver
-}
-
-func (r *Config) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
-	return false
-}
-
-func (r *Config) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
-	return false, nil
-}
-
-func (r *Config) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	r.resource = &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      r.getPrefixedName(tenantControlPlane),
-			Namespace: tenantControlPlane.GetNamespace(),
-		},
-	}
-
-	return nil
-}
-
-func (r *Config) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
-}
-
-func (r *Config) GetClient() client.Client {
-	return r.Client
-}
-
-func (r *Config) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
-}
-
-func (r *Config) GetName() string {
-	return "datastore-config"
-}
-
-func (r *Config) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
-	tenantControlPlane.Status.Storage.Driver = r.Driver
-	tenantControlPlane.Status.Storage.Config.SecretName = r.resource.GetName()
-	tenantControlPlane.Status.Storage.Config.Checksum = r.resource.GetAnnotations()["checksum"]
-
-	return nil
-}
-
-func (r *Config) mutate(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
-	return func() error {
-		var password []byte
-
-		savedHash, ok := r.resource.GetAnnotations()["checksum"]
-		switch {
-		case ok && savedHash == utilities.CalculateConfigMapChecksum(r.resource.StringData):
-			password = r.resource.Data["DB_PASSWORD"]
-		default:
-			password = []byte(utilities.GenerateUUIDString())
-		}
-
-		r.resource.Data = map[string][]byte{
-			"DB_CONNECTION_STRING": []byte(r.ConnString),
-			"DB_SCHEMA":            []byte(tenantControlPlane.GetName()),
-			"DB_USER":              []byte(tenantControlPlane.GetName()),
-			"DB_PASSWORD":          password,
-		}
-
-		annotations := r.resource.GetAnnotations()
-		if annotations == nil {
-			annotations = map[string]string{}
-		}
-
-		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
-		r.resource.SetAnnotations(annotations)
-
-		r.resource.SetLabels(utilities.MergeMaps(
-			utilities.KamajiLabels(),
-			map[string]string{
-				"kamaji.clastix.io/name":      tenantControlPlane.GetName(),
-				"kamaji.clastix.io/component": r.GetName(),
-			},
-		))
-
-		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
-	}
-}

internal/resources/etcd_ca_certificates.go

@@ -0,0 +1,119 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package resources
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/go-logr/logr"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8stypes "k8s.io/apimachinery/pkg/types"
+	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/etcd"
+	"github.com/clastix/kamaji/internal/utilities"
+)
+
+type ETCDCACertificatesResource struct {
+	resource              *corev1.Secret
+	Client                client.Client
+	Log                   logr.Logger
+	Name                  string
+	ETCDCASecretName      string
+	ETCDCASecretNamespace string
+}
+
+func (r *ETCDCACertificatesResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	if tenantControlPlane.Status.Certificates.ETCD == nil {
+		return true
+	}
+
+	return tenantControlPlane.Status.Certificates.ETCD.CA.Checksum != r.resource.GetAnnotations()["checksum"]
+}
+
+func (r *ETCDCACertificatesResource) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
+	return false
+}
+
+func (r *ETCDCACertificatesResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	return false, nil
+}
+
+func (r *ETCDCACertificatesResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	r.resource = &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      r.getPrefixedName(tenantControlPlane),
+			Namespace: tenantControlPlane.GetNamespace(),
+		},
+	}
+
+	return nil
+}
+
+func (r *ETCDCACertificatesResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
+}
+
+func (r *ETCDCACertificatesResource) GetName() string {
+	return r.Name
+}
+
+func (r *ETCDCACertificatesResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	if tenantControlPlane.Status.Certificates.ETCD == nil {
+		tenantControlPlane.Status.Certificates.ETCD = &kamajiv1alpha1.ETCDCertificatesStatus{}
+	}
+
+	tenantControlPlane.Status.Certificates.ETCD.CA.SecretName = r.resource.GetName()
+	tenantControlPlane.Status.Certificates.ETCD.CA.LastUpdate = metav1.Now()
+	tenantControlPlane.Status.Certificates.ETCD.CA.Checksum = r.resource.GetAnnotations()["checksum"]
+
+	return nil
+}
+
+func (r *ETCDCACertificatesResource) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
+}
+
+func (r *ETCDCACertificatesResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
+	return func() error {
+		if etcdStatus := tenantControlPlane.Status.Certificates.ETCD; etcdStatus != nil && len(etcdStatus.CA.Checksum) > 0 && etcdStatus.CA.Checksum == r.resource.GetAnnotations()["checksum"] {
+			isValid, err := etcd.IsETCDCertificateAndKeyPairValid(r.resource.Data[kubeadmconstants.CACertName], r.resource.Data[kubeadmconstants.CAKeyName])
+			if err != nil {
+				r.Log.Info(fmt.Sprintf("etcd certificates are not valid: %s", err.Error()))
+			}
+
+			if isValid {
+				return nil
+			}
+		}
+
+		etcdCASecretNamespacedName := k8stypes.NamespacedName{Namespace: r.ETCDCASecretNamespace, Name: r.ETCDCASecretName}
+		etcdCASecret := &corev1.Secret{}
+		if err := r.Client.Get(ctx, etcdCASecretNamespacedName, etcdCASecret); err != nil {
+			return err
+		}
+
+		r.resource.Data = map[string][]byte{
+			kubeadmconstants.CACertName: etcdCASecret.Data[kubeadmconstants.CACertName],
+			kubeadmconstants.CAKeyName:  etcdCASecret.Data[kubeadmconstants.CAKeyName],
+		}
+
+		r.resource.SetLabels(utilities.KamajiLabels())
+
+		annotations := r.resource.GetAnnotations()
+		if annotations == nil {
+			annotations = map[string]string{}
+		}
+		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
+		r.resource.SetAnnotations(annotations)
+
+		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
+	}
+}

internal/resources/etcd_certificates.go

@@ -0,0 +1,130 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package resources
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/go-logr/logr"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8stypes "k8s.io/apimachinery/pkg/types"
+	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/etcd"
+	"github.com/clastix/kamaji/internal/utilities"
+)
+
+type ETCDCertificatesResource struct {
+	resource *corev1.Secret
+	Client   client.Client
+	Log      logr.Logger
+	Name     string
+}
+
+func (r *ETCDCertificatesResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	if tenantControlPlane.Status.Certificates.ETCD == nil {
+		return true
+	}
+
+	return tenantControlPlane.Status.Certificates.ETCD.APIServer.Checksum != r.resource.GetAnnotations()["checksum"]
+}
+
+func (r *ETCDCertificatesResource) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
+	return false
+}
+
+func (r *ETCDCertificatesResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	return false, nil
+}
+
+func (r *ETCDCertificatesResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	r.resource = &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      r.getPrefixedName(tenantControlPlane),
+			Namespace: tenantControlPlane.GetNamespace(),
+		},
+	}
+
+	return nil
+}
+
+func (r *ETCDCertificatesResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
+}
+
+func (r *ETCDCertificatesResource) GetName() string {
+	return r.Name
+}
+
+func (r *ETCDCertificatesResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	if tenantControlPlane.Status.Certificates.ETCD == nil {
+		tenantControlPlane.Status.Certificates.ETCD = &kamajiv1alpha1.ETCDCertificatesStatus{}
+	}
+
+	tenantControlPlane.Status.Certificates.ETCD.APIServer.SecretName = r.resource.GetName()
+	tenantControlPlane.Status.Certificates.ETCD.APIServer.LastUpdate = metav1.Now()
+	tenantControlPlane.Status.Certificates.ETCD.APIServer.Checksum = r.resource.GetAnnotations()["checksum"]
+
+	return nil
+}
+
+func (r *ETCDCertificatesResource) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
+}
+
+func (r *ETCDCertificatesResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
+	return func() error {
+		if tenantControlPlane.Status.Certificates.ETCD == nil {
+			return fmt.Errorf("etcd is still synchronizing latest changes")
+		}
+
+		if checksum := tenantControlPlane.Status.Certificates.ETCD.APIServer.Checksum; len(checksum) > 0 && checksum == r.resource.GetAnnotations()["checksum"] {
+			isValid, err := etcd.IsETCDCertificateAndKeyPairValid(r.resource.Data[kubeadmconstants.APIServerEtcdClientCertName], r.resource.Data[kubeadmconstants.APIServerEtcdClientKeyName])
+			if err != nil {
+				r.Log.Info(fmt.Sprintf("etcd certificates are not valid: %s", err.Error()))
+			}
+
+			if isValid {
+				return nil
+			}
+		}
+
+		etcdCASecretNamespacedName := k8stypes.NamespacedName{Namespace: tenantControlPlane.GetNamespace(), Name: tenantControlPlane.Status.Certificates.ETCD.CA.SecretName}
+		etcdCASecret := &corev1.Secret{}
+		if err := r.Client.Get(ctx, etcdCASecretNamespacedName, etcdCASecret); err != nil {
+			return err
+		}
+
+		cert, privKey, err := etcd.GetETCDCACertificateAndKeyPair(
+			tenantControlPlane.GetName(),
+			etcdCASecret.Data[kubeadmconstants.CACertName],
+			etcdCASecret.Data[kubeadmconstants.CAKeyName],
+		)
+		if err != nil {
+			return err
+		}
+
+		r.resource.Data = map[string][]byte{
+			kubeadmconstants.APIServerEtcdClientCertName: cert.Bytes(),
+			kubeadmconstants.APIServerEtcdClientKeyName:  privKey.Bytes(),
+		}
+
+		r.resource.SetLabels(utilities.KamajiLabels())
+
+		annotations := r.resource.GetAnnotations()
+		if annotations == nil {
+			annotations = map[string]string{}
+		}
+		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
+		r.resource.SetAnnotations(annotations)
+
+		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
+	}
+}

internal/resources/etcd_setup.go

@@ -0,0 +1,278 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package resources
+
+import (
+	"context"
+
+	"github.com/go-logr/logr"
+	etcdclient "go.etcd.io/etcd/client/v3"
+	corev1 "k8s.io/api/core/v1"
+	k8stypes "k8s.io/apimachinery/pkg/types"
+	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/etcd"
+)
+
+const (
+	caKeyName = kubeadmconstants.CACertName
+)
+
+type etcdSetupResource struct {
+	role etcd.Role
+	user etcd.User
+}
+
+type ETCDSetupResource struct {
+	resource              *etcdSetupResource
+	Client                client.Client
+	Log                   logr.Logger
+	Name                  string
+	Endpoints             []string
+	ETCDClientCertsSecret k8stypes.NamespacedName
+	ETCDCACertsSecret     k8stypes.NamespacedName
+}
+
+func (r *ETCDSetupResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	if tenantControlPlane.Status.Storage.ETCD == nil {
+		return true
+	}
+
+	return tenantControlPlane.Status.Storage.ETCD.Role.Name != r.resource.role.Name ||
+		tenantControlPlane.Status.Storage.ETCD.User.Name != r.resource.user.Name
+}
+
+func (r *ETCDSetupResource) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
+	return false
+}
+
+func (r *ETCDSetupResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	return false, nil
+}
+
+func (r *ETCDSetupResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	r.resource = &etcdSetupResource{
+		role: etcd.Role{Name: tenantControlPlane.Name, Exists: false},
+		user: etcd.User{Name: tenantControlPlane.Name, Exists: false},
+	}
+
+	return nil
+}
+
+func (r *ETCDSetupResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	return r.reconcile(ctx)
+}
+
+func (r *ETCDSetupResource) Delete(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	if err := r.Define(ctx, tenantControlPlane); err != nil {
+		return err
+	}
+
+	client, err := r.getETCDClient(ctx)
+	if err != nil {
+		return err
+	}
+
+	if err = r.deleteData(ctx, client, tenantControlPlane); err != nil {
+		return err
+	}
+
+	if err = r.deleteUser(ctx, client, tenantControlPlane); err != nil {
+		return err
+	}
+
+	if err = r.deleteRole(ctx, client, tenantControlPlane); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (r *ETCDSetupResource) GetName() string {
+	return r.Name
+}
+
+func (r *ETCDSetupResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	if tenantControlPlane.Status.Storage.ETCD == nil {
+		tenantControlPlane.Status.Storage.ETCD = &kamajiv1alpha1.ETCDStatus{}
+	}
+	tenantControlPlane.Status.Storage.ETCD.Role = r.resource.role
+	tenantControlPlane.Status.Storage.ETCD.User = r.resource.user
+
+	return nil
+}
+
+func (r *ETCDSetupResource) reconcile(ctx context.Context) (controllerutil.OperationResult, error) {
+	reconcilationResult := controllerutil.OperationResultNone
+	var operationResult controllerutil.OperationResult
+
+	client, err := r.getETCDClient(ctx)
+	if err != nil {
+		return reconcilationResult, err
+	}
+	defer client.Close()
+
+	operationResult, err = r.reconcileUser(ctx, client)
+	if err != nil {
+		return reconcilationResult, err
+	}
+	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
+
+	operationResult, err = r.reconcileRole(ctx, client)
+	if err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
+
+	operationResult, err = r.grantUserRole(ctx, client)
+	if err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
+
+	operationResult, err = r.grantRolePermissions(ctx, client)
+	if err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
+
+	return reconcilationResult, nil
+}
+
+func (r *ETCDSetupResource) getETCDClient(ctx context.Context) (*etcdclient.Client, error) {
+	var certsClientSecret corev1.Secret
+	if err := r.Client.Get(ctx, r.ETCDClientCertsSecret, &certsClientSecret); err != nil {
+		return nil, err
+	}
+
+	var certsCASecret corev1.Secret
+	if err := r.Client.Get(ctx, r.ETCDCACertsSecret, &certsCASecret); err != nil {
+		return nil, err
+	}
+
+	config := etcd.Config{
+		ETCDCertificate: certsClientSecret.Data[corev1.TLSCertKey],
+		ETCDPrivateKey:  certsClientSecret.Data[corev1.TLSPrivateKeyKey],
+		ETCDCA:          certsCASecret.Data[caKeyName],
+		Endpoints:       r.Endpoints,
+	}
+
+	return etcd.NewClient(config)
+}
+
+func (r *ETCDSetupResource) reconcileUser(ctx context.Context, client *etcdclient.Client) (controllerutil.OperationResult, error) {
+	if err := etcd.GetUser(ctx, client, &r.resource.user); err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	if !r.resource.user.Exists {
+		if err := etcd.AddUser(ctx, client, r.resource.user.Name); err != nil {
+			return controllerutil.OperationResultNone, err
+		}
+
+		return controllerutil.OperationResultCreated, nil
+	}
+
+	return controllerutil.OperationResultNone, nil
+}
+
+func (r *ETCDSetupResource) reconcileRole(ctx context.Context, client *etcdclient.Client) (controllerutil.OperationResult, error) {
+	if err := etcd.GetRole(ctx, client, &r.resource.role); err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	if !r.resource.role.Exists {
+		if err := etcd.AddRole(ctx, client, r.resource.role.Name); err != nil {
+			return controllerutil.OperationResultNone, err
+		}
+
+		return controllerutil.OperationResultCreated, nil
+	}
+
+	return controllerutil.OperationResultNone, nil
+}
+
+func (r *ETCDSetupResource) grantUserRole(ctx context.Context, client *etcdclient.Client) (controllerutil.OperationResult, error) {
+	if err := etcd.GetUser(ctx, client, &r.resource.user); err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	if len(r.resource.user.Roles) > 0 && isRole(r.resource.user.Roles, r.resource.role.Name) {
+		return controllerutil.OperationResultNone, nil
+	}
+
+	if err := etcd.GrantUserRole(ctx, client, r.resource.user, r.resource.role); err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	return controllerutil.OperationResultUpdated, nil
+}
+
+func (r *ETCDSetupResource) grantRolePermissions(ctx context.Context, client *etcdclient.Client) (controllerutil.OperationResult, error) {
+	if err := etcd.GetRole(ctx, client, &r.resource.role); err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	if len(r.resource.role.Permissions) > 0 && isPermission(r.resource.role.Permissions, r.resource.role.Name) {
+		return controllerutil.OperationResultNone, nil
+	}
+
+	if err := etcd.GrantRolePermission(ctx, client, r.resource.role); err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	return controllerutil.OperationResultUpdated, nil
+}
+
+func (r *ETCDSetupResource) deleteData(ctx context.Context, client *etcdclient.Client, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	return etcd.CleanUpPrefix(ctx, client, tenantControlPlane.GetName())
+}
+
+func (r *ETCDSetupResource) deleteUser(ctx context.Context, client *etcdclient.Client, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	if err := etcd.GetUser(ctx, client, &r.resource.user); err != nil {
+		return err
+	}
+
+	if !r.resource.user.Exists {
+		return nil
+	}
+
+	return etcd.RemoveUser(ctx, client, tenantControlPlane.GetName())
+}
+
+func (r *ETCDSetupResource) deleteRole(ctx context.Context, client *etcdclient.Client, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	if err := etcd.GetRole(ctx, client, &r.resource.role); err != nil {
+		return err
+	}
+
+	if !r.resource.role.Exists {
+		return nil
+	}
+
+	return etcd.RemoveRole(ctx, client, tenantControlPlane.GetName())
+}
+
+func isRole(s []string, x string) bool {
+	for _, o := range s {
+		if o == x {
+			return true
+		}
+	}
+
+	return false
+}
+
+func isPermission(s []etcd.Permission, role string) bool {
+	key := etcd.BuildKey(role)
+	for _, o := range s {
+		if o.Key == key {
+			return true
+		}
+	}
+
+	return false
+}

internal/resources/front-proxy-client-certificate.go

@@ -25,22 +25,23 @@ type FrontProxyClientCertificate struct {
 	resource     *corev1.Secret
 	Client       client.Client
 	Log          logr.Logger
+	Name         string
 	TmpDirectory string
 }
 
-func (r *FrontProxyClientCertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *FrontProxyClientCertificate) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Status.Certificates.FrontProxyClient.Checksum != r.resource.GetAnnotations()["checksum"]
 }
 
-func (r *FrontProxyClientCertificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
+func (r *FrontProxyClientCertificate) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
 	return false
 }
 
-func (r *FrontProxyClientCertificate) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *FrontProxyClientCertificate) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	return false, nil
 }
 
-func (r *FrontProxyClientCertificate) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *FrontProxyClientCertificate) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      r.getPrefixedName(tenantControlPlane),
@@ -52,7 +53,7 @@ func (r *FrontProxyClientCertificate) Define(_ context.Context, tenantControlPla
 }
 
 func (r *FrontProxyClientCertificate) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
 }
 
 func (r *FrontProxyClientCertificate) GetClient() client.Client {
@@ -68,10 +69,10 @@ func (r *FrontProxyClientCertificate) CreateOrUpdate(ctx context.Context, tenant
 }
 
 func (r *FrontProxyClientCertificate) GetName() string {
-	return "front-proxy-client-certificate"
+	return r.Name
 }
 
-func (r *FrontProxyClientCertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *FrontProxyClientCertificate) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.Certificates.FrontProxyClient.LastUpdate = metav1.Now()
 	tenantControlPlane.Status.Certificates.FrontProxyClient.SecretName = r.resource.GetName()
 	tenantControlPlane.Status.Certificates.FrontProxyClient.Checksum = r.resource.GetAnnotations()["checksum"]

internal/resources/front_proxy_ca_certificate.go

@@ -24,22 +24,23 @@ type FrontProxyCACertificate struct {
 	resource     *corev1.Secret
 	Client       client.Client
 	Log          logr.Logger
+	Name         string
 	TmpDirectory string
 }
 
-func (r *FrontProxyCACertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *FrontProxyCACertificate) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Status.Certificates.FrontProxyCA.Checksum != r.resource.GetAnnotations()["checksum"]
 }
 
-func (r *FrontProxyCACertificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
+func (r *FrontProxyCACertificate) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
 	return false
 }
 
-func (r *FrontProxyCACertificate) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *FrontProxyCACertificate) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	return false, nil
 }
 
-func (r *FrontProxyCACertificate) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *FrontProxyCACertificate) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      r.getPrefixedName(tenantControlPlane),
@@ -47,11 +48,13 @@ func (r *FrontProxyCACertificate) Define(_ context.Context, tenantControlPlane *
 		},
 	}
 
+	r.Name = "front-proxy-ca-certificate"
+
 	return nil
 }
 
 func (r *FrontProxyCACertificate) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
 }
 
 func (r *FrontProxyCACertificate) GetClient() client.Client {
@@ -67,10 +70,10 @@ func (r *FrontProxyCACertificate) CreateOrUpdate(ctx context.Context, tenantCont
 }
 
 func (r *FrontProxyCACertificate) GetName() string {
-	return "front-proxy-ca-certificate"
+	return r.Name
 }
 
-func (r *FrontProxyCACertificate) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *FrontProxyCACertificate) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	tenantControlPlane.Status.Certificates.FrontProxyCA.LastUpdate = metav1.Now()
 	tenantControlPlane.Status.Certificates.FrontProxyCA.SecretName = r.resource.GetName()
 	tenantControlPlane.Status.Certificates.FrontProxyCA.Checksum = r.resource.GetAnnotations()["checksum"]

internal/resources/k8s_deployment_resource.go

@@ -14,15 +14,18 @@ import (
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
 	builder "github.com/clastix/kamaji/internal/builders/controlplane"
+	"github.com/clastix/kamaji/internal/types"
 	"github.com/clastix/kamaji/internal/utilities"
 )
 
 type KubernetesDeploymentResource struct {
-	resource           *appsv1.Deployment
-	Client             client.Client
-	DataStore          kamajiv1alpha1.DataStore
-	Name               string
-	KineContainerImage string
+	resource               *appsv1.Deployment
+	Client                 client.Client
+	ETCDStorageType        types.ETCDStorageType
+	ETCDEndpoints          []string
+	ETCDCompactionInterval string
+	Name                   string
+	KineContainerImage     string
 }
 
 func (r *KubernetesDeploymentResource) isStatusEqual(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
@@ -62,9 +65,11 @@ func (r *KubernetesDeploymentResource) mutate(ctx context.Context, tenantControl
 		}
 
 		d := builder.Deployment{
-			Address:            address,
-			DataStore:          r.DataStore,
-			KineContainerImage: r.KineContainerImage,
+			Address:                address,
+			ETCDEndpoints:          r.ETCDEndpoints,
+			ETCDCompactionInterval: r.ETCDCompactionInterval,
+			ETCDStorageType:        r.ETCDStorageType,
+			KineContainerImage:     r.KineContainerImage,
 		}
 		d.SetLabels(r.resource, utilities.MergeMaps(utilities.CommonLabels(tenantControlPlane.GetName()), tenantControlPlane.Spec.ControlPlane.Deployment.AdditionalMetadata.Labels))
 		d.SetAnnotations(r.resource, utilities.MergeMaps(r.resource.Annotations, tenantControlPlane.Spec.ControlPlane.Deployment.AdditionalMetadata.Annotations))
@@ -112,10 +117,10 @@ func (r *KubernetesDeploymentResource) UpdateTenantControlPlaneStatus(_ context.
 }
 
 func (r *KubernetesDeploymentResource) deploymentTemplateLabels(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (labels map[string]string) {
-	hash := func(ctx context.Context, namespace, secretName string) string {
-		h, _ := utilities.SecretHashValue(ctx, r.Client, namespace, secretName)
+	hash := func(ctx context.Context, namespace, secretName string) (hash string) {
+		hash, _ = utilities.SecretHashValue(ctx, r.Client, namespace, secretName)
 
-		return h
+		return
 	}
 
 	labels = map[string]string{
@@ -130,6 +135,11 @@ func (r *KubernetesDeploymentResource) deploymentTemplateLabels(ctx context.Cont
 		"component.kamaji.clastix.io/scheduler-kubeconfig":                  hash(ctx, tenantControlPlane.GetNamespace(), tenantControlPlane.Status.KubeConfig.Scheduler.SecretName),
 	}
 
+	if r.ETCDStorageType == types.ETCD {
+		labels["component.kamaji.clastix.io/etcd-ca-certificates"] = hash(ctx, tenantControlPlane.GetNamespace(), tenantControlPlane.Status.Certificates.ETCD.CA.SecretName)
+		labels["component.kamaji.clastix.io/etcd-certificates"] = hash(ctx, tenantControlPlane.GetNamespace(), tenantControlPlane.Status.Certificates.ETCD.APIServer.SecretName)
+	}
+
 	return labels
 }
 

internal/resources/k8s_ingress_resource.go

@@ -24,7 +24,7 @@ type KubernetesIngressResource struct {
 	Name     string
 }
 
-func (r *KubernetesIngressResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *KubernetesIngressResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return !(tenantControlPlane.Status.Kubernetes.Ingress.Name == r.resource.GetName() &&
 		tenantControlPlane.Status.Kubernetes.Ingress.Namespace == r.resource.GetNamespace())
 }
@@ -33,7 +33,7 @@ func (r *KubernetesIngressResource) ShouldCleanup(tenantControlPlane *kamajiv1al
 	return tenantControlPlane.Spec.ControlPlane.Ingress == nil
 }
 
-func (r *KubernetesIngressResource) CleanUp(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *KubernetesIngressResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	if err := r.Client.Delete(ctx, r.resource); err != nil {
 		if !k8serrors.IsNotFound(err) {
 			return false, err
@@ -45,7 +45,7 @@ func (r *KubernetesIngressResource) CleanUp(ctx context.Context, _ *kamajiv1alph
 	return true, nil
 }
 
-func (r *KubernetesIngressResource) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubernetesIngressResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	if tenantControlPlane.Spec.ControlPlane.Ingress != nil {
 		tenantControlPlane.Status.Kubernetes.Ingress.IngressStatus = r.resource.Status
 		tenantControlPlane.Status.Kubernetes.Ingress.Name = r.resource.GetName()
@@ -59,7 +59,7 @@ func (r *KubernetesIngressResource) UpdateTenantControlPlaneStatus(_ context.Con
 	return nil
 }
 
-func (r *KubernetesIngressResource) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubernetesIngressResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &networkingv1.Ingress{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      tenantControlPlane.GetName(),

internal/resources/k8s_service_resource.go

@@ -22,19 +22,20 @@ import (
 type KubernetesServiceResource struct {
 	resource *corev1.Service
 	Client   client.Client
+	Name     string
 }
 
-func (r *KubernetesServiceResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *KubernetesServiceResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Status.Kubernetes.Service.Name != r.resource.GetName() ||
 		tenantControlPlane.Status.Kubernetes.Service.Namespace != r.resource.GetNamespace() ||
 		tenantControlPlane.Status.Kubernetes.Service.Port != r.resource.Spec.Ports[0].Port
 }
 
-func (r *KubernetesServiceResource) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
+func (r *KubernetesServiceResource) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
 	return false
 }
 
-func (r *KubernetesServiceResource) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *KubernetesServiceResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	return false, nil
 }
 
@@ -54,7 +55,7 @@ func (r *KubernetesServiceResource) UpdateTenantControlPlaneStatus(ctx context.C
 	return nil
 }
 
-func (r *KubernetesServiceResource) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubernetesServiceResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &corev1.Service{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      tenantControlPlane.GetName(),
@@ -62,6 +63,8 @@ func (r *KubernetesServiceResource) Define(_ context.Context, tenantControlPlane
 		},
 	}
 
+	r.Name = "service"
+
 	return nil
 }
 
@@ -121,5 +124,5 @@ func (r *KubernetesServiceResource) mutate(ctx context.Context, tenantControlPla
 }
 
 func (r *KubernetesServiceResource) GetName() string {
-	return "service"
+	return r.Name
 }

internal/resources/konnectivity/agent.go

@@ -70,7 +70,7 @@ func (r *Agent) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.T
 }
 
 func (r *Agent) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return controllerutil.CreateOrUpdate(ctx, r.tenantClient, r.resource, r.mutate(tenantControlPlane))
+	return controllerutil.CreateOrUpdate(ctx, r.tenantClient, r.resource, r.mutate(ctx, tenantControlPlane))
 }
 
 func (r *Agent) GetName() string {
@@ -96,8 +96,8 @@ func (r *Agent) UpdateTenantControlPlaneStatus(ctx context.Context, tenantContro
 	return nil
 }
 
-func (r *Agent) mutate(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
-	return func() error {
+func (r *Agent) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
+	return func() (err error) {
 		address, _, err := tenantControlPlane.AssignedControlPlaneAddress()
 		if err != nil {
 			return err

internal/resources/konnectivity/cluster_role_binding_resource.go

@@ -62,7 +62,7 @@ func (r *ClusterRoleBindingResource) Define(ctx context.Context, tenantControlPl
 }
 
 func (r *ClusterRoleBindingResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return controllerutil.CreateOrUpdate(ctx, r.tenantClient, r.resource, r.mutate())
+	return controllerutil.CreateOrUpdate(ctx, r.tenantClient, r.resource, r.mutate(ctx, tenantControlPlane))
 }
 
 func (r *ClusterRoleBindingResource) GetName() string {
@@ -86,7 +86,7 @@ func (r *ClusterRoleBindingResource) UpdateTenantControlPlaneStatus(ctx context.
 	return nil
 }
 
-func (r *ClusterRoleBindingResource) mutate() controllerutil.MutateFn {
+func (r *ClusterRoleBindingResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
 		r.resource.SetLabels(utilities.MergeMaps(
 			utilities.KamajiLabels(),

internal/resources/konnectivity/deployment_resource.go

@@ -18,6 +18,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/types"
 	"github.com/clastix/kamaji/internal/utilities"
 )
 
@@ -32,10 +33,16 @@ const (
 )
 
 type KubernetesDeploymentResource struct {
-	resource      *appsv1.Deployment
-	Client        client.Client
-	ETCDEndpoints []string
-	Name          string
+	resource               *appsv1.Deployment
+	Client                 client.Client
+	ETCDStorageType        types.ETCDStorageType
+	ETCDEndpoints          []string
+	ETCDCompactionInterval string
+	Name                   string
+}
+
+func (r *KubernetesDeploymentResource) isStatusEqual(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	return r.resource.Status.String() == tenantControlPlane.Status.Kubernetes.Deployment.DeploymentStatus.String()
 }
 
 func (r *KubernetesDeploymentResource) ShouldStatusBeUpdated(context.Context, *kamajiv1alpha1.TenantControlPlane) bool {
@@ -103,7 +110,7 @@ func (r *KubernetesDeploymentResource) Define(ctx context.Context, tenantControl
 	return nil
 }
 
-func (r *KubernetesDeploymentResource) syncContainer(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) {
+func (r *KubernetesDeploymentResource) syncContainer(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	found, index := utilities.HasNamedContainer(r.resource.Spec.Template.Spec.Containers, konnectivityServerName)
 	if !found {
 		r.resource.Spec.Template.Spec.Containers = append(r.resource.Spec.Template.Spec.Containers, corev1.Container{})
@@ -188,6 +195,8 @@ func (r *KubernetesDeploymentResource) syncContainer(tenantControlPlane *kamajiv
 	if resources := tenantControlPlane.Spec.Addons.Konnectivity.Resources; resources != nil {
 		r.resource.Spec.Template.Spec.Containers[index].Resources = *resources
 	}
+
+	return nil
 }
 
 func (r *KubernetesDeploymentResource) mutate(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
@@ -202,13 +211,15 @@ func (r *KubernetesDeploymentResource) mutate(_ context.Context, tenantControlPl
 			return fmt.Errorf("the Deployment resource is not ready to be mangled for Konnectivity server enrichment")
 		}
 
-		r.syncContainer(tenantControlPlane)
-
+		if err = r.syncContainer(tenantControlPlane); err != nil {
+			return errors.Wrap(err, "cannot sync konnectivity-server container")
+		}
 		if err = r.patchKubeAPIServerContainer(); err != nil {
 			return errors.Wrap(err, "cannot sync patch kube-apiserver container")
 		}
-
-		r.syncVolumes(tenantControlPlane)
+		if err = r.syncVolumes(tenantControlPlane); err != nil {
+			return errors.Wrap(err, "cannot patch required konnectivity volumes")
+		}
 
 		return nil
 	}
@@ -237,7 +248,9 @@ func (r *KubernetesDeploymentResource) patchKubeAPIServerContainer() error {
 	// Adding the egress selector config file flag
 	args := utilities.ArgsFromSliceToMap(r.resource.Spec.Template.Spec.Containers[index].Args)
 
-	utilities.ArgsAddFlagValue(args, "--egress-selector-config-file", konnectivityEgressSelectorConfigurationPath)
+	if utilities.ArgsAddFlagValue(args, "--egress-selector-config-file", konnectivityEgressSelectorConfigurationPath) {
+		// LOG
+	}
 
 	r.resource.Spec.Template.Spec.Containers[index].Args = utilities.ArgsFromMapToSlice(args)
 
@@ -264,7 +277,7 @@ func (r *KubernetesDeploymentResource) patchKubeAPIServerContainer() error {
 	return nil
 }
 
-func (r *KubernetesDeploymentResource) syncVolumes(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) {
+func (r *KubernetesDeploymentResource) syncVolumes(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	found, index := false, 0
 	// Defining volumes for the UDS socket
 	found, index = utilities.HasNamedVolume(r.resource.Spec.Template.Spec.Volumes, konnectivityUDSVolume)
@@ -309,4 +322,6 @@ func (r *KubernetesDeploymentResource) syncVolumes(tenantControlPlane *kamajiv1a
 			DefaultMode: pointer.Int32Ptr(420),
 		},
 	}
+
+	return nil
 }

internal/resources/konnectivity/egress_selector_configuration_resource.go

@@ -77,7 +77,7 @@ func (r *EgressSelectorConfigurationResource) UpdateTenantControlPlaneStatus(ctx
 	return nil
 }
 
-func (r *EgressSelectorConfigurationResource) mutate(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) func() error {
+func (r *EgressSelectorConfigurationResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) func() error {
 	return func() error {
 		r.resource.SetLabels(utilities.MergeMaps(r.resource.GetLabels(), utilities.KamajiLabels()))
 

internal/resources/konnectivity/service_account_resource.go

@@ -61,8 +61,8 @@ func (r *ServiceAccountResource) Define(ctx context.Context, tenantControlPlane
 	return nil
 }
 
-func (r *ServiceAccountResource) CreateOrUpdate(ctx context.Context, _ *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
-	return controllerutil.CreateOrUpdate(ctx, r.tenantClient, r.resource, r.mutate())
+func (r *ServiceAccountResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	return controllerutil.CreateOrUpdate(ctx, r.tenantClient, r.resource, r.mutate(ctx, tenantControlPlane))
 }
 
 func (r *ServiceAccountResource) GetName() string {
@@ -87,7 +87,7 @@ func (r *ServiceAccountResource) UpdateTenantControlPlaneStatus(ctx context.Cont
 	return nil
 }
 
-func (r *ServiceAccountResource) mutate() controllerutil.MutateFn {
+func (r *ServiceAccountResource) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
 	return func() error {
 		r.resource.SetLabels(utilities.MergeMaps(
 			utilities.KamajiLabels(),

internal/resources/konnectivity/service_resource.go

@@ -125,7 +125,7 @@ func (r *ServiceResource) CreateOrUpdate(ctx context.Context, tenantControlPlane
 }
 
 func (r *ServiceResource) mutate(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) func() error {
-	return func() error {
+	return func() (err error) {
 		switch len(r.resource.Spec.Ports) {
 		case 0:
 			return fmt.Errorf("current state of the Service is not ready to be mangled for Konnectivity")

internal/resources/kubeadm_addons.go

@@ -55,7 +55,7 @@ func (r *KubeadmAddonResource) SetKubeadmConfigChecksum(checksum string) {
 	r.kubeadmConfigChecksum = checksum
 }
 
-func (r *KubeadmAddonResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *KubeadmAddonResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return !r.isStatusEqual(tenantControlPlane)
 }
 
@@ -90,7 +90,7 @@ func (r *KubeadmAddonResource) CleanUp(ctx context.Context, tenantControlPlane *
 	return true, nil
 }
 
-func (r *KubeadmAddonResource) Define(context.Context, *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubeadmAddonResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	return nil
 }
 
@@ -129,7 +129,7 @@ func (r *KubeadmAddonResource) GetName() string {
 	return r.Name
 }
 
-func (r *KubeadmAddonResource) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubeadmAddonResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	status, err := r.GetStatus(tenantControlPlane)
 	if err != nil {
 		return err

internal/resources/kubeadm_config.go

@@ -19,25 +19,27 @@ import (
 )
 
 type KubeadmConfigResource struct {
-	resource     *corev1.ConfigMap
-	Client       client.Client
-	ETCDs        []string
-	TmpDirectory string
+	resource               *corev1.ConfigMap
+	Client                 client.Client
+	Name                   string
+	ETCDs                  []string
+	ETCDCompactionInterval string
+	TmpDirectory           string
 }
 
-func (r *KubeadmConfigResource) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *KubeadmConfigResource) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Status.KubeadmConfig.Checksum != r.resource.GetAnnotations()["checksum"]
 }
 
-func (r *KubeadmConfigResource) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
+func (r *KubeadmConfigResource) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
 	return false
 }
 
-func (r *KubeadmConfigResource) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *KubeadmConfigResource) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	return false, nil
 }
 
-func (r *KubeadmConfigResource) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubeadmConfigResource) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      r.getPrefixedName(tenantControlPlane),
@@ -49,7 +51,7 @@ func (r *KubeadmConfigResource) Define(_ context.Context, tenantControlPlane *ka
 }
 
 func (r *KubeadmConfigResource) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
 }
 
 func (r *KubeadmConfigResource) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
@@ -57,7 +59,7 @@ func (r *KubeadmConfigResource) CreateOrUpdate(ctx context.Context, tenantContro
 }
 
 func (r *KubeadmConfigResource) GetName() string {
-	return "kubeadmconfig"
+	return r.Name
 }
 
 func (r *KubeadmConfigResource) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
@@ -96,6 +98,7 @@ func (r *KubeadmConfigResource) mutate(tenantControlPlane *kamajiv1alpha1.Tenant
 			TenantControlPlaneServiceCIDR: tenantControlPlane.Spec.NetworkProfile.ServiceCIDR,
 			TenantControlPlaneVersion:     tenantControlPlane.Spec.Kubernetes.Version,
 			ETCDs:                         r.ETCDs,
+			ETCDCompactionInterval:        r.ETCDCompactionInterval,
 			CertificatesDir:               r.TmpDirectory,
 		}
 

internal/resources/kubeadm_phases.go

@@ -15,7 +15,6 @@ import (
 
 	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
 	"github.com/clastix/kamaji/internal/kubeadm"
-	"github.com/clastix/kamaji/internal/resources/utils"
 )
 
 type kubeadmPhase int
@@ -56,19 +55,19 @@ func (r *KubeadmPhase) SetKubeadmConfigChecksum(checksum string) {
 	r.checksum = checksum
 }
 
-func (r *KubeadmPhase) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *KubeadmPhase) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return !r.isStatusEqual(tenantControlPlane)
 }
 
-func (r *KubeadmPhase) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
+func (r *KubeadmPhase) ShouldCleanup(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return false
 }
 
-func (r *KubeadmPhase) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *KubeadmPhase) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	return false, nil
 }
 
-func (r *KubeadmPhase) Define(context.Context, *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubeadmPhase) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	return nil
 }
 
@@ -105,7 +104,7 @@ func enrichBootstrapToken(bootstrapToken *bootstraptokenv1.BootstrapToken) {
 	}
 
 	if bootstrapToken.Token.ID == "" {
-		bootstrapToken.Token.ID = fmt.Sprintf("%s.%s", utils.RandomString(6), utils.RandomString(16))
+		bootstrapToken.Token.ID = fmt.Sprintf("%s.%s", randomString(6), randomString(16))
 	}
 }
 
@@ -121,7 +120,7 @@ func (r *KubeadmPhase) GetName() string {
 	return r.Name
 }
 
-func (r *KubeadmPhase) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *KubeadmPhase) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	status, err := r.GetStatus(tenantControlPlane)
 	if err != nil {
 		return err

internal/resources/kubeadm_upgrade.go

@@ -19,6 +19,7 @@ import (
 )
 
 type KubernetesUpgrade struct {
+	Name    string
 	Client  client.Client
 	upgrade upgrade.Upgrade
 
@@ -46,25 +47,25 @@ func (k *KubernetesUpgrade) CleanUp(context.Context, *kamajiv1alpha1.TenantContr
 	return false, nil
 }
 
-func (k *KubernetesUpgrade) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+func (k *KubernetesUpgrade) CreateOrUpdate(ctx context.Context, plane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
 	// A new installation, no need to upgrade
-	if len(tenantControlPlane.Status.Kubernetes.Version.Version) == 0 {
+	if len(plane.Status.Kubernetes.Version.Version) == 0 {
 		k.inProgress = false
 
 		return controllerutil.OperationResultNone, nil
 	}
 	// No version change, no need to upgrade
-	if tenantControlPlane.Status.Kubernetes.Version.Version == tenantControlPlane.Spec.Kubernetes.Version {
+	if plane.Status.Kubernetes.Version.Version == plane.Spec.Kubernetes.Version {
 		k.inProgress = false
 
 		return controllerutil.OperationResultNone, nil
 	}
 	// An upgrade is in progress, let it go
-	if status := tenantControlPlane.Status.Kubernetes.Version.Status; status != nil && *status == kamajiv1alpha1.VersionUpgrading {
+	if status := plane.Status.Kubernetes.Version.Status; status != nil && *status == kamajiv1alpha1.VersionUpgrading {
 		return controllerutil.OperationResultNone, nil
 	}
 	// Checking if the upgrade is allowed, or not
-	restClient, err := utilities.GetTenantRESTClient(ctx, k.Client, tenantControlPlane)
+	restClient, err := utilities.GetTenantRESTClient(ctx, k.Client, plane)
 	if err != nil {
 		return controllerutil.OperationResultNone, errors.Wrap(err, "cannot create REST client required for Kubernetes upgrade plan")
 	}
@@ -85,14 +86,14 @@ func (k *KubernetesUpgrade) CreateOrUpdate(ctx context.Context, tenantControlPla
 }
 
 func (k *KubernetesUpgrade) GetName() string {
-	return "upgrade"
+	return k.Name
 }
 
 func (k *KubernetesUpgrade) ShouldStatusBeUpdated(context.Context, *kamajiv1alpha1.TenantControlPlane) bool {
 	return k.inProgress
 }
 
-func (k *KubernetesUpgrade) UpdateTenantControlPlaneStatus(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (k *KubernetesUpgrade) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	if k.inProgress {
 		tenantControlPlane.Status.Kubernetes.Version.Status = &kamajiv1alpha1.VersionUpgrading
 	}

internal/resources/kubeconfig.go

@@ -61,7 +61,7 @@ func (r *KubeconfigResource) Define(ctx context.Context, tenantControlPlane *kam
 }
 
 func (r *KubeconfigResource) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
 }
 
 func (r *KubeconfigResource) GetClient() client.Client {
@@ -146,7 +146,6 @@ func (r *KubeconfigResource) mutate(ctx context.Context, tenantControlPlane *kam
 
 		kubeconfig, err := kubeadm.CreateKubeconfig(
 			r.KubeConfigFileName,
-
 			kubeadm.CertificatePrivateKeyPair{
 				Certificate: apiServerCertificatesSecret.Data[kubeadmconstants.CACertName],
 				PrivateKey:  apiServerCertificatesSecret.Data[kubeadmconstants.CAKeyName],

internal/resources/sa_certificate.go

@@ -28,19 +28,19 @@ type SACertificate struct {
 	TmpDirectory string
 }
 
-func (r *SACertificate) ShouldStatusBeUpdated(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+func (r *SACertificate) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
 	return tenantControlPlane.Status.Certificates.SA.SecretName != r.resource.GetName()
 }
 
-func (r *SACertificate) ShouldCleanup(*kamajiv1alpha1.TenantControlPlane) bool {
+func (r *SACertificate) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
 	return false
 }
 
-func (r *SACertificate) CleanUp(context.Context, *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+func (r *SACertificate) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
 	return false, nil
 }
 
-func (r *SACertificate) Define(_ context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+func (r *SACertificate) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
 	r.resource = &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      r.getPrefixedName(tenantControlPlane),
@@ -52,7 +52,7 @@ func (r *SACertificate) Define(_ context.Context, tenantControlPlane *kamajiv1al
 }
 
 func (r *SACertificate) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
-	return utilities.AddTenantPrefix(r.GetName(), tenantControlPlane)
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
 }
 
 func (r *SACertificate) GetClient() client.Client {
@@ -68,7 +68,7 @@ func (r *SACertificate) CreateOrUpdate(ctx context.Context, tenantControlPlane *
 }
 
 func (r *SACertificate) GetName() string {
-	return "sa-certificate"
+	return r.Name
 }
 
 func (r *SACertificate) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {

internal/resources/sql_certificate.go

@@ -0,0 +1,143 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package resources
+
+import (
+	"context"
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8stypes "k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/types"
+	"github.com/clastix/kamaji/internal/utilities"
+)
+
+type SQLCertificate struct {
+	resource                 *corev1.Secret
+	Client                   client.Client
+	Name                     string
+	StorageType              types.ETCDStorageType
+	SQLConfigSecretName      string
+	SQLConfigSecretNamespace string
+}
+
+func (r *SQLCertificate) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	return tenantControlPlane.Status.Storage.Kine.Certificate.Checksum != r.resource.GetAnnotations()["checksum"]
+}
+
+func (r *SQLCertificate) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
+	return false
+}
+
+func (r *SQLCertificate) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	return false, nil
+}
+
+func (r *SQLCertificate) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	r.resource = &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      r.getPrefixedName(tenantControlPlane),
+			Namespace: tenantControlPlane.GetNamespace(),
+		},
+		Data: map[string][]byte{},
+	}
+
+	return nil
+}
+
+func (r *SQLCertificate) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
+}
+
+func (r *SQLCertificate) GetClient() client.Client {
+	return r.Client
+}
+
+func (r *SQLCertificate) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
+}
+
+func (r *SQLCertificate) GetName() string {
+	return r.Name
+}
+
+func (r *SQLCertificate) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	if tenantControlPlane.Status.Storage.Kine == nil {
+		tenantControlPlane.Status.Storage.Kine = &kamajiv1alpha1.KineStatus{}
+	}
+
+	tenantControlPlane.Status.Storage.Kine.Certificate.SecretName = r.resource.GetName()
+	tenantControlPlane.Status.Storage.Kine.Certificate.Checksum = r.resource.GetAnnotations()["checksum"]
+	tenantControlPlane.Status.Storage.Kine.Certificate.LastUpdate = metav1.Now()
+
+	return nil
+}
+
+func (r *SQLCertificate) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
+	return func() error {
+		sqlConfig := &corev1.Secret{}
+		namespacedName := k8stypes.NamespacedName{Namespace: r.SQLConfigSecretNamespace, Name: r.SQLConfigSecretName}
+		if err := r.Client.Get(ctx, namespacedName, sqlConfig); err != nil {
+			return err
+		}
+
+		checksum, err := r.buildSecret(ctx, *sqlConfig)
+		if err != nil {
+			return err
+		}
+
+		annotations := r.resource.GetAnnotations()
+		if annotations == nil {
+			annotations = map[string]string{}
+		}
+
+		annotations["checksum"] = checksum
+
+		r.resource.SetAnnotations(annotations)
+
+		r.resource.SetLabels(utilities.MergeMaps(
+			utilities.KamajiLabels(),
+			r.resource.GetLabels(),
+			map[string]string{
+				"kamaji.clastix.io/name":      tenantControlPlane.GetName(),
+				"kamaji.clastix.io/component": r.GetName(),
+			},
+		))
+
+		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
+	}
+}
+
+func (r *SQLCertificate) buildSecret(ctx context.Context, sqlConfig corev1.Secret) (checksum string, err error) {
+	switch r.StorageType {
+	case types.KineMySQL, types.KinePostgreSQL:
+		keys := []string{"ca.crt", "server.crt", "server.key"}
+
+		return r.buildKineSecret(ctx, keys, sqlConfig)
+	default:
+		return "", fmt.Errorf("storage type %s is not implemented", r.StorageType)
+	}
+}
+
+func (r *SQLCertificate) buildKineSecret(ctx context.Context, keys []string, sqlConfig corev1.Secret) (string, error) {
+	checksumMap := map[string]string{}
+
+	for _, key := range keys {
+		value, ok := sqlConfig.Data[key]
+		if !ok {
+			return "", fmt.Errorf("%s is not in sql config secret", key)
+		}
+
+		r.resource.Data[key] = value
+		checksumMap[key] = string(value)
+	}
+
+	return utilities.CalculateConfigMapChecksum(checksumMap), nil
+}

internal/resources/sql_setup.go

@@ -0,0 +1,246 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package resources
+
+import (
+	"context"
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/sql"
+)
+
+type sqlSetupResource struct {
+	schema   string
+	user     string
+	password string
+}
+
+type SQLSetup struct {
+	resource     sqlSetupResource
+	Client       client.Client
+	DBConnection sql.DBConnection
+	Name         string
+	Driver       string
+}
+
+func (r *SQLSetup) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	if tenantControlPlane.Status.Storage.Kine == nil {
+		return true
+	}
+
+	return tenantControlPlane.Status.Storage.Kine.Driver != r.Driver &&
+		tenantControlPlane.Status.Storage.Kine.Setup.Checksum != tenantControlPlane.Status.Storage.Kine.Config.Checksum
+}
+
+func (r *SQLSetup) ShouldCleanup(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	return false
+}
+
+func (r *SQLSetup) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	return false, nil
+}
+
+func (r *SQLSetup) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	secret := &corev1.Secret{}
+	namespacedName := types.NamespacedName{
+		Namespace: tenantControlPlane.GetNamespace(),
+		Name:      tenantControlPlane.Status.Storage.Kine.Config.SecretName,
+	}
+	if err := r.Client.Get(ctx, namespacedName, secret); err != nil {
+		return err
+	}
+
+	r.resource = sqlSetupResource{
+		schema:   string(secret.Data["DB_SCHEMA"]),
+		user:     string(secret.Data["DB_USER"]),
+		password: string(secret.Data["DB_PASSWORD"]),
+	}
+
+	return nil
+}
+
+func (r *SQLSetup) GetClient() client.Client {
+	return r.Client
+}
+
+func (r *SQLSetup) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	if tenantControlPlane.Status.Storage.Kine.Setup.Checksum != "" &&
+		tenantControlPlane.Status.Storage.Kine.Setup.Checksum != tenantControlPlane.Status.Storage.Kine.Config.Checksum {
+		if err := r.Delete(ctx, tenantControlPlane); err != nil {
+			return controllerutil.OperationResultNone, err
+		}
+
+		return controllerutil.OperationResultUpdated, nil
+	}
+
+	reconcilationResult := controllerutil.OperationResultNone
+	var operationResult controllerutil.OperationResult
+	var err error
+
+	operationResult, err = r.createDB(ctx, tenantControlPlane)
+	if err != nil {
+		return reconcilationResult, err
+	}
+	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
+
+	operationResult, err = r.createUser(ctx, tenantControlPlane)
+	if err != nil {
+		return reconcilationResult, err
+	}
+	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
+
+	operationResult, err = r.createGrantPrivileges(ctx, tenantControlPlane)
+	if err != nil {
+		return reconcilationResult, err
+	}
+	reconcilationResult = updateOperationResult(reconcilationResult, operationResult)
+
+	return reconcilationResult, nil
+}
+
+func (r *SQLSetup) GetName() string {
+	return r.Name
+}
+
+func (r *SQLSetup) Delete(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	if err := r.Define(ctx, tenantControlPlane); err != nil {
+		return err
+	}
+
+	if err := r.revokeGrantPrivileges(ctx, tenantControlPlane); err != nil {
+		return err
+	}
+
+	if err := r.deleteDB(ctx, tenantControlPlane); err != nil {
+		return err
+	}
+
+	if err := r.deleteUser(ctx, tenantControlPlane); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (r *SQLSetup) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	if tenantControlPlane.Status.Storage.Kine == nil {
+		return fmt.Errorf("sql configuration is not ready")
+	}
+
+	tenantControlPlane.Status.Storage.Kine.Setup.Schema = r.resource.schema
+	tenantControlPlane.Status.Storage.Kine.Setup.User = r.resource.user
+	tenantControlPlane.Status.Storage.Kine.Setup.LastUpdate = metav1.Now()
+	tenantControlPlane.Status.Storage.Kine.Setup.Checksum = tenantControlPlane.Status.Storage.Kine.Config.Checksum
+
+	return nil
+}
+
+func (r *SQLSetup) createDB(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	exists, err := r.DBConnection.DBExists(ctx, r.resource.schema)
+	if err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	if exists {
+		return controllerutil.OperationResultNone, nil
+	}
+
+	if err := r.DBConnection.CreateDB(ctx, r.resource.schema); err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	return controllerutil.OperationResultCreated, nil
+}
+
+func (r *SQLSetup) deleteDB(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	exists, err := r.DBConnection.DBExists(ctx, r.resource.schema)
+	if err != nil {
+		return err
+	}
+
+	if !exists {
+		return nil
+	}
+
+	if err := r.DBConnection.DeleteDB(ctx, r.resource.schema); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (r *SQLSetup) createUser(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	exists, err := r.DBConnection.UserExists(ctx, r.resource.user)
+	if err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	if exists {
+		return controllerutil.OperationResultNone, nil
+	}
+
+	if err := r.DBConnection.CreateUser(ctx, r.resource.user, r.resource.password); err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	return controllerutil.OperationResultCreated, nil
+}
+
+func (r *SQLSetup) deleteUser(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	exists, err := r.DBConnection.UserExists(ctx, r.resource.user)
+	if err != nil {
+		return err
+	}
+
+	if !exists {
+		return nil
+	}
+
+	if err := r.DBConnection.DeleteUser(ctx, r.resource.user); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (r *SQLSetup) createGrantPrivileges(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	exists, err := r.DBConnection.GrantPrivilegesExists(ctx, r.resource.user, r.resource.schema)
+	if err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	if exists {
+		return controllerutil.OperationResultNone, nil
+	}
+
+	if err := r.DBConnection.GrantPrivileges(ctx, r.resource.user, r.resource.schema); err != nil {
+		return controllerutil.OperationResultNone, err
+	}
+
+	return controllerutil.OperationResultCreated, nil
+}
+
+func (r *SQLSetup) revokeGrantPrivileges(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	exists, err := r.DBConnection.GrantPrivilegesExists(ctx, r.resource.user, r.resource.schema)
+	if err != nil {
+		return err
+	}
+
+	if !exists {
+		return nil
+	}
+
+	if err := r.DBConnection.RevokePrivileges(ctx, r.resource.user, r.resource.schema); err != nil {
+		return err
+	}
+
+	return nil
+}

internal/resources/sql_storage_config.go

@@ -0,0 +1,123 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package resources
+
+import (
+	"context"
+	"strconv"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
+	"github.com/clastix/kamaji/internal/utilities"
+)
+
+type SQLStorageConfig struct {
+	resource *corev1.Secret
+	Client   client.Client
+	Name     string
+	Host     string
+	Port     int
+	Driver   string
+}
+
+func (r *SQLStorageConfig) ShouldStatusBeUpdated(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) bool {
+	if tenantControlPlane.Status.Storage.Kine == nil {
+		return true
+	}
+
+	return tenantControlPlane.Status.Storage.Kine.Config.Checksum != r.resource.GetAnnotations()["checksum"] ||
+		tenantControlPlane.Status.Storage.Kine.Driver != r.Driver
+}
+
+func (r *SQLStorageConfig) ShouldCleanup(plane *kamajiv1alpha1.TenantControlPlane) bool {
+	return false
+}
+
+func (r *SQLStorageConfig) CleanUp(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (bool, error) {
+	return false, nil
+}
+
+func (r *SQLStorageConfig) Define(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	r.resource = &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      r.getPrefixedName(tenantControlPlane),
+			Namespace: tenantControlPlane.GetNamespace(),
+		},
+	}
+
+	return nil
+}
+
+func (r *SQLStorageConfig) getPrefixedName(tenantControlPlane *kamajiv1alpha1.TenantControlPlane) string {
+	return utilities.AddTenantPrefix(r.Name, tenantControlPlane)
+}
+
+func (r *SQLStorageConfig) GetClient() client.Client {
+	return r.Client
+}
+
+func (r *SQLStorageConfig) CreateOrUpdate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) (controllerutil.OperationResult, error) {
+	return utilities.CreateOrUpdateWithConflict(ctx, r.Client, r.resource, r.mutate(ctx, tenantControlPlane))
+}
+
+func (r *SQLStorageConfig) GetName() string {
+	return r.Name
+}
+
+func (r *SQLStorageConfig) UpdateTenantControlPlaneStatus(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) error {
+	if tenantControlPlane.Status.Storage.Kine == nil {
+		tenantControlPlane.Status.Storage.Kine = &kamajiv1alpha1.KineStatus{}
+	}
+
+	tenantControlPlane.Status.Storage.Kine.Driver = r.Driver
+	tenantControlPlane.Status.Storage.Kine.Config.SecretName = r.resource.GetName()
+	tenantControlPlane.Status.Storage.Kine.Config.Checksum = r.resource.GetAnnotations()["checksum"]
+
+	return nil
+}
+
+func (r *SQLStorageConfig) mutate(ctx context.Context, tenantControlPlane *kamajiv1alpha1.TenantControlPlane) controllerutil.MutateFn {
+	return func() error {
+		var password []byte
+
+		savedHash, ok := r.resource.GetAnnotations()["checksum"]
+		switch {
+		case ok && savedHash == utilities.CalculateConfigMapChecksum(r.resource.StringData):
+			password = r.resource.Data["DB_PASSWORD"]
+		default:
+			password = []byte(utilities.GenerateUUIDString())
+		}
+
+		r.resource.Data = map[string][]byte{
+			"DB_HOST":     []byte(r.Host),
+			"DB_PORT":     []byte(strconv.Itoa(r.Port)),
+			"DB_SCHEMA":   []byte(tenantControlPlane.GetName()),
+			"DB_USER":     []byte(tenantControlPlane.GetName()),
+			"DB_PASSWORD": password,
+		}
+
+		annotations := r.resource.GetAnnotations()
+		if annotations == nil {
+			annotations = map[string]string{}
+		}
+
+		annotations["checksum"] = utilities.CalculateConfigMapChecksum(r.resource.StringData)
+		r.resource.SetAnnotations(annotations)
+
+		r.resource.SetLabels(utilities.MergeMaps(
+			utilities.KamajiLabels(),
+			map[string]string{
+				"kamaji.clastix.io/name":      tenantControlPlane.GetName(),
+				"kamaji.clastix.io/component": r.GetName(),
+			},
+		))
+
+		return ctrl.SetControllerReference(tenantControlPlane, r.resource, r.Client.Scheme())
+	}
+}

internal/resources/utils.go

@@ -1,7 +1,7 @@
 // Copyright 2022 Clastix Labs
 // SPDX-License-Identifier: Apache-2.0
 
-package utils
+package resources
 
 import (
 	"math/rand"
@@ -12,7 +12,7 @@ import (
 
 var letters = []byte("abcdefghijklmnopqrstuvwxyz")
 
-func UpdateOperationResult(current controllerutil.OperationResult, op controllerutil.OperationResult) controllerutil.OperationResult {
+func updateOperationResult(current controllerutil.OperationResult, op controllerutil.OperationResult) controllerutil.OperationResult {
 	if current == controllerutil.OperationResultCreated || op == controllerutil.OperationResultCreated {
 		return controllerutil.OperationResultCreated
 	}
@@ -32,7 +32,7 @@ func UpdateOperationResult(current controllerutil.OperationResult, op controller
 	return controllerutil.OperationResultNone
 }
 
-func RandomString(n int) string {
+func randomString(n int) string {
 	rand.Seed(time.Now().UnixNano())
 	b := make([]byte, n)
 	for i := range b {

internal/sql/constants.go

@@ -0,0 +1,10 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package sql
+
+const (
+	defaultProtocol = "tcp"
+	firstPort       = 1024
+	sqlErrorNoRows  = "sql: no rows in result set"
+)

internal/sql/mysql.go

@@ -1,23 +1,15 @@
 // Copyright 2022 Clastix Labs
 // SPDX-License-Identifier: Apache-2.0
 
-package datastore
+package sql
 
 import (
 	"context"
 	"database/sql"
 	"fmt"
-	"net/url"
 
 	"github.com/go-pg/pg/v10"
 	"github.com/go-sql-driver/mysql"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
-)
-
-const (
-	defaultProtocol = "tcp"
-	sqlErrorNoRows  = "sql: no rows in result set"
 )
 
 const (
@@ -33,44 +25,36 @@ const (
 )
 
 type MySQLConnection struct {
-	db        *sql.DB
-	connector ConnectionEndpoint
+	db   *sql.DB
+	host string
+	port int
 }
 
 func (c *MySQLConnection) Driver() string {
-	return string(kamajiv1alpha1.KineMySQLDriver)
+	return "MySQL"
 }
 
-func NewPostgreSQLConnection(config ConnectionConfig) (Connection, error) {
+func getPostgreSQLDB(config ConnectionConfig) (DBConnection, error) {
 	opt := &pg.Options{
-		Addr:      config.Endpoints[0].String(),
+		Addr:      fmt.Sprintf("%s:%d", config.Host, config.Port),
 		Database:  config.DBName,
 		User:      config.User,
 		Password:  config.Password,
 		TLSConfig: config.TLSConfig,
 	}
 
-	return &PostgreSQLConnection{db: pg.Connect(opt), connection: config.Endpoints[0]}, nil
+	return &PostgreSQLConnection{db: pg.Connect(opt), port: config.Port, host: config.Host}, nil
 }
 
-func NewMySQLConnection(config ConnectionConfig) (Connection, error) {
-	nameDB := fmt.Sprintf("%s(%s)", defaultProtocol, config.Endpoints[0].String())
-
-	var parameters string
-	if len(config.Parameters) > 0 {
-		parameters = url.Values(config.Parameters).Encode()
-	}
-
-	dsn := fmt.Sprintf("%s%s/%s?%s", config.getDataSourceNameUserPassword(), nameDB, config.DBName, parameters)
-
-	mysqlConfig, err := mysql.ParseDSN(dsn)
+func getMySQLDB(config ConnectionConfig) (DBConnection, error) {
+	tlsKey := "mysql"
+	dataSourceName := config.GetDataSourceName()
+	mysqlConfig, err := mysql.ParseDSN(dataSourceName)
 	if err != nil {
 		return nil, err
 	}
 
-	tlsKey := "mysql"
-
-	if err = mysql.RegisterTLSConfig(tlsKey, config.TLSConfig); err != nil {
+	if err := mysql.RegisterTLSConfig(tlsKey, config.TLSConfig); err != nil {
 		return nil, err
 	}
 
@@ -83,19 +67,27 @@ func NewMySQLConnection(config ConnectionConfig) (Connection, error) {
 		return nil, err
 	}
 
-	return &MySQLConnection{db: db, connector: config.Endpoints[0]}, nil
+	return &MySQLConnection{
+		db:   db,
+		host: config.Host,
+		port: config.Port,
+	}, nil
 }
 
-func (c *MySQLConnection) GetConnectionString() string {
-	return c.connector.String()
+func (c *MySQLConnection) GetHost() string {
+	return c.host
+}
+
+func (c *MySQLConnection) GetPort() int {
+	return c.port
 }
 
 func (c *MySQLConnection) Close() error {
 	return c.db.Close()
 }
 
-func (c *MySQLConnection) Check(ctx context.Context) error {
-	return c.db.PingContext(ctx)
+func (c *MySQLConnection) Check() error {
+	return c.db.Ping()
 }
 
 func (c *MySQLConnection) CreateUser(ctx context.Context, user, password string) error {
@@ -114,7 +106,7 @@ func (c *MySQLConnection) UserExists(ctx context.Context, user string) (bool, er
 	checker := func(row *sql.Row) (bool, error) {
 		var name string
 		if err := row.Scan(&name); err != nil {
-			if c.checkEmptyQueryResult(err) {
+			if checkEmptyQueryResult(err) {
 				return false, nil
 			}
 
@@ -131,7 +123,7 @@ func (c *MySQLConnection) DBExists(ctx context.Context, dbName string) (bool, er
 	checker := func(row *sql.Row) (bool, error) {
 		var name string
 		if err := row.Scan(&name); err != nil {
-			if c.checkEmptyQueryResult(err) {
+			if checkEmptyQueryResult(err) {
 				return false, nil
 			}
 
@@ -199,7 +191,3 @@ func (c *MySQLConnection) mutate(ctx context.Context, nonFilledStatement string,
 
 	return nil
 }
-
-func (c *MySQLConnection) checkEmptyQueryResult(err error) bool {
-	return err.Error() == sqlErrorNoRows
-}

internal/sql/postgresql.go

@@ -1,7 +1,7 @@
 // Copyright 2022 Clastix Labs
 // SPDX-License-Identifier: Apache-2.0
 
-package datastore
+package sql
 
 import (
 	"context"
@@ -9,8 +9,6 @@ import (
 	"strings"
 
 	"github.com/go-pg/pg/v10"
-
-	kamajiv1alpha1 "github.com/clastix/kamaji/api/v1alpha1"
 )
 
 const (
@@ -26,12 +24,13 @@ const (
 )
 
 type PostgreSQLConnection struct {
-	db         *pg.DB
-	connection ConnectionEndpoint
+	db   *pg.DB
+	host string
+	port int
 }
 
 func (r *PostgreSQLConnection) Driver() string {
-	return string(kamajiv1alpha1.KinePostgreSQLDriver)
+	return "PostgreSQL"
 }
 
 func (r *PostgreSQLConnection) UserExists(ctx context.Context, user string) (bool, error) {
@@ -110,14 +109,18 @@ func (r *PostgreSQLConnection) RevokePrivileges(ctx context.Context, user, dbNam
 	return err
 }
 
-func (r *PostgreSQLConnection) GetConnectionString() string {
-	return r.connection.String()
+func (r *PostgreSQLConnection) GetHost() string {
+	return r.host
+}
+
+func (r *PostgreSQLConnection) GetPort() int {
+	return r.port
 }
 
 func (r *PostgreSQLConnection) Close() error {
 	return r.db.Close()
 }
 
-func (r *PostgreSQLConnection) Check(ctx context.Context) error {
-	return r.db.Ping(ctx)
+func (r *PostgreSQLConnection) Check() error {
+	return r.db.Ping(context.Background())
 }

internal/sql/sql.go

@@ -0,0 +1,110 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package sql
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net/url"
+)
+
+type Driver int
+
+const (
+	MySQL Driver = iota
+	PostgreSQL
+)
+
+func (d Driver) ToString() string {
+	switch d {
+	case MySQL:
+		return "mysql"
+	case PostgreSQL:
+		return "postgresql"
+	default:
+		return ""
+	}
+}
+
+type ConnectionConfig struct {
+	SQLDriver  Driver
+	User       string
+	Password   string
+	Host       string
+	Port       int
+	DBName     string
+	TLSConfig  *tls.Config
+	Parameters map[string][]string
+}
+
+func (config ConnectionConfig) GetDataSourceName() string {
+	userPassword := config.getDataSourceNameUserPassword()
+	db := config.getDataSourceNameDB()
+	dataSourceName := fmt.Sprintf("%s%s/%s?%s", userPassword, db, config.DBName, config.formatParameters())
+
+	return dataSourceName
+}
+
+func (config ConnectionConfig) getDataSourceNameUserPassword() string {
+	if config.User == "" {
+		return ""
+	}
+
+	if config.Password == "" {
+		return fmt.Sprintf("%s@", config.User)
+	}
+
+	return fmt.Sprintf("%s:%s@", config.User, config.Password)
+}
+
+func (config ConnectionConfig) getDataSourceNameDB() string {
+	if config.Host == "" || config.Port < firstPort {
+		return ""
+	}
+
+	return fmt.Sprintf("%s(%s:%d)", defaultProtocol, config.Host, config.Port)
+}
+
+func (config ConnectionConfig) formatParameters() string {
+	if len(config.Parameters) == 0 {
+		return ""
+	}
+
+	values := url.Values(config.Parameters)
+
+	return values.Encode()
+}
+
+type DBConnection interface {
+	CreateUser(ctx context.Context, user, password string) error
+	CreateDB(ctx context.Context, dbName string) error
+	GrantPrivileges(ctx context.Context, user, dbName string) error
+	UserExists(ctx context.Context, user string) (bool, error)
+	DBExists(ctx context.Context, dbName string) (bool, error)
+	GrantPrivilegesExists(ctx context.Context, user, dbName string) (bool, error)
+	DeleteUser(ctx context.Context, user string) error
+	DeleteDB(ctx context.Context, dbName string) error
+	RevokePrivileges(ctx context.Context, user, dbName string) error
+	GetHost() string
+	GetPort() int
+	Close() error
+	Check() error
+	Driver() string
+}
+
+func GetDBConnection(config ConnectionConfig) (DBConnection, error) {
+	switch config.SQLDriver {
+	case MySQL:
+		return getMySQLDB(config)
+	case PostgreSQL:
+		return getPostgreSQLDB(config)
+	default:
+		return nil, fmt.Errorf("%s is not a valid driver", config.SQLDriver.ToString())
+	}
+}
+
+func checkEmptyQueryResult(err error) bool {
+	return err.Error() == sqlErrorNoRows
+}

internal/types/etcd_storage.go

@@ -0,0 +1,45 @@
+// Copyright 2022 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package types
+
+import (
+	"fmt"
+
+	"github.com/spf13/viper"
+)
+
+type ETCDStorageType int
+
+const (
+	ETCD ETCDStorageType = iota
+	KineMySQL
+	KinePostgreSQL
+)
+
+var etcdStorageTypeString = map[string]ETCDStorageType{"etcd": ETCD, "kine-mysql": KineMySQL, "kine-postgresql": KinePostgreSQL}
+
+func (s ETCDStorageType) String() string {
+	return [...]string{"etcd", "kine-mysql", "kine-postgresql"}[s]
+}
+
+// ParseETCDStorageType returns the ETCDStorageType given a string representation of the type.
+func ParseETCDStorageType(s string) ETCDStorageType {
+	if storageType, ok := etcdStorageTypeString[s]; ok {
+		return storageType
+	}
+
+	panic(fmt.Errorf("unsupported storage type %s", s))
+}
+
+// ParseETCDEndpoint returns the default ETCD endpoints used to interact with the Tenant Control Plane backing storage.
+func ParseETCDEndpoint(conf *viper.Viper) string {
+	switch ParseETCDStorageType(conf.GetString("etcd-storage-type")) {
+	case ETCD:
+		return conf.GetString("etcd-endpoints")
+	case KineMySQL, KinePostgreSQL:
+		return "127.0.0.1:2379"
+	default:
+		panic("unsupported storage type")
+	}
+}

internal/utilities/args.go

@@ -63,5 +63,5 @@ func ArgsAddFlagValue(args map[string]string, flag, value string) bool {
 
 	args[flag] = value
 
-	return !ok
+	return ok == false
 }

internal/utilities/create_or_update_conflict.go

@@ -6,7 +6,6 @@ package utilities
 import (
 	"context"
 
-	"k8s.io/apimachinery/pkg/api/errors"
 	k8stypes "k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/util/retry"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -18,10 +17,8 @@ import (
 // without enqueuing back the request in order to get the latest changes of the resource.
 func CreateOrUpdateWithConflict(ctx context.Context, client client.Client, resource client.Object, f controllerutil.MutateFn) (res controllerutil.OperationResult, err error) {
 	err = retry.RetryOnConflict(retry.DefaultRetry, func() (scopeErr error) {
-		if scopeErr = client.Get(ctx, k8stypes.NamespacedName{Namespace: resource.GetNamespace(), Name: resource.GetName()}, resource); scopeErr != nil {
-			if !errors.IsNotFound(scopeErr) {
-				return scopeErr
-			}
+		if scopeErr = client.Get(ctx, k8stypes.NamespacedName{Namespace: resource.GetNamespace(), Name: resource.GetName()}, resource); err != nil {
+			return err
 		}
 
 		res, scopeErr = controllerutil.CreateOrUpdate(ctx, client, resource, f)