Configuration on K8S

Storage and Database

MetaDefender ICAP Server container is stateless and do not require persistent storage. However in case it is needed in any scenario here is how you can configure it

extra_storage_configs: # Example for creating PVC for ICAP container. Use extraVolumeMounts and extraVolumes in icap container definition together with this PVC
extra_pvc:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: icap-disk-pvc
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 5Gi
storageClassName: azurefile

icap_container_persistent: false # To enable for mounting icap path /opt/mdicapsrv/icap_data/var/lib/mdicapsrv using below storage_configs pvc

icap_components:
md_icapsrv:
extraVolumeMounts:
- mountPath: <path_to_mount> # for icap migration from sqlite to postgresql needed to mount -> "/opt/mdicapsrv/icap_data/var/lib/mdicapsrv". From version 5.2.0

Also, if deploying the PostgreSQL database within the cluster, it is recommended to use persistent storage managed by your cloud provider.

db_user: postgres # PostgreSQL database username
db_password: postgres # PostgreSQL database password, if not set it will be randomly generated
# Support customize the database name. Default is `metadefender_icapsrv`
db_name: metadefender_icapsrv

postgres_mdicapsrv:
enabled: true
name: postgres-mdicapsrv
image: postgres:16.6
env:
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: mdicapsrv-postgres-cred
key: password
- name: POSTGRES_USER
valueFrom:
secretKeyRef:
name: mdicapsrv-postgres-cred
key: user
ports:
rest: 5432
service_type: ClusterIP

# Example using a PVC with dynamic provisioning from an existing storage class for postgres_mdicapsrv container

An remote database can be configured using the following values:

icap_components:
md_icapsrv:
database:
db_mode: "4" # Database mode
db_type: remote # Database type
db_host: postgres-mdicapsrv # Hostname / entrypoint of the database, this value should be changed any if using an external database service
db_port: "5432" # Port for the PostgreSQL Database

When using an external database not deployed via the MDSS chart, the postgres_mdicapsrv:

value must be set to false to prevent the chart from deploying an additional database.

postgres_mdicapsrv:
enabled: true

Resource Definition

To indicate the resources to allocate to the MetaDefender ICAP container. Limits are optional.

icap_components:
md_icapsrv:
resources:
requests:
memory: "2Gi" # Minimum reserved memory
cpu: "2.0" # Minimum reserved cpu
#limits:
# memory: "4Gi" # Maximum memory limit
# cpu: "4.0" # Maximum cpu limit

Exposing MetaDefender ICAP Server

Service Configuration

Ingress Configuration

Proxy configuration

MetaDefender ICAP Server container needs to access to internet for activating the application. In case of needed to use a proxy this is the way to configure it

proxy:
enabled: true
http_proxy: ""
https_proxy: ""
no_proxy: localhost

Security Context

To indicate different security context to adapt the container to the environment security policies

securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
allowPrivilegeEscalation: false

Syslog configuration

MetaDefender ICAP Server support to send the syslog to a server. This is the way to configure it for the application

  • ICAP it is using ICAP_CONF_JSON environment variable (This example uses Elastic)

    • Example: ICAP_CONF_JSON: '{"logger/cef": "true","logger/syslog": "tcp://eck-stack-eck-logstash-ls-tcp.elastic-system:5088","logger/syslog_level": "info"}'

Custom service account

icap_components:
md_icapsrv:
service_account_name: mdicapsrv-service-account

Non-root access on Kubernetes

  • Modify UID:GID to run as non-root

  • create file override.values.yaml to override default value

ACCEPT_EULA: false
mdicapsrv_user: admin # Initial admin user for the MD ICAP Server web interface
mdicapsrv_password: <password> # Initial admin password for the MD ICAP Server web interface, if not set it will be randomly generated
mdicapsrv_license_key: <SET_LICENSE_KEY_HERE> # A valid license key, **this value is mandatory**
icap_components:
md_icapsrv:
securityContext:
runAsUser: 1000 # Specify the UID of the user, id is 1000
runAsGroup: 1000 # Specify the GID of the group, id is 1000
runAsNonRoot: true
allowPrivilegeEscalation: false

  • Deploy the helm chart with override values

helm upgrade --install mdicapsrv -n <namespace> -f override.values.yaml .

Other Configuration Options

Check the table with all the configuration options listed in this page

Next to read:
Replication & HA on K8S
On This Page
Configuration on K8SStorage and DatabaseResource DefinitionExposing MetaDefender ICAP ServerProxy configurationSecurity ContextSyslog configurationCustom service accountNon-root access on KubernetesOther Configuration OptionsService ConfigurationIngress Configuration