Kamaji vs openCenter

Kamaji runs Kubernetes control planes as pods inside a management cluster, giving platform teams a way to operate multiple tenant clusters. Each tenant control plane is independent and separated from others. It uses upstream Kubernetes components and kubeadm, with CNCF-conformant tenant clusters. Worker nodes may run on bare metal, virtual machines, or cloud instances across cloud, data-center, edge, and bare-metal environments. Kamaji integrates with Cluster API for infrastructure provisioning and lifecycle management, and supports cluster provisioning, multi-cluster management, policy enforcement, and upgrade management. Datastores include etcd and MySQL- or PostgreSQL-compatible databases through kine; NATS support is experimental. Konnectivity, enabled by default, creates secure tunnels to worker nodes. Prometheus-format metrics cover management and tenant planes. Metrics endpoints use unauthenticated plaintext by default, with documented HTTPS and bearer-token options. Kamaji is free under Apache 2.0; Clastix also sells enterprise support.

openCenter provides upstream Kubernetes with GitOps automation, security hardening, observability, backup and lifecycle management. It runs on OpenStack, VMware vSphere, AWS, bare metal and air-gapped sites. Its CLI uses declarative YAML to define infrastructure, Kubernetes, services and secrets, applying schema validation and business-rule checks before generating infrastructure-as-code, Kubespray inventory and FluxCD manifests with Kustomize overlays. Listed pre-hardened services include cert-manager, Kyverno, Keycloak, Harbor, Velero, MetalLB, Longhorn, Calico, PostgreSQL Operator and OpenStack CSI. Observability components include Prometheus, Grafana, Alertmanager, Loki, Tempo and OpenTelemetry. Security controls include Kyverno ClusterPolicies, Pod Security Admission, NetworkPolicies and group-based Keycloak OIDC access controls. Secrets can use SOPS Age encryption in Git, Kubernetes encryption at rest and key rotation. Air-gap packaging uses a Zarf artifact for images, charts and binaries, with signing and SBOM generation. Community is free; paid plans start at $125/mo. Rackspace Technology develops and maintains openCenter.