{"id":37350,"date":"2026-01-01T00:40:45","date_gmt":"2025-12-31T21:40:45","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=37350"},"modified":"2026-01-01T00:40:45","modified_gmt":"2025-12-31T21:40:45","slug":"coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/","title":{"rendered":"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme"},"content":{"rendered":"

<\/p>\n

CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme<\/h2>\n

Giri\u015f<\/h2>\n

G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla de\u011fi\u015fen dijital d\u00fcnyas\u0131nda, konteyner tabanl\u0131 uygulamalar\u0131n ve mikroservis mimarilerinin benimsenmesi, i\u015fletmeler i\u00e7in \u00e7eviklik ve \u00f6l\u00e7eklenebilirlik sa\u011flamaktad\u0131r. Bu d\u00f6n\u00fc\u015f\u00fcm\u00fcn \u00f6nc\u00fclerinden biri olan CoreOS (\u015fimdi Fedora CoreOS olarak evrimle\u015fmi\u015f olsa da, temel g\u00fcvenlik prensipleri ge\u00e7erlili\u011fini korumaktad\u0131r), konteyner i\u015f y\u00fckleri i\u00e7in tasarlanm\u0131\u015f minimalist, otomatik g\u00fcncellenen ve g\u00fcvenli\u011fe odaklanm\u0131\u015f bir i\u015fletim sistemidir. Ancak, CoreOS veya herhangi bir konteyner k\u00fcmesinin potansiyel g\u00fcvenlik risklerine kar\u015f\u0131 korunmas\u0131, da\u011f\u0131t\u0131m\u0131n ba\u015far\u0131s\u0131 i\u00e7in kritik \u00f6neme sahiptir. G\u00fcvenlik ihlalleri, veri kayb\u0131na, hizmet kesintilerine ve itibar zedelenmelerine yol a\u00e7abilir. Bu teknik makale, CoreOS k\u00fcmelerinizi iki temel mekanizma olan TLS\/SSL \u015fifrelemesi ve sa\u011flam g\u00fcvenlik duvar\u0131 kurallar\u0131 kullanarak nas\u0131l g\u00fcvenli hale getirece\u011finizi ayr\u0131nt\u0131l\u0131 olarak ele alacakt\u0131r. Amac\u0131m\u0131z, hem ileti\u015fim g\u00fcvenli\u011fini sa\u011flamak hem de yetkisiz eri\u015fimi engellemek i\u00e7in kapsaml\u0131 bir rehber sunmakt\u0131r.<\/p>\n

CoreOS\/Fedora CoreOS’u Anlamak<\/h2>\n

CoreOS, Google’\u0131n Chrome OS’undan ilham alan, konteynerle\u015ftirilmi\u015f i\u015f y\u00fckleri i\u00e7in optimize edilmi\u015f, Linux tabanl\u0131 bir i\u015fletim sistemidir. Temel felsefesi, minimalizm, otomatik g\u00fcncellemeler ve g\u00fcvenliktir. Immutable (de\u011fi\u015fmez) dosya sistemi sayesinde, sistemin temel bile\u015fenleri \u00fcretim s\u0131ras\u0131nda de\u011fi\u015ftirilemez, bu da k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n kal\u0131c\u0131 olmas\u0131n\u0131 zorla\u015ft\u0131r\u0131r. Fedora CoreOS ise bu miras\u0131n devam\u0131d\u0131r ve Kubernetes gibi orkestrasyon ara\u00e7lar\u0131yla derin entegrasyon sunar.<\/p>\n

CoreOS’un g\u00fcvenlik modeli, geleneksel sunucu i\u015fletim sistemlerinden farkl\u0131d\u0131r. Uygulamalar konteynerler i\u00e7inde izole edilirken, i\u015fletim sisteminin kendisi de s\u0131k\u0131 bir \u015fekilde kontrol edilir. Bu, g\u00fcvenlik stratejilerini olu\u015ftururken hem i\u015fletim sistemi seviyesinde hem de konteyner orkestrasyon seviyesinde d\u00fc\u015f\u00fcnmeyi gerektirir. G\u00fcvenlik, yaln\u0131zca bir eklenti de\u011fil, tasar\u0131m\u0131n ayr\u0131lmaz bir par\u00e7as\u0131 olmal\u0131d\u0131r.<\/p>\n

Konteyner Orkestrasyonunda G\u00fcvenli\u011fin \u00d6nemi<\/h2>\n

Konteyner orkestrasyonu, da\u011f\u0131t\u0131k sistemlerin karma\u015f\u0131kl\u0131\u011f\u0131n\u0131 y\u00f6netirken ayn\u0131 zamanda yeni g\u00fcvenlik zorluklar\u0131 da beraberinde getirir. Bir CoreOS k\u00fcmesinde, her bir d\u00fc\u011f\u00fcm (node) \u00fczerinde \u00e7al\u0131\u015fan birden fazla konteyner, birbirleriyle ve d\u0131\u015f d\u00fcnya ile ileti\u015fim kurar. Bu ileti\u015fim kanallar\u0131n\u0131n ve eri\u015fim noktalar\u0131n\u0131n g\u00fcvence alt\u0131na al\u0131nmas\u0131 hayati \u00f6nem ta\u015f\u0131r. Potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131 \u015funlar\u0131 i\u00e7erebilir:
\n* Host \u0130\u015fletim Sistemi Zafiyetleri:<\/strong> Temel i\u015fletim sistemindeki g\u00fcvenlik a\u00e7\u0131klar\u0131, t\u00fcm k\u00fcmenin tehlikeye girmesine neden olabilir.
\n* Konteyner \u0130maj Zafiyetleri:<\/strong> G\u00fcvenilmeyen veya g\u00fcncel olmayan imajlar, bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 i\u00e7erebilir.
\n* Runtime Zafiyetleri:<\/strong> Konteyner \u00e7al\u0131\u015fma zaman\u0131 (runtime) motorundaki (\u00f6rne\u011fin, containerd, CRI-O) zafiyetler.
\n* A\u011f Zafiyetleri:<\/strong> Yetkisiz a\u011f eri\u015fimi, dinleme (eavesdropping) veya hizmet reddi (DoS) sald\u0131r\u0131lar\u0131.
\n* API Zafiyetleri:<\/strong> Kubernetes API sunucusuna yetkisiz eri\u015fim, k\u00fcmenin kontrol\u00fcn\u00fcn ele ge\u00e7irilmesine yol a\u00e7abilir.<\/p>\n

Bu riskleri azaltmak i\u00e7in \u00e7ok katmanl\u0131 bir g\u00fcvenlik yakla\u015f\u0131m\u0131 benimsemek \u015fartt\u0131r. TLS\/SSL ve g\u00fcvenlik duvar\u0131 kurallar\u0131, bu katmanl\u0131 yakla\u015f\u0131m\u0131n temelini olu\u015fturur.<\/p>\n

TLS\/SSL ile \u0130leti\u015fim G\u00fcvenli\u011fi<\/h2>\n

TLS (Transport Layer Security) ve selefi SSL (Secure Sockets Layer), internet \u00fczerinden g\u00fcvenli ileti\u015fim sa\u011flamak i\u00e7in kullan\u0131lan kriptografik protokollerdir. CoreOS k\u00fcmesi gibi da\u011f\u0131t\u0131k sistemlerde, d\u00fc\u011f\u00fcmler aras\u0131 ve istemci-sunucu aras\u0131ndaki t\u00fcm ileti\u015fim kanallar\u0131n\u0131n \u015fifrelenmesi ve kimlik do\u011frulamas\u0131 kritik \u00f6neme sahiptir.<\/p>\n

TLS\/SSL Nedir?<\/h3>\n

TLS\/SSL, \u00fc\u00e7 temel g\u00fcvenlik hizmeti sunar:
\n* \u015eifreleme:<\/strong> \u0130letilen verilerin yetkisiz ki\u015filer taraf\u0131ndan okunmas\u0131n\u0131 engeller.
\n* Kimlik Do\u011frulama:<\/strong> \u0130leti\u015fimin her iki taraf\u0131n\u0131n da iddia ettikleri taraf oldu\u011funu do\u011frular. Bu, genellikle dijital sertifikalar arac\u0131l\u0131\u011f\u0131yla yap\u0131l\u0131r.
\n* Veri B\u00fct\u00fcnl\u00fc\u011f\u00fc:<\/strong> \u0130letilen verilerin aktar\u0131m s\u0131ras\u0131nda de\u011fi\u015ftirilmedi\u011fini garanti eder.<\/p>\n

Bu \u00f6zellikler, bir sald\u0131rgan\u0131n a\u011f trafi\u011fini dinlemesini, verileri de\u011fi\u015ftirmesini veya sahte bir bile\u015fen olarak davranmas\u0131n\u0131 engeller.<\/p>\n

CoreOS K\u00fcmeleri \u0130\u00e7in TLS\/SSL Neden \u00d6nemli?<\/h3>\n

Bir CoreOS k\u00fcmesinde, \u00f6zellikle Kubernetes gibi bir orkestrasyon arac\u0131 kullan\u0131l\u0131yorsa, bir\u00e7ok bile\u015fen birbiriyle ileti\u015fim kurar:
\n* Kubernetes API Sunucusu:<\/strong> T\u00fcm k\u00fcme y\u00f6netiminin merkezi noktas\u0131d\u0131r. kubectl<\/code> gibi istemciler ve di\u011fer kontrol d\u00fczlemi bile\u015fenleri bu sunucuyla ileti\u015fim kurar. Bu ileti\u015fimin \u015fifrelenmesi ve kimlik do\u011frulamas\u0131 zorunludur.
\n* etcd:<\/strong> Kubernetes’in t\u00fcm k\u00fcme verilerini depolad\u0131\u011f\u0131 da\u011f\u0131t\u0131k anahtar-de\u011fer deposudur. etcd sunucular\u0131 aras\u0131ndaki ve etcd ile API sunucusu aras\u0131ndaki ileti\u015fimin g\u00fcvenli\u011fi, k\u00fcmenin durumunun b\u00fct\u00fcnl\u00fc\u011f\u00fc i\u00e7in hayati \u00f6neme sahiptir.
\n* Kubelet:<\/strong> Her worker d\u00fc\u011f\u00fcm\u00fcnde \u00e7al\u0131\u015fan arac\u0131d\u0131r. API sunucusuyla ileti\u015fim kurar ve konteynerleri y\u00f6netir. Kubelet’in API sunucusuna ve API sunucusunun Kubelet’e g\u00fcvenli bir \u015fekilde ba\u011flanmas\u0131 gerekir.
\n* Kontrol D\u00fczlemi Bile\u015fenleri:<\/strong> Kube-scheduler, Kube-controller-manager gibi bile\u015fenler de API sunucusuyla ileti\u015fim kurar.
\n* D\u00fc\u011f\u00fcmler Aras\u0131 \u0130leti\u015fim:<\/strong> Pod’lar aras\u0131 ileti\u015fim, hizmet a\u011f\u0131 (service network) trafi\u011fi gibi.<\/p>\n

Bu bile\u015fenler aras\u0131ndaki t\u00fcm ileti\u015fimin TLS\/SSL ile g\u00fcvence alt\u0131na al\u0131nmas\u0131, Man-in-the-Middle (MITM) sald\u0131r\u0131lar\u0131n\u0131 ve veri s\u0131z\u0131nt\u0131lar\u0131n\u0131 \u00f6nler.<\/p>\n

TLS\/SSL Uygulama Ad\u0131mlar\u0131<\/h3>\n

CoreOS k\u00fcmenizde TLS\/SSL’i etkinle\u015ftirmek i\u00e7in genellikle bir Sertifika Yetkilisi (CA) olu\u015fturman\u0131z ve ard\u0131ndan bu CA taraf\u0131ndan imzalanm\u0131\u015f sunucu ve istemci sertifikalar\u0131n\u0131 da\u011f\u0131tman\u0131z gerekir.<\/p>\n

Sertifika Yetkilisi (CA) Olu\u015fturma<\/h4>\n

K\u00fcmenizin kendi \u00f6zel Sertifika Yetkilisi’ne sahip olmas\u0131, t\u00fcm i\u00e7 bile\u015fenler i\u00e7in g\u00fcvenilir bir k\u00f6k olu\u015fturur. Bu, genellikle kendi kendine imzal\u0131 (self-signed) bir CA olacakt\u0131r. openssl<\/code> veya cfssl<\/code> gibi ara\u00e7lar kullan\u0131labilir.
\n1. CA Anahtar\u0131 ve Sertifikas\u0131 Olu\u015fturma:<\/strong><\/p>\n

openssl genrsa -out ca.key 2048\n    openssl req -x509 -new -nodes -key ca.key -days 3650 -out ca.crt -subj \"\/CN=KUBERNETES-CA\"<\/code><\/pre>\n
    Burada ca.key<\/code> \u00f6zel anahtar\u0131n\u0131z, ca.crt<\/code> ise genel sertifikan\u0131zd\u0131r. CN<\/code> (Common Name) sertifikan\u0131n ne i\u00e7in oldu\u011funu belirtir.<\/p>\n
Sunucu Sertifikalar\u0131 Olu\u015fturma<\/h4>\n
Kubernetes API Sunucusu, etcd sunucular\u0131 ve Kubelet gibi her sunucu bile\u015feni i\u00e7in bir sertifika olu\u015fturulmal\u0131d\u0131r.
\n1.  API Sunucusu \u0130\u00e7in Sertifika:<\/strong>
\n    API sunucusu sertifikas\u0131, k\u00fcmenin t\u00fcm IP adreslerini, DNS adlar\u0131n\u0131 ve hizmet IP’lerini i\u00e7ermelidir (Subject Alternative Names – SANs).
\n    *   Anahtar Olu\u015fturma:<\/strong><\/p>\n
openssl genrsa -out apiserver.key 2048<\/code><\/pre>\n
    *   Sertifika \u0130mzalama \u0130ste\u011fi (CSR) Olu\u015fturma:<\/strong>
\n        apiserver.csr<\/code> i\u00e7in bir yap\u0131land\u0131rma dosyas\u0131 (\u00f6rne\u011fin apiserver.cnf<\/code>) olu\u015fturulur. Bu dosyada [alt_names]<\/code> b\u00f6l\u00fcm\u00fcnde t\u00fcm IP adresleri ve DNS adlar\u0131 belirtilmelidir.<\/p>\n
[req]\n        req_extensions = v3_req\n        distinguished_name = req_distinguished_name\n        [req_distinguished_name]\n        [v3_req]\n        keyUsage = critical, digitalSignature, keyEncipherment\n        extendedKeyUsage = serverAuth\n        subjectAltName = @alt_names\n        [alt_names]\n        DNS.1 = kubernetes\n        DNS.2 = kubernetes.default\n        DNS.3 = kubernetes.default.svc\n        DNS.4 = kubernetes.default.svc.cluster.local\n        IP.1 = 10.96.0.1          # Kubernetes hizmet IP'si\n        IP.2 = 192.168.1.100     # API Sunucusu d\u00fc\u011f\u00fcm IP'si\n        IP.3 = 127.0.0.1<\/code><\/pre>\n
        Ard\u0131ndan CSR olu\u015fturulur:<\/p>\n
openssl req -new -key apiserver.key -out apiserver.csr -subj \"\/CN=kube-apiserver\" -config apiserver.cnf<\/code><\/pre>\n
    *   CA ile \u0130mzalama:<\/strong><\/p>\n
openssl x509 -req -in apiserver.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out apiserver.crt -days 3650 -extensions v3_req -extfile apiserver.cnf<\/code><\/pre>\n
2.  etcd Sunucular\u0131 \u0130\u00e7in Sertifikalar:<\/strong> Her etcd d\u00fc\u011f\u00fcm\u00fc i\u00e7in benzer ad\u0131mlar izlenir. SANs, etcd d\u00fc\u011f\u00fcmlerinin IP adreslerini i\u00e7ermelidir.
\n3.  Kubelet Sertifikalar\u0131:<\/strong> Her worker d\u00fc\u011f\u00fcm\u00fcndeki Kubelet i\u00e7in sertifika olu\u015fturulur. Kubelet’in CN<\/code> de\u011feri genellikle system:node:<\/code> format\u0131nda olur.<\/p>\n
\u0130stemci Sertifikalar\u0131 Olu\u015fturma<\/h4>\n
kubectl<\/code> gibi y\u00f6netim ara\u00e7lar\u0131, kube-proxy<\/code>, kube-controller-manager<\/code> ve kube-scheduler<\/code> gibi di\u011fer kontrol d\u00fczlemi bile\u015fenleri i\u00e7in de istemci sertifikalar\u0131 gereklidir.
\n*   Admin Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Sertifika:<\/strong><\/p>\n
openssl genrsa -out admin.key 2048\n    openssl req -new -key admin.key -out admin.csr -subj \"\/CN=admin\/O=system:masters\"\n    openssl x509 -req -in admin.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out admin.crt -days 3650<\/code><\/pre>\n
    \/O=system:masters<\/code> ifadesi, bu kullan\u0131c\u0131n\u0131n Kubernetes’te s\u00fcper y\u00f6netici yetkilerine sahip olmas\u0131n\u0131 sa\u011flar.
\n*   Di\u011fer bile\u015fenler i\u00e7in de benzer ad\u0131mlar izlenir, ancak CN<\/code> ve O<\/code> de\u011ferleri ilgili bile\u015fenin kimli\u011fini yans\u0131tmal\u0131d\u0131r (\u00f6rn. CN=system:kube-proxy<\/code>).<\/p>\n
Sertifikalar\u0131 Da\u011f\u0131tma ve Yap\u0131land\u0131rma<\/h4>\n
Olu\u015fturulan sertifikalar ve anahtarlar, CoreOS d\u00fc\u011f\u00fcmlerine ve Kubernetes bile\u015fenlerine da\u011f\u0131t\u0131lmal\u0131d\u0131r.
\n*   CoreOS D\u00fc\u011f\u00fcmleri:<\/strong> Sertifikalar, Ignition dosyalar\u0131 veya systemd birimleri arac\u0131l\u0131\u011f\u0131yla \/etc\/kubernetes\/pki\/<\/code> gibi uygun bir dizine kopyalanabilir.
\n*   Kubernetes Bile\u015fenleri:<\/strong> Her bile\u015fenin (API Sunucusu, etcd, Kubelet vb.) yap\u0131land\u0131rma dosyalar\u0131 (genellikle YAML dosyalar\u0131), kullanaca\u011f\u0131 sertifika, anahtar ve CA sertifikas\u0131n\u0131n yollar\u0131n\u0131 belirtecek \u015fekilde g\u00fcncellenmelidir. \u00d6rne\u011fin, Kubernetes API sunucusu i\u00e7in --tls-cert-file<\/code>, --tls-private-key-file<\/code>, --client-ca-file<\/code> parametreleri kullan\u0131l\u0131r.
\n*   Kubeconfig Dosyalar\u0131:<\/strong> kubectl<\/code> gibi istemciler i\u00e7in, CA sertifikas\u0131n\u0131, istemci sertifikas\u0131n\u0131 ve anahtar\u0131n\u0131 i\u00e7eren kubeconfig dosyalar\u0131 olu\u015fturulmal\u0131d\u0131r.<\/p>\n
TLS \u015eifrelemesini Do\u011frulama<\/h4>\n
T\u00fcm yap\u0131land\u0131rmalar tamamland\u0131ktan sonra, TLS’in d\u00fczg\u00fcn \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulamak \u00f6nemlidir.
\n*   kubectl cluster-info dump<\/code> komutu, k\u00fcme bile\u015fenlerinin dinledi\u011fi portlar\u0131 ve sertifika bilgilerini g\u00f6sterebilir.
\n*   curl -k https:\/\/:6443<\/code> komutunu kullanarak API sunucusuna ba\u011flanmay\u0131 deneyin. -k<\/code> (insecure) bayra\u011f\u0131 olmadan, istemcinin CA sertifikas\u0131na g\u00fcvenmesi gerekir.
\n*   Loglar\u0131 kontrol edin. Bile\u015fenlerin TLS ile ilgili hatalar vermedi\u011finden emin olun.<\/p>\n
G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile A\u011f G\u00fcvenli\u011fi<\/h2>\n
G\u00fcvenlik duvar\u0131 (firewall) kurallar\u0131, CoreOS k\u00fcmenizi yetkisiz a\u011f eri\u015fimine kar\u015f\u0131 koruman\u0131n ilk ve en temel savunma hatt\u0131d\u0131r. Gelen ve giden a\u011f trafi\u011fini kontrol ederek, yaln\u0131zca izin verilen ileti\u015fime olanak tan\u0131r ve k\u00f6t\u00fc niyetli veya gereksiz ba\u011flant\u0131lar\u0131 engeller.<\/p>\n
G\u00fcvenlik Duvar\u0131 Neden \u00d6nemli?<\/h3>\n
*   Eri\u015fim Kontrol\u00fc:<\/strong> K\u00fcme d\u00fc\u011f\u00fcmlerine veya konteynerlere yetkisiz eri\u015fimi \u00f6nler.
\n*   Sald\u0131r\u0131 Y\u00fczeyini Azaltma:<\/strong> Yaln\u0131zca gerekli portlar\u0131 a\u00e7arak potansiyel sald\u0131r\u0131 vekt\u00f6rlerini s\u0131n\u0131rlar.
\n*   \u0130zolasyon:<\/strong> K\u00fcme bile\u015fenlerini veya farkl\u0131 a\u011f segmentlerini birbirinden izole eder.
\n*   Minimum Ayr\u0131cal\u0131k \u0130lkesi:<\/strong> Yaln\u0131zca belirli kaynaklar\u0131n belirli hizmetlere eri\u015fmesine izin verir.<\/p>\n
CoreOS’ta G\u00fcvenlik Duvar\u0131 Y\u00f6netimi<\/h3>\n
Fedora CoreOS, varsay\u0131lan olarak firewalld<\/code> hizmetini kullan\u0131r. firewalld<\/code>, dinamik bir g\u00fcvenlik duvar\u0131 y\u00f6netim arac\u0131d\u0131r ve b\u00f6lgeler (zones) kavram\u0131n\u0131 kullanarak farkl\u0131 a\u011f arabirimleri i\u00e7in farkl\u0131 g\u00fcvenlik seviyeleri tan\u0131mlaman\u0131za olanak tan\u0131r. Alternatif olarak, iptables<\/code> veya nftables<\/code> de kullan\u0131labilir, ancak firewalld<\/code> daha y\u00fcksek seviyeli ve kullan\u0131m\u0131 kolay bir aray\u00fcz sunar.<\/p>\n
Kal\u0131c\u0131 G\u00fcvenlik Duvar\u0131 Kurallar\u0131<\/h4>\n
CoreOS’un immutable yap\u0131s\u0131 nedeniyle, g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131n kal\u0131c\u0131 olmas\u0131 i\u00e7in firewalld<\/code> yap\u0131land\u0131rma dosyalar\u0131n\u0131 do\u011frudan d\u00fczenlemek veya Ignition dosyalar\u0131 arac\u0131l\u0131\u011f\u0131yla kurallar\u0131 da\u011f\u0131tmak en iyi yakla\u015f\u0131md\u0131r.
\n*   Ignition ile Kurallar:<\/strong> \u0130lk \u00f6ny\u00fckleme s\u0131ras\u0131nda g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131 uygulamak i\u00e7in Ignition dosyalar\u0131 kullan\u0131labilir. Bu, sistemin ilk kez ba\u015flat\u0131ld\u0131\u011f\u0131nda tamamen g\u00fcvenli olmas\u0131n\u0131 sa\u011flar.
\n*   Systemd Birimleri:<\/strong> firewalld<\/code> hizmetini yap\u0131land\u0131rmak i\u00e7in systemd birimleri kullan\u0131labilir. \u00d6rne\u011fin, bir firewalld<\/code> hizmeti i\u00e7in ek yap\u0131land\u0131rma sa\u011flamak veya belirli portlar\u0131 a\u00e7an komutlar\u0131 bir ExecStartPost<\/code> beti\u011fi olarak \u00e7al\u0131\u015ft\u0131rmak.<\/p>\n
Gerekli Ba\u011flant\u0131 Noktalar\u0131 ve Protokoller<\/h3>\n
Bir Kubernetes k\u00fcmesinde, \u00e7e\u015fitli bile\u015fenler aras\u0131nda ileti\u015fim i\u00e7in belirli portlar\u0131n a\u00e7\u0131k olmas\u0131 gerekir. Bu portlar, k\u00fcmenizin da\u011f\u0131t\u0131m\u0131na ve kulland\u0131\u011f\u0131n\u0131z CNI (Container Network Interface) eklentisine g\u00f6re de\u011fi\u015fiklik g\u00f6sterebilir. A\u015fa\u011f\u0131da tipik bir Kubernetes k\u00fcmesi i\u00e7in temel portlar listelenmi\u015ftir:<\/p>\n
Kubernetes Kontrol D\u00fczlemi (Master D\u00fc\u011f\u00fcmleri) \u0130\u00e7in:<\/h4>\n
*   TCP 6443 (veya 443):<\/strong> Kubernetes API Sunucusu. kubectl<\/code> ve di\u011fer bile\u015fenler buraya ba\u011flan\u0131r.
\n*   TCP 2379-2380:<\/strong> etcd sunucular\u0131 aras\u0131 ileti\u015fim ve etcd istemci portlar\u0131.
\n*   TCP 10250:<\/strong> Kubelet API. API sunucusu, Kubelet ile ileti\u015fim kurmak i\u00e7in kullan\u0131r.
\n*   TCP 10257:<\/strong> Kube-controller-manager.
\n*   TCP 10259:<\/strong> Kube-scheduler.
\n*   TCP 22:<\/strong> SSH eri\u015fimi (sadece y\u00f6netim i\u00e7in, k\u0131s\u0131tl\u0131 IP’lerden).<\/p>\n
Worker D\u00fc\u011f\u00fcmleri \u0130\u00e7in:<\/h4>\n
*   TCP 10250:<\/strong> Kubelet API.
\n*   TCP 10255:<\/strong> Kubelet’in salt okunur API’si (genellikle kapat\u0131l\u0131r).
\n*   TCP 30000-32767:<\/strong> NodePort hizmetleri i\u00e7in varsay\u0131lan aral\u0131k.
\n*   UDP (\u00e7e\u015fitli portlar):<\/strong> CNI eklentisine ba\u011fl\u0131 olarak (\u00f6rne\u011fin, Flannel i\u00e7in UDP 8472, Calico i\u00e7in TCP 4789).
\n*   TCP 22:<\/strong> SSH eri\u015fimi (sadece y\u00f6netim i\u00e7in, k\u0131s\u0131tl\u0131 IP’lerden).<\/p>\n
Genel Kurallar:<\/h4>\n
*   D\u00fc\u011f\u00fcmler Aras\u0131 \u0130leti\u015fim:<\/strong> T\u00fcm d\u00fc\u011f\u00fcmlerin birbirleriyle Pod a\u011f\u0131 \u00fczerinden ileti\u015fim kurmas\u0131 gerekir. Bu, CNI eklentinizin gerektirdi\u011fi portlar\u0131 i\u00e7erir.
\n*   Harici Eri\u015fim:<\/strong> Yaln\u0131zca ger\u00e7ekten gerekli olan hizmetler (\u00f6rne\u011fin, Ingress Controller veya Load Balancer taraf\u0131ndan sunulan uygulamalar) d\u0131\u015far\u0131dan eri\u015filebilir olmal\u0131d\u0131r.<\/p>\n
G\u00fcvenlik Duvar\u0131 Kural\u0131 Uygulama \u00d6rnekleri (firewalld)<\/h3>\n
firewalld<\/code> kullanarak kurallar\u0131 tan\u0131mlamak i\u00e7in firewall-cmd<\/code> komutu kullan\u0131l\u0131r. Kal\u0131c\u0131 olmas\u0131 i\u00e7in --permanent<\/code> bayra\u011f\u0131n\u0131 eklemeyi ve ard\u0131ndan firewall-cmd --reload<\/code> komutuyla de\u011fi\u015fiklikleri y\u00fcklemeyi unutmay\u0131n.<\/p>\n
1.  Varsay\u0131lan Olarak T\u00fcm\u00fcn\u00fc Reddet (Deny-All):<\/strong>
\n    En g\u00fcvenli yakla\u015f\u0131m, varsay\u0131lan olarak t\u00fcm gelen ba\u011flant\u0131lar\u0131 reddetmek ve yaln\u0131zca belirli portlar\u0131 veya hizmetleri beyaz listeye almakt\u0131r.<\/p>\n
firewall-cmd --zone=public --set-target=DROP --permanent<\/code><\/pre>\n
2.  SSH Eri\u015fimi A\u00e7ma (Yaln\u0131zca Belirli IP’lerden):<\/strong><\/p>\n
firewall-cmd --zone=public --add-source=192.168.1.0\/24 --add-service=ssh --permanent\n    # Veya belirli bir port i\u00e7in:\n    firewall-cmd --zone=public --add-source=192.168.1.0\/24 --add-port=22\/tcp --permanent<\/code><\/pre>\n
3.  Kubernetes API Sunucusu Portunu A\u00e7ma (Master D\u00fc\u011f\u00fcmde):<\/strong><\/p>\n
firewall-cmd --zone=public --add-port=6443\/tcp --permanent<\/code><\/pre>\n
4.  etcd Portlar\u0131n\u0131 A\u00e7ma (Master D\u00fc\u011f\u00fcmlerinde):<\/strong>
\n    etcd portlar\u0131 genellikle yaln\u0131zca di\u011fer etcd d\u00fc\u011f\u00fcmleri ve Kubernetes API sunucusu taraf\u0131ndan eri\u015filebilir olmal\u0131d\u0131r.<\/p>\n
# etcd istemci portu (API sunucusu i\u00e7in)\n    firewall-cmd --zone=public --add-source= --add-port=2379\/tcp --permanent\n    # etcd peer portu (di\u011fer etcd d\u00fc\u011f\u00fcmleri i\u00e7in)\n    firewall-cmd --zone=public --add-source= --add-port=2380\/tcp --permanent<\/code><\/pre>\n
5.  Kubelet Portunu A\u00e7ma (T\u00fcm D\u00fc\u011f\u00fcmlerde):<\/strong>
\n    API sunucusunun Kubelet’e eri\u015fmesi i\u00e7in.<\/p>\n
firewall-cmd --zone=public --add-source= --add-port=10250\/tcp --permanent<\/code><\/pre>\n
6.  CNI Eklentisi Portlar\u0131n\u0131 A\u00e7ma (T\u00fcm D\u00fc\u011f\u00fcmlerde):<\/strong>
\n    \u00d6rne\u011fin, Flannel i\u00e7in:<\/p>\n
firewall-cmd --zone=public --add-port=8472\/udp --permanent<\/code><\/pre>\n
7.  De\u011fi\u015fiklikleri Y\u00fckleme:<\/strong><\/p>\n
firewall-cmd --reload<\/code><\/pre>\n
En \u0130yi G\u00fcvenlik Duvar\u0131 Uygulamalar\u0131<\/h3>\n
*   Minimum Ayr\u0131cal\u0131k \u0130lkesi:<\/strong> Yaln\u0131zca kesinlikle gerekli olan portlar\u0131 ve protokolleri a\u00e7\u0131n. “Her \u015feyi a\u00e7” yakla\u015f\u0131m\u0131ndan ka\u00e7\u0131n\u0131n.
\n*   IP Beyaz Listeleme (Whitelisting):<\/strong> M\u00fcmk\u00fcn oldu\u011funda, eri\u015fime izin verilen kaynak IP adreslerini veya IP aral\u0131klar\u0131n\u0131 belirtin. Bu, sald\u0131r\u0131 y\u00fczeyini \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131r.
\n*   A\u011f Segmentasyonu:<\/strong> K\u00fcme i\u00e7indeki farkl\u0131 bile\u015fenleri (kontrol d\u00fczlemi, worker d\u00fc\u011f\u00fcmleri, etcd) farkl\u0131 a\u011f segmentlerine ay\u0131r\u0131n ve bu segmentler aras\u0131nda s\u0131k\u0131 g\u00fcvenlik duvar\u0131 kurallar\u0131 uygulay\u0131n.
\n*   Loglama ve \u0130zleme:<\/strong> G\u00fcvenlik duvar\u0131 reddetme olaylar\u0131n\u0131 loglay\u0131n ve bu loglar\u0131 merkezi bir sistemde izleyin. Anormal aktiviteyi tespit etmek i\u00e7in bu loglar \u00e7ok de\u011ferlidir.
\n*   D\u00fczenli \u0130nceleme:<\/strong> G\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131z\u0131 d\u00fczenli olarak g\u00f6zden ge\u00e7irin ve k\u00fcme mimarisi veya uygulama gereksinimleri de\u011fi\u015ftik\u00e7e g\u00fcncelleyin.
\n*   DDoS Korumas\u0131:<\/strong> D\u0131\u015far\u0131dan gelen trafi\u011fi dengeleyen ve DDoS sald\u0131r\u0131lar\u0131n\u0131 hafifleten bir y\u00fck dengeleyici veya CDN kullanmay\u0131 d\u00fc\u015f\u00fcn\u00fcn.<\/p>\n
Di\u011fer G\u00fcvenlik Katmanlar\u0131 ve En \u0130yi Uygulamalar<\/h2>\n
TLS\/SSL ve g\u00fcvenlik duvar\u0131 kurallar\u0131 temel g\u00fcvenlik katmanlar\u0131 olsa da, kapsaml\u0131 bir CoreOS k\u00fcme g\u00fcvenli\u011fi stratejisi daha fazla katman\u0131 i\u00e7ermelidir.<\/p>\n
Kimlik Do\u011frulama ve Yetkilendirme<\/h3>\n
*   RBAC (Role-Based Access Control):<\/strong> Kubernetes’te kullan\u0131c\u0131lar\u0131n ve hizmet hesaplar\u0131n\u0131n k\u00fcme kaynaklar\u0131na eri\u015fimini en ince ayr\u0131nt\u0131s\u0131na kadar kontrol etmek i\u00e7in RBAC kullan\u0131n. Minimum ayr\u0131cal\u0131k ilkesini uygulay\u0131n.
\n*   OIDC\/LDAP Entegrasyonu:<\/strong> Kurumsal kimlik sa\u011flay\u0131c\u0131lar\u0131n\u0131zla Kubernetes’i entegre ederek merkezi kimlik y\u00f6netimi sa\u011flay\u0131n.<\/p>\n
Runtime G\u00fcvenli\u011fi<\/h3>\n
*   Pod Security Standards (PSS):<\/strong> Pod’lar\u0131n g\u00fcvenlik ba\u011flamlar\u0131n\u0131 (security contexts) ve di\u011fer g\u00fcvenlik ayarlar\u0131n\u0131 zorunlu k\u0131lmak i\u00e7in PSS’yi kullan\u0131n.
\n*   Seccomp, AppArmor, SELinux:<\/strong> Konteynerlerin sistem \u00e7a\u011fr\u0131lar\u0131n\u0131 k\u0131s\u0131tlayarak veya dosya sistemi eri\u015fimini kontrol ederek kernel d\u00fczeyinde g\u00fcvenlik sa\u011flay\u0131n.
\n*   G\u00fcvenlik Ba\u011flamlar\u0131:<\/strong> Konteynerlerin root olarak \u00e7al\u0131\u015fmas\u0131n\u0131 engelleyin, okuma-yazma dosya sistemlerini k\u0131s\u0131tlay\u0131n ve ayr\u0131cal\u0131kl\u0131 (privileged) konteyner kullan\u0131m\u0131ndan ka\u00e7\u0131n\u0131n.<\/p>\n
\u0130maj G\u00fcvenli\u011fi<\/h3>\n
*   G\u00fcvenilir Kaynaklar:<\/strong> Konteyner imajlar\u0131n\u0131 yaln\u0131zca g\u00fcvenilir ve do\u011frulanm\u0131\u015f kaynaklardan (\u00f6rn. kendi \u00f6zel kay\u0131t defteriniz) \u00e7ekin.
\n*   \u0130maj Tarama:<\/strong> Konteyner imajlar\u0131n\u0131 bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131 i\u00e7in taray\u0131n ve da\u011f\u0131t\u0131mdan \u00f6nce bu a\u00e7\u0131klar\u0131 giderin.
\n*   Azalt\u0131lm\u0131\u015f Boyutlu \u0130majlar:<\/strong> “Distroless” veya minimal taban imajlar\u0131 kullanarak sald\u0131r\u0131 y\u00fczeyini azalt\u0131n.<\/p>\n
G\u00fcncelleme ve Yama Y\u00f6netimi<\/h3>\n
*   Otomatik CoreOS G\u00fcncellemeleri:<\/strong> CoreOS’un otomatik g\u00fcncelleme mekanizmas\u0131n\u0131 etkinle\u015ftirin ve y\u00f6netin. Bu, i\u015fletim sistemi d\u00fczeyindeki g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n h\u0131zla kapat\u0131lmas\u0131n\u0131 sa\u011flar.
\n*   Kubernetes Versiyon G\u00fcncellemeleri:<\/strong> Kubernetes’i d\u00fczenli olarak en son kararl\u0131 s\u00fcr\u00fcme g\u00fcncelleyin. Yeni s\u00fcr\u00fcmler genellikle g\u00fcvenlik yamalar\u0131 ve iyile\u015ftirmeler i\u00e7erir.<\/p>\n
Loglama ve \u0130zleme<\/h3>\n
*   Merkezi Log Y\u00f6netimi:<\/strong> K\u00fcme loglar\u0131n\u0131 (Kubernetes denetim loglar\u0131, konteyner loglar\u0131, sistem loglar\u0131) merkezi bir log y\u00f6netim sistemine (\u00f6rn. ELK Stack, Grafana Loki) g\u00f6nderin.
\n*   \u0130zleme ve Uyar\u0131:<\/strong> K\u00fcme metriklerini ve g\u00fcvenlik olaylar\u0131n\u0131 izleyin. Anormal davran\u0131\u015flar veya g\u00fcvenlik ihlalleri durumunda otomatik uyar\u0131lar yap\u0131land\u0131r\u0131n.<\/p>\n
Veri \u015eifreleme<\/h3>\n
*   Disk \u015eifrelemesi:<\/strong> D\u00fc\u011f\u00fcmlerdeki hassas verileri depolayan diskleri (\u00f6rn. etcd verileri) LUKS gibi ara\u00e7larla \u015fifreleyin.
\n*   Kubernetes Secret \u015eifrelemesi:<\/strong> Kubernetes Secret’lar\u0131, etcd’de \u015fifrelenmi\u015f olarak saklanmal\u0131d\u0131r. Bu, API sunucusu etcd’ye veri yazarken \u015fifreleme anahtarlar\u0131 kullanarak hassas verilerin okunmas\u0131n\u0131 engeller.<\/p>\n
Sonu\u00e7<\/h2>\n
CoreOS (veya Fedora CoreOS) k\u00fcmelerini g\u00fcvenli hale getirmek, s\u00fcrekli dikkat ve \u00e7ok katmanl\u0131 bir yakla\u015f\u0131m gerektiren karma\u015f\u0131k ancak zorunlu bir s\u00fcre\u00e7tir. TLS\/SSL \u015fifrelemesi, k\u00fcme bile\u015fenleri aras\u0131ndaki ileti\u015fimin gizlili\u011fini, b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve kimlik do\u011frulamas\u0131n\u0131 sa\u011flarken, sa\u011flam g\u00fcvenlik duvar\u0131 kurallar\u0131 yetkisiz a\u011f eri\u015fimine kar\u015f\u0131 ilk savunma hatt\u0131n\u0131 olu\u015fturur. Bu iki mekanizma, k\u00fcmenizin temel g\u00fcvenlik duru\u015funun temel ta\u015flar\u0131d\u0131r.<\/p>\n
Ancak, yaln\u0131zca TLS\/SSL ve g\u00fcvenlik duvar\u0131 kurallar\u0131yla yetinmek yeterli de\u011fildir. Kapsaml\u0131 bir g\u00fcvenlik stratejisi; RBAC ile yetkilendirme, runtime g\u00fcvenli\u011fi, imaj tarama, d\u00fczenli g\u00fcncellemeler, merkezi loglama ve veri \u015fifrelemesi gibi di\u011fer g\u00fcvenlik katmanlar\u0131n\u0131 da i\u00e7ermelidir. Her bir katman, potansiyel bir sald\u0131rgan\u0131n k\u00fcmenize s\u0131zmas\u0131n\u0131 daha da zorla\u015ft\u0131r\u0131r.<\/p>\n
Unutmay\u0131n ki g\u00fcvenlik, tek seferlik bir i\u015flem de\u011fil, s\u00fcrekli bir s\u00fcre\u00e7tir. K\u00fcme mimarisi geli\u015ftik\u00e7e, yeni zafiyetler ortaya \u00e7\u0131kt\u0131k\u00e7a ve tehdit ortam\u0131 de\u011fi\u015ftik\u00e7e g\u00fcvenlik stratejilerinizi d\u00fczenli olarak g\u00f6zden ge\u00e7irmeli, test etmeli ve g\u00fcncellemelisiniz. Bu makalede sunulan y\u00f6nergeleri uygulayarak, CoreOS k\u00fcmenizin g\u00fcvenli\u011fini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131rabilir ve kritik i\u015f y\u00fcklerinizi potansiyel tehditlere kar\u015f\u0131 koruyabilirsiniz. G\u00fcvenli bir k\u00fcme, hem operasyonel verimlilik hem de i\u015f s\u00fcreklili\u011fi i\u00e7in temel bir \u00f6n ko\u015fuldur.
\n<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme\nGiri\u015f\nG\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla de\u011fi\u015fen dijital d\u00fcnyas\u0131nda, konte","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[874],"tags":[],"class_list":{"0":"post-37350","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-server","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nCoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme\" \/>\n<meta property=\"og:description\" content=\"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme Giri\u015f G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla de\u011fi\u015fen dijital d\u00fcnyas\u0131nda, konte\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-31T21:40:45+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme\",\"datePublished\":\"2025-12-31T21:40:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/\"},\"wordCount\":2965,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Server\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/\",\"name\":\"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-12-31T21:40:45+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/","og_locale":"tr_TR","og_type":"article","og_title":"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme","og_description":"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme Giri\u015f G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla de\u011fi\u015fen dijital d\u00fcnyas\u0131nda, konte","og_url":"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-12-31T21:40:45+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"16 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme","datePublished":"2025-12-31T21:40:45+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/"},"wordCount":2965,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Server"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/","url":"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/","name":"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-12-31T21:40:45+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/coreos-kumenizi-tls-ssl-ve-guvenlik-duvari-kurallari-ile-guvenli-hale-getirme\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"CoreOS K\u00fcmenizi TLS\/SSL ve G\u00fcvenlik Duvar\u0131 Kurallar\u0131 ile G\u00fcvenli Hale Getirme"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=37350"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37350\/revisions"}],"predecessor-version":[{"id":37351,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37350\/revisions\/37351"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=37350"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=37350"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=37350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}