{"id":31703,"date":"2025-10-13T02:31:06","date_gmt":"2025-10-12T23:31:06","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/"},"modified":"2025-10-13T02:31:06","modified_gmt":"2025-10-12T23:31:06","slug":"kubernetes-pod-identity-kimlik-yonetiminde-devrim","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/","title":{"rendered":"Kubernetes Pod Identity: Kimlik Y\u00f6netiminde Devrim"},"content":{"rendered":"<p><body><\/p>\n<style>\n    body {\n        font-family: Arial, sans-serif;\n        line-height: 1.6;\n        color: #333;\n        margin: 0 auto;\n        padding: 20px;\n        max-width: 900px;\n    }\n    h2, h3 {\n        color: #2c3e50;\n        margin-top: 30px;\n        margin-bottom: 15px;\n    }\n    h2 {\n        font-size: 2em;\n    }\n    h3 {\n        font-size: 1.5em;\n    }\n    p {\n        margin-bottom: 1em;\n    }\n    pre {\n        background-color: #f4f4f4;\n        padding: 15px;\n        border-radius: 5px;\n        overflow-x: auto;\n        margin-bottom: 1.5em;\n    }\n    code {\n        font-family: \"Courier New\", monospace;\n        font-size: 0.9em;\n        color: #c7254e;\n        background-color: #f9f2f4;\n        padding: 2px 4px;\n        border-radius: 4px;\n    }\n    pre code {\n        color: #333;\n        background-color: transparent;\n        padding: 0;\n        border-radius: 0;\n    }\n    ul, ol {\n        margin-bottom: 1em;\n    }\n    li {\n        margin-bottom: 0.5em;\n    }\n    table {\n        width: 100%;\n        border-collapse: collapse;\n        margin-bottom: 1.5em;\n    }\n    th, td {\n        border: 1px solid #ddd;\n        padding: 8px;\n        text-align: left;\n    }\n    th {\n        background-color: #f2f2f2;\n        font-weight: bold;\n    }\n    blockquote {\n        background-color: #e6f7ff;\n        border-left: 5px solid #3498db;\n        padding: 10px 20px;\n        margin: 20px 0;\n        font-style: italic;\n        color: #2c3e50;\n    }<\/p>\n<p>    \/* Mobil uyumluluk i\u00e7in medya sorgusu *\/\n    @media (max-width: 768px) {\n        body {\n            padding: 10px;\n        }\n        h2 {\n            font-size: 1.8em;\n        }\n        h3 {\n            font-size: 1.3em;\n        }\n        table, thead, tbody, th, td, tr {\n            display: block;\n        }\n        th {\n            display: none; \/* Sadece b\u00fcy\u00fck ekranlarda ba\u015fl\u0131klar\u0131 g\u00f6ster *\/\n        }\n        td {\n            border: none;\n            border-bottom: 1px solid #eee;\n            position: relative;\n            padding-left: 50%; \/* Etiketi i\u00e7in bo\u015fluk *\/\n            text-align: left;\n        }\n        td:before {\n            position: absolute;\n            top: 6px;\n            left: 6px;\n            width: 45%;\n            padding-right: 10px;\n            white-space: nowrap;\n            content: attr(data-label); \/* data-label niteli\u011fini etiket olarak kullan *\/\n            font-weight: bold;\n        }\n    }\n<\/style>\n<p>Kubernetes ortamlar\u0131nda kimlik do\u011frulama ve yetkilendirme s\u00fcre\u00e7leri karma\u015f\u0131k m\u0131d\u0131r? Pod Identity, uygulamalar\u0131n\u0131za g\u00fcvenli ve dinamik eri\u015fim sa\u011flaman\u0131n anahtar\u0131d\u0131r. Bu makale, Pod Identity&#8217;nin temel prensiplerini, kurulumunu ve ileri d\u00fczey kullan\u0131m senaryolar\u0131n\u0131 ke\u015ffedecek ve bulut kaynaklar\u0131n\u0131za g\u00fcvenli bir kap\u0131 aralayacak.<\/p>\n<p>G\u00fcn\u00fcm\u00fcz\u00fcn mikroservis mimarilerinde ve bulut tabanl\u0131 uygulamalar\u0131nda, g\u00fcvenlik her zamankinden daha \u00f6nemli bir rol oynamaktad\u0131r. \u00d6zellikle Kubernetes gibi dinamik ve \u00f6l\u00e7eklenebilir platformlarda \u00e7al\u0131\u015fan uygulamalar\u0131n, veritabanlar\u0131, depolama servisleri, mesajla\u015fma kuyruklar\u0131 veya di\u011fer API&#8217;ler gibi bulut kaynaklar\u0131na g\u00fcvenli bir \u015fekilde eri\u015fmesi elzemdir. Geleneksel yakla\u015f\u0131mlar, yani kimlik bilgilerini do\u011frudan pod&#8217;lar\u0131n i\u00e7ine koymak (\u00f6rne\u011fin ortam de\u011fi\u015fkenleri veya Kubernetes Secrets kullanarak), beraberinde ciddi g\u00fcvenlik riskleri ta\u015f\u0131r. Bu y\u00f6ntemler, hassas verilerin yanl\u0131\u015f ellere ge\u00e7me, kolayca a\u00e7\u0131\u011fa \u00e7\u0131kma ve k\u00f6t\u00fcye kullan\u0131lma potansiyelini art\u0131r\u0131r. Ayr\u0131ca, bu t\u00fcr kimlik bilgilerinin ya\u015fam d\u00f6ng\u00fcs\u00fc y\u00f6netimi, rotasyonu ve g\u00fcncellenmesi olduk\u00e7a zahmetli ve hataya a\u00e7\u0131k bir s\u00fcre\u00e7tir. Her bir hizmet i\u00e7in ayr\u0131 ayr\u0131 kimlik bilgileri olu\u015fturmak, y\u00f6netmek ve bunlar\u0131 her deployment&#8217;ta g\u00fcncellemek, operasyonel y\u00fck\u00fc art\u0131r\u0131rken g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n olu\u015fma ihtimalini de y\u00fckseltir.<\/p>\n<p>Dahas\u0131, &#8220;least privilege&#8221; (en az ayr\u0131cal\u0131k) ilkesi modern g\u00fcvenlik stratejilerinin temel ta\u015flar\u0131ndan biridir. Bu ilke, bir uygulaman\u0131n veya kullan\u0131c\u0131n\u0131n, g\u00f6revini yerine getirmek i\u00e7in ihtiya\u00e7 duydu\u011fu minimum ayr\u0131cal\u0131klara sahip olmas\u0131 gerekti\u011fini belirtir. Geleneksel y\u00f6ntemlerle bu ilkeyi uygulamak zordur; genellikle pod&#8217;lara gere\u011finden fazla yetki verilmek zorunda kal\u0131n\u0131r. Bu durum, bir sald\u0131rgan\u0131n sistemde ba\u015far\u0131l\u0131 olmas\u0131 durumunda etkileyebilece\u011fi alan\u0131 geni\u015fletir. \u00d6rne\u011fin, bir pod&#8217;un S3 bucket&#8217;\u0131na eri\u015fmesi gerekiyorsa, bu pod&#8217;a sadece o bucket&#8217;a okuma\/yazma yetkisi verilmelidir, t\u00fcm S3 kaynaklar\u0131na de\u011fil. Ancak, hardcoded kimlik bilgileriyle bu t\u00fcr detayl\u0131 yetkilendirmeleri y\u00f6netmek son derece karma\u015f\u0131kt\u0131r. \u0130\u015fte tam da bu noktada Pod Identity gibi \u00e7\u00f6z\u00fcmler devreye girerek bu zorluklar\u0131 ortadan kald\u0131rmay\u0131 hedefler. Pod Identity, uygulamalar\u0131n bulut kaynaklar\u0131na eri\u015fimi i\u00e7in dinamik, g\u00fcvenli ve &#8220;least privilege&#8221; odakl\u0131 bir yakla\u015f\u0131m sunarak, Kubernetes&#8217;in g\u00fcvenlik modelini bir \u00fcst seviyeye ta\u015f\u0131r. B\u00f6ylece, geli\u015ftiriciler ve operasyon ekipleri, kimlik y\u00f6netimi karma\u015fas\u0131yla u\u011fra\u015fmak yerine temel i\u015f y\u00fcklerine odaklanabilirler. G\u00fcvenli\u011fin otomatikle\u015fmesi ve basitle\u015fmesi, modern bulut yerel uygulamalar i\u00e7in vazge\u00e7ilmez bir avantajd\u0131r.<\/p>\n<h2>Pod Identity Nedir ve Temel Kavramlar\u0131 Nelerdir?<\/h2>\n<p>Pod Identity, Kubernetes ortam\u0131nda \u00e7al\u0131\u015fan pod&#8217;lar\u0131n bulut sa\u011flay\u0131c\u0131lar\u0131n\u0131n (AWS, Azure, GCP gibi) kimlik ve eri\u015fim y\u00f6netimi (IAM) sistemleriyle do\u011frudan entegre olmas\u0131n\u0131 sa\u011flayan bir mekanizmad\u0131r. Ba\u015fka bir deyi\u015fle, bu teknoloji, her bir pod&#8217;a, t\u0131pk\u0131 sanal makinelerde oldu\u011fu gibi, bulut IAM rollerini veya y\u00f6netilen kimlikleri atayabilme yetene\u011fi kazand\u0131r\u0131r. Bu sayede, uygulamalar\u0131n\u0131z\u0131n bulut kaynaklar\u0131na eri\u015fimi i\u00e7in \u00f6zel anahtarlar, parolalar veya di\u011fer hassas kimlik bilgileri olu\u015fturma, da\u011f\u0131tma ve y\u00f6netme ihtiyac\u0131 ortadan kalkar. Bunun yerine, pod&#8217;lar kendi hizmet hesaplar\u0131 (Service Account) arac\u0131l\u0131\u011f\u0131yla veya do\u011frudan bir kimlik denetleyicisi (Identity Controller) vas\u0131tas\u0131yla bulut IAM sisteminden ge\u00e7ici kimlik bilgileri talep eder.<\/p>\n<p>Pod Identity&#8217;nin temel prensibi, &#8220;kimlikleri pod&#8217;lara atamak&#8221;t\u0131r. Bu s\u00fcre\u00e7 genellikle a\u015fa\u011f\u0131daki anahtar bile\u015fenler arac\u0131l\u0131\u011f\u0131yla i\u015fler:<\/p>\n<ol>\n<li><strong>Kubernetes Service Account:<\/strong> Her pod, Kubernetes i\u00e7inde bir Service Account ile ili\u015fkilidir. Pod Identity \u00e7\u00f6z\u00fcmleri genellikle bu Service Account&#8217;\u0131 bulut IAM rol\u00fc veya y\u00f6netilen kimlikle e\u015fle\u015ftirir.<\/li>\n<li><strong>Identity Controller (Kimlik Denetleyicisi):<\/strong> Bu bile\u015fen, Kubernetes API&#8217;sini izler ve pod&#8217;lar\u0131n bulut kimliklerine y\u00f6nelik taleplerini y\u00f6netir. \u00d6rne\u011fin, bir pod&#8217;un belirli bir bulut IAM rol\u00fcn\u00fc talep etti\u011fini alg\u0131lar ve bu talebi bulut sa\u011flay\u0131c\u0131n\u0131n IAM sistemiyle senkronize eder. Azure AD Pod Identity&#8217;de bu rol\u00fc Managed Identity Controller (MIC) \u00fcstlenir.<\/li>\n<li><strong>Node\/Pod Bile\u015feni (Agent):<\/strong> Her Kubernetes d\u00fc\u011f\u00fcm\u00fcnde (node) veya baz\u0131 durumlarda do\u011frudan pod i\u00e7inde \u00e7al\u0131\u015fan bir bile\u015fen bulunur. Bu bile\u015fenin g\u00f6revi, pod&#8217;dan gelen bulut API \u00e7a\u011fr\u0131lar\u0131n\u0131 yakalamak ve bu \u00e7a\u011fr\u0131lar\u0131 ge\u00e7ici kimlik bilgileriyle (\u00f6rne\u011fin bir JWT token&#8217;\u0131) imzalamakt\u0131r. AWS&#8217;deki IRSA (IAM Roles for Service Accounts) veya Azure&#8217;daki NMI (Node Managed Identity) gibi bile\u015fenler bu i\u015flevi g\u00f6r\u00fcr. NMI, pod&#8217;dan gelen Azure Instance Metadata Service (IMDS) \u00e7a\u011fr\u0131lar\u0131n\u0131 keserek, ilgili kimli\u011fe ait token&#8217;\u0131 d\u00f6nd\u00fcr\u00fcr.<\/li>\n<\/ol>\n<p><strong>Peki, s\u00fcre\u00e7 nas\u0131l i\u015fler?<\/strong> Bir pod, bulut kayna\u011f\u0131na eri\u015fmek i\u00e7in bir API \u00e7a\u011fr\u0131s\u0131 yapt\u0131\u011f\u0131nda (\u00f6rne\u011fin, Azure Key Vault&#8217;tan s\u0131r \u00e7ekmek istedi\u011finde), bu \u00e7a\u011fr\u0131 do\u011frudan bulut sa\u011flay\u0131c\u0131n\u0131n API&#8217;sine gitmez. Bunun yerine, \u00e7a\u011fr\u0131 ilk olarak Kubernetes d\u00fc\u011f\u00fcm\u00fcndeki veya pod i\u00e7indeki Pod Identity bile\u015feni taraf\u0131ndan yakalan\u0131r. Bu bile\u015fen, pod&#8217;un ili\u015fkili oldu\u011fu bulut kimli\u011fini (rol\u00fcn\u00fc) belirler ve bu kimlik ad\u0131na bulut sa\u011flay\u0131c\u0131dan ge\u00e7ici bir g\u00fcvenlik token&#8217;\u0131 (\u00f6rne\u011fin, bir OAuth2 veya JWT token&#8217;\u0131) ister. Bulut sa\u011flay\u0131c\u0131, pod&#8217;un yetkili oldu\u011funu do\u011frulad\u0131ktan sonra token&#8217;\u0131 geri verir. Pod Identity bile\u015feni bu token&#8217;\u0131 orijinal API \u00e7a\u011fr\u0131s\u0131na ekler ve \u00e7a\u011fr\u0131y\u0131 bulut API&#8217;sine y\u00f6nlendirir. B\u00f6ylece, pod do\u011frudan kimlik bilgisi tutmak zorunda kalmadan, bulut sa\u011flay\u0131c\u0131s\u0131 taraf\u0131ndan do\u011frulanm\u0131\u015f ve yetkilendirilmi\u015f bir \u015fekilde kaynaklara eri\u015febilir.<\/p>\n<p>Bu yakla\u015f\u0131m, birden \u00e7ok avantaj sunar: Her \u015feyden \u00f6nce, g\u00fcvenlik a\u00e7\u0131s\u0131ndan \u00f6nemli bir iyile\u015fme sa\u011flar \u00e7\u00fcnk\u00fc hassas kimlik bilgileri hi\u00e7bir zaman kal\u0131c\u0131 olarak pod i\u00e7inde depolanmaz. Kimlik bilgileri ge\u00e7ici olup, d\u00fczenli olarak yenilenir. \u0130kinci olarak, &#8220;least privilege&#8221; ilkesini uygulamay\u0131 kolayla\u015ft\u0131r\u0131r; her pod&#8217;a, sadece ihtiya\u00e7 duydu\u011fu kaynaklara ve i\u015flemlere eri\u015fim yetkisi veren spesifik bir rol atanabilir. \u00dc\u00e7\u00fcnc\u00fc olarak, operasyonel y\u00fck\u00fc azalt\u0131r; kimlik bilgisi rotasyonu veya g\u00fcncellemesi gibi i\u015flemler Pod Identity mekanizmas\u0131 taraf\u0131ndan otomatik olarak y\u00f6netilir. Son olarak, denetlenebilirli\u011fi art\u0131r\u0131r; bulut sa\u011flay\u0131c\u0131n\u0131n denetim g\u00fcnl\u00fcklerinde (audit logs), kaynaklara hangi Kubernetes pod&#8217;u veya ili\u015fkili kimli\u011fin eri\u015fti\u011fi a\u00e7\u0131k\u00e7a g\u00f6r\u00fclebilir. Bu temel kavramlar, Pod Identity&#8217;nin Kubernetes i\u00e7in neden bir kimlik y\u00f6netimi devrimi oldu\u011funu a\u00e7\u0131k\u00e7a ortaya koymaktad\u0131r.<\/p>\n<p>\u0130\u015fte Azure AD Pod Identity&#8217;nin temel bile\u015fenleri ve g\u00f6revleri:<\/p>\n<table border=\"1\">\n<thead>\n<tr>\n<th data-label=\"Bile\u015fen\">Bile\u015fen<\/th>\n<th data-label=\"G\u00f6revi\">G\u00f6revi<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td data-label=\"Bile\u015fen\"><strong>Managed Identity Controller (MIC)<\/strong><\/td>\n<td data-label=\"G\u00f6revi\">Kubernetes API&#8217;sindeki <code>AzureIdentity<\/code> ve <code>AzureIdentityBinding<\/code> kaynaklar\u0131n\u0131 izler. Bu kaynaklar ile Azure AD&#8217;deki y\u00f6netilen kimlikler aras\u0131nda e\u015fle\u015fmeler olu\u015fturur. Pod&#8217;lar\u0131n etiketlerine g\u00f6re hangi kimliklerin atanaca\u011f\u0131n\u0131 belirler.<\/td>\n<\/tr>\n<tr>\n<td data-label=\"Bile\u015fen\"><strong>Node Managed Identity (NMI)<\/strong><\/td>\n<td data-label=\"G\u00f6revi\">Her Kubernetes d\u00fc\u011f\u00fcm\u00fcnde DaemonSet olarak \u00e7al\u0131\u015f\u0131r. Pod&#8217;lardan gelen Azure Instance Metadata Service (IMDS) \u00e7a\u011fr\u0131lar\u0131n\u0131 keser. Pod&#8217;un ili\u015fkili oldu\u011fu Azure AD y\u00f6netilen kimli\u011fini belirler ve bu kimlik ad\u0131na Azure AD&#8217;den OAuth2 token&#8217;\u0131 talep eder, ard\u0131ndan bu token&#8217;\u0131 pod&#8217;a d\u00f6nd\u00fcr\u00fcr.<\/td>\n<\/tr>\n<tr>\n<td data-label=\"Bile\u015fen\"><strong>AzureIdentity<\/strong><\/td>\n<td data-label=\"G\u00f6revi\">Kubernetes Custom Resource (CRD). Azure AD&#8217;deki bir kullan\u0131c\u0131 tan\u0131ml\u0131 y\u00f6netilen kimli\u011fi (User-Assigned Managed Identity) veya sistem taraf\u0131ndan atanan kimli\u011fi (System-Assigned Managed Identity) temsil eder.<\/td>\n<\/tr>\n<tr>\n<td data-label=\"Bile\u015fen\"><strong>AzureIdentityBinding<\/strong><\/td>\n<td data-label=\"G\u00f6revi\">Kubernetes Custom Resource (CRD). Bir <code>AzureIdentity<\/code> kayna\u011f\u0131n\u0131 belirli pod&#8217;larla e\u015fle\u015ftirir. Bu e\u015fle\u015ftirme, pod&#8217;lar\u0131n etiketleri arac\u0131l\u0131\u011f\u0131yla yap\u0131l\u0131r.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Kubernetes Ortam\u0131nda Pod Identity Nas\u0131l Kurulur ve Yap\u0131land\u0131r\u0131l\u0131r?<\/h2>\n<p>Pod Identity kurulumu ve yap\u0131land\u0131rmas\u0131, se\u00e7ilen bulut sa\u011flay\u0131c\u0131s\u0131na ve kullan\u0131lan Kubernetes da\u011f\u0131t\u0131m\u0131na g\u00f6re de\u011fi\u015fiklik g\u00f6sterebilir. Bu b\u00f6l\u00fcmde, Azure Kubernetes Service (AKS) \u00fczerinde Azure AD Pod Identity&#8217;nin nas\u0131l kurulup yap\u0131land\u0131r\u0131laca\u011f\u0131na dair ad\u0131m ad\u0131m bir \u00f6rnek inceleyece\u011fiz. Bu senaryo, Azure Key Vault&#8217;tan s\u0131rlar\u0131 okumak isteyen bir uygulaman\u0131n, bu s\u0131rlar\u0131 Azure AD Y\u00f6netilen Kimlikleri (Managed Identities) arac\u0131l\u0131\u011f\u0131yla nas\u0131l g\u00fcvenli bir \u015fekilde alabilece\u011fini g\u00f6sterir. Kurulum s\u00fcreci karma\u015f\u0131k g\u00f6r\u00fcnebilir ancak her ad\u0131m mant\u0131ksal bir s\u0131ra izler.<\/p>\n<h3>1. Azure AD Pod Identity Bile\u015fenlerini Kurma<\/h3>\n<p>\u0130lk olarak, AKS k\u00fcmenize Azure AD Pod Identity bile\u015fenlerini (MIC ve NMI) da\u011f\u0131tman\u0131z gerekir. Bu bile\u015fenler genellikle Helm ile veya do\u011frudan YAML dosyalar\u0131yla da\u011f\u0131t\u0131l\u0131r. A\u015fa\u011f\u0131daki komutlar, Helm kullanarak kurulumu g\u00f6stermektedir. Bu, hem MIC hem de NMI&#8217;yi k\u00fcmenize kuracakt\u0131r.<\/p>\n<pre><code>\nhelm repo add aad-pod-identity https:\/\/raw.githubusercontent.com\/Azure\/aad-pod-identity\/master\/charts\nhelm repo update\nhelm install aad-pod-identity aad-pod-identity\/aad-pod-identity --namespace kube-system\n<\/pre>\n<p><\/code><\/p>\n<p>Bu komutlar \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131ktan sonra, <code>kube-system<\/code> namespace'inde MIC deployment'\u0131n\u0131n ve her d\u00fc\u011f\u00fcmde NMI daemonset'inin \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 g\u00f6receksiniz. Bu bile\u015fenler, pod'lar\u0131n kimlik taleplerini y\u00f6netmek i\u00e7in gereklidir.<\/p>\n<h3>2. Azure Y\u00f6netilen Kimlik Olu\u015fturma ve \u0130zinleri Atama<\/h3>\n<p>Uygulaman\u0131z\u0131n eri\u015fmesini istedi\u011fi bulut kaynaklar\u0131na (\u00f6rne\u011fin Azure Key Vault) eri\u015fmek i\u00e7in bir Azure Y\u00f6netilen Kimli\u011fi olu\u015fturmal\u0131s\u0131n\u0131z. Bu kimlik, uygulaman\u0131z\u0131n Key Vault'tan s\u0131rlar\u0131 okumas\u0131na izin verecek yetkilere sahip olmal\u0131d\u0131r. A\u015fa\u011f\u0131daki Azure CLI komutlar\u0131, bir kullan\u0131c\u0131 taraf\u0131ndan atanan y\u00f6netilen kimlik olu\u015fturur ve ona Key Vault'a \"Secret Get\" yetkisi verir.<\/p>\n<pre><code>\n# Kaynak grubu ve Key Vault adlar\u0131n\u0131 kendi de\u011ferlerinizle de\u011fi\u015ftirin\nRESOURCE_GROUP=\"myResourceGroup\"\nKEYVAULT_NAME=\"mySecureKeyVault\"\nIDENTITY_NAME=\"myPodManagedIdentity\"\n\n# Y\u00f6netilen kimlik olu\u015fturma\naz identity create --resource-group $RESOURCE_GROUP --name $IDENTITY_NAME\n\n# Olu\u015fturulan kimli\u011fin istemci kimli\u011fini (client ID) al\nCLIENT_ID=$(az identity show --resource-group $RESOURCE_GROUP --name $IDENTITY_NAME --query \"clientId\" -otsv)\n\n# Key Vault'a \"Secret Get\" yetkisi atama\naz keyvault set-policy --name $KEYVAULT_NAME --secret-permissions get --spn $CLIENT_ID\n<\/pre>\n<p><\/code><\/p>\n<p>Bu ad\u0131mlar tamamland\u0131\u011f\u0131nda, Kubernetes pod'lar\u0131n\u0131z\u0131n kullanabilece\u011fi bir Azure Y\u00f6netilen Kimli\u011fi'ne ve bu kimli\u011fin Key Vault'a eri\u015fim yetkisine sahip olacaks\u0131n\u0131z.<\/p>\n<h3>3. Kubernetes Kaynaklar\u0131n\u0131 Tan\u0131mlama: AzureIdentity ve AzureIdentityBinding<\/h3>\n<p>\u015eimdi, Azure'da olu\u015fturdu\u011funuz y\u00f6netilen kimli\u011fi Kubernetes k\u00fcmenizde tan\u0131man\u0131z ve bu kimli\u011fi hangi pod'lar\u0131n kullanabilece\u011fini belirtmeniz gerekiyor. Bunun i\u00e7in iki Custom Resource (CRD) kullan\u0131l\u0131r: <code>AzureIdentity<\/code> ve <code>AzureIdentityBinding<\/code>.<\/p>\n<h4>AzureIdentity Tan\u0131m\u0131<\/h4>\n<p><code>AzureIdentity<\/code> kayna\u011f\u0131, Azure'daki y\u00f6netilen kimli\u011fi Kubernetes'e tan\u0131t\u0131r. A\u015fa\u011f\u0131daki YAML \u00f6rne\u011fi, daha \u00f6nce olu\u015fturdu\u011fumuz y\u00f6netilen kimli\u011fi referans al\u0131r. L\u00fctfen <code>resourceID<\/code> ve <code>clientID<\/code> de\u011ferlerini kendi ortam\u0131n\u0131za g\u00f6re g\u00fcncelleyin. Bu de\u011ferleri yukar\u0131daki <code>az identity show<\/code> komutuyla elde edebilirsiniz.<\/p>\n<pre><code>\napiVersion: aadpodidentity.k8s.io\/v1\nkind: AzureIdentity\nmetadata:\n  name: {{IDENTITY_NAME}}\nspec:\n  type: 0 # 0 for User-Assigned Managed Identity, 1 for System-Assigned\n  resourceID: \"\/subscriptions\/<SUBSCRIPTION_ID>\/resourcegroups\/{{RESOURCE_GROUP}}\/providers\/Microsoft.ManagedIdentity\/userAssignedIdentities\/{{IDENTITY_NAME}}\"\n  clientID: \"{{CLIENT_ID}}\"\n<\/pre>\n<p><\/code><\/p>\n<p>Bu YAML'\u0131 uygulayarak Azure kimli\u011finizi Kubernetes'e tan\u0131tm\u0131\u015f olursunuz:<\/p>\n<pre><code>\nkubectl apply -f your-azureidentity.yaml\n<\/pre>\n<p><\/code><\/p>\n<h4>AzureIdentityBinding Tan\u0131m\u0131<\/h4>\n<p><code>AzureIdentityBinding<\/code>, belirli bir <code>AzureIdentity<\/code> kayna\u011f\u0131n\u0131, belirli pod etiketlerine sahip pod'larla ili\u015fkilendirir. Bu sayede, uygulaman\u0131z\u0131n pod'lar\u0131n\u0131 etiketleyerek hangi kimli\u011fi kullanacaklar\u0131n\u0131 kolayca belirleyebilirsiniz. A\u015fa\u011f\u0131daki \u00f6rnek, <code>aadpodidentitybinding: {{IDENTITY_NAME}}<\/code> etiketine sahip t\u00fcm pod'lar\u0131n yukar\u0131da tan\u0131mlanan <code>AzureIdentity<\/code>'\u0131 kullanaca\u011f\u0131n\u0131 belirtir.<\/p>\n<pre><code>\napiVersion: aadpodidentity.k8s.io\/v1\nkind: AzureIdentityBinding\nmetadata:\n  name: {{IDENTITY_NAME}}-binding\nspec:\n  azureIdentity: {{IDENTITY_NAME}}\n  selector: {{IDENTITY_NAME}}\n<\/pre>\n<p><\/code><\/p>\n<p>Bu YAML'\u0131 da uygulay\u0131n:<\/p>\n<pre><code>\nkubectl apply -f your-azureidentitybinding.yaml\n<\/pre>\n<p><\/code><\/p>\n<h3>4. Uygulama Pod'unu Yap\u0131land\u0131rma<\/h3>\n<p>Son ad\u0131m, Azure Key Vault'tan s\u0131rlar\u0131 okuyacak olan uygulaman\u0131z\u0131n pod'unu yap\u0131land\u0131rmakt\u0131r. Pod tan\u0131m\u0131n\u0131za, <code>AzureIdentityBinding<\/code>'de belirtilen <code>selector<\/code> de\u011feriyle e\u015fle\u015fen bir etiket (label) eklemeniz yeterlidir. NMI, bu etikete sahip pod'lardan gelen IMDS (Instance Metadata Service) \u00e7a\u011fr\u0131lar\u0131n\u0131 yakalayacak ve do\u011fru kimlik token'\u0131n\u0131 d\u00f6nd\u00fcrecektir.<\/p>\n<pre><code>\napiVersion: apps\/v1\nkind: Deployment\nmetadata:\n  name: keyvault-reader-app\nspec:\n  selector:\n    matchLabels:\n      app: keyvault-reader\n  template:\n    metadata:\n      labels:\n        app: keyvault-reader\n        aadpodidentitybinding: {{IDENTITY_NAME}} # \u00d6nemli: Bu etiket AzureIdentityBinding'deki selector ile e\u015fle\u015fmeli\n    spec:\n      containers:\n      - name: app-container\n        image: your-app-image:latest # Kendi uygulaman\u0131z\u0131n imaj\u0131\n        env:\n          - name: KEYVAULT_NAME\n            value: \"{{KEYVAULT_NAME}}\"\n        # Uygulama kodunuz Azure SDK kullanarak Key Vault'tan s\u0131rlar\u0131 okuyacakt\u0131r\n        # \u00d6rnek Python kodu:\n        # from azure.keyvault.secrets import SecretClient\n        # from azure.identity import DefaultAzureCredential\n        # credential = DefaultAzureCredential()\n        # client = SecretClient(vault_url=f\"https:\/\/{KEYVAULT_NAME}.vault.azure.net\/\", credential=credential)\n        # secret = client.get_secret(\"mySecret\")\n        # print(secret.value)\n<\/pre>\n<p><\/code><\/p>\n<p>Uygulaman\u0131z\u0131n kodunda, Azure SDK'lar\u0131n\u0131n Y\u00f6netilen Kimlikleri otomatik olarak kullanmas\u0131n\u0131 sa\u011flayacak <code>DefaultAzureCredential<\/code> gibi kimlik sa\u011flay\u0131c\u0131lar\u0131n\u0131 kullanman\u0131z yeterlidir. Bu, uygulaman\u0131z\u0131n do\u011frudan IMDS endpoint'i ile konu\u015fmas\u0131na gerek kalmadan, Pod Identity taraf\u0131ndan sa\u011flanan token'lar\u0131 otomatik olarak kullanmas\u0131n\u0131 sa\u011flar.<\/p>\n<pre><code>\nkubectl apply -f your-app-deployment.yaml\n<\/pre>\n<p><\/code><\/p>\n<p>Bu ad\u0131mlar tamamland\u0131\u011f\u0131nda, <code>keyvault-reader-app<\/code> pod'lar\u0131, do\u011frudan hi\u00e7bir kimlik bilgisi ta\u015f\u0131madan Azure Key Vault'tan s\u0131rlar\u0131 g\u00fcvenli bir \u015fekilde okuyabilecektir. Bu kurulum, geleneksel y\u00f6ntemlere k\u0131yasla \u00f6nemli \u00f6l\u00e7\u00fcde daha g\u00fcvenli ve y\u00f6netimi daha kolay bir yakla\u015f\u0131md\u0131r. Pod Identity, hassas bilgileri Kubernetes Secrets'ta tutma veya ortam de\u011fi\u015fkeni olarak ekleme ihtiyac\u0131n\u0131 ortadan kald\u0131rarak g\u00fcvenlik duru\u015funuzu g\u00fc\u00e7lendirir.<\/p>\n<blockquote><p>\n  Uzman \u0130pucu: Azure AD Pod Identity'nin do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulamak i\u00e7in, NMI pod'lar\u0131n\u0131n ve MIC pod'lar\u0131n\u0131n loglar\u0131n\u0131 kontrol edin. Ayr\u0131ca, uygulaman\u0131z\u0131n pod'undan Key Vault'a eri\u015fmeye \u00e7al\u0131\u015ft\u0131\u011f\u0131nda olu\u015fan hatalar\u0131 izlemek, olas\u0131 yetkilendirme sorunlar\u0131n\u0131 tespit etmede kritik \u00f6neme sahiptir.\n<\/p><\/blockquote>\n<h2>Ger\u00e7ek D\u00fcnya Senaryolar\u0131: Pod Identity ile G\u00fcvenli\u011fi Art\u0131rma<\/h2>\n<p>Pod Identity, Kubernetes'te uygulama kimlik y\u00f6netimi paradigmalar\u0131n\u0131 d\u00f6n\u00fc\u015ft\u00fcrerek, bir\u00e7ok ger\u00e7ek d\u00fcnya senaryosunda g\u00fcvenlik ve operasyonel verimlilik sa\u011flar. Gelin, Pod Identity'nin nas\u0131l somut faydalar sundu\u011funu g\u00f6steren birka\u00e7 vaka analizini inceleyelim. Bu senaryolar, Pod Identity'nin sadece bir teorik konsept olmad\u0131\u011f\u0131n\u0131, aksine modern bulut yerel uygulamalar\u0131 i\u00e7in vazge\u00e7ilmez bir ara\u00e7 oldu\u011funu ortaya koyacakt\u0131r.<\/p>\n<h3>Vaka Analizi 1: Mikroservisler Aras\u0131 G\u00fcvenli Veritaban\u0131 Eri\u015fimi<\/h3>\n<p>Bir e-ticaret uygulamas\u0131n\u0131n mikroservis mimarisine sahip oldu\u011funu d\u00fc\u015f\u00fcn\u00fcn. Sipari\u015f y\u00f6netimi servisi, \u00fcr\u00fcn katalog servisi ve m\u00fc\u015fteri hesab\u0131 servisi gibi birden fazla mikroservis, veritaban\u0131na (\u00f6rne\u011fin Azure SQL Database veya AWS RDS) eri\u015fmek zorundad\u0131r. Geleneksel olarak, her servisin kendi veritaban\u0131 kullan\u0131c\u0131 ad\u0131 ve \u015fifresini Kubernetes Secrets i\u00e7inde saklamas\u0131 gerekirdi. Bu yakla\u015f\u0131m, her \u015fifrenin rotasyonunu, g\u00fcncellenmesini ve g\u00fcvenli bir \u015fekilde da\u011f\u0131t\u0131lmas\u0131n\u0131 gerektiren b\u00fcy\u00fck bir y\u00f6netim y\u00fck\u00fc olu\u015fturur. Ayr\u0131ca, bir secret'\u0131n s\u0131zmas\u0131 durumunda t\u00fcm veritaban\u0131 eri\u015fiminin tehlikeye girme riski vard\u0131r.<\/p>\n<p><strong>Pod Identity ile \u00c7\u00f6z\u00fcm:<\/strong> Pod Identity sayesinde, her bir mikroservise, g\u00f6revine \u00f6zel en az ayr\u0131cal\u0131kl\u0131 bir bulut IAM rol\u00fc atanabilir. \u00d6rne\u011fin, Sipari\u015f Y\u00f6netimi servisi pod'lar\u0131na sadece sipari\u015f tablosuna yazma ve okuma yetkisi olan bir IAM rol\u00fc, \u00dcr\u00fcn Katalog servisine ise sadece \u00fcr\u00fcn tablosuna okuma yetkisi olan farkl\u0131 bir rol atan\u0131r. Her pod, \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131 anda bu role atanm\u0131\u015f ge\u00e7ici kimlik bilgilerini otomatik olarak al\u0131r ve veritaban\u0131na ba\u011flan\u0131rken kullan\u0131r. Bu sayede:<\/p>\n<ul>\n<li>Hi\u00e7bir hassas kimlik bilgisi pod i\u00e7inde kal\u0131c\u0131 olarak depolanmaz.<\/li>\n<li>\"Least privilege\" ilkesi tam olarak uygulan\u0131r, bir servisin ele ge\u00e7irilmesi durumunda di\u011fer servisler ve veriler daha g\u00fcvende olur.<\/li>\n<li>Kimlik bilgisi rotasyonu otomatik olarak bulut sa\u011flay\u0131c\u0131s\u0131 taraf\u0131ndan y\u00f6netilir, operasyonel y\u00fck azal\u0131r.<\/li>\n<\/ul>\n<p>Bu, e-ticaret platformunun genel g\u00fcvenlik duru\u015funu \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirirken, geli\u015ftiricilerin g\u00fcvenlik endi\u015feleri yerine i\u015f mant\u0131\u011f\u0131na odaklanmas\u0131na olanak tan\u0131r.<\/p>\n<h3>Vaka Analizi 2: CI\/CD S\u00fcre\u00e7lerinde G\u00fcvenli Bulut Kaynak Eri\u015fimi<\/h3>\n<p>Modern DevOps s\u00fcre\u00e7lerinde, s\u00fcrekli entegrasyon ve s\u00fcrekli da\u011f\u0131t\u0131m (CI\/CD) boru hatlar\u0131, da\u011f\u0131t\u0131m, test ve di\u011fer operasyonlar i\u00e7in bulut kaynaklar\u0131na eri\u015fmek zorundad\u0131r. \u00d6rne\u011fin, bir CI\/CD arac\u0131 (Jenkins, GitLab CI, Argo CD) yeni bir uygulama imaj\u0131n\u0131 bir container registry'ye (Azure Container Registry, AWS ECR) itmeli, da\u011f\u0131t\u0131m i\u00e7in Kubernetes kaynaklar\u0131n\u0131 y\u00f6netmeli veya veritaban\u0131 migrasyonlar\u0131 \u00e7al\u0131\u015ft\u0131rmal\u0131d\u0131r. Bu t\u00fcr operasyonlar i\u00e7in genellikle y\u00fcksek ayr\u0131cal\u0131kl\u0131 kimlik bilgilerine ihtiya\u00e7 duyulur ve bu kimlik bilgilerini CI\/CD ortamlar\u0131nda g\u00fcvenli bir \u015fekilde saklamak her zaman bir meydan okuma olmu\u015ftur.<\/p>\n<p><strong>Pod Identity ile \u00c7\u00f6z\u00fcm:<\/strong> CI\/CD arac\u0131, Kubernetes k\u00fcmesi i\u00e7inde bir pod olarak \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131nda, Pod Identity devreye girer. \u00d6rne\u011fin, Argo CD pod'una, da\u011f\u0131t\u0131m yapaca\u011f\u0131 Kubernetes namespace'lerinde kaynaklar\u0131 y\u00f6netme yetkisi veren bir Service Account e\u015fle\u015ftirilmi\u015f bir bulut IAM rol\u00fc atan\u0131r. Ayr\u0131ca, yeni imajlar\u0131 container registry'ye itmek i\u00e7in gerekli yetkilere sahip ba\u015fka bir rol de atanabilir. Bu yakla\u015f\u0131m, CI\/CD boru hatt\u0131n\u0131n kimlik bilgilerini do\u011frudan ara\u00e7 i\u00e7inde saklamak yerine, Kubernetes'in sa\u011flad\u0131\u011f\u0131 g\u00fcvenli kimlik do\u011frulama mekanizmas\u0131n\u0131 kullanmas\u0131n\u0131 sa\u011flar. B\u00f6ylece:<\/p>\n<ul>\n<li>CI\/CD ortam\u0131ndaki potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131 azalt\u0131l\u0131r.<\/li>\n<li>Farkl\u0131 CI\/CD i\u015f ak\u0131\u015flar\u0131 veya a\u015famalar\u0131 i\u00e7in ayr\u0131 ayr\u0131 yetkilendirmeler tan\u0131mlanabilir.<\/li>\n<li>Kimlik bilgisi s\u0131z\u0131nt\u0131s\u0131 riski ortadan kalkar \u00e7\u00fcnk\u00fc kimlik bilgileri sadece ihtiya\u00e7 duyuldu\u011fu anlarda ve ge\u00e7ici olarak kullan\u0131l\u0131r.<\/li>\n<\/ul>\n<p>Bu, DevOps ekiplerinin daha g\u00fcvenli ve daha esnek CI\/CD boru hatlar\u0131 olu\u015fturmas\u0131na olanak tan\u0131r.<\/p>\n<h3>Vaka Analizi 3: Sunucusuz \u0130\u015f Y\u00fckleri i\u00e7in Dinamik S\u0131r Y\u00f6netimi<\/h3>\n<p>Baz\u0131 uygulamalar, belirli bir olay \u00fczerine tetiklenen veya k\u0131sa \u00f6m\u00fcrl\u00fc g\u00f6revler ger\u00e7ekle\u015ftiren sunucusuz i\u015f y\u00fckleri (\u00f6rne\u011fin, Kubernetes CronJob'lar veya KEDA ile \u00f6l\u00e7eklenen uygulamalar) i\u00e7erebilir. Bu i\u015f y\u00fckleri de genellikle d\u0131\u015f sistemlerden s\u0131rlar\u0131 veya yap\u0131land\u0131rma verilerini \u00e7ekmek zorundad\u0131r (\u00f6rne\u011fin, bir API anahtar\u0131, \u00fc\u00e7\u00fcnc\u00fc taraf hizmet kimlik bilgileri). Her bir k\u0131sa \u00f6m\u00fcrl\u00fc pod i\u00e7in manuel olarak s\u0131r y\u00f6netimi yapmak pratik de\u011fildir ve g\u00fcvenlik riskleri ta\u015f\u0131r.<\/p>\n<p><strong>Pod Identity ile \u00c7\u00f6z\u00fcm:<\/strong> Pod Identity, sunucusuz i\u015f y\u00fckleri i\u00e7in m\u00fckemmel bir \u00e7\u00f6z\u00fcmd\u00fcr. \u00d6rne\u011fin, bir CronJob pod'u \u00e7al\u0131\u015ft\u0131\u011f\u0131nda, ona belirli bir bulut s\u0131r y\u00f6netimi hizmetinden (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) s\u0131rlar\u0131 okuma yetkisi veren bir rol atan\u0131r. Pod \u00e7al\u0131\u015f\u0131r, s\u0131rr\u0131 al\u0131r, g\u00f6revini tamamlar ve sonlan\u0131r. T\u00fcm bu s\u00fcre\u00e7 boyunca, s\u0131rr\u0131 do\u011frudan ortam de\u011fi\u015fkenleri arac\u0131l\u0131\u011f\u0131yla vermek yerine Pod Identity kullan\u0131larak g\u00fcvenli bir \u015fekilde eri\u015filir. Bu durum \u015funlar\u0131 sa\u011flar:<\/p>\n<ul>\n<li>K\u0131sa \u00f6m\u00fcrl\u00fc pod'lar i\u00e7in otomatik ve g\u00fcvenli kimlik do\u011frulama.<\/li>\n<li>S\u0131rlar\u0131n ya\u015fam d\u00f6ng\u00fcs\u00fc y\u00f6netiminin basitle\u015ftirilmesi.<\/li>\n<li>K\u00f6t\u00fc niyetli kullan\u0131c\u0131lar\u0131n veya uygulamalar\u0131n hassas s\u0131rlara eri\u015fimini engelleme.<\/li>\n<\/ul>\n<p>Bu senaryolar, Pod Identity'nin modern Kubernetes ortamlar\u0131nda ne kadar kritik bir rol oynad\u0131\u011f\u0131n\u0131 ve \u00e7e\u015fitli uygulama ihtiya\u00e7lar\u0131na nas\u0131l g\u00fcvenli ve verimli \u00e7\u00f6z\u00fcmler sunabildi\u011fini a\u00e7\u0131k\u00e7a g\u00f6stermektedir. G\u00fcvenlik ve operasyonel kolayl\u0131k a\u00e7\u0131s\u0131ndan Pod Identity, ger\u00e7ekten de Kubernetes i\u00e7in ihtiya\u00e7 duyulan bir kimlik y\u00f6netimi devrimidir.<\/p>\n<h2>Pod Identity'nin \u0130leri D\u00fczey Kullan\u0131m \u0130pu\u00e7lar\u0131 ve En \u0130yi Uygulamalar\u0131<\/h2>\n<p>Pod Identity'yi sadece kurmakla kalmay\u0131p, onu en etkili ve g\u00fcvenli \u015fekilde kullanmak i\u00e7in baz\u0131 ileri d\u00fczey ipu\u00e7lar\u0131 ve en iyi uygulamalar\u0131 bilmek olduk\u00e7a \u00f6nemlidir. Bu b\u00f6l\u00fcmde, deneyimli kullan\u0131c\u0131lar\u0131n Pod Identity'den maksimum verimi almas\u0131na yard\u0131mc\u0131 olacak stratejileri ve kar\u015f\u0131la\u015fabilecekleri olas\u0131 durumlar i\u00e7in \u00e7\u00f6z\u00fcm \u00f6nerilerini ele alaca\u011f\u0131z. Performans optimizasyonundan g\u00fcvenlik katmanlar\u0131n\u0131n g\u00fc\u00e7lendirilmesine kadar geni\u015f bir yelpazede konulara de\u011finece\u011fiz.<\/p>\n<h3>\u0130zleme ve Sorun Giderme<\/h3>\n<p>Pod Identity \u00e7\u00f6z\u00fcmlerinin sa\u011fl\u0131kl\u0131 \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flamak i\u00e7in, bile\u015fenlerinin (MIC, NMI veya di\u011fer ilgili agent'lar) d\u00fczenli olarak izlenmesi hayati \u00f6neme sahiptir. Loglar\u0131 toplamak ve analiz etmek, olas\u0131 sorunlar\u0131 proaktif olarak tespit etmenize yard\u0131mc\u0131 olur. \u00d6rne\u011fin, NMI pod'lar\u0131n\u0131n loglar\u0131nda kimlik taleplerine ili\u015fkin hatalar\u0131 veya gecikmeleri arayabilirsiniz. Prometheus ve Grafana gibi ara\u00e7lar kullanarak NMI ve MIC metriklerini izlemek, performans darbo\u011fazlar\u0131n\u0131 veya kimlik do\u011frulama sorunlar\u0131n\u0131 g\u00f6rselle\u015ftirmek i\u00e7in etkili bir y\u00f6ntemdir.<\/p>\n<pre><code>\n# MIC (Managed Identity Controller) loglar\u0131n\u0131 g\u00f6r\u00fcnt\u00fcleme\nkubectl logs -f -l app=mic -n kube-system\n\n# NMI (Node Managed Identity) loglar\u0131n\u0131 g\u00f6r\u00fcnt\u00fcleme\nkubectl logs -f -l app=nmi -n kube-system\n<\/pre>\n<p><\/code><\/p>\n<p>E\u011fer bir pod kimlik bilgisi alam\u0131yorsa, a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 kontrol edin:<\/p>\n<ol>\n<li>Pod'unuzun etiketinin (\u00f6rne\u011fin <code>aadpodidentitybinding: my-identity<\/code>) <code>AzureIdentityBinding<\/code>'deki <code>selector<\/code> ile tam olarak e\u015fle\u015fti\u011finden emin olun.<\/li>\n<li><code>AzureIdentity<\/code> kayna\u011f\u0131ndaki <code>clientID<\/code> ve <code>resourceID<\/code> de\u011ferlerinin do\u011fru ve Azure'daki y\u00f6netilen kimli\u011finizle e\u015fle\u015fti\u011finden emin olun.<\/li>\n<li>Y\u00f6netilen kimli\u011fe, eri\u015fmeye \u00e7al\u0131\u015ft\u0131\u011f\u0131 bulut kayna\u011f\u0131 i\u00e7in gerekli izinlerin (\u00f6rne\u011fin Key Vault i\u00e7in \"Secret Get\") verildi\u011fini do\u011frulay\u0131n.<\/li>\n<li>NMI ve MIC pod'lar\u0131n\u0131n \u00e7al\u0131\u015f\u0131r durumda ve sa\u011fl\u0131kl\u0131 oldu\u011funu kontrol edin.<\/li>\n<\/ol>\n<h3>Performans ve \u00d6l\u00e7eklenebilirlik<\/h3>\n<p>NMI, her d\u00fc\u011f\u00fcmde \u00e7al\u0131\u015ft\u0131\u011f\u0131 ve pod'lardan gelen IMDS \u00e7a\u011fr\u0131lar\u0131n\u0131 kesti\u011fi i\u00e7in, y\u00fcksek trafikli senaryolarda ek bir gecikme yaratabilir. \u00c7o\u011fu durumda bu gecikme ihmal edilebilir d\u00fczeydedir. Ancak, performans kritik uygulamalarda, NMI'nin CPU ve bellek kaynak kullan\u0131m\u0131n\u0131 izlemek \u00f6nemlidir. Gerekirse, NMI'nin kaynak limitlerini art\u0131rabilir veya daha az yo\u011fun d\u00fc\u011f\u00fcmlere da\u011f\u0131t\u0131m stratejileri uygulayabilirsiniz. Ayr\u0131ca, pod'lar\u0131n s\u0131k s\u0131k kimlik bilgisi talep etmesini engelleyen \u00f6nbellekleme mekanizmalar\u0131n\u0131 da dikkate almak faydal\u0131 olacakt\u0131r; bir\u00e7ok bulut SDK's\u0131 token'lar\u0131 otomatik olarak \u00f6nbelle\u011fe al\u0131r.<\/p>\n<blockquote><p>\n  Uzman \u0130pucu: Pod Identity bile\u015fenlerinin kaynak kullan\u0131m\u0131n\u0131 d\u00fczenli olarak takip etmek, beklenmedik performans d\u00fc\u015f\u00fc\u015flerinin \u00f6n\u00fcne ge\u00e7mek i\u00e7in kritik \u00f6neme sahiptir. Metrikleri inceleyerek NMI ve MIC'e yeterli kaynak atand\u0131\u011f\u0131ndan emin olun.\n<\/p><\/blockquote>\n<h3>En Az Ayr\u0131cal\u0131k Prensibi (Least Privilege)<\/h3>\n<p>Pod Identity'nin en b\u00fcy\u00fck avantajlar\u0131ndan biri, en az ayr\u0131cal\u0131k prensibini kolayca uygulayabilmesidir. Her pod'a, g\u00f6revi i\u00e7in kesinlikle gerekli olan minimum bulut IAM yetkilerini atay\u0131n. Geni\u015f yetkiler yerine spesifik kaynaklara (\u00f6rne\u011fin belirli bir S3 bucket'\u0131na, belirli bir veritaban\u0131 tablosuna) ve spesifik i\u015flemlere (sadece okuma, sadece yazma) izin veren \u00f6zel roller olu\u015fturun. Bu, bir pod'un ele ge\u00e7irilmesi durumunda potansiyel zarar\u0131 minimize eder. Otomatik yetki denetimi ara\u00e7lar\u0131 veya OPA (Open Policy Agent) gibi \u00e7\u00f6z\u00fcmlerle bu prensibi uygulaman\u0131z\u0131 zorunlu k\u0131labilirsiniz.<\/p>\n<h3>G\u00fcvenlik Katmanlar\u0131n\u0131 G\u00fc\u00e7lendirme<\/h3>\n<p>Pod Identity, kimlik do\u011frulama ve yetkilendirme i\u00e7in g\u00fc\u00e7l\u00fc bir temel sa\u011flasa da, g\u00fcvenlik stratejinizin tek katman\u0131 olmamal\u0131d\u0131r. A\u015fa\u011f\u0131daki ek g\u00fcvenlik \u00f6nlemlerini birle\u015ftirmek, genel g\u00fcvenlik duru\u015funuzu daha da g\u00fc\u00e7lendirecektir:<\/p>\n<ul>\n<li><strong>A\u011f Politikalar\u0131 (Network Policies):<\/strong> Pod'lar\u0131n sadece ihtiya\u00e7 duyduklar\u0131 di\u011fer pod'larla veya d\u0131\u015f hizmetlerle ileti\u015fim kurmas\u0131na izin veren Kubernetes A\u011f Politikalar\u0131 uygulay\u0131n. Bu, yetkisiz eri\u015fimi veya yan hareketleri engeller.<\/li>\n<li><strong>S\u0131r Y\u00f6netimi Stratejileri:<\/strong> Pod Identity, bulut kaynaklar\u0131na eri\u015fimi basitle\u015ftirse de, uygulaman\u0131z\u0131n hala baz\u0131 durumlarda Kubernetes Secrets kullanmas\u0131 gerekebilir (\u00f6rne\u011fin, k\u00fcme i\u00e7i servis kimlik bilgileri). Bu s\u0131rlar\u0131 g\u00fcvenli bir \u015fekilde y\u00f6netmek i\u00e7in external-secrets.io gibi \u00e7\u00f6z\u00fcmleri veya Kubernetes Secrets'\u0131 bir Key Management System (KMS) ile \u015fifreleyerek kullanmay\u0131 d\u00fc\u015f\u00fcn\u00fcn.<\/li>\n<li><strong>G\u00fcvenlik Taramalar\u0131 ve Denetim:<\/strong> Pod imajlar\u0131n\u0131 ve Kubernetes konfig\u00fcrasyonlar\u0131n\u0131 d\u00fczenli olarak g\u00fcvenlik a\u00e7\u0131klar\u0131 i\u00e7in taray\u0131n. Bulut sa\u011flay\u0131c\u0131n\u0131z\u0131n denetim g\u00fcnl\u00fcklerini (audit logs) kullanarak hangi pod'lar\u0131n hangi bulut kaynaklar\u0131na eri\u015fti\u011fini izleyin.<\/li>\n<li><strong>OIDC ve IRSA (AWS):<\/strong> E\u011fer AWS kullan\u0131yorsan\u0131z, OIDC (OpenID Connect) ve IRSA (IAM Roles for Service Accounts) kombinasyonu Pod Identity'ye benzer ve yerel bir \u00e7\u00f6z\u00fcmd\u00fcr. Pod Identity'nin \u00e7al\u0131\u015fma prensiplerine \u00e7ok benzer \u015fekilde Service Account'lar\u0131 IAM rolleriyle e\u015fle\u015ftirir ve do\u011frudan Kubernetes i\u00e7inde OIDC token'lar\u0131 kullanarak kimlik do\u011frulamas\u0131 yapar.<\/li>\n<\/ul>\n<h3>S\u00fcr\u00fcm Y\u00f6netimi ve G\u00fcncellemeler<\/h3>\n<p>Pod Identity bile\u015fenlerini (MIC, NMI) d\u00fczenli olarak g\u00fcncel tutmak, g\u00fcvenlik yamalar\u0131ndan ve yeni \u00f6zelliklerden faydalanmak i\u00e7in \u00f6nemlidir. G\u00fcncellemeleri yapmadan \u00f6nce test ortamlar\u0131nda kapsaml\u0131 testler yaparak uyumluluk sorunlar\u0131n\u0131n \u00f6n\u00fcne ge\u00e7in. Otomasyon ara\u00e7lar\u0131 kullanarak bu g\u00fcncellemeleri daha y\u00f6netilebilir hale getirebilirsiniz.<\/p>\n<p>Bu ileri d\u00fczey ipu\u00e7lar\u0131 ve en iyi uygulamalar, Pod Identity'nin sundu\u011fu potansiyeli tam olarak kullanman\u0131z\u0131 ve Kubernetes ortam\u0131n\u0131zda sa\u011flam, g\u00fcvenli ve y\u00f6netilebilir bir kimlik altyap\u0131s\u0131 olu\u015fturman\u0131z\u0131 sa\u011flayacakt\u0131r. Unutmay\u0131n, g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir ve katmanl\u0131 bir yakla\u015f\u0131m her zaman en iyisidir.<\/p>\n<h2>Sonu\u00e7: Kubernetes'te Kimlik Devriminin Gelece\u011fi<\/h2>\n<p>Kubernetes ekosisteminde kimlik do\u011frulama ve yetkilendirme, her zaman karma\u015f\u0131k ve kritik bir alan olmu\u015ftur. Geleneksel y\u00f6ntemlerle, yani hassas kimlik bilgilerini pod'lar i\u00e7inde manuel olarak y\u00f6netmekle ili\u015fkili g\u00fcvenlik riskleri ve operasyonel y\u00fckler, modern bulut yerel uygulamalar\u0131n\u0131n h\u0131zl\u0131 geli\u015fimini ve g\u00fcvenli\u011fini s\u0131n\u0131rlam\u0131\u015ft\u0131r. Ancak, Pod Identity gibi \u00e7\u00f6z\u00fcmler, bu zorluklara dinamik, g\u00fcvenli ve \u00f6l\u00e7eklenebilir bir yan\u0131t sunarak Kubernetes'teki kimlik y\u00f6netimi anlay\u0131\u015f\u0131m\u0131z\u0131 temelden de\u011fi\u015ftirmi\u015ftir.<\/p>\n<p>Bu makalede, Pod Identity'nin ne oldu\u011funu, temel prensiplerini ve bulut sa\u011flay\u0131c\u0131lar\u0131yla nas\u0131l entegre oldu\u011funu ad\u0131m ad\u0131m inceledik. \u00d6zellikle Azure AD Pod Identity \u00fczerinden kurulum ve yap\u0131land\u0131rma \u00f6rnekleriyle, uygulamalar\u0131m\u0131z\u0131n Azure Key Vault gibi d\u0131\u015f kaynaklara nas\u0131l g\u00fcvenli bir \u015fekilde eri\u015febilece\u011fini somut olarak g\u00f6sterdik. Ger\u00e7ek d\u00fcnya senaryolar\u0131 arac\u0131l\u0131\u011f\u0131yla, Pod Identity'nin mikroservisler aras\u0131 g\u00fcvenli eri\u015fimden CI\/CD s\u00fcre\u00e7lerinin g\u00fc\u00e7lendirilmesine kadar geni\u015f bir yelpazede pratik faydalar sundu\u011funu g\u00f6rd\u00fck. Son olarak, izleme, performans optimizasyonu ve katmanl\u0131 g\u00fcvenlik yakla\u015f\u0131mlar\u0131 gibi ileri d\u00fczey ipu\u00e7lar\u0131 ve en iyi uygulamalarla, Pod Identity'nin sadece bir ba\u015flang\u0131\u00e7 de\u011fil, ayn\u0131 zamanda s\u00fcrekli iyile\u015ftirilmesi gereken bir s\u00fcre\u00e7 oldu\u011funu vurgulad\u0131k.<\/p>\n<p>Pod Identity, Least Privilege ilkesini benimseyerek, kimlik bilgilerinin s\u0131zd\u0131r\u0131lmas\u0131 riskini minimuma indirerek ve operasyonel karma\u015f\u0131kl\u0131\u011f\u0131 azaltarak Kubernetes g\u00fcvenli\u011finde bir devrim yaratm\u0131\u015ft\u0131r. Uygulamalar\u0131n bulut kaynaklar\u0131na dinamik ve otomatik olarak eri\u015fmesini sa\u011flayarak, geli\u015ftiricilerin g\u00fcvenli\u011fe odaklanmaktan \u00e7ok i\u015f mant\u0131\u011f\u0131na odaklanmas\u0131na olanak tan\u0131r. Gelecekte, Kubernetes ekosistemi geli\u015ftik\u00e7e, Pod Identity ve benzeri kimlik \u00e7\u00f6z\u00fcmlerinin daha da olgunla\u015faca\u011f\u0131n\u0131 ve farkl\u0131 bulut sa\u011flay\u0131c\u0131lar\u0131 ile daha derin entegrasyonlar sunaca\u011f\u0131n\u0131 \u00f6ng\u00f6rebiliriz. Bu teknoloji, bulutta g\u00fcvenli ve \u00f6l\u00e7eklenebilir uygulama geli\u015ftirmenin temel ta\u015flar\u0131ndan biri olmaya devam edecektir. Kubernetes'in sundu\u011fu esneklik ve Pod Identity'nin sa\u011flad\u0131\u011f\u0131 g\u00fcvenlik, \u015firketlerin dijital d\u00f6n\u00fc\u015f\u00fcm yolculu\u011funda \u00f6nemli avantajlar sunmaktad\u0131r.<\/p>\n<h3>S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h3>\n<p>Pod Identity hakk\u0131nda akl\u0131n\u0131za tak\u0131labilecek baz\u0131 sorular\u0131 ve cevaplar\u0131n\u0131 a\u015fa\u011f\u0131da bulabilirsiniz:<\/p>\n<ol>\n<li>\n        <strong>Pod Identity sadece Azure i\u00e7in mi ge\u00e7erlidir?<\/strong><\/p>\n<p>Hay\u0131r, Pod Identity konsepti farkl\u0131 bulut sa\u011flay\u0131c\u0131lar\u0131 i\u00e7in benzer uygulamalara sahiptir. \u00d6rne\u011fin, AWS'de \"IAM Roles for Service Accounts (IRSA)\" ve GCP'de \"Workload Identity\" gibi \u00e7\u00f6z\u00fcmler bulunur. Temel fikir ayn\u0131d\u0131r: Kubernetes pod'lar\u0131n\u0131 bulut IAM rolleri veya y\u00f6netilen kimliklerle e\u015fle\u015ftirmek.<\/p>\n<\/li>\n<li>\n        <strong>Pod Identity kullanmak Kubernetes Secrets'a olan ihtiyac\u0131 tamamen ortadan kald\u0131r\u0131r m\u0131?<\/strong><\/p>\n<p>Pod Identity, bulut kaynaklar\u0131na eri\u015fim i\u00e7in hassas kimlik bilgilerini pod'larda saklama ihtiyac\u0131n\u0131 b\u00fcy\u00fck \u00f6l\u00e7\u00fcde azalt\u0131r veya ortadan kald\u0131r\u0131r. Ancak, Kubernetes Secrets hala k\u00fcme i\u00e7i servis kimlik bilgileri, TLS sertifikalar\u0131 veya di\u011fer hassas konfig\u00fcrasyonlar i\u00e7in kullan\u0131labilir. En iyi uygulama, Pod Identity'yi bulut kaynaklar\u0131 i\u00e7in, Secrets'\u0131 ise k\u00fcme i\u00e7i veya \u00f6zel durumlar i\u00e7in kullanmakt\u0131r.<\/p>\n<\/li>\n<li>\n        <strong>Pod Identity'nin performansa etkisi nedir?<\/strong><\/p>\n<p>Pod Identity \u00e7\u00f6z\u00fcmleri, genellikle pod'lardan gelen API \u00e7a\u011fr\u0131lar\u0131n\u0131 kesen ve kimlik do\u011frulamas\u0131 yapan bir ara katman i\u00e7erir. Bu durum, teorik olarak ek bir gecikme yaratabilir. Ancak, \u00e7o\u011fu durumda bu gecikme mili saniye d\u00fczeyinde olup, uygulamalar\u0131n genel performans\u0131 \u00fczerinde g\u00f6zle g\u00f6r\u00fcl\u00fcr bir etkisi yoktur. Bile\u015fenlerin \u00f6nbellekleme mekanizmalar\u0131 da bu etkiyi minimize eder.<\/p>\n<\/li>\n<li>\n        <strong>E\u011fer Pod Identity bile\u015fenleri (MIC\/NMI) \u00e7al\u0131\u015fmazsa ne olur?<\/strong><\/p>\n<p>MIC veya NMI gibi Pod Identity bile\u015fenlerinin ar\u0131zalanmas\u0131 durumunda, pod'lar\u0131n\u0131z bulut kaynaklar\u0131na eri\u015fmek i\u00e7in gerekli kimlik do\u011frulama token'lar\u0131n\u0131 alamaz ve bulut API \u00e7a\u011fr\u0131lar\u0131 ba\u015far\u0131s\u0131z olur. Bu durum, uygulamalar\u0131n\u0131z\u0131n \u00e7al\u0131\u015fmas\u0131n\u0131 do\u011frudan etkiler. Bu nedenle, bu bile\u015fenlerin y\u00fcksek eri\u015filebilirlik (HA) modunda \u00e7al\u0131\u015fmas\u0131 ve d\u00fczenli olarak izlenmesi kritik \u00f6neme sahiptir.<\/p>\n<\/li>\n<li>\n        <strong>Pod Identity ile \"least privilege\" prensibini nas\u0131l sa\u011flar\u0131m?<\/strong><\/p>\n<p>Least Privilege prensibini sa\u011flamak i\u00e7in, her bir AzureIdentity (veya AWS IAM Rol\u00fc) i\u00e7in yaln\u0131zca pod'un ihtiya\u00e7 duydu\u011fu spesifik izinleri ve kaynaklar\u0131 tan\u0131mlay\u0131n. \u00d6rne\u011fin, bir pod'un yaln\u0131zca belirli bir S3 bucket'\u0131na yazma yetkisi olmal\u0131, t\u00fcm S3 kaynaklar\u0131na veya di\u011fer bulut hizmetlerine de\u011fil. Bu, Azure AD'deki rol tan\u0131mlar\u0131 veya AWS IAM politikalar\u0131 arac\u0131l\u0131\u011f\u0131yla yap\u0131l\u0131r. Gereksiz yetkilerden ka\u00e7\u0131nmak, g\u00fcvenlik risklerini \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131r.<\/p>\n<\/li>\n<\/ol>\n<p><\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Kubernetes ortamlar\u0131nda kimlik do\u011frulama ve yetkilendirme s\u00fcre\u00e7leri karma\u015f\u0131k m\u0131d\u0131r? Pod Identity, uygulamalar\u0131n\u0131za g\u00fcvenli ve dinamik eri\u015fim sa\u011flaman\u0131n anahtar\u0131d\u0131r.&hellip;","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1491],"tags":[],"class_list":{"0":"post-31703","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-kubernetes","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Kubernetes Pod Identity: Kimlik Y\u00f6netiminde Devrim<\/title>\n<meta name=\"description\" content=\"Kubernetes ortamlar\u0131nda kimlik do\u011frulama ve yetkilendirme s\u00fcre\u00e7leri karma\u015f\u0131k m\u0131d\u0131r? Pod Identity, uygulamalar\u0131n\u0131za g\u00fcvenli ve dinamik eri\u015fim sa\u011flaman\u0131n anahtar\u0131d\u0131r. Bu makale, Pod Identity&#039;nin temel prensiplerini, kurulumunu ve ileri d\u00fczey kullan\u0131m senaryolar\u0131n\u0131 ke\u015ffedecek ve bulut kaynaklar\u0131n\u0131za g\u00fcvenli bir kap\u0131 aralayacak.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kubernetes Pod Identity: Kimlik Y\u00f6netiminde Devrim\" \/>\n<meta property=\"og:description\" content=\"Kubernetes ortamlar\u0131nda kimlik do\u011frulama ve yetkilendirme s\u00fcre\u00e7leri karma\u015f\u0131k m\u0131d\u0131r? Pod Identity, uygulamalar\u0131n\u0131za g\u00fcvenli ve dinamik eri\u015fim sa\u011flaman\u0131n anahtar\u0131d\u0131r. Bu makale, Pod Identity&#039;nin temel prensiplerini, kurulumunu ve ileri d\u00fczey kullan\u0131m senaryolar\u0131n\u0131 ke\u015ffedecek ve bulut kaynaklar\u0131n\u0131za g\u00fcvenli bir kap\u0131 aralayacak.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-12T23:31:06+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"25 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Kubernetes Pod Identity: Kimlik Y\u00f6netiminde Devrim\",\"datePublished\":\"2025-10-12T23:31:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/\"},\"wordCount\":4683,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Kubernetes\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/\",\"name\":\"Kubernetes Pod Identity: Kimlik Y\u00f6netiminde Devrim\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-10-12T23:31:06+00:00\",\"description\":\"Kubernetes ortamlar\u0131nda kimlik do\u011frulama ve yetkilendirme s\u00fcre\u00e7leri karma\u015f\u0131k m\u0131d\u0131r? Pod Identity, uygulamalar\u0131n\u0131za g\u00fcvenli ve dinamik eri\u015fim sa\u011flaman\u0131n anahtar\u0131d\u0131r. Bu makale, Pod Identity'nin temel prensiplerini, kurulumunu ve ileri d\u00fczey kullan\u0131m senaryolar\u0131n\u0131 ke\u015ffedecek ve bulut kaynaklar\u0131n\u0131za g\u00fcvenli bir kap\u0131 aralayacak.\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kubernetes Pod Identity: Kimlik Y\u00f6netiminde Devrim\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Kubernetes Pod Identity: Kimlik Y\u00f6netiminde Devrim","description":"Kubernetes ortamlar\u0131nda kimlik do\u011frulama ve yetkilendirme s\u00fcre\u00e7leri karma\u015f\u0131k m\u0131d\u0131r? Pod Identity, uygulamalar\u0131n\u0131za g\u00fcvenli ve dinamik eri\u015fim sa\u011flaman\u0131n anahtar\u0131d\u0131r. Bu makale, Pod Identity'nin temel prensiplerini, kurulumunu ve ileri d\u00fczey kullan\u0131m senaryolar\u0131n\u0131 ke\u015ffedecek ve bulut kaynaklar\u0131n\u0131za g\u00fcvenli bir kap\u0131 aralayacak.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/","og_locale":"tr_TR","og_type":"article","og_title":"Kubernetes Pod Identity: Kimlik Y\u00f6netiminde Devrim","og_description":"Kubernetes ortamlar\u0131nda kimlik do\u011frulama ve yetkilendirme s\u00fcre\u00e7leri karma\u015f\u0131k m\u0131d\u0131r? Pod Identity, uygulamalar\u0131n\u0131za g\u00fcvenli ve dinamik eri\u015fim sa\u011flaman\u0131n anahtar\u0131d\u0131r. Bu makale, Pod Identity'nin temel prensiplerini, kurulumunu ve ileri d\u00fczey kullan\u0131m senaryolar\u0131n\u0131 ke\u015ffedecek ve bulut kaynaklar\u0131n\u0131za g\u00fcvenli bir kap\u0131 aralayacak.","og_url":"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-10-12T23:31:06+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"25 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Kubernetes Pod Identity: Kimlik Y\u00f6netiminde Devrim","datePublished":"2025-10-12T23:31:06+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/"},"wordCount":4683,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Kubernetes"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/","url":"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/","name":"Kubernetes Pod Identity: Kimlik Y\u00f6netiminde Devrim","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-10-12T23:31:06+00:00","description":"Kubernetes ortamlar\u0131nda kimlik do\u011frulama ve yetkilendirme s\u00fcre\u00e7leri karma\u015f\u0131k m\u0131d\u0131r? Pod Identity, uygulamalar\u0131n\u0131za g\u00fcvenli ve dinamik eri\u015fim sa\u011flaman\u0131n anahtar\u0131d\u0131r. Bu makale, Pod Identity'nin temel prensiplerini, kurulumunu ve ileri d\u00fczey kullan\u0131m senaryolar\u0131n\u0131 ke\u015ffedecek ve bulut kaynaklar\u0131n\u0131za g\u00fcvenli bir kap\u0131 aralayacak.","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/kubernetes-pod-identity-kimlik-yonetiminde-devrim\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Kubernetes Pod Identity: Kimlik Y\u00f6netiminde Devrim"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/31703","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=31703"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/31703\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=31703"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=31703"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=31703"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}