Articles in this section

See more

Configure a new Email Signature Server in Kubernetes

Avatar
Kevin Waddle
Updated
Follow

About this article

In this article we will be using the provided Terraform scripts to configure and create the Kubernetes cluster and resources required to run the Email Signature Server.

The following resources will be created by the Terraform scripts:

  • Service principal, this is required for the Kubernetes cluster to access the azure resources.
  • Resource group, the Kubernetes cluster, Storage account, and Log analytics resources will be created here.
  • Node resource group, MC_<Original Resource Group Name>_<Kubernetes Cluster Name>_<Location>
  • Kubernetes cluster, this is required to host the email signature server component.
  • Log analytics, from here the performance of the Kubernetes cluster can be monitored.
  • Storage account, this is where the email signature generated from Templafy will be stored.

Prerequisites

 

  • Base default implementation Terraform scripts provided by Templafy.

     

  • Global Admin account in Azure. The account needs to have either the Owner role in the subscription or the Contributor role and the permissions to create service principals and assign roles.

     

  • Available Azure vCPU Compute Quota in the region the cluster will be implemented in. This will need to be at least 12 vCPUs for our default implementation using 3 Standard_F4s_v2 Compute optimized virtual machines.

     

  • Certificates for encrypted communication.

    • CA issued or self-signed certificates (Step 1. Configure certificates)
    • When creating self-signed certificates the scripts will generate two PKCS #12 archive (PFX) files with two corresponding files containing the provided password to the PFX archive files.
    • The PFX and password files (either existing or generated) need to have the following names: 
      azureAppRegistrationCertificate.pfx 
azureAppRegistrationCertificatePassword 
smtpTlsCertificate.pfx 
smtpTlsCertificatePassword

     

 

Installation steps from Azure Cloud Shell

 
  • These steps are based on the Bash version of Cloud Shell

  1. Log in to Azure portal.

  2. Start Cloud Shell mceclip0.png

  1. Verify subscription where the AKS cluster should reside:

    az account show

    • Set the default subscription to the one all resources should be created under, with the following command:
      az account set --subscription <subscription name or id>

  2. In Cloud Shell navigate to the clouddrive directory:
    cd clouddrive

  3. Create a new directory which will host the terraform files:
    mkdir terraform

  4. Change to this directory
    cd terraform

  5. Download and extract the terraform-root.zip file:

    curl https://templafydownload.blob.core.windows.net/delivery/ESS/terraform-root.zip > terraform-root.zip
    unzip terraform-root.zip

  6. Open the editor by executing the following command:
    code .

  7. Select the configuration file variables.tfvars and edit the variables based on your environment.

     

     

    • office365ApplicationId is the Application Id assigned in the app registration
      (Step 2. Configure access to mailboxes) 

    • office365SmtpServerHostname can be retrieved from the exchange admin portal, by accessing https://admin.microsoft.com/AdminPortal/Home#/Domains and selecting the default domain. From here you can select the DNS records tab to find the MX entry

      • Alternatively, to find this setting, you can run nslookup -type=mx <your primary domain>

    • office365AuthenticationUrl is https://login.microsoftonline.com/<your Primary Domain or Tenant ID>

  8. Run the first set of terraform scripts:

    ./tf-run-azure-config.bat

  9. The output result will display the public IP on which the email signature server is listening on.
    Save the value of the cluster_public_ip from the output for the next steps.

     

    • Update the SPF record for all email sending domains.

    • To ensure the Email Signature Server is identified as authorized to process mail for your domains it is important to add the Public IP address for your cluster to the DNS SPF record for each domain that may be sending emails through the Templafy Email Signature Server for processing.
    • nslookup -type=txt <your primary domain>
    • Example (SPF Record): v=spf1 ip4:<public_ip_address> ...
  10. Source the init.env file to set the environment variables for your cluster that will be used by the rest of the commands:

    source init.env

  11. Since the cluster uses Azure AD RBAC we need to go through an authentication process to gain access to the cluster.

    • Run the following command to authenticate:

      ./ess-get-credentials.bat

    • This will trigger an SSO Microsoft authentication process. Follow the instructions on screen and after successful authentication the output will be the namespaces of the cluster. Now you have a valid session with the cluste to run the next terraform deployment.
  12. Run the second set of terraform scripts:

    ./tf-run-kubernetes-config.bat

Configure Standard Azure Load Balancer

  1. Run the command to set the load balancer configuration in the deployment to the cluster_public_ip:

    ./ess-set-standard-load-balancer.bat

Upload the secrets to the Kubernetes cluster

  • Upload the certificate files created earlier in Configure certificates to the Cloud Shell by clicking on the "Upload/Download files" icon.

    2022-12-07_10-24-53.png

  • Click the "Manage file share" link
  • Navigate to the terraform/ directory
  • Navigate to the certs/ directory
  • Click the [Upload] button and select the certificates from your local machine and upload them into the certs/ directory

  • Run the following commands to upload the certificates to the secrets in the cluster:

    ./ess-upload-certs.bat

Activate the deployment replica set

  • Run the following command to activate the replica set and create the email-signature-server pods: ./ess-activate-replicas.bat

Show the generated Azure Blob storage Shared Access Signature URL

  1. ./ess-show-sas-url.bat
  2. Copy the Blob SAS URL and save it for use in Configure Templafy for Email Signature Server

Related articles

Comments

0 comments

Article is closed for comments.