vorlon001/full rebuild kamaji.md

Last active May 26, 2026 19:05

Star (0) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Select an option

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/vorlon001/c2c2e13615ab96382bf87229b5583193.js"></script>
Save vorlon001/c2c2e13615ab96382bf87229b5583193 to your computer and use it in GitHub Desktop.

Download ZIP

How to install kamaji v4, how to how to change the certificate lifetime

Raw

readme.md

AS IS

test: cloudstack v181, k8s 1.36.1, debian 13, 6.12.86+deb13-amd64, Cilium:1.19.1, Containerd:2.3.0, CNI 1.9.1
install: cert-manager
my fork
- https://github.com/vorlon001/kamaji/tree/26.4.5-edge-patch
- https://github.com/vorlon001/kamaji/tree/26.5.3-edge-patch

Result test

BUG: clastix/kamaji#1154 "Two many run pods on kamaji tag: 26.5.3-edge"

if add section, then will work not correctly.

      extraArgs:
        apiServer:
        - --profiling=false

Init Test

apt install git -y
git clone https://github.com/aenix-io/etcd-operator
git clone https://github.com/cozystack/cozystack
git clone https://github.com/clastix/kamaji

cat <<EOF>/root/etcd-operator/charts/etcd-operator/Chart.yaml
apiVersion: v2
name: etcd-operator
type: application
version: 0.4.3 # Placeholder, the actual version will be set in the release pipeline.
appVersion: "v0.4.3" # Placeholder, the actual version will be set in the release pipeline.
EOF

cd /root/etcd-operator/charts
kubectl create ns etcd-operator
helm install etcd-operator -n etcd-operator \
  --set etcdOperator.vpa.enabled=false \
  --set kubeRbacProxy.vpa.enabled=false \
  --set replicaCount=1 etcd-operator \
  --set etcdOperator.image.repository=ghcr.io/aenix-io/etcd-operator \
  --set etcdOperator.image.tag=v0.4.3 \
  --set kubeRbacProxy.image.repository=quay.io/brancz/kube-rbac-proxy \
  --set kubeRbacProxy.image.tag=v0.21.2

kubectl get all -n etcd-operator

Deploy Etcd

cat <<EOF>/root/etcdcluster-kamaji.yaml
---
apiVersion: etcd.aenix.io/v1alpha1
kind: EtcdCluster
metadata:
  name: etcd
  namespace: cluster1
spec:
  podTemplate:
    spec:
      imagePullSecrets:
      - name: myregistrykey
      containers:
      - name: etcd
        image: "harbor.iblog.pro/registry.k8s.io/etcd:3.6.8-0"
  storage:
    volumeClaimTemplate:
      spec:
        storageClassName: managed-nfs-storage
        accessModes: [ "ReadWriteOnce" ]
        resources:
          requests:
            storage: 4Gi
  security:
    tls:
      peerTrustedCASecret: etcd-peer-ca-tls
      peerSecret: etcd-peer-tls
      serverSecret: etcd-server-tls
      clientTrustedCASecret: etcd-ca-tls
      clientSecret: etcd-client-tls
---
apiVersion: kamaji.clastix.io/v1alpha1
kind: DataStore
metadata:
  name: cluster1
spec:
  driver: etcd
  endpoints:
  - etcd-0.etcd-headless.cluster1.svc:2379
  - etcd-1.etcd-headless.cluster1.svc:2379
  - etcd-2.etcd-headless.cluster1.svc:2379
  tlsConfig:
    certificateAuthority:
      certificate:
        secretReference:
          keyPath: tls.crt
          name: etcd-ca-tls
          namespace: cluster1
      privateKey:
        secretReference:
          keyPath: tls.key
          name: etcd-ca-tls
          namespace: cluster1
    clientCertificate:
      certificate:
        secretReference:
          keyPath: tls.crt
          name: etcd-client-tls
          namespace: cluster1
      privateKey:
        secretReference:
          keyPath: tls.key
          name: etcd-client-tls
          namespace: cluster1
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: etcd-selfsigning-issuer
  namespace: cluster1
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: etcd-peer-ca
  namespace: cluster1
spec:
  isCA: true
  usages:
  - "signing"
  - "key encipherment"
  - "cert sign"
  commonName: etcd-peer-ca
  subject:
    organizations:
      - ACME Inc.
    organizationalUnits:
      - Widgets
  secretName: etcd-peer-ca-tls
  privateKey:
    algorithm: RSA
    size: 4096
  issuerRef:
    name: etcd-selfsigning-issuer
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: etcd-ca
  namespace: cluster1
spec:
  isCA: true
  usages:
  - "signing"
  - "key encipherment"
  - "cert sign"
  commonName: etcd-ca
  subject:
    organizations:
      - ACME Inc.
    organizationalUnits:
      - Widgets
  secretName: etcd-ca-tls
  privateKey:
    algorithm: RSA
    size: 4096
  issuerRef:
    name: etcd-selfsigning-issuer
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: etcd-peer-issuer
  namespace: cluster1
spec:
  ca:
    secretName: etcd-peer-ca-tls
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: etcd-issuer
  namespace: cluster1
spec:
  ca:
    secretName: etcd-ca-tls
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: etcd-server
  namespace: cluster1
spec:
  secretName: etcd-server-tls
  isCA: false
  usages:
    - "client auth"
    - "server auth"
    - "signing"
    - "key encipherment"
  dnsNames:
  - etcd-0
  - etcd-0.etcd-headless
  - etcd-0.etcd-headless.cluster1.svc
  - etcd-0.etcd-headless.cluster1.svc.cluster.local
  - etcd-1
  - etcd-1.etcd-headless
  - etcd-1.etcd-headless.cluster1.svc
  - etcd-1.etcd-headless.cluster1.svc.cluster.local
  - etcd-2
  - etcd-2.etcd-headless
  - etcd-2.etcd-headless.cluster1.svc
  - etcd-2.etcd-headless.cluster1.svc.cluster.local
  - localhost
  ipAddresses:
  - 127.0.0.1
  privateKey:
    rotationPolicy: Always
    algorithm: RSA
    size: 4096
  issuerRef:
    name: etcd-issuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: etcd-peer
  namespace: cluster1
spec:
  secretName: etcd-peer-tls
  isCA: false
  usages:
    - "server auth"
    - "client auth"
    - "signing"
    - "key encipherment"
  dnsNames:
  - etcd-0
  - etcd-0.etcd-headless
  - etcd-0.etcd-headless.cluster1.svc
  - etcd-0.etcd-headless.cluster1.svc.cluster.local
  - etcd-1
  - etcd-1.etcd-headless
  - etcd-1.etcd-headless.cluster1.svc
  - etcd-1.etcd-headless.cluster1.svc.cluster.local
  - etcd-2
  - etcd-2.etcd-headless
  - etcd-2.etcd-headless.cluster1.svc
  - etcd-2.etcd-headless.cluster1.svc.cluster.local
  - localhost
  - "127.0.0.1"
  privateKey:
    rotationPolicy: Always
    algorithm: RSA
    size: 4096
  issuerRef:
    name: etcd-peer-issuer
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: etcd-client
  namespace: cluster1
spec:
  commonName: root
  secretName: etcd-client-tls
  usages:
  - "signing"
  - "key encipherment"
  - "client auth"
  privateKey:
    rotationPolicy: Always
    algorithm: RSA
    size: 4096
  issuerRef:
    name: etcd-issuer
    kind: Issuer
EOF

kubectl create ns cluster1
kubectl apply  -n cluster1 -f /root/etcdcluster-kamaji.yaml

kubectl get secret -n cluster1 etcd-client-tls -o go-template='{{index .data "tls.crt"}}'
kubectl get all -n cluster1

apt install dnsutils -y
dig etcd-2.etcd-headless.cluster1.svc.cluster.local. @10.97.128.10

kubectl rollout restart deployment.apps/kamaji -n kamaji-system
kubectl get all -n kamaji-system

Install Kamaji

cd /root/charts/kamaji/charts/kamaji-crds
helm dependency build

cd /root/charts/kamaji/charts/kamaji-crds
helm package  .

cd /root/charts/kamaji/charts/kamaji
helm repo add clastix https://clastix.github.io/charts
helm dependency build
helm package  .

# Step 1: Install CRDs
kubectl create ns kamaji-system
helm install kamaji-crds -n kamaji-system /root/charts/kamaji/charts/kamaji-crds/kamaji-crds-0.0.0+latest.tgz

# Step 2: Install Kamaji operator
helm install kamaji -n kamaji-system --set kamaji-etcd.deploy=false \
 --set replicaCount=1 \
 --set image.repository=harbor.iblog.pro/test/cloudstack/kamaji \
 --set image.tag=26.5.3-edge-3 \
 /root/charts/kamaji/charts//kamaji/kamaji-0.0.0+latest.tgz

Deploy Kamaji tenant

export TENANT_NAMESPACE=cluster1
export TENANT_NAME=paas
export TENANT_VERSION=v1.36.1
export TENANT_DOMAIN=cloud.local
export TENANT_SVC_CIDR=244.1.0.0/16
export TENANT_POD_CIDR=244.2.0.0/16
export TENANT_DNS_SERVICE=244.1.0.10
export TENANT_PROXY_PORT=16443
export TENANT_PORT=6443

kubectl create ns ${TENANT_NAMESPACE}
kubectl create configmap tenant-audit-policy --from-file=/etc/kubernetes/policies/audit-policy.yaml -n ${TENANT_NAMESPACE}

cat > ${TENANT_NAMESPACE}-${TENANT_NAME}-tcp.yaml <<EOF
apiVersion: kamaji.clastix.io/v1alpha1
kind: TenantControlPlane
metadata:
  name: ${TENANT_NAME}
  namespace: ${TENANT_NAMESPACE}
  labels:
    tenant.clastix.io: ${TENANT_NAME}
spec:
  dataStore: cluster1
  controlPlane:
    deployment:
      additionalVolumeMounts:
        apiServer:
          - name: audit-policy
            mountPath: /etc/kubernetes/audit
            readOnly: true
      additionalVolumes:
        - name: audit-policy
          configMap:
            name: tenant-audit-policy
      registrySettings:
         registry: harbor.iblog.pro/registry.k8s.io
      replicas: 3
      additionalMetadata:
        labels:
          tenant.clastix.io: ${TENANT_NAME}
      extraArgs:
        apiServer:
        - --profiling=false
        - --audit-log-format=json
        - --audit-log-maxage=7
        - --audit-log-maxbackup=10
        - --audit-log-maxsize=100
        - --audit-log-path=/dev/stdout
        - --authorization-webhook-cache-authorized-ttl=5m0s
        - --authorization-webhook-cache-unauthorized-ttl=30s
        - --audit-policy-file=/etc/kubernetes/audit/audit-policy.yaml
        - --profiling=false
        - --request-timeout=300s
        - --tls-min-version=VersionTLS13
        - --service-node-port-range=30000-32767
        - --authorization-mode=Node,RBAC
        - --kubelet-preferred-address-types=InternalDNS,InternalIP,Hostname,ExternalDNS,ExternalIP
        - --default-not-ready-toleration-seconds=300
        - --default-unreachable-toleration-seconds=300
        - --enable-aggregator-routing=False
        - --anonymous-auth=True
        - --event-ttl=1h0m0s
        - --kubelet-preferred-address-types=InternalDNS,InternalIP,Hostname,ExternalDNS,ExternalIP
        - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256
        controllerManager:
        - --profiling=false
        scheduler:
        - --profiling=false
      resources: {}
    service:
      additionalMetadata:
        labels:
          tenant.clastix.io: ${TENANT_NAME}
      serviceType: LoadBalancer
  kubernetes:
    version: ${TENANT_VERSION}
    caCertificateValidityPeriod: 876000h
    certificateValidityPeriod: 87600h
    clusterName: cluster.local
    encryptionAlgorithm: RSA-4096
    kubelet:
      cgroupfs: systemd
      preferredAddressTypes: [InternalDNS,InternalIP,Hostname,ExternalDNS,ExternalIP]
      configurationJSONPatches: [{"op": "remove", "path": "/nodeLeaseDurationSeconds"}, {"op": "remove", "path": "/address"}, {"op": "remove", "path": "/cpuCFSQuotaPeriod"}, {"op": "remove", "path": "/configMapAndSecretChangeDetectionStrategy"}, {"op": "remove", "path": "/cpuManagerPolicy"}, {"op": "remove", "path": "/iptablesMasqueradeBit"}, {"op": "remove", "path": "/port"}, {"op": "remove", "path": "/imagePullCredentialsVerificationPolicy"}, {"op": "remove", "path": "/enableControllerAttachDetach"}, {"op": "remove", "path": "/failCgroupV1"}, {"op": "remove", "path": "/seccompDefault"}, {"op": "remove", "path": "/enableDebuggingHandlers"}, {"op": "remove", "path": "/containerLogMonitorInterval"}, {"op": "remove", "path": "/failSwapOn"}, {"op": "remove", "path": "/enableDebugFlagsHandler"}, {"op": "remove", "path": "/podLogsDir"}, {"op": "remove", "path": "/volumePluginDir"}, {"op": "remove", "path": "/containerLogMaxWorkers"}, {"op": "remove", "path": "/eventBurst"}, {"op": "remove", "path": "/registryBurst"}, {"op": "remove", "path": "/memoryManagerPolicy"}, {"op": "remove", "path": "/enforceNodeAllocatable"}, {"op": "remove", "path": "/iptablesDropBit"}, {"op": "remove", "path": "/makeIPTablesUtilChains"}, {"op": "remove", "path": "/contentType"}, {"op": "remove", "path": "/eventRecordQPS"}, {"op": "remove", "path": "/mergeDefaultEvictionSettings"}, {"op": "remove", "path": "/oomScoreAdj"}, {"op": "remove", "path": "/topologyManagerPolicy"}, {"op": "remove", "path": "/topologyManagerScope"}, {"op": "remove", "path": "/enableSystemLogHandler"}, {"op": "remove", "path": "/enableServer"}, {"op": "remove", "path": "/cpuCFSQuota"}, {"op": "remove", "path": "/localStorageCapacityIsolation"}, {"op": "remove", "path": "/enableProfilingHandler"}, {"op": "add", "path": "/evictionMinimumReclaim", "value": {"imagefs.available": "2Gi", "memory.available": "0Mi", "nodefs.available": "500Mi"}}, {"op": "add", "path": "/cgroupRoot", "value": "/"}, {"op": "add", "path": "/allowedUnsafeSysctls", "value": ["net.core.somaxconn"]}, {"op": "add", "path": "/kubeletCgroups", "value": "/kubelet.slice"}, {"op": "add", "path": "/evictionSoftGracePeriod", "value": {"imagefs.available": "2m30s", "imagefs.inodesFree": "2m30s", "memory.available": "2m30s", "nodefs.available": "2m30s", "nodefs.inodesFree": "2m30s"}}, {"op": "move", "from": "/registryPullQPS", "path": "/maxParallelImagePulls"}, {"op": "add", "path": "/kubeReservedCgroup", "value": "/kubelet.slice"}, {"op": "add", "path": "/tlsCipherSuites", "value": ["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384", "TLS_CHACHA20_POLY1305_SHA256"]}, {"op": "add", "path": "/podsPerCore", "value": 5}, {"op": "add", "path": "/evictionSoft", "value": {"imagefs.available": "30%", "imagefs.inodesFree": "25%", "memory.available": "500Mi", "nodefs.available": "25%", "nodefs.inodesFree": "15%"}}, {"op": "add", "path": "/systemReserved", "value": {"cpu": "500m", "ephemeral-storage": "1Gi", "memory": "1000Mi"}}, {"op": "add", "path": "/evictionMaxPodGracePeriod", "value": 300}, {"op": "add", "path": "/evictionHard", "value": {"imagefs.available": "25%", "imagefs.inodesFree": "15%", "memory.available": "500Mi", "nodefs.available": "20%", "nodefs.inodesFree": "10%"}}, {"op": "add", "path": "/kubeReserved", "value": {"cpu": "500m", "ephemeral-storage": "3Gi", "memory": "500Mi"}}, {"op": "add", "path": "/tlsMinVersion", "value": "VersionTLS13"}, {"op": "replace", "path": "/streamingConnectionIdleTimeout", "value": "0s"}, {"op": "replace", "path": "/hairpinMode", "value": "hairpin-veth"}, {"op": "replace", "path": "/authentication/webhook/cacheTTL", "value": "0s"}, {"op": "replace", "path": "/nodeStatusUpdateFrequency", "value": "30s"}, {"op": "replace", "path": "/runtimeRequestTimeout", "value": "0s"}, {"op": "replace", "path": "/podPidsLimit", "value": 4096}, {"op": "replace", "path": "/nodeStatusReportFrequency", "value": "20s"}, {"op": "replace", "path": "/fileCheckFrequency", "value": "0s"}, {"op": "replace", "path": "/authorization/webhook/cacheUnauthorizedTTL", "value": "0s"}, {"op": "replace", "path": "/authorization/webhook/cacheAuthorizedTTL", "value": "0s"}, {"op": "replace", "path": "/imageGCHighThresholdPercent", "value": 55}, {"op": "replace", "path": "/containerLogMaxSize", "value": "50Mi"}, {"op": "replace", "path": "/shutdownGracePeriodCriticalPods", "value": "5s"}, {"op": "remove", "path": "/logging/format"}, {"op": "replace", "path": "/logging/flushFrequency", "value": 0}, {"op": "replace", "path": "/httpCheckFrequency", "value": "0s"}, {"op": "replace", "path": "/imageMinimumGCAge", "value": "0s"}, {"op": "replace", "path": "/volumeStatsAggPeriod", "value": "0s"}, {"op": "replace", "path": "/syncFrequency", "value": "0s"}, {"op": "replace", "path": "/shutdownGracePeriod", "value": "15s"}, {"op": "replace", "path": "/cpuManagerReconcilePeriod", "value": "0s"}, {"op": "remove", "path": "/crashLoopBackOff/maxContainerRestartPeriod"}, {"op": "replace", "path": "/imageGCLowThresholdPercent", "value": 50}, {"op": "replace", "path": "/maxPods", "value": 20}, {"op": "replace", "path": "/serializeImagePulls", "value": false}, {"op": "replace", "path": "/clusterDNS/0", "value": "244.1.0.10"}]
    admissionControllers:
      - ResourceQuota
      - LimitRanger
  networkProfile:
    port: ${TENANT_PORT}
    certSANs:
    - ${TENANT_NAME}.${TENANT_DOMAIN}
    serviceCidr: ${TENANT_SVC_CIDR}
    podCidr: ${TENANT_POD_CIDR}
    dnsServiceIPs:
    - ${TENANT_DNS_SERVICE}
  addons:
    coreDNS: {}
    konnectivity:
      server:
        image: registry.k8s.io/kas-network-proxy/proxy-server
        version: v0.34.0
        port: ${TENANT_PROXY_PORT}
      agent:
        image: registry.k8s.io/kas-network-proxy/proxy-agent
        version: v0.34.0
    kubeProxy: {}
EOF

kubectl -n ${TENANT_NAMESPACE} apply -f ${TENANT_NAMESPACE}-${TENANT_NAME}-tcp.yaml

kubectl get tenantcontrolplanes.kamaji.clastix.io --all-namespaces
kubectl get all,cm,secret -n ${TENANT_NAMESPACE}
kubectl get all,cm,secret,tenantcontrolplanes.kamaji.clastix.io -n ${TENANT_NAMESPACE}

kubectl get -n cluster1 secret/paas-ca -o go-template='{{index .data "ca.crt"}}' | base64 -d | openssl x509 --text
kubectl get configmap/paas-kubeadmconfig -n cluster1 -o yaml

kubectl get -n cluster1  secret/paas-admin-kubeconfig -o yaml | grep super-admin.conf: | awk '{ print $2}' | base64 -d >1
kubectl --kubeconfig=1 cluster-info
kubectl get -n cluster1  secret/paas-admin-kubeconfig -o yaml | grep super-admin.conf: | awk '{ print $2}' | base64 -d > ${TENANT_NAMESPACE}-${TENANT_NAME}.kubeconfig
JOIN_CMD=$(echo "sudo ")$(kubeadm --kubeconfig=${TENANT_NAMESPACE}-${TENANT_NAME}.kubeconfig token create --print-join-command)
echo $JOIN_CMD

Raw

full rebuild kamaji.md

Build APKO

git clone https://github.com/chainguard-dev/apko
make  apko

Config for build docker image. Example one

cat <<EOF>config-one.json
{
  "accounts": {
    "groups": [
      {
        "gid": 65532,
        "groupname": "nonroot",
        "members": []
      }
    ],
    "run-as": "65532",
    "users": [
      {
        "gid": 65532,
        "homedir": "",
        "shell": "",
        "uid": 65532,
        "username": "nonroot"
      }
    ]
  },
  "annotations": {
    "dev.chainguard.image.title": "static",
    "org.opencontainers.image.authors": "Chainguard Team https://www.chainguard.dev/",
    "org.opencontainers.image.source": "https://github.com/chainguard-images/images-private/tree/main/images/static",
    "org.opencontainers.image.title": "static",
    "org.opencontainers.image.url": "https://images.chainguard.dev/directory/image/static/overview",
    "org.opencontainers.image.vendor": "Chainguard"
  },
  "archs": [
    "amd64"
  ],
  "cmd": "",
  "contents": {
    "build_repositories": [],
    "keyring": [ "https://packages.wolfi.dev/os/wolfi-signing.rsa.pub"],
    "packages": [
      "ca-certificates-bundle",
      "tzdata",
      "wolfi-baselayout"
    ],
    "repositories": [
      "https://packages.wolfi.dev/os"
    ],
    "runtime_repositories": []
  },
  "entrypoint": {
    "command": "",
    "services": {},
    "shell-fragment": "",
    "type": ""
  },
  "environment": {},
  "include": "",
  "layering": null,
  "paths": [],
  "stop-signal": "",
  "vcs-url": "",
  "volumes": [],
  "work-dir": ""
}
EOF

Build Image. Example One

apko build config-one.json harbor.iblog.pro/test/chainguard/static:latest static-static-public-one.tar --arch x86_64
docker load < static-static-public-one.tar

Push image

docker tag harbor.iblog.pro/test/chainguard/static:latest-amd64 harbor.iblog.pro/test/chainguard/static:latest
docker push harbor.iblog.pro/test/chainguard/static:latest

Config for build docker image. Example two

cat <<EOF>config-two.json
{
  "accounts": {
    "groups": [
      {
        "gid": 65532,
        "groupname": "nonroot",
        "members": []
      }
    ],
    "run-as": "65532",
    "users": [
      {
        "gid": 65532,
        "homedir": "",
        "shell": "",
        "uid": 65532,
        "username": "nonroot"
      }
    ]
  },
  "annotations": {
    "dev.chainguard.image.title": "static",
    "org.opencontainers.image.authors": "Chainguard Team https://www.chainguard.dev/",
    "org.opencontainers.image.source": "https://github.com/chainguard-images/images-private/tree/main/images/static",
    "org.opencontainers.image.title": "static",
    "org.opencontainers.image.url": "https://images.chainguard.dev/directory/image/static/overview",
    "org.opencontainers.image.vendor": "Chainguard"
  },
  "archs": [
    "amd64"
  ],
  "cmd": "",
  "contents": {
    "build_repositories": [],
    "keyring": [ ],
    "packages": [
      "ca-certificates-bundle",
      "tzdata",
      "alpine-base"
    ],
    "repositories": [
      "https://dl-cdn.alpinelinux.org/alpine/v3.22/main"
    ],
    "runtime_repositories": []
  },
  "entrypoint": {
    "command": "",
    "services": {},
    "shell-fragment": "",
    "type": ""
  },
  "environment": { "PATH": "/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin" },
  "include": "",
  "layering": null,
  "paths": [],
  "stop-signal": "",
  "vcs-url": "",
  "volumes": [],
  "work-dir": ""
}
EOF

Build image. Example two

apko build config-two.json harbor.iblog.pro/test/chainguard/static:latest-alpine static-static-public-two.tar --arch x86_64
docker load < static-static-public-two.tar

Push image

docker tag harbor.iblog.pro/test/chainguard/static:latest-alpine-amd64 harbor.iblog.pro/test/chainguard/static:latest-alpine
docker push harbor.iblog.pro/test/chainguard/static:latest-alpine

Rebuild kamaji

Change .ko.yaml

root@node1:/cloud/TEST.3/kamaji# cat .ko.yaml
defaultPlatforms:
  - linux/arm64
  - linux/amd64
  - linux/arm
builds:
  - id: kamaji
    main: .
    ldflags:
      - '{{ if index .Env "LD_FLAGS" }}{{ .Env.LD_FLAGS }}{{ end }}'
defaultBaseImage: harbor.iblog.pro/test/chainguard/static:latest

root@node1:/cloud/TEST.3/kamaji# cat .ko.yaml
defaultPlatforms:
  - linux/arm64
  - linux/amd64
  - linux/arm
builds:
  - id: kamaji
    main: .
    ldflags:
      - '{{ if index .Env "LD_FLAGS" }}{{ .Env.LD_FLAGS }}{{ end }}'
defaultBaseImage: harbor.iblog.pro/test/chainguard/static:latest-alpine

build kamaji

export CONTAINER_REPOSITORY=harbor.iblog.pro/test/cloudstack/kamaji
make build

Images

root@node1:/cloud/TEST.3/kamaji# docker images | grep kamaji
harbor.iblog.pro/test/cloudstack/kamaji                  26.5.3-edge                                                        679d86c9b579   3 weeks ago     111MB
harbor.iblog.pro/test/cloudstack/kamaji                  dadb9b0192501343047c9089984acd4ccba26e1e2e18d9db18d3844fd42e9c5e   679d86c9b579   3 weeks ago     111MB
root@node1:/cloud/TEST.3/kamaji#

Kamaji image push in docker registry

docker push harbor.iblog.pro/test/cloudstack/kamaji:26.5.3-edge

install controller gen

make controller-gen

Build manifest

make rbac

test -s /cloud/TEST.3/kamaji/bin/yq || GOBIN=/cloud/TEST.3/kamaji/bin CGO_ENABLED=0 go install -ldflags="-s -w" github.com/mikefarah/yq/v4@v4.44.2
....
/cloud/TEST.3/kamaji/bin/controller-gen rbac:roleName=manager-role paths="./..." output:stdout | /cloud/TEST.3/kamaji/bin/yq '.rules' > ./charts/kamaji/controller-gen/clusterrole.yaml

make crds
make manifests

...........
       image: harbor.iblog.pro/test/cloudstack/kamaji:26.5.3-edge
...........

How to install new CR

root@node130:~/kamaji/charts/kamaji/crds# kubectl replace -f .
customresourcedefinition.apiextensions.k8s.io/datastores.kamaji.clastix.io replaced
customresourcedefinition.apiextensions.k8s.io/kubeconfiggenerators.kamaji.clastix.io replaced
customresourcedefinition.apiextensions.k8s.io/tenantcontrolplanes.kamaji.clastix.io replaced
root@node130:~/kamaji/charts/kamaji/crds#

View CR

kubectl get customresourcedefinition.apiextensions.k8s.io/tenantcontrolplanes.kamaji.clastix.io -o yaml

How to set patch in git

git apply --check my-patch.patch
git apply my-patch.patch
git apply --stat my-patch.patch

git apply --check /cloud/TEST.3/kamaji/patch
git apply /cloud/TEST.3/kamaji/patch
git apply --stat /cloud/TEST.3/kamaji/patch

How to change Kamaji

Git Diff kamaji-26.4.5-edge

root@node1:/cloud/TEST.3/kamaji-26.4.5-edge# cat git.patch
diff --git a/.ko.yaml b/.ko.yaml
index 47c9d49..ef77bf9 100644
--- a/.ko.yaml
+++ b/.ko.yaml
@@ -7,3 +7,4 @@ builds:
     main: .
     ldflags:
       - '{{ if index .Env "LD_FLAGS" }}{{ .Env.LD_FLAGS }}{{ end }}'
+defaultBaseImage: harbor.iblog.pro/test/chainguard/static:latest-alpine
diff --git a/api/v1alpha1/tenantcontrolplane_types.go b/api/v1alpha1/tenantcontrolplane_types.go
index 25b14e7..dbc15c8 100644
--- a/api/v1alpha1/tenantcontrolplane_types.go
+++ b/api/v1alpha1/tenantcontrolplane_types.go
@@ -9,6 +9,9 @@ import (
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/util/intstr"
        gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
+
+       kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+
 )

 // NetworkProfileSpec defines the desired state of NetworkProfile.
@@ -107,6 +110,24 @@ type KubernetesSpec struct {
        Version string      `json:"version"`
        Kubelet KubeletSpec `json:"kubelet"`

+       // The cluster name. This name will be used in kubeconfig files generated by kubeadm
+       // and will also be passed as a value to the kube-controller-manager's --cluster-name flag.
+       // Default value is 'kubernetes'.
+       ClusterName string `json:"clusterName,omitempty"`
+
+        // EncryptionAlgorithm holds the type of asymmetric encryption algorithm used for keys and certificates.
+        // Can be one of "RSA-2048" (default), "RSA-3072", "RSA-4096", "ECDSA-P256" or "ECDSA-P384".
+       EncryptionAlgorithm kubeadmapi.EncryptionAlgorithmType `json:"encryptionAlgorithm,omitempty"`
+
+        // CertificateValidityPeriod specifies the validity period for a non-CA certificate generated by kubeadm.
+        // Default value: 8760h (365 days * 24 hours = 1 year)
+       CertificateValidityPeriod *metav1.Duration `json:"certificateValidityPeriod,omitempty"`
+
+        // CACertificateValidityPeriod specifies the validity period for a CA certificate generated by kubeadm.
+        // Default value: 87600h (365 days * 24 hours * 10 = 10 years)
+       CACertificateValidityPeriod *metav1.Duration `json:"caCertificateValidityPeriod,omitempty"`
+
+
        // List of enabled Admission Controllers for the Tenant cluster.
        // Full reference available here: https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers
        //+kubebuilder:default=CertificateApproval;CertificateSigning;CertificateSubjectRestriction;DefaultIngressClass;DefaultStorageClass;DefaultTolerationSeconds;LimitRanger;MutatingAdmissionWebhook;NamespaceLifecycle;PersistentVolumeClaimResize;Priority;ResourceQuota;RuntimeClass;ServiceAccount;StorageObjectInUseProtection;TaintNodesByCondition;ValidatingAdmissionWebhook
diff --git a/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml b/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
index c343dd2..cf1267d 100644
--- a/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
+++ b/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
@@ -7499,6 +7499,27 @@ versions:
                         - ValidatingAdmissionWebhook
                       type: string
                     type: array
+                  caCertificateValidityPeriod:
+                    description: |-
+                      CACertificateValidityPeriod specifies the validity period for a CA certificate generated by kubeadm.
+                      Default value: 87600h (365 days * 24 hours * 10 = 10 years)
+                    type: string
+                  certificateValidityPeriod:
+                    description: |-
+                      CertificateValidityPeriod specifies the validity period for a non-CA certificate generated by kubeadm.
+                      Default value: 8760h (365 days * 24 hours = 1 year)
+                    type: string
+                  clusterName:
+                    description: |-
+                      The cluster name. This name will be used in kubeconfig files generated by kubeadm
+                      and will also be passed as a value to the kube-controller-manager's --cluster-name flag.
+                      Default value is 'kubernetes'.
+                    type: string
+                  encryptionAlgorithm:
+                    description: |-
+                      EncryptionAlgorithm holds the type of asymmetric encryption algorithm used for keys and certificates.
+                      Can be one of "RSA-2048" (default), "RSA-3072", "RSA-4096", "ECDSA-P256" or "ECDSA-P384".
+                    type: string
                   kubelet:
                     properties:
                       cgroupfs:
diff --git a/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml b/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
index 8b40056..85a2580 100644
--- a/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
+++ b/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
@@ -7507,6 +7507,27 @@ spec:
                           - ValidatingAdmissionWebhook
                         type: string
                       type: array
+                    caCertificateValidityPeriod:
+                      description: |-
+                        CACertificateValidityPeriod specifies the validity period for a CA certificate generated by kubeadm.
+                        Default value: 87600h (365 days * 24 hours * 10 = 10 years)
+                      type: string
+                    certificateValidityPeriod:
+                      description: |-
+                        CertificateValidityPeriod specifies the validity period for a non-CA certificate generated by kubeadm.
+                        Default value: 8760h (365 days * 24 hours = 1 year)
+                      type: string
+                    clusterName:
+                      description: |-
+                        The cluster name. This name will be used in kubeconfig files generated by kubeadm
+                        and will also be passed as a value to the kube-controller-manager's --cluster-name flag.
+                        Default value is 'kubernetes'.
+                      type: string
+                    encryptionAlgorithm:
+                      description: |-
+                        EncryptionAlgorithm holds the type of asymmetric encryption algorithm used for keys and certificates.
+                        Can be one of "RSA-2048" (default), "RSA-3072", "RSA-4096", "ECDSA-P256" or "ECDSA-P384".
+                      type: string
                     kubelet:
                       properties:
                         cgroupfs:
diff --git a/charts/kamaji/values.yaml b/charts/kamaji/values.yaml
index 0e99af1..f340b21 100644
--- a/charts/kamaji/values.yaml
+++ b/charts/kamaji/values.yaml
@@ -7,10 +7,10 @@ replicaCount: 1

 image:
   # -- The container image of the Kamaji controller.
-  repository: clastix/kamaji
+  repository: harbor.iblog.pro/test/cloudstack/kamaji
   pullPolicy: Always
   # -- Overrides the image tag whose default is the chart appVersion.
-  tag:
+  tag: 26.5.3-edge

 # -- A list of extra arguments to add to the kamaji controller default ones
 extraArgs: []
diff --git a/internal/kubeadm/configuration.go b/internal/kubeadm/configuration.go
index 8714c3b..5fbf1bb 100644
--- a/internal/kubeadm/configuration.go
+++ b/internal/kubeadm/configuration.go
@@ -70,6 +70,12 @@ func CreateKubeadmInitConfiguration(params Parameters) (*Configuration, error) {
        }
        conf.ClusterName = params.TenantControlPlaneName

+
+       conf.ClusterName = params.TenantControlPlaneClusterName
+       conf.EncryptionAlgorithm = params.TenantControlPlaneEncryptionAlgorithm
+       conf.CertificateValidityPeriod = params.TenantControlPlaneCertificateValidityPeriod
+       conf.CACertificateValidityPeriod = params.TenantControlPlaneCACertificateValidityPeriod
+
        return &Configuration{InitConfiguration: *conf}, nil
 }

diff --git a/internal/kubeadm/types.go b/internal/kubeadm/types.go
index 7693498..d94485c 100644
--- a/internal/kubeadm/types.go
+++ b/internal/kubeadm/types.go
@@ -7,7 +7,7 @@ import (
        json "github.com/json-iterator/go"
        clientcmdapiv1 "k8s.io/client-go/tools/clientcmd/api/v1"
        kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-
+       metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "github.com/clastix/kamaji/internal/utilities"
 )

@@ -49,6 +49,25 @@ type Parameters struct {
        KubeconfigDir                   string
        KubeProxyOptions                *AddonOptions
        CoreDNSOptions                  *AddonOptions
+
+       // The cluster name. This name will be used in kubeconfig files generated by kubeadm
+       // and will also be passed as a value to the kube-controller-manager's --cluster-name flag.
+       // Default value is 'kubernetes'.
+       TenantControlPlaneClusterName string
+
+       // EncryptionAlgorithm holds the type of asymmetric encryption algorithm used for keys and certificates.
+       // Can be one of "RSA-2048" (default), "RSA-3072", "RSA-4096", "ECDSA-P256" or "ECDSA-P384".
+       TenantControlPlaneEncryptionAlgorithm kubeadmapi.EncryptionAlgorithmType
+
+       // CertificateValidityPeriod specifies the validity period for a non-CA certificate generated by kubeadm.
+       // Default value: 8760h (365 days * 24 hours = 1 year)
+       TenantControlPlaneCertificateValidityPeriod *metav1.Duration
+
+       // CACertificateValidityPeriod specifies the validity period for a CA certificate generated by kubeadm.
+       // Default value: 87600h (365 days * 24 hours * 10 = 10 years)
+       TenantControlPlaneCACertificateValidityPeriod *metav1.Duration
+
+
 }

 type AddonOptions struct {
diff --git a/internal/resources/kubeadm_config.go b/internal/resources/kubeadm_config.go
index 08adf87..c532a48 100644
--- a/internal/resources/kubeadm_config.go
+++ b/internal/resources/kubeadm_config.go
@@ -130,6 +130,12 @@ func (r *KubeadmConfigResource) mutate(ctx context.Context, tenantControlPlane *
                        TenantControlPlaneVersion:       tenantControlPlane.Spec.Kubernetes.Version,
                        ETCDs:                           r.ETCDs,
                        CertificatesDir:                 r.TmpDirectory,
+
+                       TenantControlPlaneClusterName:                  tenantControlPlane.Spec.Kubernetes.ClusterName,
+                       TenantControlPlaneEncryptionAlgorithm:          tenantControlPlane.Spec.Kubernetes.EncryptionAlgorithm,
+                       TenantControlPlaneCertificateValidityPeriod:    tenantControlPlane.Spec.Kubernetes.CertificateValidityPeriod,
+                       TenantControlPlaneCACertificateValidityPeriod:  tenantControlPlane.Spec.Kubernetes.CACertificateValidityPeriod,
+
                }

                config, err := kubeadm.CreateKubeadmInitConfiguration(params)
root@node1:/cloud/TEST.3/kamaji-26.4.5-edge#

Git Diff kamaji-26.4.5-edge

root@node1:/cloud/TEST.3/kamaji-26.5.3-edge# cat git.patch
diff --git a/.ko.yaml b/.ko.yaml
index 47c9d49..ef77bf9 100644
--- a/.ko.yaml
+++ b/.ko.yaml
@@ -7,3 +7,4 @@ builds:
     main: .
     ldflags:
       - '{{ if index .Env "LD_FLAGS" }}{{ .Env.LD_FLAGS }}{{ end }}'
+defaultBaseImage: harbor.iblog.pro/test/chainguard/static:latest-alpine
diff --git a/api/v1alpha1/tenantcontrolplane_types.go b/api/v1alpha1/tenantcontrolplane_types.go
index 1dec180..dde2924 100644
--- a/api/v1alpha1/tenantcontrolplane_types.go
+++ b/api/v1alpha1/tenantcontrolplane_types.go
@@ -9,6 +9,9 @@ import (
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/util/intstr"
        gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
+
+       kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
+
 )

 // NetworkProfileSpec defines the desired state of NetworkProfile.
@@ -107,6 +110,24 @@ type KubernetesSpec struct {
        Version string      `json:"version"`
        Kubelet KubeletSpec `json:"kubelet"`

+       // The cluster name. This name will be used in kubeconfig files generated by kubeadm
+       // and will also be passed as a value to the kube-controller-manager's --cluster-name flag.
+       // Default value is 'kubernetes'.
+       ClusterName string `json:"clusterName,omitempty"`
+
+        // EncryptionAlgorithm holds the type of asymmetric encryption algorithm used for keys and certificates.
+        // Can be one of "RSA-2048" (default), "RSA-3072", "RSA-4096", "ECDSA-P256" or "ECDSA-P384".
+       EncryptionAlgorithm kubeadmapi.EncryptionAlgorithmType `json:"encryptionAlgorithm,omitempty"`
+
+        // CertificateValidityPeriod specifies the validity period for a non-CA certificate generated by kubeadm.
+        // Default value: 8760h (365 days * 24 hours = 1 year)
+       CertificateValidityPeriod *metav1.Duration `json:"certificateValidityPeriod,omitempty"`
+
+        // CACertificateValidityPeriod specifies the validity period for a CA certificate generated by kubeadm.
+        // Default value: 87600h (365 days * 24 hours * 10 = 10 years)
+       CACertificateValidityPeriod *metav1.Duration `json:"caCertificateValidityPeriod,omitempty"`
+
+
        // List of enabled Admission Controllers for the Tenant cluster.
        // Full reference available here: https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers
        //+kubebuilder:default=CertificateApproval;CertificateSigning;CertificateSubjectRestriction;DefaultIngressClass;DefaultStorageClass;DefaultTolerationSeconds;LimitRanger;MutatingAdmissionWebhook;NamespaceLifecycle;PersistentVolumeClaimResize;Priority;ResourceQuota;RuntimeClass;ServiceAccount;StorageObjectInUseProtection;TaintNodesByCondition;ValidatingAdmissionWebhook
diff --git a/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml b/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
index aae7ad5..98c4c6f 100644
--- a/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
+++ b/charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
@@ -7496,6 +7496,27 @@ versions:
                         - ValidatingAdmissionWebhook
                       type: string
                     type: array
+                  caCertificateValidityPeriod:
+                    description: |-
+                      CACertificateValidityPeriod specifies the validity period for a CA certificate generated by kubeadm.
+                      Default value: 87600h (365 days * 24 hours * 10 = 10 years)
+                    type: string
+                  certificateValidityPeriod:
+                    description: |-
+                      CertificateValidityPeriod specifies the validity period for a non-CA certificate generated by kubeadm.
+                      Default value: 8760h (365 days * 24 hours = 1 year)
+                    type: string
+                  clusterName:
+                    description: |-
+                      The cluster name. This name will be used in kubeconfig files generated by kubeadm
+                      and will also be passed as a value to the kube-controller-manager's --cluster-name flag.
+                      Default value is 'kubernetes'.
+                    type: string
+                  encryptionAlgorithm:
+                    description: |-
+                      EncryptionAlgorithm holds the type of asymmetric encryption algorithm used for keys and certificates.
+                      Can be one of "RSA-2048" (default), "RSA-3072", "RSA-4096", "ECDSA-P256" or "ECDSA-P384".
+                    type: string
                   kubelet:
                     properties:
                       cgroupfs:
diff --git a/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml b/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
index 835cd73..2a92a73 100644
--- a/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
+++ b/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
@@ -7504,6 +7504,27 @@ spec:
                           - ValidatingAdmissionWebhook
                         type: string
                       type: array
+                    caCertificateValidityPeriod:
+                      description: |-
+                        CACertificateValidityPeriod specifies the validity period for a CA certificate generated by kubeadm.
+                        Default value: 87600h (365 days * 24 hours * 10 = 10 years)
+                      type: string
+                    certificateValidityPeriod:
+                      description: |-
+                        CertificateValidityPeriod specifies the validity period for a non-CA certificate generated by kubeadm.
+                        Default value: 8760h (365 days * 24 hours = 1 year)
+                      type: string
+                    clusterName:
+                      description: |-
+                        The cluster name. This name will be used in kubeconfig files generated by kubeadm
+                        and will also be passed as a value to the kube-controller-manager's --cluster-name flag.
+                        Default value is 'kubernetes'.
+                      type: string
+                    encryptionAlgorithm:
+                      description: |-
+                        EncryptionAlgorithm holds the type of asymmetric encryption algorithm used for keys and certificates.
+                        Can be one of "RSA-2048" (default), "RSA-3072", "RSA-4096", "ECDSA-P256" or "ECDSA-P384".
+                      type: string
                     kubelet:
                       properties:
                         cgroupfs:
diff --git a/charts/kamaji/values.yaml b/charts/kamaji/values.yaml
index 0e99af1..f340b21 100644
--- a/charts/kamaji/values.yaml
+++ b/charts/kamaji/values.yaml
@@ -7,10 +7,10 @@ replicaCount: 1

 image:
   # -- The container image of the Kamaji controller.
-  repository: clastix/kamaji
+  repository: harbor.iblog.pro/test/cloudstack/kamaji
   pullPolicy: Always
   # -- Overrides the image tag whose default is the chart appVersion.
-  tag:
+  tag: 26.5.3-edge

 # -- A list of extra arguments to add to the kamaji controller default ones
 extraArgs: []
diff --git a/go.mod b/go.mod
index d25893a..6b54eb6 100644
--- a/go.mod
+++ b/go.mod
@@ -194,7 +194,7 @@ require (
        k8s.io/kms v0.36.0 // indirect
        k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
        k8s.io/kube-proxy v0.0.0 // indirect
-       k8s.io/streaming v0.36.0 // indirect
+       k8s.io/streaming v0.36.1 // indirect
        k8s.io/system-validators v1.12.1 // indirect
        mellium.im/sasl v0.3.1 // indirect
        sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
diff --git a/go.sum b/go.sum
index a69a0b9..17ac9b8 100644
--- a/go.sum
+++ b/go.sum
@@ -541,8 +541,8 @@ k8s.io/kubelet v0.36.0 h1:zWeevZeGl80DInNU6WUo13yWmgbEajkRaBFqeKqkweA=
 k8s.io/kubelet v0.36.0/go.mod h1:PLROV2RwWJkSbAkdZ8HeJWsbsjEEEMlhRIEzAwGeU9c=
 k8s.io/kubernetes v1.36.0 h1:JKaAkgSzI4+ZvNWrNJg56jAkUaOiqgBaJstmi6ycyoU=
 k8s.io/kubernetes v1.36.0/go.mod h1:MLdeJ3qw2CWH9BFml5GvptxQVQckz54fJOZ/WuixpFE=
-k8s.io/streaming v0.36.0 h1:agnTxU+NFulUrtYzXUGKO3ndEa8jKwht1Kwn9nu9x+4=
-k8s.io/streaming v0.36.0/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s=
+k8s.io/streaming v0.36.1 h1:L+K68n4Gg940BGNNYtUBvL1WTLL0YnKT3s+P1MNAmR4=
+k8s.io/streaming v0.36.1/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s=
 k8s.io/system-validators v1.12.1 h1:AY1+COTLJN/Sj0w9QzH1H0yvyF3Kl6CguMnh32WlcUU=
 k8s.io/system-validators v1.12.1/go.mod h1:awfSS706v9R12VC7u7K89FKfqVy44G+E0L1A0FX9Wmw=
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
diff --git a/internal/kubeadm/configuration.go b/internal/kubeadm/configuration.go
index 8714c3b..5fbf1bb 100644
--- a/internal/kubeadm/configuration.go
+++ b/internal/kubeadm/configuration.go
@@ -70,6 +70,12 @@ func CreateKubeadmInitConfiguration(params Parameters) (*Configuration, error) {
        }
        conf.ClusterName = params.TenantControlPlaneName

+
+       conf.ClusterName = params.TenantControlPlaneClusterName
+       conf.EncryptionAlgorithm = params.TenantControlPlaneEncryptionAlgorithm
+       conf.CertificateValidityPeriod = params.TenantControlPlaneCertificateValidityPeriod
+       conf.CACertificateValidityPeriod = params.TenantControlPlaneCACertificateValidityPeriod
+
        return &Configuration{InitConfiguration: *conf}, nil
 }

diff --git a/internal/kubeadm/types.go b/internal/kubeadm/types.go
index 7693498..d94485c 100644
--- a/internal/kubeadm/types.go
+++ b/internal/kubeadm/types.go
@@ -7,7 +7,7 @@ import (
        json "github.com/json-iterator/go"
        clientcmdapiv1 "k8s.io/client-go/tools/clientcmd/api/v1"
        kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-
+       metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "github.com/clastix/kamaji/internal/utilities"
 )

@@ -49,6 +49,25 @@ type Parameters struct {
        KubeconfigDir                   string
        KubeProxyOptions                *AddonOptions
        CoreDNSOptions                  *AddonOptions
+
+       // The cluster name. This name will be used in kubeconfig files generated by kubeadm
+       // and will also be passed as a value to the kube-controller-manager's --cluster-name flag.
+       // Default value is 'kubernetes'.
+       TenantControlPlaneClusterName string
+
+       // EncryptionAlgorithm holds the type of asymmetric encryption algorithm used for keys and certificates.
+       // Can be one of "RSA-2048" (default), "RSA-3072", "RSA-4096", "ECDSA-P256" or "ECDSA-P384".
+       TenantControlPlaneEncryptionAlgorithm kubeadmapi.EncryptionAlgorithmType
+
+       // CertificateValidityPeriod specifies the validity period for a non-CA certificate generated by kubeadm.
+       // Default value: 8760h (365 days * 24 hours = 1 year)
+       TenantControlPlaneCertificateValidityPeriod *metav1.Duration
+
+       // CACertificateValidityPeriod specifies the validity period for a CA certificate generated by kubeadm.
+       // Default value: 87600h (365 days * 24 hours * 10 = 10 years)
+       TenantControlPlaneCACertificateValidityPeriod *metav1.Duration
+
+
 }

 type AddonOptions struct {
diff --git a/internal/resources/kubeadm_config.go b/internal/resources/kubeadm_config.go
index 08adf87..c532a48 100644
--- a/internal/resources/kubeadm_config.go
+++ b/internal/resources/kubeadm_config.go
@@ -130,6 +130,12 @@ func (r *KubeadmConfigResource) mutate(ctx context.Context, tenantControlPlane *
                        TenantControlPlaneVersion:       tenantControlPlane.Spec.Kubernetes.Version,
                        ETCDs:                           r.ETCDs,
                        CertificatesDir:                 r.TmpDirectory,
+
+                       TenantControlPlaneClusterName:                  tenantControlPlane.Spec.Kubernetes.ClusterName,
+                       TenantControlPlaneEncryptionAlgorithm:          tenantControlPlane.Spec.Kubernetes.EncryptionAlgorithm,
+                       TenantControlPlaneCertificateValidityPeriod:    tenantControlPlane.Spec.Kubernetes.CertificateValidityPeriod,
+                       TenantControlPlaneCACertificateValidityPeriod:  tenantControlPlane.Spec.Kubernetes.CACertificateValidityPeriod,
+
                }

                config, err := kubeadm.CreateKubeadmInitConfiguration(params)
root@node1:/cloud/TEST.3/kamaji-26.5.3-edge#

vorlon001/full rebuild kamaji.md

Select an option

No results found

Select an option

No results found

Result test

BUG: clastix/kamaji#1154 "Two many run pods on kamaji tag: 26.5.3-edge"

Init Test

Deploy Etcd

Install Kamaji

Deploy Kamaji tenant

Build APKO

Config for build docker image. Example one

Build Image. Example One

Push image

Config for build docker image. Example two

Build image. Example two

Push image

Rebuild kamaji

Change .ko.yaml

build kamaji

Images

Kamaji image push in docker registry

install controller gen

Build manifest

How to install new CR

View CR

How to set patch in git

How to change Kamaji

Git Diff kamaji-26.4.5-edge

Git Diff kamaji-26.4.5-edge