Postfix Chart
Relevant source files
The following files were used as context for generating this wiki page:
The Postfix Helm chart deploys a Postfix SMTP server within a Kubernetes cluster. It is designed as a standard application chart, meaning it can be deployed as a standalone service or, more commonly, as a sub-chart dependency for other applications that require email sending capabilities. A key example is its integration into the agh3 chart, where it provides SMTP services to components like the captain module.
This chart packages Postfix with OpenDKIM for signing outgoing emails, enhancing deliverability and authenticity. The deployment consists of a single pod with two containers: one for the Postfix service and another for the DKIM service. Configuration is managed through standard Helm values, allowing for customization of domains, hostnames, and container images.
Chart Overview
The postfix chart is defined as an application type with its own versioning. It has a dependency on the common library chart from Bitnami, which provides helper templates and functions.
Sources: charts/postfix/Chart.yaml
| Parameter | Description | Value |
|---|---|---|
name | The name of the chart. | postfix |
description | A short description of the chart. | Postifx server |
type | The type of the chart. | application |
version | The chart's version, following SemVer. | 0.1.4 |
appVersion | The version of the Postfix application. | 1.16.0 |
dependencies | List of chart dependencies. | common (v2.19.1) |
Sources: charts/postfix/Chart.yaml:2-23
Integration as a Dependency
The postfix chart is used as a conditional dependency in other charts, such as agh3. It is enabled or disabled using a boolean flag in the parent chart's values.yaml.
# charts/agh3/Chart.yaml
dependencies:
- name: postfix
version: 0.1.4
repository: https://charts.lkc-lab.com
condition: postfix.enabled
Sources: charts/agh3/Chart.yaml:23-26
This configuration in the agh3 chart's values.yaml enables the Postfix sub-chart:
# charts/agh3/values.yaml
postfix:
enabled: true
Sources: charts/agh3/values.yaml:286-288
Architecture and Components
The chart creates a single Kubernetes Deployment resource. This deployment manages a pod containing two containers: postfix and dkim.
This diagram illustrates the main Kubernetes objects created by the chart.
Containers
The pod runs two specialized containers to provide the mail service.
| Container Name | Image Source | Purpose | Ports |
|---|---|---|---|
postfix | leukocyte-lab/argushack3/postfix:production | Runs the main Postfix SMTP service. | 25 (smtp) |
dkim | leukocyte-lab/argushack3/opendkim:production | Runs the OpenDKIM service for signing outgoing mail. | - |
Sources: charts/postfix/templates/deployment.yaml:21-58, charts/agh3/values.yaml:293-311
postfix Container
This is the primary container that runs the Postfix mail transfer agent. It listens on port 25 for SMTP traffic. Its configuration is mounted from a ConfigMap named postfix-config.
Sources: charts/postfix/templates/deployment.yaml:21-31
dkim Container
This container handles DomainKeys Identified Mail (DKIM) signing. On startup, it copies a private key from a secret, generates its configuration file from a template, and starts the opendkim service.
The startup logic is as follows:
- Create the
/etc/domainkeydirectory. - Copy the private key from
/tmp/key.private(mounted from thersa-private-keysecret) to/etc/domainkey/key.private. - Set appropriate ownership (
opendkim:opendkim) and permissions (600) on the private key. - Use
erbto process a template (opendkim.conf.erb) with the configureddomainvalue, creating/etc/opendkim.conf. - Start the
opendkimdaemon in the foreground.
Sources: charts/postfix/templates/deployment.yaml:32-58
Configuration
The chart is configured through the values.yaml file. When used as a sub-chart, these values are nested under a postfix key in the parent chart's values.yaml.
| Parameter | Description | Default Value (from agh3) |
|---|---|---|
enabled | Toggles the deployment of the Postfix chart. | true |
fullnameOverride | Overrides the full name of the chart resources. | postfix |
image.repository | The repository for the Postfix container image. | leukocyte-lab/argushack3/postfix |
image.tag | The tag for the Postfix container image. | production |
service.type | The type of Kubernetes service to create. | ClusterIP |
service.port | The port for the SMTP service. | 25 |
dkim.image.repository | The repository for the OpenDKIM container image. | leukocyte-lab/argushack3/opendkim |
dkim.image.tag | The tag for the OpenDKIM container image. | production |
mydomain | The mydomain parameter for Postfix configuration. | bas-mail-test.com |
mail_myhostname | The myhostname parameter for Postfix configuration. | smtp.bas-mail-test.com |
domain | The domain used for DKIM signing. | bas-mail-test.com |
Sources: charts/agh3/values.yaml:285-316
Service Consumption
Other applications within the cluster, such as the captain service from the agh3 chart, connect to the Postfix server using its internal Kubernetes service name. The service endpoint is passed to the application via environment variables.
The following diagram shows the sequence of an application sending an email via the Postfix service.
In the captain deployment, the SMTP_HOST and SMTP_PORT environment variables are set to point to the Postfix service.
# charts/agh3/templates/captain/captain-deployment.yml
# ...
env:
# ...
{{- if .Values.postfix.enabled }}
- name: SMTP_HOST
value: "postfix.$(NAMESPACE).svc.cluster.local"
- name: SMTP_PORT
value: {{ .Values.postfix.service.port | quote }}
{{- end }}
# ...
Sources: charts/agh3/templates/captain/captain-deployment.yml:143-149
This allows the captain application to resolve and send emails through the Postfix pod without needing to know its specific IP address, relying on Kubernetes DNS-based service discovery.