Kamaji vs kOps

Kamaji runs Kubernetes control planes as pods inside a management cluster, giving platform teams a way to operate multiple tenant clusters. Each tenant control plane is independent and separated from others. It uses upstream Kubernetes components and kubeadm, with CNCF-conformant tenant clusters. Worker nodes may run on bare metal, virtual machines, or cloud instances across cloud, data-center, edge, and bare-metal environments. Kamaji integrates with Cluster API for infrastructure provisioning and lifecycle management, and supports cluster provisioning, multi-cluster management, policy enforcement, and upgrade management. Datastores include etcd and MySQL- or PostgreSQL-compatible databases through kine; NATS support is experimental. Konnectivity, enabled by default, creates secure tunnels to worker nodes. Prometheus-format metrics cover management and tenant planes. Metrics endpoints use unauthenticated plaintext by default, with documented HTTPS and bearer-token options. Kamaji is free under Apache 2.0; Clastix also sells enterprise support.

kOps is a free, open-source tool for creating, upgrading, maintaining, and destroying production-grade, highly available Kubernetes clusters. It also provisions the cloud infrastructure those clusters require, with the control plane managed by the customer. AWS and Google Cloud are officially supported; DigitalOcean, Hetzner, and OpenStack are in beta, while Azure is in alpha.

Configuration uses a YAML manifest-based API with templating and dry-run modes. State synchronization supports dry runs and automatic idempotency, and kOps can generate Terraform. It offers popular CNI networking providers out of the box and supports ARM64 architectures. kOps runs on Linux, macOS, and Windows; kubectl is required to install and use it. SSH access to masters and nodes is allowed from any address by default, although no public key is installed by default. SSH sources can be restricted in cluster configuration or with a command option. The security documentation says Pods can access the underlying instance IAM role and describes its permission scope as broad. The project points users to public office hours and Kubernetes Slack channels for support.