---
# clamd + freshclam (the image's init runs both); signatures come from database.clamav.net.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: clamav
  namespace: mail
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: clamav
  template:
    metadata:
      labels:
        app.kubernetes.io/name: clamav
    spec:
      automountServiceAccountToken: false
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: clamav
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: clamav
          image: docker.io/clamav/clamav:1.5.4
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 3310
              name: clamd
              protocol: TCP
          startupProbe:
            tcpSocket:
              port: clamd
            periodSeconds: 10
            failureThreshold: 60
          readinessProbe:
            tcpSocket:
              port: clamd
            periodSeconds: 10
          livenessProbe:
            tcpSocket:
              port: clamd
            periodSeconds: 30
          resources:
            requests:
              cpu: 100m
              memory: 1536Mi
            limits:
              cpu: "2"
              memory: 3Gi
          volumeMounts:
            - name: db
              mountPath: /var/lib/clamav
      volumes:
        - name: db
          emptyDir: {}
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: clamav
  namespace: mail
spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: clamav
---
apiVersion: v1
kind: Service
metadata:
  name: clamav
  namespace: mail
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: clamav
  ports:
    - name: clamd
      port: 3310
      targetPort: clamd