Documentation / clamav
ClamAV Helm Chart
Deploys ClamAV as a shared in-cluster malware scanner using the official
all-in-one clamav/clamav image (clamd + freshclam in one container).
freshclam keeps signatures current and signals clamd to reload them.
Applications send files to clamd for scanning over its TCP protocol
(INSTREAM, port 3310) before storing them.
Design
A single replica with a persistent volume at /var/lib/clamav caching
the signature database across restarts. The signature DB is held in memory, so
budget ~1.5–2.5 GiB. Scale out only if scan throughput ever demands it — at
which point split freshclam into its own updater writing to a shared volume.
Connecting an application
Applications reach clamd through the chart’s Service:
<release>-clamav.<namespace>.svc.cluster.local:3310
Key values
| Key | Default | Description |
|---|---|---|
replicaCount |
1 |
Number of clamd pods |
image.repository |
clamav/clamav |
All-in-one clamd + freshclam image |
service.port |
3310 |
clamd TCP listener |
persistence.enabled |
true |
Cache the signature DB on a PVC |
persistence.size |
2Gi |
Signature DB volume size |
resources.limits.memory |
2560Mi |
Memory ceiling (DB is in RAM) |
Render / lint
helm lint charts/clamav
helm template clamav charts/clamav