Kamaji is a Kubernetes operator that transforms any Kubernetes cluster into a management cluster capable of orchestrating multiple independent tenant control planes. It provisions and manages Tenant Control Plane (TCP) custom resources—essentially running full Kubernetes control planes (kube-apiserver, kube-scheduler, kube-controller-manager) as pods inside a management cluster, using unmodified upstream Kubernetes components and kubeadm for bootstrapping. The operator extends Kubernetes via three CRDs: TenantControlPlane (namespace-scoped), DataStore (cluster-scoped, backing store abstraction), and KubeconfigGenerator. It supports multiple datastore drivers (etcd, MySQL, PostgreSQL, NATS via Kine) with TLS, basic auth, and live migration. The architecture features multiple controllers (main TCP reconciler, datastore lifecycle, certificate lifecycle, KubeconfigGenerator, telemetry), mutating/validating webhooks, and a per-TCP 'soot' manager that handles kubeadm phases, addons (CoreDNS, kube-proxy, Konnectivity), and write permissions. It integrates with Cluster API as a control plane provider and exposes Prometheus metrics, a Grafana dashboard, and optional telemetry. The codebase is a standard Go-based controller-runtime operator with Helm charts for deployment.