ClamAV

Latest chart version:

chartVersion: "1.1.0"

Chart for deploying ClamAV antivirus scanner on Kubernetes — used by HCL Domino and Chat and Meetings for file and email attachment scanning.

Architecture

Two Deployments sharing a single RWX PVC for the signature database:

clamav-scan — clamd scanner (2–N replicas) with an nginx TLS sidecar. Clients connect via TLS on port 3311; nginx terminates TLS and proxies to clamd on port 3310. A cert-watcher sidecar detects certificate rotation and sends SIGHUP to nginx for graceful reload without pod restarts.
clamav-freshclam — single replica running freshclam. Downloads and updates the signature database on the shared PVC. clamav-scan pods mount the PVC read-only.

Clients (Chat and Meetings / Domino)
        │ TLS :3311
        ▼
  nginx sidecar  ──────────────────────── cert-watcher
        │ plain TCP :3310                 (SIGHUP on cert change)
        ▼
      clamd
        │ read-only
        ▼
   PVC clamav-db (RWX)
        ▲ write
    freshclam

TLS certificate is issued automatically by cert-manager and stored in a Kubernetes Secret. cert-watcher monitors the certificate file and triggers a graceful nginx reload on rotation — no pod restarts required.

clamav-scan pods will not start until daily.cvd is present on the PVC (init container wait-for-db). On first install this takes 5–10 minutes while freshclam downloads the full database (~200 MB).

Prerequisites

cert-manager with a ClusterIssuer that supports internal cluster hostnames
A StorageClass that supports ReadWriteMany
Image pull access — public images by default (clamav/clamav, nginx); set imageCredentials for a private registry

Inspect default values

helm registry login hclcr.io --username <username> --password <password>
helm show values oci://hclcr.io/hcl-domino-workspace-communicate/clamav/charts/clamav --version <version>

Available versions and chart contents are also browsable via the Harbor UI at hclcr.io.

Deployment via Helm

Download chart and create your own custom values file for your env if needed.

helm pull oci://hclcr.io/hcl-domino-workspace-communicate/clamav/charts/clamav --version <version>

Use your custom values file in installation command or ommit -f option to use default values.

helm upgrade --install clamav \
  oci://hclcr.io/hcl-domino-workspace-communicate/clamav/charts/clamav \
  --version <version> \
  --create-namespace \
  --namespace clamav \
  -f <your-values>.yaml \
  --timeout 15m

Values

Image

Key	Default	Description
`image.repository`	`clamav/clamav`	ClamAV image (clamd + freshclam)
`image.tag`	`latest`	Image tag
`image.pullPolicy`	`IfNotPresent`	Pull policy
`nginxImage.repository`	`nginx`	nginx image for TLS sidecar and cert-watcher
`nginxImage.tag`	`alpine`	nginx image tag
`nginxImage.pullPolicy`	`IfNotPresent`	Pull policy
`imageCredentials.registry`	`""`	Registry hostname — triggers automatic `regcred` secret creation
`imageCredentials.username`	`""`	Registry username
`imageCredentials.password`	`""`	Registry password/token

Deployment

Key	Default	Description
`replicaCount`	`2`	Number of `clamav-scan` replicas

cert-manager

Key	Default	Description
`certManager.issuerRef.name`	`cluster-ca`	ClusterIssuer name
`certManager.issuerRef.kind`	`ClusterIssuer`	Issuer kind
`certManager.secretName`	`clamav-tls-cert`	Name of the Secret cert-manager will create

clamd

Key	Default	Description
`clamd.tcpPort`	`3310`	clamd TCP listen port (internal)
`clamd.maxThreads`	`12`	Maximum concurrent scan threads
`clamd.streamMaxLength`	`200M`	Maximum file size for stream scanning
`clamd.readTimeout`	`300`	Socket read timeout (seconds)
`clamd.selfCheck`	`120`	Database reload check interval (seconds)
`tlsPort`	`3311`	nginx TLS listen port (exposed via Service)

freshclam

Key	Default	Description
`freshclam.privateMirror`	`""`	Optional private mirror URL. Empty = official `database.clamav.net` CDN
`freshclam.checks`	`24`	Database update checks per day (24 = hourly)
`freshclam.httpUserAgent`	`ClamAV`	HTTP User-Agent sent to mirror

Scheduling

Key	Default	Description
`affinity`	`{}`	Pod affinity, applied to both `clamav-scan` and `clamav-freshclam`

Persistence

Key	Default	Description
`persistence.storageClassName`	`""`	Required — StorageClass for the database PVC. Must support `ReadWriteMany`.
`persistence.size`	`10Gi`	PVC size

Resources

Key	Default	Description
`resources.scan.requests`	`100m / 2Gi`	clamd container requests
`resources.scan.limits`	`2 / 3Gi`	clamd container limits
`resources.freshclam.requests`	`100m / 512Mi`	freshclam container requests
`resources.freshclam.limits`	`2 / 4Gi`	freshclam container limits
`resources.nginx.requests`	`10m / 32Mi`	nginx sidecar requests
`resources.nginx.limits`	`100m / 64Mi`	nginx sidecar limits

Verify

kubectl get pods -n clamav

Deployment succeeded once all pods report Running with all containers ready (see Architecture for clamav-scan first-install timing).

Uninstall

helm uninstall clamav --namespace clamav