Zenko Cloudserver

Zenko Cloudserver is an open-source Node.js implementation of the Amazon S3 API. It serves as the S3 storage battery for lab deployments where a lightweight, zero-fuss object store is needed.

Motivation

The Minio operator became unavailable for our use case, and Rook-Ceph — while powerful — carries a heavy footprint and significant operational complexity that is disproportionate for single-node lab environments. Zenko Cloudserver fills the gap: it deploys as a single Kubernetes Deployment, requires no operators or CRDs, and is immediately usable. For labs where neither performance, scale-out, capacity, nor long-term persistence are requirements, it is the right tool.

Configuration

Enable it in your lab.yml:

install_zenko_cloudserver: true

The following settings can be overridden in your lab.yml, but TLS is on by default:

zenko_storage_size: 10Gi        # PVC size for object data (default: 10Gi)
zenko_tls_enabled: true         # default: true
zenko_cert_name: "zenko-tls"    # default: "zenko-tls"

S3 Endpoint

TLS is enabled by default. The standard endpoint is:

• HTTPS: https://zenko-cloudserver.<namespace>:8000

Plain HTTP (http://zenko-cloudserver.<namespace>:8000) is available if zenko_tls_enabled is explicitly set to false, but this is not the default and not recommended.

Credentials

S3 credentials are injected via a Kubernetes Secret and automatically propagated to pypod and App Suite configurations. The access key and secret key are derived from the same minio.secret.* variables used elsewhere in the framework, so no separate credential management is needed.

Hostname whitelisting

Cloudserver requires that every hostname used to address it is listed in restEndpoints. This is handled by the Helm chart: the config.restEndpoints map in values.yaml is rendered into a ConfigMap and mounted as config.json. Add entries there for any additional hostnames (e.g. an Ingress FQDN).

TLS

TLS is enabled by default (zenko_tls_enabled: true, zenko_cert_name: "zenko-tls"). The framework generates a certificate via cert-manager, mounts it into the pod, and the Helm chart's ConfigMap template includes the certFilePaths block pointing at the mounted secret. No runtime configuration is needed.

Image

The runtime image is built on gcr.io/distroless/nodejs22-debian13. See batteries/zenko-cloudserver/README.md for the full image design rationale and debugging instructions.