323 task create helm subchart for clamav service#326
323 task create helm subchart for clamav service#326Aravinda-HWK wants to merge 11 commits intoLSFLK:mainfrom
Conversation
….yaml for persistence handling
- Introduced Redis chart with service, statefulset, and service account templates. - Added Rspamd chart including service, statefulset, config maps, and network policies. - Implemented liveness and readiness probes for both Redis and Rspamd. - Configured persistence for Redis and Rspamd with volume claim templates. - Created helper templates for both charts to manage naming and labels. - Added README files for both charts with installation and configuration instructions. - Established dependencies between Rspamd and Redis, Unbound, and ClamAV.
… checks and security context
…lates (LSFLK#320) * Create Helm subchart for OpenDKIM service with configuration and templates * Add detailed local testing instructions for OpenDKIM chart * Refactor OpenDKIM Helm chart: remove PVC template and adjust workload.yaml for persistence handling
….yaml for persistence handling
…uired directories
|
@maneeshaxyz Can you have a look on this PR as well? |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces new Helm subcharts for Redis, Unbound, ClamAV, and Rspamd to the silver umbrella chart. The review identified several security and configuration improvements, including the need to run containers as non-root users, the use of more restrictive file permissions, and the replacement of fragile string manipulation in Helm templates with more robust integer-based configurations.
| privileged: true | ||
| allowPrivilegeEscalation: true | ||
| runAsUser: 0 |
There was a problem hiding this comment.
Running Unbound with privileged: true and as root is a significant security risk. Unbound should run as a non-privileged user. If it needs to bind to port 53, use the NET_BIND_SERVICE capability instead of full privileges.
privileged: false
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
runAsUser: 100| command: | ||
| - /bin/sh | ||
| - -c | ||
| - chmod -R 0777 /var/lib/clamav /var/log/clamav /var/run/clamav |
There was a problem hiding this comment.
Setting directory permissions to 0777 is a security risk as it allows any user in the container to write to these paths. It is better to change the ownership of the directories to the specific user running the application (typically UID 100 for ClamAV) and use more restrictive permissions like 0770.
- chmod -R 0770 /var/lib/clamav /var/log/clamav /var/run/clamav && chown -R 100:101 /var/lib/clamav /var/log/clamav /var/run/clamav| runAsUser: 0 | ||
| runAsNonRoot: false |
There was a problem hiding this comment.
Running the ClamAV pod as root (runAsUser: 0) is not recommended for security reasons. The official ClamAV image is designed to run as a non-root user (UID 100).
runAsUser: 100
runAsNonRoot: true| host: silver-clamav | ||
| port: 3310 | ||
| strictInitChecks: true | ||
| initCheckTimeout: 60s |
There was a problem hiding this comment.
It is better to define the timeout as a raw integer (seconds) to avoid fragile string manipulation in the Helm templates. The current replace logic in the StatefulSet will fail if the value is provided in minutes or as a raw integer.
initCheckTimeout: 60| - -c | ||
| - | | ||
| echo "Checking Redis connectivity at {{ .Values.dependencies.redis.host }}:{{ .Values.dependencies.redis.port }}" | ||
| timeout_sec={{ .Values.dependencies.initCheckTimeout | replace "s" "" }} |
There was a problem hiding this comment.
The replace "s" "" logic is fragile. If the timeout is defined as an integer in values.yaml, this filter can be removed to simplify the template.
timeout_sec={{ .Values.dependencies.initCheckTimeout }}| runAsUser: 0 | ||
| runAsNonRoot: false |
There was a problem hiding this comment.
Running the Unbound pod as root is not recommended. It should be configured to run as a non-root user for better security posture.
runAsUser: 100
runAsNonRoot: true1 participant
📌 Description
Adds a new Helm subchart for ClamAV so the Silver mail stack can run virus scanning as part of the Kubernetes deployment.
Closes #323
🔍 Changes Made
✅ Checklist (Email System)
🧪 Testing Instructions
3310📷 Screenshots / Logs (if applicable)