$ show clastix/kamaji
Kamaji is a Kubernetes operator that transforms any Kubernetes cluster into a management cluster capable of orchestrating multiple independent tenant control planes. It provisions and manages Tenant Control Plane (TCP) custom resources—essentially running full Kubernetes control planes (kube-apiserver, kube-scheduler, kube-controller-manager) as pods inside a management cluster, using unmodified upstream Kubernetes components and kubeadm for bootstrapping. The operator extends Kubernetes via three CRDs: TenantControlPlane (namespace-scoped), DataStore (cluster-scoped, backing store abstraction), and KubeconfigGenerator. It supports multiple datastore drivers (etcd, MySQL, PostgreSQL, NATS via Kine) with TLS, basic auth, and live migration. The architecture features multiple controllers (main TCP reconciler, datastore lifecycle, certificate lifecycle, KubeconfigGenerator, telemetry), mutating/validating webhooks, and a per-TCP 'soot' manager that handles kubeadm phases, addons (CoreDNS, kube-proxy, Konnectivity), and write permissions. It integrates with Cluster API as a control plane provider and exposes Prometheus metrics, a Grafana dashboard, and optional telemetry. The codebase is a standard Go-based controller-runtime operator with Helm charts for deployment.
The LLM identified 4 files worth highlighting for reuse:
Defines a clean `Resource` interface with methods `Define`, `ShouldCleanup`, `CleanUp`, `CreateOrUpdate`, `GetName`, `ShouldStatusBeUpdated`, `UpdateTenantControlPlaneStatus`, and a centralized `Handle` function with Prometheus timing. This pattern decouples resource lifecycle from the controller logic, making it easy to add, remove, or test individual resources. Reusable in any Kubernetes operator that needs to manage a homogeneous set of sub-resources.
Provides a `Connection` interface that abstracts datastore operations (CreateUser, CreateDB, GrantPrivileges, UserExists, DBExists, Migrate, etc.) with concrete implementations for etcd, MySQL, PostgreSQL, and NATS. The interface allows the controller to work uniformly across different backing stores, and the migration logic supports live datastore changes. The pattern is highly reusable for any project that needs a pluggable storage backend.
Implements `CreateOrUpdateWithConflict`, a wrapper around controllerutil's CreateOrUpdate that retries on conflict errors with an expiring context. This is a common pattern in Kubernetes controllers to handle optimistic concurrency, and the implementation is clean, generic, and easily extractable into any Go controller project.
Contains `CalculateMapChecksum` and `CalculateSliceChecksum` functions that compute MD5 checksums of maps or slices, used to detect configuration drift via the `kamaji.clastix.io/checksum` annotation. The functions are self-contained, well-tested, and can be reused in any project requiring deterministic checksums for data structures.