Use NFS PersistentVolume for asset-manager clamav for compliance with…

… PSS restricted

Description:
- PSS restricted doesn't allow volume types of `nfs` (see [here](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted)) but does allow us to use a `PersistentVolume` of type NFS
- Add some additional annotations onto Licensify `PersistentVolume` and `PersistentVolumeClaim`
- As part of #1883

charts/app-config/values-integration.yaml

@@ -1510,7 +1510,6 @@ govukApplications:
 
   - name: licensify
     chartPath: charts/licensify
-    namespace: licensify
     imageValues:
       - "licensify-admin"
       - "licensify-backend"

charts/app-config/values-production.yaml

@@ -1544,7 +1544,6 @@ govukApplications:
 
   - name: licensify
     chartPath: charts/licensify
-    namespace: licensify
     imageValues:
       - "licensify-admin"
       - "licensify-backend"

charts/app-config/values-staging.yaml

@@ -1564,7 +1564,6 @@ govukApplications:
 
   - name: licensify
     chartPath: charts/licensify
-    namespace: licensify
     imageValues:
       - "licensify-admin"
       - "licensify-backend"

charts/asset-manager/templates/_freshclam_podspec.yaml

@@ -37,9 +37,8 @@ spec:
         readOnlyRootFilesystem: true
   volumes:
     - name: clam-virus-db
-      nfs:
-        server: "{{ .Values.assetManagerNFS }}"
-        path: /clamav-db
+      persistentVolumeClaim:
+        claimName: { { include "licensify.name" . } }-{{ .Values.appName }}-db
     - name: etc-clamav
       configMap:
         name: {{ $fullName }}-etc-clamav

charts/asset-manager/templates/clamav-pv.yaml

@@ -0,0 +1,21 @@
+{{- define "asset-manager.freshclam.podspec" }}
+{{- $fullName := include "asset-manager.fullname" . }}
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: {{ $fullName }}-freshclam-db
+  labels:
+    {{- include "asset-manager.labels" . | nindent 4 }}
+    app: {{ .Values.fullName }}
+    app.kubernetes.io/name: {{ .Values.fullName }}-freshclam-db
+    app.kubernetes.io/component: {{ .Values.fullName }}-freshclam-db #V Verify this
+spec:
+  capacity:
+    storage: {{ .Values.nfs.storage }}
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: "{{ .Values.assetManagerNFS }}"
+    path: /clamav-db
+    readOnly: true

charts/asset-manager/templates/clamav-pvc.yaml

@@ -0,0 +1,21 @@
+{{- define "asset-manager.freshclam.podspec" }}
+{{- $fullName := include "asset-manager.fullname" . }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ $fullName }}-freshclam-db
+  labels:
+    {{- include "asset-manager.labels" . | nindent 4 }}
+    app: {{ $fullName }}-freshclam
+    app.kubernetes.io/name: {{ $fullName }}-freshclam-db # Verify this
+    app.kubernetes.io/component: {{ $fullName }}-freshclam-db # Verify this
+spec:
+  storageClassName: ""
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.nfs.storage }}
+  selector:
+    matchLabels:
+      {{- include "asset-manager.selectorLabels" . | nindent 6 }}

charts/asset-manager/templates/worker-deployment.yaml

@@ -45,10 +45,8 @@ spec:
             server: "{{ .Values.assetManagerNFS }}"
             path: /asset-manager
         - name: clam-virus-db
-          nfs:
-            server: "{{ .Values.assetManagerNFS }}"
-            path: /clamav-db
-            readOnly: true
+          persistentVolumeClaim:
+            claimName: { { include "licensify.name" . } }-{{ .Values.appName }}-db
         - name: etc-clamav
           configMap:
             name: {{ $fullName }}-etc-clamav

charts/asset-manager/values.yaml

@@ -141,3 +141,5 @@ redis:
   redisUrlOverride:
     app: ""
     workers: ""
+nfs:
+  storage: 15Gi # This may not be the same for the other NFS. Consider adding more keys here

charts/licensify/templates/clamav/pv.yaml

@@ -6,6 +6,9 @@ metadata:
   name: {{ include "licensify.name" . }}-{{ .Values.appName }}-db
   labels:
     {{- include "licensify.labels" . | nindent 4 }}
+    app: {{ .Values.appName }}
+    app.kubernetes.io/name: {{ .Values.appName }}
+    app.kubernetes.io/component: {{ .Values.appName }} # Verify this
 spec:
   capacity:
     storage: {{ .Values.nfs.storage }}

charts/licensify/templates/clamav/pvc.yaml

@@ -8,6 +8,7 @@ metadata:
     {{- include "licensify.labels" . | nindent 4 }}
     app: {{ .Values.appName }}
     app.kubernetes.io/name: {{ .Values.appName }}
+    app.kubernetes.io/component: {{ .Values.appName }} # Verify this
 spec:
   storageClassName: ""
   accessModes: