G\u00fcn\u00fcm\u00fczde internet sitelerinin g\u00fcvenli\u011fi, kullan\u0131c\u0131 deneyimi ve veri gizlili\u011fi a\u00e7\u0131s\u0131ndan hayati bir \u00f6neme sahiptir. HTTPS (Hypertext Transfer Protocol Secure) kullan\u0131m\u0131, taray\u0131c\u0131lar ve sunucular aras\u0131ndaki ileti\u015fimi \u015fifreleyerek verilerin yetkisiz eri\u015fime kar\u015f\u0131 korunmas\u0131n\u0131 sa\u011flar. Google gibi arama motorlar\u0131 da HTTPS kullanan siteleri tercih etmekte ve hatta baz\u0131 yeni web teknolojileri i\u00e7in HTTPS’i zorunlu k\u0131lmaktad\u0131r.<\/p>\n
Kubernetes, konteynerize edilmi\u015f uygulamalar\u0131 da\u011f\u0131tmak, \u00f6l\u00e7eklendirmek ve y\u00f6netmek i\u00e7in g\u00fc\u00e7l\u00fc bir platform sunarken, bu uygulamalar\u0131n g\u00fcvenli bir \u015fekilde internete a\u00e7\u0131lmas\u0131 ayr\u0131 bir uzmanl\u0131k gerektirir. Bu makalede, Kubernetes ortam\u0131nda Traefik bir Ingress Controller olarak, cert-manager otomatik sertifika y\u00f6netimi i\u00e7in ve Let’s Encrypt \u00fccretsiz sertifika sa\u011flay\u0131c\u0131s\u0131 olarak kullan\u0131larak sitelerin nas\u0131l g\u00fcvenli hale getirilece\u011fini ad\u0131m ad\u0131m inceleyece\u011fiz. Bu \u00fc\u00e7l\u00fc kombinasyon, sertifika ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fc tamamen otomatikle\u015ftirerek modern, g\u00fcvenli ve bak\u0131m\u0131 kolay bir altyap\u0131 olu\u015fturman\u0131za olanak tan\u0131r.<\/p>\n
HTTPS, sadece bir “g\u00fcvenlik \u00f6zelli\u011fi” olman\u0131n \u00f6tesinde, modern web’in temel bir gereksinimidir. \u0130\u015fte neden HTTPS kullanman\u0131z gerekti\u011fine dair ba\u015fl\u0131ca nedenler:<\/p>\n
* Veri B\u00fct\u00fcnl\u00fc\u011f\u00fc ve Gizlili\u011fi:<\/strong> HTTPS, kullan\u0131c\u0131lar\u0131n taray\u0131c\u0131lar\u0131 ile sunucunuz aras\u0131ndaki t\u00fcm ileti\u015fimi \u015fifreler. Bu, hassas verilerin (kullan\u0131c\u0131 adlar\u0131, \u015fifreler, kredi kart\u0131 bilgileri vb.) \u00fc\u00e7\u00fcnc\u00fc taraflarca ele ge\u00e7irilmesini veya de\u011fi\u015ftirilmesini engeller. Sitemizi Kubernetes’te g\u00fcvenli hale getirmek i\u00e7in kullanaca\u011f\u0131m\u0131z temel bile\u015fenleri tan\u0131yal\u0131m:<\/p>\n Kubernetes, konteynerize edilmi\u015f i\u015f y\u00fcklerini ve hizmetleri y\u00f6netmek i\u00e7in a\u00e7\u0131k kaynakl\u0131 bir platformdur. Uygulamalar\u0131n da\u011f\u0131t\u0131m\u0131n\u0131, \u00f6l\u00e7eklendirilmesini, g\u00fcncelle\u015ftirilmesini ve izlenmesini otomatikle\u015ftirir. Bu makalede, uygulamalar\u0131m\u0131z\u0131 ve ilgili hizmetleri Kubernetes cluster’\u0131m\u0131zda \u00e7al\u0131\u015ft\u0131raca\u011f\u0131z.<\/p>\n Traefik, modern bulut tabanl\u0131 uygulamalar i\u00e7in tasarlanm\u0131\u015f bir Edge Router ve Ingress Controller’d\u0131r. Kubernetes ile m\u00fckemmel bir entegrasyona sahiptir ve dinamik olarak yap\u0131land\u0131r\u0131labilir. Temel \u00f6zellikleri \u015funlard\u0131r:<\/p>\n * Dinamik Konfig\u00fcrasyon:<\/strong> Uygulaman\u0131z\u0131n servislerini otomatik olarak ke\u015ffeder ve y\u00f6nlendirme kurallar\u0131n\u0131 an\u0131nda g\u00fcnceller. Kubernetes servisleri, Ingress kaynaklar\u0131 ve Traefik’in kendi CRD’leri (Custom Resource Definitions) ile entegre \u00e7al\u0131\u015f\u0131r. Traefik, Kubernetes Ingress Controller olarak g\u00f6rev yaparak d\u0131\u015far\u0131dan gelen trafi\u011fi cluster i\u00e7indeki servislere y\u00f6nlendirir.<\/p>\n cert-manager, Kubernetes cluster’lar\u0131nda sertifikalar\u0131 otomatik olarak sa\u011flamak ve y\u00f6netmek i\u00e7in tasarlanm\u0131\u015f g\u00fc\u00e7l\u00fc bir eklentidir. Sertifika ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fc (olu\u015fturma, yenileme, iptal etme) otomatize eder ve \u00e7e\u015fitli sertifika yetkilileri (CA’lar) ile entegre olabilir.<\/p>\n * Otomatik Sertifika Y\u00f6netimi:<\/strong> Let’s Encrypt, HashiCorp Vault, Venafi gibi CA’lardan sertifika alabilir veya kendi PKI’n\u0131z\u0131 kullanarak sertifika olu\u015fturabilir. Let’s Encrypt, \u0130nternet G\u00fcvenlik Ara\u015ft\u0131rma Grubu (ISRG) taraf\u0131ndan i\u015fletilen, \u00fccretsiz, otomatik ve a\u00e7\u0131k bir Sertifika Yetkilisidir (CA). Milyonlarca web sitesi taraf\u0131ndan kullan\u0131lmaktad\u0131r ve HTTPS’i herkes i\u00e7in eri\u015filebilir hale getirme misyonuyla yola \u00e7\u0131km\u0131\u015ft\u0131r.<\/p>\n * \u00dccretsiz:<\/strong> Herkesin \u00fccretsiz olarak g\u00fcvenilir SSL\/TLS sertifikalar\u0131 almas\u0131n\u0131 sa\u011flar. Let’s Encrypt, bir alan ad\u0131n\u0131n kontrol\u00fcn\u00fc do\u011frulamak i\u00e7in \u00e7e\u015fitli “challenge” y\u00f6ntemleri kullan\u0131r. En yayg\u0131n olanlar\u0131 HTTP-01 ve DNS-01’dir. Biz bu makalede Traefik’in HTTP-01 challenge’\u0131n\u0131 kullanarak cert-manager arac\u0131l\u0131\u011f\u0131yla sertifika alaca\u011f\u0131z.<\/p>\n Bu rehberi takip etmek i\u00e7in a\u015fa\u011f\u0131daki \u00f6n gereksinimlere sahip olman\u0131z gerekmektedir:<\/p>\n 1. \u00c7al\u0131\u015fan Bir Kubernetes Cluster’\u0131:<\/strong> Minikube, Kind gibi yerel bir cluster veya GKE, AKS, EKS gibi bulut tabanl\u0131 bir cluster olabilir. \u015eimdi, bile\u015fenlerimizi Kubernetes cluster’\u0131m\u0131za kurup yap\u0131land\u0131rmaya ge\u00e7elim.<\/p>\n Traefik’i Kubernetes’e da\u011f\u0131tmak i\u00e7in Helm kullanmak en kolay yoldur.<\/p>\n \u00d6ncelikle Traefik Helm deposunu ekleyin ve g\u00fcncelleyin:<\/p>\n \u015eimdi Traefik’i kendi namespace’ine kural\u0131m. Burada Traefik’in bir LoadBalancer servisi olarak d\u0131\u015far\u0131ya a\u00e7\u0131lmas\u0131n\u0131 sa\u011flayaca\u011f\u0131z. E\u011fer bulut ortam\u0131nda de\u011filseniz (minikube gibi), A\u015fa\u011f\u0131daki Yukar\u0131daki \u015eimdi Traefik’i Helm ile kural\u0131m:<\/p>\n Traefik podlar\u0131n\u0131n \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 kontrol edin:<\/p>\n cert-manager’\u0131 da Helm ile kuraca\u011f\u0131z.<\/p>\n \u00d6ncelikle cert-manager Helm deposunu ekleyin ve g\u00fcncelleyin:<\/p>\n cert-manager’\u0131 kural\u0131m. Kurulum s\u0131ras\u0131nda CRD’lerinin de olu\u015fturulmas\u0131 gerekti\u011fini belirtmeliyiz:<\/p>\n cert-manager podlar\u0131n\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n:<\/p>\n \u00dc\u00e7 pod g\u00f6rmelisiniz: cert-manager’\u0131n sertifika alabilmesi i\u00e7in bir \u00d6ncelikle Let’s Encrypt’in “staging” (test) ortam\u0131n\u0131 kullanarak sertifika almay\u0131 deneyece\u011fiz. Bu, Let’s Encrypt’in \u00fcretim ortam\u0131n\u0131n limitlerine tak\u0131lmadan test yapmam\u0131z\u0131 sa\u011flar. Her \u015fey yolunda gitti\u011finde “production” ortam\u0131na ge\u00e7ece\u011fiz.<\/p>\n Bu Her \u015fey yolunda giderse, \u015fimdi Bu \u015eimdi basit bir Nginx uygulamas\u0131 da\u011f\u0131tal\u0131m ve bu uygulamaya Traefik IngressRoute arac\u0131l\u0131\u011f\u0131yla eri\u015fim sa\u011flayal\u0131m.<\/p>\n Uygulamay\u0131 da\u011f\u0131t\u0131n:<\/p>\n \u015eimdi bu Nginx uygulamas\u0131na HTTPS \u00fczerinden eri\u015fim sa\u011flamak i\u00e7in bir Traefik Uygulaman\u0131z i\u00e7in kullanaca\u011f\u0131n\u0131z Bu \u015eimdi cert-manager’a Bu Sertifika talebinin durumunu izleyin:<\/p>\n Staging sertifikas\u0131 ba\u015far\u0131yla al\u0131nd\u0131ktan sonra, ayn\u0131 i\u015flemi \u00fcretim sertifikas\u0131 i\u00e7in yapaca\u011f\u0131z. \u00d6nce staging \u015eimdi Bu Tekrar sertifika talebinin durumunu izleyin:<\/p>\n \u00dcretim sertifikas\u0131 da ba\u015far\u0131yla al\u0131nd\u0131\u011f\u0131nda, Dashboard i\u00e7in Sertifika (\u0130ste\u011fe Ba\u011fl\u0131):<\/strong> Bu sertifikay\u0131 Traefik namespace’ine uygulay\u0131n ve Traefik Art\u0131k her \u015feyin \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulamak i\u00e7in alan ad\u0131n\u0131z\u0131 (\u00f6rne\u011fin * Taray\u0131c\u0131n\u0131z\u0131n adres \u00e7ubu\u011funda ye\u015fil bir kilit simgesi veya “G\u00fcvenli” ibaresi g\u00f6rmelisiniz. HTTP-01 challenge, genellikle Ingress Controller’lar i\u00e7in yeterli olsa da, baz\u0131 durumlarda DNS-01 challenge daha uygun olabilir:<\/p>\n Wildcard Sertifikalar:<\/strong> cert-manager, \u00e7e\u015fitli DNS sa\u011flay\u0131c\u0131lar\u0131 (Cloudflare, AWS Route 53, Google Cloud DNS vb.) ile entegre olabilir. DNS-01 challenge i\u00e7in cert-manager, sertifikalar\u0131n s\u00fcresi dolmadan \u00f6nce otomatik olarak yenilenmesini sa\u011flar. Varsay\u0131lan olarak, sertifikalar son kullanma tarihlerinden 30 g\u00fcn \u00f6nce yenilenmeye ba\u015flar. Bu, sizin manuel olarak m\u00fcdahale etmenize gerek kalmadan sitenizin s\u00fcrekli olarak g\u00fcvenli kalmas\u0131n\u0131 sa\u011flar.<\/p>\n cert-manager’\u0131n d\u00fczg\u00fcn \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak i\u00e7in Prometheus ve Grafana gibi ara\u00e7larla izleyebilirsiniz. cert-manager, Prometheus uyumlu metrikler yay\u0131nlar. Ayr\u0131ca, Traefik Middleware’ler, HTTP isteklerini i\u015flerken ek g\u00fcvenlik \u00f6nlemleri uygulaman\u0131za olanak tan\u0131r.<\/p>\n * HSTS (HTTP Strict Transport Security):<\/strong> Taray\u0131c\u0131lara sitenize her zaman HTTPS \u00fczerinden ba\u011flanmalar\u0131n\u0131 s\u00f6yleyen bir ba\u015fl\u0131k ekler. Bu, MitM (Man-in-the-Middle) sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flar. \u00d6rnek bir HSTS Middleware tan\u0131m\u0131:<\/p>\n Bu middleware’\u0131 bir Kurulum s\u0131ras\u0131nda veya sonras\u0131nda kar\u015f\u0131la\u015fabilece\u011finiz baz\u0131 yayg\u0131n sorunlar ve \u00e7\u00f6z\u00fcmleri:<\/p>\n * Sertifika Al\u0131nam\u0131yor (Pending\/Failed):<\/strong> * HTTPS Y\u00f6nlendirmesi \u00c7al\u0131\u015fm\u0131yor:<\/strong> * Traefik Dashboard’a Eri\u015filemiyor:<\/strong> * Kubernetes’te cert-manager, Traefik ve Let’s Encrypt \u00fc\u00e7l\u00fcs\u00fc, modern web uygulamalar\u0131n\u0131z i\u00e7in g\u00fc\u00e7l\u00fc, esnek ve tamamen otomatik bir HTTPS \u00e7\u00f6z\u00fcm\u00fc sunar. Bu entegrasyon sayesinde, sertifika y\u00f6netimiyle ilgili manuel s\u00fcre\u00e7leri ortadan kald\u0131rarak geli\u015ftiricilerin ve operasyon ekiplerinin i\u015f y\u00fck\u00fcn\u00fc \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131rs\u0131n\u0131z.<\/p>\n Bu rehberde ad\u0131m ad\u0131m Traefik’i Ingress Controller olarak kurduk, cert-manager’\u0131 otomatik sertifika y\u00f6netimi i\u00e7in yap\u0131land\u0131rd\u0131k ve Let’s Encrypt ile \u00fccretsiz, g\u00fcvenilir SSL\/TLS sertifikalar\u0131 ald\u0131k. Ayr\u0131ca, g\u00fcvenlik ba\u015fl\u0131klar\u0131 gibi ek iyile\u015ftirmelerle sitenizin g\u00fcvenli\u011fini daha da art\u0131rman\u0131n yollar\u0131n\u0131 ke\u015ffettik.<\/p>\n HTTPS’in sadece bir se\u00e7enek de\u011fil, bir zorunluluk haline geldi\u011fi g\u00fcn\u00fcm\u00fcz internet d\u00fcnyas\u0131nda, bu t\u00fcr otomatize edilmi\u015f \u00e7\u00f6z\u00fcmler, uygulamalar\u0131n\u0131z\u0131n g\u00fcvenli\u011fini ve kullan\u0131c\u0131lar\u0131n\u0131z\u0131n gizlili\u011fini sa\u011flaman\u0131n en etkili yollar\u0131ndan biridir. Bu kurulumla, Kubernetes \u00fczerinde g\u00fcvenli ve y\u00fcksek performansl\u0131 uygulamalar \u00e7al\u0131\u015ft\u0131rmak i\u00e7in sa\u011flam bir temele sahip olursunuz.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Kubernetes’te cert-manager, Traefik ve Let\u2019s Encrypt ile Sitenizi G\u00fcvenli Hale Getirme\nGiri\u015f\nG\u00fcn\u00fcm\u00fczde internet sitelerinin g\u00fcvenli\u011fi, kulla","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1328],"tags":[],"class_list":{"0":"post-35443","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-bash","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n
\n* Kullan\u0131c\u0131 G\u00fcveni:<\/strong> Taray\u0131c\u0131lar, HTTPS ile korunan siteleri ye\u015fil bir kilit simgesiyle i\u015faretlerken, HTTPS olmayan siteleri “G\u00fcvenli De\u011fil” olarak etiketler. Bu, kullan\u0131c\u0131lar\u0131n sitenize olan g\u00fcvenini do\u011frudan etkiler. G\u00fcvenli olmayan siteler, ziyaret\u00e7ilerin siteyi terk etmesine neden olabilir.
\n* SEO Faydalar\u0131:<\/strong> Google, 2014’ten beri HTTPS’i bir s\u0131ralama fakt\u00f6r\u00fc olarak kullanmaktad\u0131r. HTTPS kullanan siteler, arama motoru sonu\u00e7lar\u0131nda daha \u00fcst s\u0131ralarda yer alma potansiyeline sahiptir.
\n* Yeni Web Teknolojileri \u0130\u00e7in Gereklilik:<\/strong> Service Workers, Geolocation API, Web Push Notifications gibi bir\u00e7ok modern web \u00f6zelli\u011fi ve API, sadece g\u00fcvenli (HTTPS) ba\u011flamlarda \u00e7al\u0131\u015f\u0131r.
\n* Yasal ve D\u00fczenleyici Uyum:<\/strong> \u00d6zellikle e-ticaret siteleri ve ki\u015fisel veri i\u015fleyen platformlar i\u00e7in GDPR, KVKK gibi veri koruma d\u00fczenlemeleri ve PCI DSS gibi end\u00fcstri standartlar\u0131, hassas verilerin \u015fifrelenmesini zorunlu k\u0131lar.<\/p>\nKullan\u0131lacak Bile\u015fenlere Genel Bak\u0131\u015f<\/h3>\n
Kubernetes<\/h4>\n
Traefik<\/h4>\n
\n* Otomatik HTTPS:<\/strong> Let’s Encrypt gibi sertifika sa\u011flay\u0131c\u0131lar\u0131 ile do\u011frudan entegre olarak otomatik olarak SSL\/TLS sertifikalar\u0131 alabilir ve yenileyebilir. Ancak biz bu makalede cert-manager ile daha esnek bir y\u00f6netim sa\u011flayaca\u011f\u0131z.
\n* Y\u00fck Dengeleme:<\/strong> Gelen trafi\u011fi birden fazla uygulama \u00f6rne\u011fine da\u011f\u0131tabilir.
\n* Middleware Deste\u011fi:<\/strong> HTTP ba\u015fl\u0131klar\u0131n\u0131 de\u011fi\u015ftirmek, kimlik do\u011frulama eklemek, s\u0131k\u0131\u015ft\u0131rma yapmak gibi ek i\u015flevler i\u00e7in middleware’ler kullanabilir.
\n* Kolay Kurulum ve Y\u00f6netim:<\/strong> Hafif yap\u0131s\u0131 ve basit konfig\u00fcrasyonu sayesinde h\u0131zla devreye al\u0131nabilir.<\/p>\ncert-manager<\/h4>\n
\n* Kubernetes-Native:<\/strong> Kubernetes API’sini ve CRD’lerini kullanarak \u00e7al\u0131\u015f\u0131r. Certificate<\/code> ve Issuer<\/code> veya ClusterIssuer<\/code> gibi kaynaklar tan\u0131mlars\u0131n\u0131z.
\n* Yenileme Otomasyonu:<\/strong> Sertifikalar\u0131n s\u00fcresi dolmadan \u00f6nce otomatik olarak yenilenmesini sa\u011flar.
\n* Secret Y\u00f6netimi:<\/strong> Al\u0131nan sertifikalar\u0131 Kubernetes Secret’lar\u0131 olarak depolar, b\u00f6ylece Ingress Controller’lar veya di\u011fer uygulamalar bunlar\u0131 kolayca kullanabilir.<\/p>\nLet’s Encrypt<\/h4>\n
\n* Otomatik:<\/strong> ACME (Automated Certificate Management Environment) protokol\u00fcn\u00fc kullanarak sertifika al\u0131m\u0131n\u0131 ve yenilemesini otomatize eder.
\n* G\u00fcvenilir:<\/strong> T\u00fcm b\u00fcy\u00fck taray\u0131c\u0131lar taraf\u0131ndan g\u00fcvenilen k\u00f6k sertifikalara sahiptir.<\/p>\n\u00d6n Gereksinimler<\/h3>\n
\n2. kubectl<\/code> Arac\u0131:<\/strong> Cluster’\u0131n\u0131zla etkile\u015fim kurmak i\u00e7in kubectl<\/code>‘in kurulu ve yap\u0131land\u0131r\u0131lm\u0131\u015f olmas\u0131.
\n3. Bir Alan Ad\u0131 (Domain Name):<\/strong> Uygulaman\u0131za eri\u015fmek i\u00e7in kullanaca\u011f\u0131n\u0131z, kay\u0131tl\u0131 bir alan ad\u0131na ihtiyac\u0131n\u0131z var. \u00d6rne\u011fin, example.com<\/code>.
\n4. Alan Ad\u0131 Y\u00f6nlendirmesi:<\/strong> Alan ad\u0131n\u0131z\u0131n veya bir alt alan ad\u0131n\u0131n (\u00f6rne\u011fin, www.example.com<\/code> veya app.example.com<\/code>) Kubernetes cluster’\u0131n\u0131z\u0131n Ingress Controller’\u0131na (Traefik) i\u015faret etmesi gerekmektedir. Bu genellikle alan ad\u0131n\u0131z\u0131n DNS kay\u0131tlar\u0131nda bir A kayd\u0131 (IP adresi i\u00e7in) veya CNAME kayd\u0131 (ba\u015fka bir host ad\u0131na y\u00f6nlendirme i\u00e7in) olu\u015fturularak yap\u0131l\u0131r. Bulut sa\u011flay\u0131c\u0131lar\u0131nda Traefik LoadBalancer servisi otomatik olarak bir d\u0131\u015f IP veya host ad\u0131 atayacakt\u0131r, bu de\u011feri DNS kay\u0131tlar\u0131n\u0131za eklemeniz gerekecektir.<\/p>\nAd\u0131m Ad\u0131m Uygulama<\/h3>\n
1. Traefik Kurulumu<\/h4>\n
helm repo add traefik https:\/\/traefik.github.io\/charts\nhelm repo update<\/code><\/pre>\nservice.type<\/code> de\u011ferini NodePort<\/code> olarak ayarlaman\u0131z ve minikube service traefik --url<\/code> komutuyla IP adresini alman\u0131z gerekebilir.<\/p>\nvalues.yaml<\/code> dosyas\u0131n\u0131 olu\u015fturarak Traefik’in temel yap\u0131land\u0131rmas\u0131n\u0131 yapal\u0131m. Bu yap\u0131land\u0131rma, Traefik’in IngressRoute CRD’lerini kullanmas\u0131n\u0131, HTTP’den HTTPS’e y\u00f6nlendirme yapmas\u0131n\u0131 ve bir dashboard sa\u011flamas\u0131n\u0131 i\u00e7erir.<\/p>\n# traefik-values.yaml\nports:\n web:\n redirectTo: websecure\n websecure:\n tls:\n enabled: true\n\nEnable the dashboard<\/h2>\ndashboard:\n enabled: true\n domain: traefik.example.com # Dashboard i\u00e7in kullanaca\u011f\u0131n\u0131z domaini buraya yaz\u0131n\n ## IngressRoute for the dashboard\n ingressRoute:\n enabled: true\n entryPoints:\n - websecure\n rule: Host(
traefik.example.com<\/code>) # Dashboard i\u00e7in kullanaca\u011f\u0131n\u0131z domaini buraya yaz\u0131n\n tls:\n certResolver: letsencrypt # cert-manager taraf\u0131ndan y\u00f6netilecek\n options: {}\n\nKubernetes IngressRoute CRD'lerini etkinle\u015ftir<\/h2>\nkubernetes:\n ingressRoute:\n enabled: true\n\n
LoadBalancer servisini etkinle\u015ftir<\/h2>\nservice:\n type: LoadBalancer\n annotations: {} # Cloud provider'a \u00f6zel anotasyonlar buraya eklenebilir\n\n
Otomatik HTTPS i\u00e7in Let's Encrypt yap\u0131land\u0131rmas\u0131 (cert-manager ile entegre)<\/h2>\n
Traefik'in kendi ACME client'\u0131n\u0131 de\u011fil, cert-manager taraf\u0131ndan olu\u015fturulan Secret'\u0131 kullanaca\u011f\u0131z.<\/h2>\n
Bu y\u00fczden Traefik'in ACME yap\u0131land\u0131rmas\u0131n\u0131 burada devre d\u0131\u015f\u0131 b\u0131rak\u0131yoruz.<\/h2>\n
Ancak dashboard i\u00e7in IngressRoute'da certResolver'\u0131 kullanmak cert-manager ile \u00e7al\u0131\u015fmayacakt\u0131r.<\/h2>\n
Bunun yerine dashboard i\u00e7in de manuel olarak Certificate kayna\u011f\u0131 tan\u0131mlayaca\u011f\u0131z.<\/h2>\n
Bu k\u0131s\u0131m daha sonra cert-manager ile y\u00f6netilece\u011fi i\u00e7in burada \u00f6zel bir ACME yap\u0131land\u0131rmas\u0131 yapm\u0131yoruz.<\/h2>\n
Traefik'in kendisi sadece bir Ingress Controller ve HTTP\/HTTPS router olarak g\u00f6rev yapacak.<\/code><\/pre>\n<\/h2>\n
traefik-values.yaml<\/code> dosyas\u0131nda, Traefik dashboard’\u0131 i\u00e7in traefik.example.com<\/code> gibi bir alan ad\u0131 belirttik. Kendi alan ad\u0131n\u0131za g\u00f6re bu de\u011feri g\u00fcncellemeyi unutmay\u0131n.<\/p>\nhelm install traefik traefik\/traefik \\\n --namespace traefik \\\n --create-namespace \\\n -f traefik-values.yaml<\/code><\/pre>\nkubectl get pods -n traefik\nkubectl get svc -n traefik<\/code><\/pre>\nkubectl get svc -n traefik<\/code> komutu, Traefik LoadBalancer servisine atanm\u0131\u015f harici IP adresini veya host ad\u0131n\u0131 g\u00f6sterecektir. Bu adresi, alan ad\u0131n\u0131z\u0131n (\u00f6rne\u011fin *.example.com<\/code> veya traefik.example.com<\/code>) DNS kay\u0131tlar\u0131na A veya CNAME olarak eklemeyi unutmay\u0131n.<\/p>\n2. cert-manager Kurulumu<\/h4>\n
helm repo add jetstack https:\/\/charts.jetstack.io\nhelm repo update<\/code><\/pre>\nhelm install cert-manager jetstack\/cert-manager \\\n --namespace cert-manager \\\n --create-namespace \\\n --version v1.13.1 \\\n --set installCRDs=true<\/code><\/pre>\n--version<\/code> arg\u00fcman\u0131n\u0131, cert-manager’\u0131n en son kararl\u0131 s\u00fcr\u00fcm\u00fcyle g\u00fcncellemeyi d\u00fc\u015f\u00fcnebilirsiniz.<\/p>\nkubectl get pods -n cert-manager<\/code><\/pre>\ncert-manager<\/code>, cert-manager-cainjector<\/code> ve cert-manager-webhook<\/code>.<\/p>\n3. ClusterIssuer Yap\u0131land\u0131rmas\u0131<\/h4>\n
Issuer<\/code> veya ClusterIssuer<\/code> tan\u0131mlamam\u0131z gerekiyor. ClusterIssuer<\/code>, t\u00fcm cluster genelinde kullan\u0131labilen bir sertifika sa\u011flay\u0131c\u0131s\u0131d\u0131r. Let’s Encrypt ile sertifika almak i\u00e7in HTTP-01 challenge y\u00f6ntemini kullanaca\u011f\u0131z ve bu challenge’\u0131 Traefik Ingress Controller \u00fczerinden \u00e7\u00f6zece\u011fiz.<\/p>\nclusterissuer-staging.yaml<\/code> dosyas\u0131n\u0131 olu\u015fturun:<\/p>\n# clusterissuer-staging.yaml\napiVersion: cert-manager.io\/v1\nkind: ClusterIssuer\nmetadata:\n name: letsencrypt-staging\nspec:\n acme:\n # Let's Encrypt'in staging sunucusu. Testler i\u00e7in kullan\u0131l\u0131r.\n server: https:\/\/acme-staging-v02.api.letsencrypt.org\/directory\n email: your-email@example.com # Kendi e-posta adresinizi buraya yaz\u0131n\n privateKeySecretRef:\n # ACME hesab\u0131n\u0131n \u00f6zel anahtar\u0131n\u0131 depolamak i\u00e7in bir Kubernetes Secret ad\u0131\n name: letsencrypt-staging-private-key\n solvers:\n - http01:\n ingress:\n class: traefik # Traefik Ingress Controller'\u0131 kullanaca\u011f\u0131m\u0131z\u0131 belirtiyoruz<\/code><\/pre>\nyour-email@example.com<\/code> k\u0131sm\u0131n\u0131 kendi e-posta adresinizle g\u00fcncellemeyi unutmay\u0131n. Let’s Encrypt, sertifika s\u00fcresinin dolmak \u00fczere oldu\u011funu veya ba\u015fka bir sorun oldu\u011funda bu e-posta adresini kullan\u0131r.<\/p>\nClusterIssuer<\/code> kayna\u011f\u0131n\u0131 uygulay\u0131n:<\/p>\nkubectl apply -f clusterissuer-staging.yaml<\/code><\/pre>\nClusterIssuer<\/code>‘\u0131n durumunu kontrol edin:<\/p>\nkubectl get clusterissuer letsencrypt-staging -o yaml<\/code><\/pre>\nstatus.conditions<\/code> alt\u0131nda Ready<\/code> durumunun True<\/code> oldu\u011funu g\u00f6rmelisiniz.<\/p>\nclusterissuer-production.yaml<\/code> dosyas\u0131n\u0131 olu\u015fturup Let’s Encrypt’in \u00fcretim ortam\u0131n\u0131 yap\u0131land\u0131ral\u0131m:<\/p>\n# clusterissuer-production.yaml\napiVersion: cert-manager.io\/v1\nkind: ClusterIssuer\nmetadata:\n name: letsencrypt-production\nspec:\n acme:\n # Let's Encrypt'in \u00fcretim sunucusu. Ger\u00e7ek sertifikalar i\u00e7in kullan\u0131l\u0131r.\n server: https:\/\/acme-v02.api.letsencrypt.org\/directory\n email: your-email@example.com # Kendi e-posta adresinizi buraya yaz\u0131n\n privateKeySecretRef:\n name: letsencrypt-production-private-key\n solvers:\n - http01:\n ingress:\n class: traefik # Traefik Ingress Controller'\u0131 kullanaca\u011f\u0131m\u0131z\u0131 belirtiyoruz<\/code><\/pre>\nClusterIssuer<\/code> kayna\u011f\u0131n\u0131 uygulay\u0131n:<\/p>\nkubectl apply -f clusterissuer-production.yaml<\/code><\/pre>\nkubectl get clusterissuer letsencrypt-production -o yaml<\/code> ile durumunu kontrol edin.<\/p>\n4. Uygulama Da\u011f\u0131t\u0131m\u0131 ve IngressRoute Olu\u015fturma<\/h4>\n
nginx-app.yaml<\/code> dosyas\u0131n\u0131 olu\u015fturun:<\/p>\n# nginx-app.yaml\napiVersion: apps\/v1\nkind: Deployment\nmetadata:\n name: nginx-deployment\n labels:\n app: nginx\nspec:\n replicas: 2\n selector:\n matchLabels:\n app: nginx\n template:\n metadata:\n labels:\n app: nginx\n spec:\n containers:\n - name: nginx\n image: nginx:latest\n ports:\n - containerPort: 80\n---\napiVersion: v1\nkind: Service\nmetadata:\n name: nginx-service\nspec:\n selector:\n app: nginx\n ports:\n - protocol: TCP\n port: 80\n targetPort: 80<\/code><\/pre>\nkubectl apply -f nginx-app.yaml<\/code><\/pre>\nIngressRoute<\/code> ve bir Certificate<\/code> kayna\u011f\u0131 tan\u0131mlayaca\u011f\u0131z. Certificate<\/code> kayna\u011f\u0131, cert-manager’a bir sertifika almas\u0131n\u0131 ve bu sertifikay\u0131 belirli bir Kubernetes Secret’\u0131nda saklamas\u0131n\u0131 s\u00f6yleyecektir. IngressRoute<\/code> ise bu Secret’\u0131 kullanarak HTTPS trafi\u011fini y\u00f6netecek.<\/p>\ningressroute-app.yaml<\/code> dosyas\u0131n\u0131 olu\u015fturun. host<\/code> de\u011ferini ve tls.secretName<\/code> de\u011ferini kendi alan ad\u0131n\u0131za g\u00f6re g\u00fcncellemeyi unutmay\u0131n.<\/p>\n# ingressroute-app.yaml\napiVersion: traefik.containo.us\/v1alpha1\nkind: IngressRoute\nmetadata:\n name: nginx-ingressroute\nspec:\n entryPoints:\n - web\n - websecure\n routes:\n - match: Host(app.example.com<\/code>) # Uygulaman\u0131z i\u00e7in kullanaca\u011f\u0131n\u0131z domaini buraya yaz\u0131n\n kind: Rule\n services:\n - name: nginx-service\n port: 80\n tls:\n secretName: app-example-com-tls # cert-manager'\u0131n olu\u015fturaca\u011f\u0131 Secret'\u0131n ad\u0131\n # options:\n # name: my-tls-options@kubernetescrd # \u0130ste\u011fe ba\u011fl\u0131, Traefik TLS se\u00e7enekleri<\/code><\/pre>\napp.example.com<\/code> gibi bir alt alan ad\u0131n\u0131 veya ana alan ad\u0131n\u0131z\u0131 Host()<\/code> i\u00e7inde belirtin. secretName<\/code> de\u011feri, cert-manager’\u0131n olu\u015fturaca\u011f\u0131 TLS Secret’\u0131n\u0131n ad\u0131 olacakt\u0131r.<\/p>\nIngressRoute<\/code> kayna\u011f\u0131n\u0131 uygulay\u0131n:<\/p>\nkubectl apply -f ingressroute-app.yaml<\/code><\/pre>\n5. Certificate Kayna\u011f\u0131 Olu\u015fturma<\/h4>\n
app.example.com<\/code> i\u00e7in bir sertifika almas\u0131n\u0131 s\u00f6yleyen Certificate<\/code> kayna\u011f\u0131n\u0131 olu\u015ftural\u0131m. \u0130lk ba\u015fta letsencrypt-staging<\/code> ClusterIssuer’\u0131 kullanarak test edece\u011fiz.<\/p>\ncertificate-staging.yaml<\/code> dosyas\u0131n\u0131 olu\u015fturun:<\/p>\n# certificate-staging.yaml\napiVersion: cert-manager.io\/v1\nkind: Certificate\nmetadata:\n name: app-example-com-certificate-staging\nspec:\n secretName: app-example-com-tls # IngressRoute'da belirtilen Secret ad\u0131 ile e\u015fle\u015fmeli\n dnsNames:\n - app.example.com # Sertifika almak istedi\u011finiz domaini buraya yaz\u0131n\n issuerRef:\n name: letsencrypt-staging # Staging ClusterIssuer'\u0131m\u0131z\u0131 kullan\u0131yoruz\n kind: ClusterIssuer<\/code><\/pre>\nCertificate<\/code> kayna\u011f\u0131n\u0131 uygulay\u0131n:<\/p>\nkubectl apply -f certificate-staging.yaml<\/code><\/pre>\nkubectl get certificaterequest -w\nkubectl describe certificate app-example-com-certificate-staging<\/code><\/pre>\nCertificate<\/code> kayna\u011f\u0131n\u0131n Ready<\/code> durumunun True<\/code> oldu\u011funu ve Secret<\/code>‘\u0131n olu\u015fturuldu\u011funu g\u00f6rmelisiniz. Bu i\u015flem birka\u00e7 dakika s\u00fcrebilir. E\u011fer bir sorun olursa, kubectl describe certificate<\/code> ve kubectl logs -n cert-manager deploy\/cert-manager<\/code> komutlar\u0131 hata ay\u0131klama i\u00e7in faydal\u0131d\u0131r.<\/p>\nCertificate<\/code>‘i silin:<\/p>\nkubectl delete certificate app-example-com-certificate-staging<\/code><\/pre>\ncertificate-production.yaml<\/code> dosyas\u0131n\u0131 olu\u015fturun:<\/p>\n# certificate-production.yaml\napiVersion: cert-manager.io\/v1\nkind: Certificate\nmetadata:\n name: app-example-com-certificate-production\nspec:\n secretName: app-example-com-tls # IngressRoute'da belirtilen Secret ad\u0131 ile e\u015fle\u015fmeli\n dnsNames:\n - app.example.com # Sertifika almak istedi\u011finiz domaini buraya yaz\u0131n\n issuerRef:\n name: letsencrypt-production # \u00dcretim ClusterIssuer'\u0131m\u0131z\u0131 kullan\u0131yoruz\n kind: ClusterIssuer<\/code><\/pre>\nCertificate<\/code> kayna\u011f\u0131n\u0131 uygulay\u0131n:<\/p>\nkubectl apply -f certificate-production.yaml<\/code><\/pre>\nkubectl get certificaterequest -w\nkubectl describe certificate app-example-com-certificate-production<\/code><\/pre>\napp-example-com-tls<\/code> adl\u0131 bir Secret’\u0131n olu\u015ftu\u011funu g\u00f6receksiniz. Traefik IngressRoute’unuz bu Secret’\u0131 otomatik olarak kullanmaya ba\u015flayacakt\u0131r.<\/p>\n
\nE\u011fer Traefik dashboard’\u0131 i\u00e7in de HTTPS eri\u015fimi istiyorsan\u0131z, dashboard i\u00e7in belirledi\u011finiz domain (traefik.example.com<\/code>) i\u00e7in de bir Certificate<\/code> kayna\u011f\u0131 olu\u015fturman\u0131z gerekecektir.<\/p>\n# certificate-traefik-dashboard.yaml\napiVersion: cert-manager.io\/v1\nkind: Certificate\nmetadata:\n name: traefik-dashboard-certificate\n namespace: traefik # Dashboard Traefik namespace'inde oldu\u011fu i\u00e7in\nspec:\n secretName: traefik-dashboard-tls\n dnsNames:\n - traefik.example.com # Dashboard domaini\n issuerRef:\n name: letsencrypt-production\n kind: ClusterIssuer<\/code><\/pre>\nvalues.yaml<\/code> dosyas\u0131nda dashboard ingressRoute<\/code>‘unda tls.secretName: traefik-dashboard-tls<\/code> olarak g\u00fcncelleyin. Helm upgrade ile Traefik’i g\u00fcncellemeyi unutmay\u0131n.<\/p>\n6. Eri\u015fimi Test Etme<\/h4>\n
https:\/\/app.example.com<\/code>) bir web taray\u0131c\u0131s\u0131ndan ziyaret edin.<\/p>\n
\n* Kilit simgesine t\u0131klayarak sertifika detaylar\u0131n\u0131 inceleyin. Sertifikan\u0131n Let’s Encrypt taraf\u0131ndan verildi\u011fini ve alan ad\u0131n\u0131z i\u00e7in ge\u00e7erli oldu\u011funu do\u011frulay\u0131n.
\n* HTTP’den HTTPS’e otomatik y\u00f6nlendirmenin \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in http:\/\/app.example.com<\/code> adresini ziyaret edin. Otomatik olarak https:\/\/app.example.com<\/code> adresine y\u00f6nlendirilmelisiniz.<\/p>\n\u0130leri Seviye Konular \/ En \u0130yi Uygulamalar<\/h3>\n
DNS-01 Challenge<\/h4>\n
<\/em>.example.com<\/code> gibi wildcard sertifikalar almak i\u00e7in DNS-01 challenge zorunludur.
\n* \u0130\u00e7 A\u011f Uygulamalar\u0131:<\/strong> Uygulaman\u0131z\u0131n internete a\u00e7\u0131k olmad\u0131\u011f\u0131 ancak yine de g\u00fcvenli\u011fe ihtiyac\u0131 oldu\u011fu durumlarda.
\n* A\u011f Yap\u0131land\u0131rmas\u0131 K\u0131s\u0131tlamalar\u0131:<\/strong> HTTP-01 challenge i\u00e7in port 80’in Traefik’e ula\u015f\u0131labilir olmas\u0131 gerekir. E\u011fer bu m\u00fcmk\u00fcn de\u011filse DNS-01 bir alternatiftir.<\/p>\nClusterIssuer<\/code> yap\u0131land\u0131rmas\u0131nda http01<\/code> yerine dns01<\/code> solver’\u0131 kullanman\u0131z ve DNS sa\u011flay\u0131c\u0131n\u0131za \u00f6zel API kimlik bilgilerini bir Secret olarak sa\u011flaman\u0131z gerekir.<\/p>\nSertifika Yenileme<\/h4>\n
cert-manager’\u0131 \u0130zleme<\/h4>\n
kubectl get certificate<\/code> ve kubectl describe certificate<\/code> komutlar\u0131n\u0131 d\u00fczenli olarak kontrol etmek, herhangi bir sorun olup olmad\u0131\u011f\u0131n\u0131 anlaman\u0131za yard\u0131mc\u0131 olur.<\/p>\nG\u00fcvenlik En \u0130yi Uygulamalar\u0131 (Traefik Middleware)<\/h4>\n
\n* G\u00fcvenlik Ba\u015fl\u0131klar\u0131:<\/strong> X-Content-Type-Options<\/code>, X-Frame-Options<\/code>, X-XSS-Protection<\/code>, Referrer-Policy<\/code>, Content-Security-Policy<\/code> gibi ba\u015fl\u0131klar\u0131 ekleyerek \u00e7e\u015fitli web zafiyetlerine kar\u015f\u0131 koruma sa\u011flayabilirsiniz.<\/p>\napiVersion: traefik.containo.us\/v1alpha1\nkind: Middleware\nmetadata:\n name: security-headers\n namespace: default\nspec:\n headers:\n stsSeconds: 31536000 # 1 y\u0131l\n stsIncludeSubdomains: true\n stsPreload: true\n contentTypeNosniff: true\n frameDeny: true\n browserXssFilter: true<\/code><\/pre>\nIngressRoute<\/code>‘a eklemek i\u00e7in:<\/p>\napiVersion: traefik.containo.us\/v1alpha1\nkind: IngressRoute\nmetadata:\n name: nginx-ingressroute\nspec:\n entryPoints:\n - web\n - websecure\n routes:\n - match: Host(app.example.com<\/code>)\n kind: Rule\n services:\n - name: nginx-service\n port: 80\n middlewares:\n - name: security-headers@kubernetescrd # Middleware'i IngressRoute'a ekle\n tls:\n secretName: app-example-com-tls<\/code><\/pre>\nSorun Giderme<\/h3>\n
\n * kubectl describe certificate kubectl describe certificaterequest
\n * kubectl logs -n cert-manager deploy\/cert-manager<\/code> komutuyla cert-manager podunun g\u00fcnl\u00fcklerini kontrol edin.
\n * E-posta adresinizin do\u011fru oldu\u011fundan ve Let’s Encrypt’e ula\u015f\u0131labilir oldu\u011fundan emin olun.
\n * Alan ad\u0131n\u0131z\u0131n Traefik LoadBalancer IP adresine do\u011fru \u015fekilde i\u015faret etti\u011finden emin olun. DNS yay\u0131l\u0131m\u0131 zaman alabilir. dig app.example.com<\/code> komutuyla kontrol edin.
\n * Firewall kurallar\u0131n\u0131z\u0131n Let’s Encrypt’in ACME sunucular\u0131ndan gelen HTTP (port 80) isteklerine izin verdi\u011finden emin olun.
\n * ClusterIssuer<\/code>‘daki solvers.http01.ingress.class<\/code> de\u011ferinin Traefik’in do\u011fru Ingress s\u0131n\u0131f\u0131na i\u015faret etti\u011finden emin olun (genellikle traefik<\/code>).<\/p>\n
\n * Traefik values.yaml<\/code> dosyas\u0131ndaki ports.web.redirectTo: websecure<\/code> ayar\u0131n\u0131n do\u011fru oldu\u011fundan emin olun.
\n * IngressRoute<\/code> tan\u0131m\u0131n\u0131zda entryPoints<\/code> alt\u0131nda hem web<\/code> hem de websecure<\/code>‘\u0131n listelendi\u011finden emin olun.<\/p>\n
\n * Traefik LoadBalancer servisinin bir d\u0131\u015f IP veya host ad\u0131 ald\u0131\u011f\u0131ndan emin olun (kubectl get svc -n traefik<\/code>).
\n * Dashboard i\u00e7in kulland\u0131\u011f\u0131n\u0131z alan ad\u0131n\u0131n bu IP adresine do\u011fru \u015fekilde y\u00f6nlendirildi\u011finden emin olun.
\n * Traefik pod g\u00fcnl\u00fcklerini kontrol edin (kubectl logs -n traefik deploy\/traefik<\/code>).<\/p>\nsecretName<\/code> E\u015fle\u015fmiyor:<\/strong>
\n * Certificate<\/code> kayna\u011f\u0131ndaki spec.secretName<\/code> ile IngressRoute<\/code> kayna\u011f\u0131ndaki tls.secretName<\/code> de\u011ferlerinin tam olarak ayn\u0131 oldu\u011fundan emin olun.<\/p>\nSonu\u00e7<\/h3>\n