> ## Documentation Index > Fetch the complete documentation index at: https://docs.apinizer.com/llms.txt > Use this file to discover all available pages before exploring further. # Kubernetes Antivirus Exclusion List > You can review the list of directories, files, and ports that must be excluded so that the Apinizer application running on Kubernetes is not affected by antivirus software. You can maintain performance and ensure secure configuration by applying the antivirus exclusion list. ## Table of Contents 1. [Kubernetes System Directories](#1-kubernetes-system-directories) 2. [Container Runtime Directories](#2-container-runtime-directories) 3. [Apinizer Application Directories](#3-apinizer-application-directories) 4. [Log Directories](#4-log-directories) 5. [Data Directories (Persistent Volumes)](#5-data-directories-persistent-volumes) 6. [Container Image Directories](#6-container-image-directories) 7. [Network Files](#7-network-files) 8. [Process and System Files](#8-process-and-system-files) 9. [Apinizer Component Ports (Network Exclusion)](#9-apinizer-component-ports-network-exclusion) 10. [Process Exclusions](#10-process-exclusions) 11. [Summary Exclusion List](#summary-exclusion-list) 12. [Important Notes](#important-notes) *** ## 1. Kubernetes System Directories Directories required for Kubernetes operation: ``` /var/lib/kubelet/** /var/lib/etcd/** /var/lib/containerd/** /var/lib/docker/** /var/lib/cni/** /var/run/containerd/** /var/run/docker/** /var/run/kubelet/** /var/run/secrets/kubernetes.io/serviceaccount/** /etc/kubernetes/** /etc/cni/** /opt/cni/** ``` **Important:** Apinizer accesses Kubernetes service account files: * `/var/run/secrets/kubernetes.io/serviceaccount/namespace` * `/var/run/secrets/kubernetes.io/serviceaccount/token` ## 2. Container Runtime Directories ``` /var/lib/containerd/** /var/lib/docker/** /var/lib/crio/** /var/lib/podman/** /var/run/containerd/** /var/run/docker/** /var/run/crio/** /var/run/podman/** ``` ## 3. Apinizer Application Directories In-container working directories: ``` /home/ubuntu/** /tmp/** /var/tmp/** ``` **Note:** Apinizer uses `java.io.tmpdir` (typically `/tmp` or `/var/tmp`). ## 4. Log Directories Log files for Apinizer components: ``` /var/log/apinizer/** /var/log/kubernetes/** /var/log/containers/** /var/log/pods/** ``` ## 5. Data Directories (Persistent Volumes) For MongoDB, Elasticsearch, and Hazelcast: ``` # MongoDB data directories /var/lib/mongodb/** /data/mongodb/** /mongodb-data/** # Elasticsearch data directories /var/lib/elasticsearch/** /data/elasticsearch/** /elasticsearch-data/** # Hazelcast cache directories /var/lib/hazelcast/** /data/hazelcast/** /hazelcast-data/** # General persistent volume directories /var/lib/kubelet/pods/** ``` ## 6. Container Image Directories ``` /var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/** /var/lib/docker/image/** /var/lib/docker/overlay2/** ``` ## 7. Network Files Kubernetes network plugin files: ``` /var/lib/cni/** /opt/cni/bin/** /etc/cni/net.d/** /var/run/flannel/** ``` ## 8. Process and System Files ``` /proc/** /sys/** /dev/** ``` ## 9. Apinizer Component Ports (Network Exclusion) To prevent antivirus from scanning network traffic: ``` # Worker NodePorts 32080/tcp # API Management Console 30180/tcp # API Portal 30080/tcp # API Gateway 30090/tcp # API Gateway alternative # Kubernetes ports 6443/tcp # Kubernetes API server 10248/tcp # Kubelet API 10250/tcp # Kubelet API 10257/tcp # Kube-controller-manager 10259/tcp # Kube-scheduler 2379-2380/tcp # etcd 8285/udp # Flannel 8472/udp # Flannel 179/tcp # Calico 9091/tcp # Calico 9099/tcp # Calico # Apinizer component ports 8080/tcp # Manager API 5701/tcp # Hazelcast Cache 9200/tcp # Elasticsearch HTTP 9300/tcp # Elasticsearch Transport 25080/tcp # MongoDB ``` ## 10. Process Exclusions The following processes should be exempt from scanning: ``` # Kubernetes components kubelet kube-proxy kube-apiserver kube-controller-manager kube-scheduler etcd containerd dockerd crio # Apinizer components java (for Apinizer Worker, Manager, Cache) mongod elasticsearch ``` ## Summary Exclusion List The following format can be used with most antivirus solutions: ```bash theme={null} # Kubernetes Core /var/lib/kubelet/** /var/lib/etcd/** /var/lib/containerd/** /var/lib/docker/** /var/run/containerd/** /var/run/secrets/kubernetes.io/serviceaccount/** /etc/kubernetes/** # Container Runtime /var/lib/cni/** /opt/cni/** # Apinizer Application /home/ubuntu/** /tmp/** /var/tmp/** # Logs /var/log/apinizer/** /var/log/kubernetes/** /var/log/containers/** /var/log/pods/** # Data Volumes /var/lib/mongodb/** /var/lib/elasticsearch/** /var/lib/hazelcast/** /var/lib/kubelet/pods/** # System /proc/** /sys/** /dev/** ``` ## Important Notes 1. **Performance:** Excluding these directories reduces the performance impact of antivirus and ensures Apinizer runs normally. 2. **Security:** Limit exclusions to necessary directories only. Unnecessary exclusions can create security risks. 3. **Monitoring:** Perform security monitoring on excluded directories. Even if antivirus does not scan them, log monitoring and behavioral analysis should continue. 4. **Documentation:** When DMZ and LAN separation is applied as described on the [Network Topology and Port Requirements](/en/concepts/deployment/network-topology) page, separate exclusion policies per zone can be considered. ## Apinizer Deployment Topology Apinizer is deployed on Kubernetes as follows: ### DMZ Zone (Demilitarized Zone) **Worker Nodes:** * Local Cache * Token Provider API * Proxy Handler **Port Requirements:** * 32080 (NodePort) - Manager access * 30080/30090 (NodePort) - Apinizer API Gateway * 443/80 (HTTPS/HTTP) - Client access ### LAN Zone (Local Area Network) **Manager Module:** * Scheduled Jobs * Monitoring & Alerting * Analytics Engine * Web Manager **Port Requirements:** * 8080 (Management API) - Access from Workers * 8080 (HTTP) - Web Manager **MongoDB:** * Port 25080 (Apinizer DB Port) * Port 25080 (MongoDB) **Elasticsearch:** * Port 9200 (HTTP) - Log submission * Port 9300 (Transport) - Cluster communication **Cache Cluster (Hazelcast):** * Port 5701 - Cluster communication ## Configuration by Antivirus Solution * **Symantec Endpoint Protection:** File and Folder Exclusions * **McAfee:** Real-Time Scan Exclusions * **Trend Micro:** Scan Exclusions * **Windows Defender:** Exclusion paths * **ClamAV:** ExcludePath directive ## Resources * [Network Topology and Port Requirements](/en/concepts/deployment/network-topology) * [Kubernetes Ports and Protocols](https://v1-31.docs.kubernetes.io/docs/reference/networking/ports-and-protocols/) *** **Last Updated:** 2026-02-04