feat(malwaremanager): remove the ClamAV scanner
ClamAV was the only in-tree implementation of the MalwareScanner
interface. It is obsolete: its alerts never reach the hash-signature
matcher (that path handles rule R6000 only), and the dashboard's
"Malware Name" field reads a signature name that only the hash path
fills, so a ClamAV alert renders it empty.
Removed:
- pkg/malwaremanager/v1/clamav (the scanner)
- clamav/ (the sidecar image: Dockerfile, Makefile, init and
database-filter scripts)
- the CLAMAV_SOCKET wiring in CreateMalwareManager
- the ClamAV surface of the CI test chart
- the ClamAV claims in README, docs/CONFIGURATION.md and the demo
- Test_10_MalwareDetectionTest and its entry in the component-tests
workflow
That last one is why the test goes rather than gets fixed: it deploys a
malware container and asserts a ClamAV signature name,
"Multios.Coinminer.Miner-6781728-2.UNOFFICIAL". With no scanner left in
the tree that alert can never be produced, so the test would fail
deterministically on every run, not only on this one.
tests/testutils.GetMalwareAlerts stays. It filters on the
KubescapeMalwareDetected alert name, which an out-of-tree scanner still
produces, so it remains useful to whoever adds one.
Kept:
- the MalwareScanner, MalwareResult and MalwareManagerClient
interfaces, and pkg/malwaremanager/v1/types. They are the extension
point for out-of-tree scanners, and downstream exporters build on
MalwareResult.
- the malware manager itself and malwareDetectionEnabled. With no
scanner registered it cannot alert, so it logs a warning that says
exactly that instead of failing silently.
The matching chart change removes the sidecar from
kubescape/helm-charts. The two are independent: this agent ignores an
absent CLAMAV_SOCKET, and a running sidecar with no client is inert.
Signed-off-by: Alon Liwsky <40373481+AlonLiwsky@users.noreply.github.com> A
Alon Liwsky committed
6dbab1bc76942133c20d09c00193663f593dc295
Parent: de4676b