Remove patch 0025 (ClamAV) and ClamAV deployment (#1228)

Drop the ClamAV malware scanning patch, remove the clamav-client
dependency, and remove all ClamAV references from the ClowdApp
deployment (ConfigMap, pod spec, env vars, parameters).

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: dkliban

Dockerfile

@@ -135,10 +135,6 @@ RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages <
 COPY images/assets/patches/0022-Adds-authentication-to-the-mvn-deploy-api.patch /tmp/
 RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0022-Adds-authentication-to-the-mvn-deploy-api.patch
 
-COPY images/assets/patches/0025-clamAV.patch /tmp/
-RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0025-clamAV.patch
-
-
 COPY images/assets/patches/0028-OCIStorage-create-manifest.patch /tmp/
 RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0028-OCIStorage-create-manifest.patch
 
@@ -165,12 +161,12 @@ COPY images/assets/keys/SIGSTORE-redhat-release3.pem /etc/pki/sigstore/SIGSTORE-
 COPY images/assets/patches/0048-Re-enable-attestation-verification-with-vendored-key.patch /tmp/
 RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0048-Re-enable-attestation-verification-with-vendored-key.patch
 
-COPY images/assets/patches/0049-Skip-content-units-validation.patch /tmp/
-RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0049-Skip-content-units-validation.patch
-
 COPY images/assets/patches/0052-pulpcore-agent-scan-report.patch /tmp/
 RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0052-pulpcore-agent-scan-report.patch
 
+COPY images/assets/patches/0049-Skip-content-units-validation.patch /tmp/
+RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0049-Skip-content-units-validation.patch
+
 COPY images/assets/patches/0053-python-agent-scan-task.patch /tmp/
 RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0053-python-agent-scan-task.patch
 

deploy/clowdapp.yaml

@@ -258,22 +258,6 @@ objects:
         sleep 1d
       done
 
-- apiVersion: v1
-  kind: ConfigMap
-  metadata:
-    name: clamav-conf
-  data:
-    clamd.conf: |
-      LogFile /var/log/clamav/clamd.log
-      LogTime yes
-      LocalSocket /tmp/clamd.sock
-      User clamav
-      StreamMaxLength ${CLAMAV_STREAM_MAX_LENGTH}
-      MaxFileSize ${CLAMAV_MAX_FILE_SIZE}
-      MaxScanSize ${CLAMAV_MAX_SCAN_SIZE}
-      TCPSocket ${CLAMAV_TCP_SOCKET}
-      Debug ${CLAMAV_DEBUG}
-
 - apiVersion: cloud.redhat.com/v1alpha1
   kind: ClowdApp
   metadata:
@@ -448,10 +432,6 @@ objects:
               fieldRef:
                 apiVersion: v1
                 fieldPath: metadata.namespace
-          - name: PULP_CLAMAV_HOST
-            value: ${PULP_CLAMAV_SVC_NAME}.$(NAMESPACE).svc
-          - name: PULP_CLAMAV_PORT
-            value: ${PULP_CLAMAV_SVC_PORT}
           - name: PULP_API_APP_TTL
             value: ${PULP_API_APP_TTL}
           - name: PULP_RDS_CONNECTION_TESTS_ENABLED
@@ -590,10 +570,6 @@ objects:
               fieldRef:
                 apiVersion: v1
                 fieldPath: metadata.namespace
-          - name: PULP_CLAMAV_HOST
-            value: ${PULP_CLAMAV_SVC_NAME}.$(NAMESPACE).svc
-          - name: PULP_CLAMAV_PORT
-            value: ${PULP_CLAMAV_SVC_PORT}
           - name: PULP_WORKER_TYPE
             value: ${PULP_WORKER_TYPE}
 
@@ -734,75 +710,6 @@ objects:
                     value: 5
                     periodSeconds: 30
 
-    - name: clamav
-      replicas: ${{CLAMAV_REPLICAS}}
-      webServices:
-        private:
-          appProtocol: tcp
-          enabled: true
-      podSpec:
-        metadata:
-          annotations:
-            ignore-check.kube-linter.io/minimum-three-replicas: "ClamAV is a low-requirement and must run with just one replica."
-        image: ${CLAMAV_IMAGE}:${CLAMAV_IMAGE_TAG}
-        command:
-          - /bin/sh
-        args:
-          - -c
-          - /init-unprivileged  
-        env:
-          - name: CLAMD_CONF_StreamMaxLength
-            value: ${CLAMAV_STREAM_MAX_LENGTH}
-          - name: CLAMD_CONF_MaxFileSize
-            value: ${CLAMAV_MAX_FILE_SIZE}
-          - name: CLAMD_CONF_MaxScanSize
-            value: ${CLAMAV_MAX_SCAN_SIZE}
-          - name: CLAMD_CONF_TCPSocket
-            value: ${CLAMAV_TCP_SOCKET}
-        readinessProbe:
-          exec:
-            command:
-              - clamdscan
-              - "--ping"
-              - "1"
-          initialDelaySeconds: 20
-          periodSeconds: 25
-          timeoutSeconds: 20
-          failureThreshold: 5
-        livenessProbe:
-          exec:
-            command:
-              - clamdscan
-              - "--ping"
-              - "1"
-          initialDelaySeconds: 20
-          periodSeconds: 25
-          timeoutSeconds: 20
-          failureThreshold: 5
-        resources:
-          requests:
-            cpu: ${{CLAMAV_CPU_REQUEST}}
-            memory: ${{CLAMAV_MEMORY_REQUEST}}
-          limits:
-            cpu: ${{CLAMAV_CPU_LIMIT}}
-            memory: ${{CLAMAV_MEMORY_LIMIT}}
-        volumes:
-          - name: lib
-            emptyDir: {}
-          - name: log
-            emptyDir: {}
-          - name: clamav-conf
-            configMap:
-              name: clamav-conf
-        volumeMounts:
-          - name: lib
-            mountPath: /var/lib/clamav
-          - name: log
-            mountPath: /var/log/clamav
-          - name: clamav-conf
-            mountPath: /etc/clamav/clamd.conf
-            subPath: clamd.conf
-
     - name: migrate-db
       replicas: ${{PULP_MIGRATION_REPLICAS}}
       podSpec:
@@ -1443,48 +1350,6 @@ parameters:
   - name: PULP_TASK_DIAGNOSTICS
     description: List of profilers available for task diagnostics
     value: "['memory', 'memray', 'pyinstrument']"
-  - name: CLAMAV_REPLICAS
-    description: Number of ClamAV replicas 
-    value: "1"
-  - name: CLAMAV_IMAGE
-    description: Specify which ClamAV container image the operator will deploy.
-    value: docker.io/clamav/clamav
-  - name: CLAMAV_IMAGE_TAG
-    description: Specify the tag or hash for the ClamAV image deployed by the operator.
-    value: "1.5.1"
-  - name: CLAMAV_STREAM_MAX_LENGTH
-    description: This option allows you to specify the upper limit for data size that will be transfered to remote daemon when scanning a single file.
-    value: 2G
-  - name: CLAMAV_MAX_FILE_SIZE
-    description: Files larger than this limit won't be scanned.
-    value: 2G
-  - name: CLAMAV_MAX_SCAN_SIZE
-    description: Sets the maximum amount of data to be scanned for each input file.
-    value: 2G
-  - name: CLAMAV_CPU_REQUEST
-    description: Amount of CPU to request for ClamAV container
-    value: "1"
-  - name: CLAMAV_MEMORY_REQUEST
-    description: Amount of memory to request for ClamAV container
-    value: 3Gi
-  - name: CLAMAV_CPU_LIMIT
-    description: Limit of CPU use by ClamAV container
-    value: "2"
-  - name: CLAMAV_MEMORY_LIMIT
-    description: Limit of memory use by ClamAV container
-    value: 4Gi
-  - name: CLAMAV_TCP_SOCKET
-    description: TCP port number the daemon will listen on. DO NOT MODIFY THIS. As of now, it seems like clowder only accepts/configures port 10000 for the "private services".
-    value: "10000"
-  - name: PULP_CLAMAV_SVC_NAME
-    description: ClamAV service name. This variable will be used by Pulp to define the TCP host to connect to ClamAV.
-    value: pulp-clamav
-  - name: PULP_CLAMAV_SVC_PORT
-    description: ClamAV service port. This variable will be used by Pulp to define the TCP port to connect to ClamAV.
-    value: "10000"
-  - name: CLAMAV_DEBUG
-    description: Enable debug messages from libclamav.
-    value: "false"
   - name: PULP_UPLOAD_PROTECTION_TIME
     description: Enable uploads cleanup after some period, in minutes.
     value: "480"