clamav-rest

Production-ready Helm chart for a REST-fronted ClamAV antivirus scanner.

Quick start

helm repo add clamav-rest https://community-artifacts.github.io/clamav-rest-helm
helm repo update
helm install av clamav-rest/clamav-rest

Then scan a file over the REST API:

kubectl port-forward svc/av-clamav-rest 9000:9000 &
curl -F 'file=@/path/to/file' http://localhost:9000/v2/scan

Need a values.yaml? See the full values reference and the example overlays in the repo.

What’s inside

An opinionated, hardened deployment of a REST-fronted ClamAV scanner — safe defaults, everything heavyweight opt-in:

REST scan API on :9000 — POST /v2/scan, /scanFile, /scanPath, /version, /metrics
TLS on :9443 — inline cert/key or existingSecret
Signature-DB persistence — optional PVC at /clamav/data (keep policy enforced) to warm cold starts
freshclam config overlay + forward-proxy support (proxy password via Secret) for restricted egress
Autoscaling — HPA v2 (CPU + memory) with a custom behavior block
PodDisruptionBudget — fail-loud guard against conflicting minAvailable/maxUnavailable
NetworkPolicy — default-deny + freshclam egress + Prometheus allow, plus a CiliumNetworkPolicy with FQDN-locked egress for *.clamav.net
Observability — ServiceMonitor for the image’s /metrics endpoint
Image-pull credentials via External Secrets Operator (dockerconfigjson from Vault)
extraManifests escape hatch — arbitrary extra resources, templated against the release context
values.schema.json shipped with the chart, so helm install --set foo=bar is validated client-side

Probes & cold-start

The image has no dedicated /healthz; probes target /, which returns 200 only once clamd has loaded the signature database (30–120 s cold). Two levers: enable persistence.enabled=true to reuse the DB across restarts, or startupProbe.enabled=true to decouple cold-start tolerance from the liveness probe.

Versions

SemVer; full changelog in RELEASE-NOTES.md. appVersion tracks the rolling ajilaag/clamav-rest image (pin image.tag to a digest in production).

Chart	`appVersion`	Highlights
`0.1.0`	`latest`	Initial release: Deployment + TLS, freshclam overlay, PVC, HPA, PDB, NetworkPolicy (vanilla + Cilium), ServiceMonitor, ESO image-pull credential, `extraManifests`

# pin a specific version
helm install av clamav-rest/clamav-rest --version 0.1.0

Source, issues, contributing

Chart source: https://github.com/community-artifacts/clamav-rest-helm
Issue tracker: https://github.com/community-artifacts/clamav-rest-helm/issues
Contributing guide: CONTRIBUTING.md
ClamAV project: https://www.clamav.net