{"id":31981,"date":"2025-10-16T09:31:22","date_gmt":"2025-10-16T06:31:22","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/"},"modified":"2025-10-16T09:31:22","modified_gmt":"2025-10-16T06:31:22","slug":"hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/","title":{"rendered":"Hashicorp Vault: G\u00fcvenli S\u0131r Y\u00f6netimi ve Y\u00fcksek Seviye Mimarisi"},"content":{"rendered":"<style>\n  \/* Temel mobil uyumlu ayarlamalar *\/\n  body {\n    font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;\n    line-height: 1.7;\n    color: #333;\n    margin: 0;\n    padding: 20px;\n    background-color: #f9f9f9;\n  }\n  h2, h3 {\n    color: #2c3e50;\n    margin-top: 35px;\n    margin-bottom: 15px;\n    border-bottom: 2px solid #eee;\n    padding-bottom: 8px;\n  }\n  h2 {\n    font-size: 28px;\n  }\n  h3 {\n    font-size: 22px;\n    border-bottom: 1px solid #f0f0f0;\n    padding-bottom: 5px;\n  }\n  p {\n    margin-bottom: 15px;\n  }\n  pre {\n    background-color: #2d2d2d;\n    color: #f8f8f2;\n    padding: 15px;\n    border-radius: 6px;\n    overflow-x: auto;\n    font-family: 'Fira Code', 'Cascadia Code', 'Consolas', monospace;\n    font-size: 14px;\n    line-height: 1.5;\n    margin-bottom: 20px;\n  }\n  code {\n    background-color: #e0e0e0;\n    padding: 2px 4px;\n    border-radius: 3px;\n    font-family: 'Fira Code', 'Cascadia Code', 'Consolas', monospace;\n    font-size: 0.9em;\n  }\n  .expert-tip {\n    background-color: #e6f7ff;\n    border-left: 5px solid #337ab7;\n    padding: 15px 20px;\n    margin: 25px 0;\n    border-radius: 5px;\n    font-style: italic;\n    color: #2a6496;\n  }\n  ul, ol {\n    margin-bottom: 15px;\n    padding-left: 25px;\n  }\n  li {\n    margin-bottom: 8px;\n  }\n  table {\n    width: 100%;\n    border-collapse: collapse;\n    margin-bottom: 20px;\n    background-color: #fff;\n    box-shadow: 0 2px 5px rgba(0,0,0,0.1);\n  }\n  th, td {\n    border: 1px solid #ddd;\n    padding: 12px 15px;\n    text-align: left;\n  }\n  th {\n    background-color: #f2f2f2;\n    font-weight: bold;\n    color: #555;\n  }\n  tr:nth-child(even) {\n    background-color: #fdfdfd;\n  }<\/p>\n<p>  \/* Mobil cihazlar i\u00e7in \u00f6zel ayarlamalar *\/\n  @media (max-width: 768px) {\n    body {\n      padding: 15px;\n      font-size: 16px;\n    }\n    h2 {\n      font-size: 26px;\n    }\n    h3 {\n      font-size: 20px;\n    }\n    pre {\n      font-size: 13px;\n      padding: 10px;\n    }\n    table, thead, tbody, th, td, tr {\n      display: block;\n    }\n    thead tr {\n      position: absolute;\n      top: -9999px;\n      left: -9999px;\n    }\n    tr {\n      border: 1px solid #ccc;\n      margin-bottom: 10px;\n      display: block;\n    }\n    td {\n      border: none;\n      border-bottom: 1px solid #eee;\n      position: relative;\n      padding-left: 50%; \/* Etiket i\u00e7in yer a\u00e7 *\/\n      text-align: right;\n    }\n    td:last-child {\n      border-bottom: none;\n    }\n    td:before {\n      position: absolute;\n      top: 12px;\n      left: 10px;\n      width: 45%;\n      padding-right: 10px;\n      white-space: nowrap;\n      content: attr(data-label); \/* data-label kullanarak mobil ba\u015fl\u0131klar *\/\n      font-weight: bold;\n      text-align: left;\n      color: #555;\n    }\n  }\n<\/style>\n<p>Hashicorp Vault, g\u00fcn\u00fcm\u00fcz\u00fcn karma\u015f\u0131k IT altyap\u0131lar\u0131nda s\u0131r y\u00f6netimi sorunlar\u0131na \u00e7\u00f6z\u00fcm sunan g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r. Bu makalede, Vault&#8217;un y\u00fcksek seviye mimarisini, temel bile\u015fenlerini ve s\u0131r y\u00f6netimindeki kilit kavramlar\u0131n\u0131 pratik \u00f6rneklerle \u00f6\u011frenerek, g\u00fcvenlik duru\u015funuzu nas\u0131l g\u00fc\u00e7lendirebilece\u011finizi ke\u015ffedeceksiniz. Modern uygulamalar\u0131n ve mikroservislerin h\u0131zla yayg\u0131nla\u015fmas\u0131yla birlikte, veritaban\u0131 \u015fifreleri, API anahtarlar\u0131, sertifikalar ve di\u011fer hassas kimlik bilgileri gibi s\u0131rlar\u0131n g\u00fcvenli bir \u015fekilde saklanmas\u0131, eri\u015filmesi ve y\u00f6netilmesi giderek daha karma\u015f\u0131k hale gelmi\u015ftir. Peki, bu kritik bilgileri g\u00fcvenli bir \u015fekilde nas\u0131l y\u00f6netebiliriz? Geli\u015ftiriciler, operasyon ekipleri ve g\u00fcvenlik uzmanlar\u0131 i\u00e7in ortak bir sorun haline gelen bu karma\u015f\u0131kl\u0131k, maalesef bir\u00e7ok g\u00fcvenlik ihlalinin de temelini olu\u015fturmaktad\u0131r.<\/p>\n<p>Geleneksel yakla\u015f\u0131mlar genellikle s\u0131rlar\u0131n yap\u0131land\u0131rma dosyalar\u0131na, ortam de\u011fi\u015fkenlerine veya kaynak koduna sabitlenmesi (hardcoding) \u015feklinde olurdu. Bu y\u00f6ntemler, s\u0131rlar\u0131n if\u015fa olma riskini art\u0131r\u0131r, rotasyonu zorla\u015ft\u0131r\u0131r ve denetlenebilirli\u011fi imkans\u0131z hale getirir. \u0130\u015fte tam bu noktada, Hashicorp Vault devreye giriyor. Vault, s\u0131rlar\u0131n merkezi bir konumda, g\u00fcvenli bir \u015fekilde saklanmas\u0131n\u0131 ve gerekti\u011finde yaln\u0131zca yetkili kullan\u0131c\u0131lar veya uygulamalar taraf\u0131ndan eri\u015filmesini sa\u011flayan bir platformdur. Sadece saklamakla kalmaz, ayn\u0131 zamanda dinamik olarak s\u0131r \u00fcretme, s\u00fcreli kiralamalar (leases), otomatik rotasyon ve kapsaml\u0131 denetim kay\u0131tlar\u0131 gibi geli\u015fmi\u015f \u00f6zellikler sunarak g\u00fcvenlik duru\u015funuzu k\u00f6kten iyile\u015ftirir. \u00d6zetle, Vault, &#8220;s\u0131rlar&#8221; olarak adland\u0131rd\u0131\u011f\u0131m\u0131z her t\u00fcrl\u00fc hassas veriyi merkezi, g\u00fcvenli ve programatik bir \u015fekilde y\u00f6netmek i\u00e7in tasarlanm\u0131\u015f bir ara\u00e7t\u0131r. Bu sayede, g\u00fcvenlik ekipleri operasyonel y\u00fcklerini azalt\u0131rken, geli\u015ftiriciler de uygulamalar\u0131n\u0131 daha g\u00fcvenli bir \u015fekilde tasarlayabilirler.<\/p>\n<h2>Hashicorp Vault&#8217;un Y\u00fcksek Seviye Mimarisi Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/h2>\n<p>Hashicorp Vault&#8217;un temel mimarisi, g\u00fcvenli\u011fi ve esnekli\u011fi bir arada sunacak \u015fekilde tasarlanm\u0131\u015ft\u0131r. Bu mimari, Vault&#8217;u sadece bir s\u0131r depolama arac\u0131 olmaktan \u00e7\u0131kar\u0131p, kapsaml\u0131 bir s\u0131r y\u00f6netimi platformuna d\u00f6n\u00fc\u015ft\u00fcr\u00fcr. \u00c7ekirde\u011finde, Vault bir istemci-sunucu modeline dayan\u0131r; uygulamalar ve kullan\u0131c\u0131lar bir API arac\u0131l\u0131\u011f\u0131yla Vault sunucusuyla etkile\u015fim kurar. Ancak bu etkile\u015fimin alt\u0131nda yatan katmanlar, sistemin sa\u011flaml\u0131\u011f\u0131n\u0131 ve g\u00fcvenli\u011fini garanti eder.<\/p>\n<p>Vault sunucusunun kalbinde, t\u00fcm s\u0131rlar\u0131n, politikalar\u0131n ve yap\u0131land\u0131rmalar\u0131n \u015fifrelenmi\u015f olarak sakland\u0131\u011f\u0131 bir <strong>Depolama Arka Ucu (Storage Backend)<\/strong> bulunur. Bu arka u\u00e7, Vault&#8217;un \u00e7al\u0131\u015fmas\u0131 i\u00e7in hayati \u00f6nem ta\u015f\u0131r ve verileri kal\u0131c\u0131 hale getirir. Vault, Consul, PostgreSQL, Azure Blob Storage, Google Cloud Storage gibi bir\u00e7ok farkl\u0131 depolama arka ucunu destekler. Hashicorp&#8217;un kendi \u00f6nerdi\u011fi ve genellikle varsay\u0131lan olarak kullan\u0131lan \u00e7\u00f6z\u00fcm ise, y\u00fcksek eri\u015filebilirlik ve tutarl\u0131l\u0131k sa\u011flayan entegre depolama \u00e7\u00f6z\u00fcm\u00fc olan <strong>Integrated Storage<\/strong>&#8216;d\u0131r. Ancak unutulmamal\u0131d\u0131r ki, Vault&#8217;un kendisi bu depolama birimlerine s\u0131rlar\u0131 \u015fifrelenmi\u015f olarak yazar; yani, depolama arka ucuna do\u011frudan eri\u015fen bir ki\u015fi bile s\u0131rlar\u0131 okuyamaz.<\/p>\n<p>Vault&#8217;un ba\u015flat\u0131lmas\u0131 s\u0131ras\u0131nda, depolama arka ucundaki verilerin \u015fifresini \u00e7\u00f6zmek i\u00e7in bir <strong>M\u00fch\u00fcr A\u00e7ma (Unseal)<\/strong> i\u015flemi gereklidir. Vault ilk ba\u015flat\u0131ld\u0131\u011f\u0131nda veya yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda &#8220;m\u00fch\u00fcrl\u00fc&#8221; (sealed) durumdad\u0131r. Bu durumdayken, depolanan \u015fifreli verilere eri\u015filemez. M\u00fch\u00fcr a\u00e7ma i\u015flemi, genellikle Shamir&#8217;in Gizli Payla\u015f\u0131m Algoritmas\u0131 kullan\u0131larak olu\u015fturulan ve birden fazla yetkili ki\u015fiye da\u011f\u0131t\u0131lan anahtar par\u00e7alar\u0131n\u0131n (unseal keys) belirli bir say\u0131s\u0131n\u0131n girilmesiyle ger\u00e7ekle\u015ftirilir. Bu, tek bir ki\u015finin Vault&#8217;a tam eri\u015fimini engeller ve &#8220;yaln\u0131zca iki ki\u015fiyle yap\u0131lan kontrol&#8221; (two-person control) prensibini uygular. M\u00fch\u00fcr a\u00e7\u0131ld\u0131ktan sonra, Vault bellekteki bir k\u00f6k anahtar arac\u0131l\u0131\u011f\u0131yla s\u0131rlar\u0131 \u015fifreleyip \u00e7\u00f6zebilir hale gelir.<\/p>\n<p>Mimari, ayn\u0131 zamanda <strong>S\u0131r Motorlar\u0131 (Secret Engines)<\/strong>, <strong>Kimlik Do\u011frulama Y\u00f6ntemleri (Auth Methods)<\/strong> ve <strong>Denetim Cihazlar\u0131 (Audit Devices)<\/strong> gibi temel bile\u015fenlerle zenginle\u015ftirilmi\u015ftir. S\u0131r motorlar\u0131, Vault&#8217;un farkl\u0131 t\u00fcrdeki s\u0131rlar\u0131 nas\u0131l y\u00f6netti\u011fini belirlerken, kimlik do\u011frulama y\u00f6ntemleri kullan\u0131c\u0131lar\u0131n ve uygulamalar\u0131n Vault&#8217;a nas\u0131l kimlik do\u011frulamas\u0131 yapaca\u011f\u0131n\u0131 tan\u0131mlar. Denetim cihazlar\u0131 ise Vault \u00fczerindeki t\u00fcm i\u015flemleri detayl\u0131 bir \u015fekilde kaydeder. Bu mod\u00fcler yap\u0131 sayesinde, Vault farkl\u0131 altyap\u0131 ve g\u00fcvenlik gereksinimlerine kolayca adapte olabilir. \u00d6rne\u011fin, bir mikroservis Kubernetes \u00fczerinden kimlik do\u011frulamas\u0131 yaparken, bir insan kullan\u0131c\u0131s\u0131 LDAP veya GitHub \u00fczerinden Vault&#8217;a eri\u015febilir. Bu esneklik, Vault&#8217;u modern, dinamik ve bulut tabanl\u0131 ortamlar i\u00e7in ideal bir s\u0131r y\u00f6netimi \u00e7\u00f6z\u00fcm\u00fc haline getirir.<\/p>\n<h3>Vault&#8217;un Temel Bile\u015fenleri Nelerdir ve G\u00f6revleri Nedir?<\/h3>\n<p>Vault mimarisini daha yak\u0131ndan inceledi\u011fimizde, her biri belirli bir amaca hizmet eden ve birlikte uyum i\u00e7inde \u00e7al\u0131\u015fan bir dizi temel bile\u015fenle kar\u015f\u0131la\u015f\u0131r\u0131z. Bu bile\u015fenler, Vault&#8217;un g\u00fcc\u00fcn\u00fc ve esnekli\u011fini ortaya koyar.<\/p>\n<ol>\n<li>\n        <strong>Depolama Arka Ucu (Storage Backend):<\/strong><\/p>\n<p>Bu, Vault&#8217;un t\u00fcm verilerini (s\u0131rlar, politikalar, yap\u0131land\u0131rmalar vb.) \u015fifrelenmi\u015f bir bi\u00e7imde kal\u0131c\u0131 olarak depolad\u0131\u011f\u0131 katmand\u0131r. Vault, bu depolama katman\u0131na do\u011frudan eri\u015fim sa\u011flamaz ve depolanan veriler \u015fifreli oldu\u011fu i\u00e7in, depolama arka ucunun kendisi ele ge\u00e7irilse bile s\u0131rlar\u0131n\u0131z g\u00fcvende kal\u0131r. Vault, bir\u00e7ok farkl\u0131 depolama arka ucunu destekler:<\/p>\n<ul>\n<li><strong>Integrated Storage:<\/strong> Genellikle \u00f6nerilen ve varsay\u0131lan olarak kullan\u0131lan \u00e7\u00f6z\u00fcmd\u00fcr. Raft konsens\u00fcs algoritmas\u0131n\u0131 kullanarak y\u00fcksek eri\u015filebilirlik ve veri tutarl\u0131l\u0131\u011f\u0131 sa\u011flar. Tek bir Vault k\u00fcmesi i\u00e7inde \u00e7al\u0131\u015f\u0131r ve harici bir ba\u011f\u0131ml\u0131l\u0131k gerektirmez.<\/li>\n<li><strong>Consul:<\/strong> Hashicorp&#8217;un hizmet ke\u015ffi ve yap\u0131land\u0131rma y\u00f6netimi arac\u0131d\u0131r. Vault ile iyi entegre olur ve y\u00fcksek eri\u015filebilirlik i\u00e7in tercih edilebilir.<\/li>\n<li><strong>PostgreSQL, MySQL:<\/strong> \u0130li\u015fkisel veritabanlar\u0131 da depolama arka ucu olarak kullan\u0131labilir.<\/li>\n<li><strong>Bulut Sa\u011flay\u0131c\u0131 Depolama \u00c7\u00f6z\u00fcmleri:<\/strong> AWS S3, Azure Blob Storage, Google Cloud Storage gibi nesne depolama servisleri de Vault verilerini saklamak i\u00e7in kullan\u0131labilir.<\/li>\n<\/ul>\n<p>Depolama arka ucunun temel g\u00f6revi, Vault&#8217;un durumunu g\u00fcvenli ve kal\u0131c\u0131 bir \u015fekilde saklamakt\u0131r.<\/p>\n<\/li>\n<li>\n        <strong>S\u0131r Motorlar\u0131 (Secret Engines):<\/strong><\/p>\n<p>S\u0131r motorlar\u0131, Vault&#8217;un s\u0131rlar\u0131 nas\u0131l depolad\u0131\u011f\u0131n\u0131, olu\u015fturdu\u011funu veya y\u00f6netti\u011fini belirleyen tak\u0131labilir bile\u015fenlerdir. Her s\u0131r motoru belirli bir s\u0131r t\u00fcr\u00fc i\u00e7in optimize edilmi\u015ftir:<\/p>\n<ul>\n<li><strong>Key-Value (KV) Secret Engine:<\/strong> En basitidir, anahtar-de\u011fer \u00e7iftlerini saklamak i\u00e7in kullan\u0131l\u0131r. Statik s\u0131rlar\u0131 (\u00f6rne\u011fin, manuel olarak girilen API anahtarlar\u0131) depolamak i\u00e7in idealdir.<\/li>\n<li><strong>Database Secret Engine:<\/strong> Dinamik veritaban\u0131 kimlik bilgileri olu\u015fturur. Bir uygulama Vault&#8217;tan kimlik bilgisi istedi\u011finde, Vault veritaban\u0131nda ge\u00e7ici, belirli ayr\u0131cal\u0131klara sahip bir kullan\u0131c\u0131 olu\u015fturur ve belirli bir s\u00fcre sonra otomatik olarak siler veya rotasyonunu yapar.<\/li>\n<li><strong>AWS Secret Engine:<\/strong> Dinamik AWS IAM kullan\u0131c\u0131lar\u0131, rol ve anahtarlar olu\u015fturur.<\/li>\n<li><strong>PKI Secret Engine:<\/strong> Dinamik olarak X.509 sertifikalar\u0131 olu\u015fturur ve y\u00f6netir, kendi CA (Sertifika Yetkilisi) rol\u00fcn\u00fc \u00fcstlenebilir.<\/li>\n<li><strong>SSH Secret Engine:<\/strong> SSH kimlik bilgileri ve tek kullan\u0131ml\u0131k \u015fifreler (OTP) sa\u011flar.<\/li>\n<\/ul>\n<p>Bu motorlar sayesinde, farkl\u0131 t\u00fcrdeki s\u0131rlar i\u00e7in farkl\u0131 y\u00f6netim stratejileri uygulayabilir ve g\u00fcvenlik modelinizi geni\u015fletebilirsiniz.<\/p>\n<\/li>\n<li>\n        <strong>Kimlik Do\u011frulama Y\u00f6ntemleri (Auth Methods):<\/strong><\/p>\n<p>Bu bile\u015fenler, kullan\u0131c\u0131lar\u0131n ve makinelerin Vault&#8217;a nas\u0131l kimlik do\u011frulamas\u0131 yapaca\u011f\u0131n\u0131 belirler. Her kimlik do\u011frulama y\u00f6ntemi, farkl\u0131 bir kimlik sistemiyle entegrasyonu sa\u011flar:<\/p>\n<ul>\n<li><strong>AppRole:<\/strong> Uygulamalar\u0131n veya makinelerin Vault&#8217;a programatik olarak kimlik do\u011frulamas\u0131 yapmas\u0131 i\u00e7in tasarlanm\u0131\u015ft\u0131r. G\u00fcvenli ve otomatik bir yoldur.<\/li>\n<li><strong>Kubernetes:<\/strong> Kubernetes pod&#8217;lar\u0131n\u0131n Service Account belirte\u00e7lerini kullanarak kimlik do\u011frulamas\u0131 yapmas\u0131n\u0131 sa\u011flar.<\/li>\n<li><strong>LDAP\/Active Directory:<\/strong> Kurumsal dizin hizmetleriyle entegrasyon sa\u011flar, insan kullan\u0131c\u0131lar i\u00e7in idealdir.<\/li>\n<li><strong>GitHub, JWT\/OIDC:<\/strong> Geli\u015ftirici veya bulut kimlikleriyle entegrasyonu m\u00fcmk\u00fcn k\u0131lar.<\/li>\n<li><strong>Token:<\/strong> Vault taraf\u0131ndan verilen veya kullan\u0131c\u0131 taraf\u0131ndan sa\u011flanan belirte\u00e7lerle do\u011frudan kimlik do\u011frulama.<\/li>\n<\/ul>\n<p>Kimlik do\u011frulama ba\u015far\u0131l\u0131 oldu\u011funda, Vault bir belirte\u00e7 (token) d\u00f6nd\u00fcr\u00fcr. Bu belirte\u00e7, ilgili politikalara g\u00f6re Vault&#8217;a eri\u015fim sa\u011flamak i\u00e7in kullan\u0131l\u0131r.<\/p>\n<\/li>\n<li>\n        <strong>Denetim Cihazlar\u0131 (Audit Devices):<\/strong><\/p>\n<p>Vault&#8217;taki her eri\u015fim ve i\u015flem, denetim cihazlar\u0131 taraf\u0131ndan detayl\u0131 bir \u015fekilde kaydedilir. Bu kay\u0131tlar, g\u00fcvenlik denetimleri ve adli analizler i\u00e7in kritik \u00f6neme sahiptir.<\/p>\n<ul>\n<li><strong>File Audit Device:<\/strong> \u0130\u015flemleri yerel bir dosyaya kaydeder.<\/li>\n<li><strong>Syslog Audit Device:<\/strong> \u0130\u015flemleri uzak bir syslog sunucusuna g\u00f6nderir, merkezi log y\u00f6netimi i\u00e7in tercih edilir.<\/li>\n<\/ul>\n<p>Denetim kay\u0131tlar\u0131, hassas bilgilerin maskelenmesi veya karma\u015f\u0131k bir \u015fekilde \u015fifrelenmesiyle g\u00fcvenlik ve gizlili\u011fi korur.<\/p>\n<\/li>\n<\/ol>\n<p>Bu bile\u015fenler, Vault&#8217;un s\u0131rlar\u0131 etkin, g\u00fcvenli ve denetlenebilir bir \u015fekilde y\u00f6netmesini sa\u011flar. Her bir bile\u015fen kendi ba\u015f\u0131na \u00f6nemli bir rol oynarken, bir araya geldiklerinde g\u00fc\u00e7l\u00fc bir g\u00fcvenlik \u00e7er\u00e7evesi olu\u015ftururlar.<\/p>\n<h2>Hashicorp Vault ile S\u0131r Y\u00f6netimi Nas\u0131l Yap\u0131l\u0131r: Temel Kavramlar ve Pratik \u00d6rnekler?<\/h2>\n<p>Hashicorp Vault&#8217;un g\u00fcc\u00fc, sadece s\u0131rlar\u0131 depolamas\u0131nda de\u011fil, ayn\u0131 zamanda bu s\u0131rlar\u0131 modern g\u00fcvenlik prensiplerine uygun olarak y\u00f6netme \u015feklindedir. Bir\u00e7ok temel kavram ve mekanizma, Vault&#8217;un bu yetene\u011finin merkezinde yer al\u0131r.<\/p>\n<h3>S\u0131r (Secret) ve Belirte\u00e7 (Token) Y\u00f6netimi<\/h3>\n<p>Bir &#8220;s\u0131r&#8221;, veritaban\u0131 kimlik bilgilerinden API anahtarlar\u0131na, bulut kimlik bilgilerinden SSH anahtarlar\u0131na kadar herhangi bir hassas bilgi olabilir. Vault, bu s\u0131rlar\u0131 \u015fifrelenmi\u015f olarak depolar ve yetkilendirilmi\u015f eri\u015fim sa\u011flayan bir &#8220;belirte\u00e7&#8221; (token) arac\u0131l\u0131\u011f\u0131yla sunar. Belirte\u00e7ler, Vault&#8217;ta kimlik do\u011frulama sonras\u0131nda elde edilen, belirli bir ya\u015fam s\u00fcresine ve ili\u015fkili politikalara sahip eri\u015fim anahtarlar\u0131d\u0131r. Bir uygulama veya kullan\u0131c\u0131 Vault&#8217;a kimlik do\u011frulamas\u0131 yapt\u0131\u011f\u0131nda, Vault bu varl\u0131\u011fa bir belirte\u00e7 verir. Bu belirte\u00e7, daha sonra Vault API&#8217;sine yap\u0131lan isteklerde kullan\u0131l\u0131r ve Vault, belirtecin politikalar\u0131na g\u00f6re eri\u015fim izinlerini denetler. Belirte\u00e7lerin s\u00fcresi dolabilir ve yenilenmesi gerekebilir, bu da g\u00fcvenlik i\u00e7in ek bir katman sa\u011flar.<\/p>\n<h3>Vault Politikalar\u0131 (Policies) ile Eri\u015fim Kontrol\u00fc Nas\u0131l Sa\u011flan\u0131r?<\/h3>\n<p>Vault&#8217;un g\u00fcvenlik modelinin temel ta\u015f\u0131 &#8220;politikalar&#8221;d\u0131r (policies). Politikalar, bir belirtecin veya kimlik do\u011frulama y\u00f6nteminin hangi s\u0131r yollar\u0131na eri\u015febilece\u011fini ve bu yollarda hangi i\u015flemleri (okuma, yazma, silme, listeleme) ger\u00e7ekle\u015ftirebilece\u011fini tan\u0131mlayan ACL (Eri\u015fim Kontrol Listesi) kurallar\u0131d\u0131r. Politikalar JSON veya HCL (Hashicorp Configuration Language) format\u0131nda yaz\u0131l\u0131r. \u00d6rne\u011fin, bir web uygulamas\u0131n\u0131n yaln\u0131zca belirli bir veritaban\u0131 s\u0131rr\u0131n\u0131 okumas\u0131na izin veren bir politika \u015f\u00f6yle g\u00f6r\u00fcnebilir:<\/p>\n<pre><code class=\"language-hcl\">\npath \"database\/creds\/my-webapp\" {\n  capabilities = [\"read\"]\n}\n\npath \"kv\/data\/my-app\/*\" {\n  capabilities = [\"read\", \"list\"]\n}\n<\/pre>\n<p><\/code><\/p>\n<p>Yukar\u0131daki \u00f6rnekte, web uygulamas\u0131 <code>database\/creds\/my-webapp<\/code> yolundaki veritaban\u0131 kimlik bilgilerini okuyabilir ve <code>kv\/data\/my-app\/<\/code> yolundaki KV s\u0131rlar\u0131n\u0131 okuyup listeleyebilir. Politikalar, \"en az ayr\u0131cal\u0131k\" (least privilege) ilkesini uygulamak i\u00e7in kritik \u00f6neme sahiptir ve her belirtece yaln\u0131zca ihtiyac\u0131 olan eri\u015fimi sa\u011flar.<\/p>\n<h3>M\u00fch\u00fcrleme\/M\u00fchr\u00fc A\u00e7ma (Sealing\/Unsealing) \u0130\u015flemleri Nedir?<\/h3>\n<p>Vault'un en temel g\u00fcvenlik \u00f6zelliklerinden biri, depolanan s\u0131rlar\u0131n dinlenme halindeyken (at rest) g\u00fcvenli\u011fini sa\u011flamakt\u0131r. Vault ilk ba\u015flat\u0131ld\u0131\u011f\u0131nda veya bir kesintinin ard\u0131ndan yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda, \"m\u00fch\u00fcrl\u00fc\" (sealed) durumdad\u0131r. Bu, Vault'un s\u0131r depolama arka ucuna eri\u015fimi olsa bile, s\u0131rlar\u0131 \u015fifrelemek ve \u00e7\u00f6zmek i\u00e7in gereken ana \u015fifreleme anahtar\u0131na (master key) sahip olmad\u0131\u011f\u0131 anlam\u0131na gelir. Bu anahtar, Vault belle\u011findedir ve sunucu kapat\u0131ld\u0131\u011f\u0131nda kaybolur.<\/p>\n<p>Vault'u \"m\u00fchr\u00fc a\u00e7mak\" (unseal) i\u00e7in, birka\u00e7 yetkili operat\u00f6r taraf\u0131ndan sa\u011flanan \"m\u00fch\u00fcr a\u00e7ma anahtarlar\u0131\"n\u0131n (unseal keys) belirli bir say\u0131s\u0131na (genellikle 3 veya 5'ten 2 veya 3'\u00fc) ihtiya\u00e7 duyulur. Bu anahtarlar, Shamir'in Gizli Payla\u015f\u0131m Algoritmas\u0131 kullan\u0131larak olu\u015fturulur. M\u00fch\u00fcr a\u00e7ma i\u015flemi tamamland\u0131\u011f\u0131nda, Vault aktif hale gelir ve \u015fifreli s\u0131rlar\u0131 \u00e7\u00f6zmeye ba\u015flayabilir. Bu, tek bir ki\u015finin sunucuya fiziksel eri\u015fimi olsa bile, s\u0131rlar\u0131 do\u011frudan okumas\u0131n\u0131 engeller ve birden fazla yetkilinin i\u015fbirli\u011fini gerektiren bir g\u00fcvenlik mekanizmas\u0131 sunar.<\/p>\n<h3>Kiralama (Leasing) ve Yenileme (Renewal) ile Dinamik S\u0131rlar<\/h3>\n<p>Vault'un dinamik s\u0131r yetene\u011fi, geleneksel statik s\u0131r y\u00f6netimini k\u00f6kten de\u011fi\u015ftirir. Dinamik s\u0131rlar, bir uygulama veya kullan\u0131c\u0131 taraf\u0131ndan talep edildi\u011finde Vault taraf\u0131ndan an\u0131nda olu\u015fturulan ve belirli bir \"kiralama s\u00fcresi\" (lease duration) olan kimlik bilgileridir. \u00d6rne\u011fin, bir veritaban\u0131 s\u0131r motoru, her talep edildi\u011finde veritaban\u0131nda ge\u00e7ici bir kullan\u0131c\u0131 ve \u015fifre olu\u015fturabilir. Bu ge\u00e7ici kimlik bilgilerinin belirli bir ya\u015fam s\u00fcresi (TTL - Time-To-Live) vard\u0131r ve s\u00fcre doldu\u011funda otomatik olarak iptal edilir veya silinir.<\/p>\n<p>Bu yakla\u015f\u0131m\u0131n faydalar\u0131 \u015funlard\u0131r:<\/p>\n<ul>\n<li><strong>Azalt\u0131lm\u0131\u015f Maruz Kalma S\u00fcresi:<\/strong> S\u0131rlar sadece ihtiya\u00e7 duyuldu\u011fu s\u00fcrece aktiftir.<\/li>\n<li><strong>Otomatik Rotasyon:<\/strong> S\u0131rlar s\u00fcrekli olarak de\u011fi\u015fti\u011fi i\u00e7in, bir s\u0131rr\u0131n ele ge\u00e7irilmesi durumunda bile etkisi s\u0131n\u0131rl\u0131d\u0131r.<\/li>\n<li><strong>Azalt\u0131lm\u0131\u015f Y\u00f6netim Y\u00fck\u00fc:<\/strong> Manuel s\u0131r rotasyonu ve g\u00fcncellemeleri ihtiyac\u0131n\u0131 ortadan kald\u0131r\u0131r.<\/li>\n<\/ul>\n<p>Bir s\u0131rr\u0131n kiralama s\u00fcresi dolmadan \u00f6nce, uygulama veya kullan\u0131c\u0131 Vault'tan s\u0131rr\u0131 \"yenileme\" (renewal) isteyebilir, bu da kiralama s\u00fcresini uzat\u0131r. E\u011fer yenileme yap\u0131lmazsa veya s\u0131r art\u0131k kullan\u0131lm\u0131yorsa, otomatik olarak \"iptal\" (revocation) edilir. Bu dinamik y\u00f6netim, s\u0131rlar\u0131n ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fc otomatikle\u015ftirerek g\u00fcvenlik ve operasyonel verimlili\u011fi \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131r.<\/p>\n<aside class=\"expert-tip\">\n  Uzman \u0130pucu: Kiralama s\u00fcrelerini (TTL) uygulaman\u0131z\u0131n ihtiya\u00e7lar\u0131na g\u00f6re m\u00fcmk\u00fcn olan en k\u0131sa s\u00fcrede tutun. Bu, bir s\u0131rr\u0131n ele ge\u00e7irilmesi durumunda potansiyel zarar\u0131 en aza indirecektir. Genellikle saniyeler, dakikalar veya nadiren saatler tercih edilir.<br \/>\n<\/aside>\n<p><strong>Pratik \u00d6rnek: Statik S\u0131r Depolama ve Eri\u015fim<\/strong><\/p>\n<p>\u015eimdi, Vault'un KV (Key-Value) s\u0131r motorunu kullanarak basit bir s\u0131rr\u0131 nas\u0131l depolay\u0131p alaca\u011f\u0131m\u0131za dair bir \u00f6rnekle devam edelim.<\/p>\n<p>\u00d6ncelikle, KV s\u0131r motorunu etkinle\u015ftirmemiz gerekebilir (varsay\u0131lan olarak genellikle <code>\/secret<\/code> yolunda etkindir, ancak <code>kv-v2<\/code> versiyonu i\u00e7in <code>\/secret\/data<\/code> kullan\u0131l\u0131r):<\/p>\n<pre><code class=\"language-bash\">\nvault secrets enable kv-v2\n<\/pre>\n<p><\/code><\/p>\n<pre><code class=\"language-bash\">\u015eimdi, bir uygulamam\u0131z i\u00e7in bir veritaban\u0131 \u015fifresi depolayal\u0131m:<\/pre>\n<p><\/code><br \/>\nvault kv put secret\/data\/my-app\/db username=\"webapp_user\" password=\"supersecretpassword123\"<br \/>\n<\/code><\/p>\n<pre><code class=\"language-bash\">S\u0131rr\u0131 almak i\u00e7in:<\/pre>\n<p><\/code><br \/>\nvault kv get secret\/data\/my-app\/db<br \/>\n<\/code><\/p>\n<pre><code class=\"language-json\">\u00c7\u0131kt\u0131 \u015f\u00f6yle olacakt\u0131r:<\/pre>\n<p><\/code><br \/>\n# \u00c7\u0131kt\u0131 \u00f6rne\u011fi<br \/>\nKey              Value<br \/>\n---              -----<br \/>\nusername         webapp_user<br \/>\npassword         supersecretpassword123<br \/>\n<\/code><\/p>\n<p>Bu basit \u00f6rnek, Vault'un temel bir s\u0131r depolama i\u015flevini g\u00f6sterir. Ancak as\u0131l g\u00fc\u00e7, dinamik s\u0131rlar ve entegrasyon yeteneklerinde yatar.<\/p>\n<h2>Ger\u00e7ek D\u00fcnya Senaryosu: Mikroservisler \u0130\u00e7in Dinamik Veritaban\u0131 Kimlik Bilgileri Nas\u0131l Y\u00f6netilir?<\/h2>\n<p>Modern uygulama mimarilerinde, \u00f6zellikle mikroservis tabanl\u0131 sistemlerde, veritaban\u0131 kimlik bilgilerini y\u00f6netmek b\u00fcy\u00fck bir zorluktur. Her mikroservisin kendi veritaban\u0131na eri\u015fim sa\u011flamas\u0131 gerekir ve bu eri\u015fim kimlik bilgilerinin g\u00fcvenli bir \u015fekilde depolanmas\u0131, rotasyonu ve izlenmesi hayati \u00f6neme sahiptir. Geleneksel yakla\u015f\u0131mlar (\u00f6rn. yap\u0131land\u0131rma dosyalar\u0131na sabit kodlama) g\u00fcvenlik a\u00e7\u0131klar\u0131 olu\u015ftururken, Vault'un dinamik s\u0131r yetene\u011fi bu soruna devrim niteli\u011finde bir \u00e7\u00f6z\u00fcm sunar.<\/p>\n<p><strong>Problem:<\/strong> Bir e-ticaret uygulamas\u0131nda bir\u00e7ok mikroservis (\u00f6rne\u011fin, sipari\u015f y\u00f6netimi, \u00fcr\u00fcn katalo\u011fu, kullan\u0131c\u0131 profili) PostgreSQL veritaban\u0131na ihtiya\u00e7 duyar. E\u011fer her servis ayn\u0131 statik kullan\u0131c\u0131 ad\u0131 ve \u015fifreyi kullan\u0131rsa:<\/p>\n<ol>\n<li>Bir servisin kimlik bilgileri ele ge\u00e7irildi\u011finde, t\u00fcm di\u011fer servisler de riske girer.<\/li>\n<li>\u015eifrelerin manuel olarak rotasyonu, operasyonel y\u00fck\u00fc art\u0131r\u0131r ve insan hatas\u0131na a\u00e7\u0131kt\u0131r.<\/li>\n<li>Hangi servisin hangi kimlik bilgilerini kulland\u0131\u011f\u0131n\u0131 izlemek zordur.<\/li>\n<li>En az ayr\u0131cal\u0131k (least privilege) ilkesi uygulanmaz; her servis gere\u011finden fazla yetkiye sahip olabilir.<\/li>\n<\/ol>\n<p><strong>\u00c7\u00f6z\u00fcm: Vault'un Dinamik Veritaban\u0131 S\u0131r Motoru<\/strong><\/p>\n<p>Vault'un Database Secret Engine'\u0131, bu sorunlar\u0131 \u00e7\u00f6zmek i\u00e7in tasarlanm\u0131\u015ft\u0131r. Bu motor, bir uygulama Vault'tan veritaban\u0131 kimlik bilgisi talep etti\u011finde, veritaban\u0131nda do\u011frudan ge\u00e7ici bir kullan\u0131c\u0131 hesab\u0131 ve \u015fifre olu\u015fturur. Bu kimlik bilgileri belirli bir kiralama s\u00fcresiyle (lease duration) verilir ve s\u00fcre sonunda otomatik olarak iptal edilir.<\/p>\n<p><strong>Ad\u0131m Ad\u0131m Senaryo Ak\u0131\u015f\u0131:<\/strong><\/p>\n<p>1.  <strong>Veritaban\u0131 S\u0131r Motorunu Etkinle\u015ftirme:<\/strong> Vault y\u00f6neticisi, PostgreSQL i\u00e7in veritaban\u0131 s\u0131r motorunu etkinle\u015ftirir ve Vault'un PostgreSQL sunucusuyla ileti\u015fim kurmas\u0131n\u0131 sa\u011flayacak bir y\u00f6netici kimlik bilgisi ile yap\u0131land\u0131r\u0131r.<\/p>\n<pre><code class=\"language-bash\">\n    vault secrets enable database\n    vault write database\/config\/postgresql \\\n        plugin_name=postgresql-database-plugin \\\n        allowed_roles=\"my-app-role\" \\\n        connection_url=\"postgresql:\/\/{{username}}:{{password}}@localhost:5432\/mydb\" \\\n        username=\"db_admin\" \\\n        password=\"admin_password\"\n    <\/pre>\n<p><\/code><br \/>\n2.  <strong>Veritaban\u0131 Rol\u00fc Tan\u0131mlama:<\/strong> Y\u00f6netici, mikroservislerin ihtiya\u00e7 duydu\u011fu ayr\u0131cal\u0131klarla bir veritaban\u0131 rol\u00fc tan\u0131mlar. \u00d6rne\u011fin, <code>my-app-role<\/code> sadece <code>products<\/code> tablosunu okuyabilir.<\/p>\n<pre><code class=\"language-bash\">\n    vault write database\/roles\/my-app-role \\\n        db_name=postgresql \\\n        creation_statements=\"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \\\n                             GRANT SELECT ON ALL TABLES IN SCHEMA public TO \\\"{{name}}\\\";\" \\\n        default_ttl=\"1h\" \\\n        max_ttl=\"24h\"\n    <\/pre>\n<p><\/code><br \/>\n    Bu komut, Vault'a <code>my-app-role<\/code> ad\u0131nda bir rol tan\u0131mlar. Bu rol\u00fc talep eden bir uygulama i\u00e7in PostgreSQL'de yeni bir kullan\u0131c\u0131 olu\u015fturulacak, belirli bir \u015fifre atanacak, <code>public<\/code> \u015femas\u0131ndaki t\u00fcm tablolarda <code>SELECT<\/code> yetkisi verilecek ve 1 saat sonra ge\u00e7ersiz olacak.<br \/>\n3.  <strong>Mikroservis Kimlik Do\u011frulama:<\/strong> <code>ProductCatalogService<\/code> adl\u0131 mikroservis, ba\u015flat\u0131ld\u0131\u011f\u0131nda Kubernetes Auth Method veya AppRole kullanarak Vault'a kimlik do\u011frulamas\u0131 yapar ve bir Vault belirteci al\u0131r.<br \/>\n4.  <strong>Dinamik Kimlik Bilgileri Talep Etme:<\/strong> <code>ProductCatalogService<\/code>, ald\u0131\u011f\u0131 Vault belirtecini kullanarak <code>database\/creds\/my-app-role<\/code> yolundan veritaban\u0131 kimlik bilgilerini talep eder.<\/p>\n<pre><code class=\"language-bash\">\n    # Mikroservis i\u00e7indeki \u00f6rnek kod (Python)\n    # import hvac # Python Vault client\n    # client = hvac.Client(...) # Vault istemcisi ba\u015flatma\n    # db_creds = client.read('database\/creds\/my-app-role')['data']\n    # username = db_creds['username']\n    # password = db_creds['password']\n    <\/pre>\n<p><\/code><br \/>\n5.  <strong>Ge\u00e7ici Kullan\u0131c\u0131 Olu\u015fturma ve Kullanma:<\/strong> Vault, PostgreSQL'de <code>my-app-role<\/code> i\u00e7in yeni, ge\u00e7ici bir kullan\u0131c\u0131 (\u00f6rne\u011fin, <code>v-token-abcdef123<\/code>) olu\u015fturur ve bu kullan\u0131c\u0131n\u0131n kimlik bilgilerini servise iletir. Servis bu kimlik bilgilerini kullanarak veritaban\u0131na ba\u011flan\u0131r.<br \/>\n6.  <strong>Otomatik \u0130ptal\/Rotasyon:<\/strong> Kiralama s\u00fcresi (\u00f6rne\u011fin 1 saat) doldu\u011funda, Vault otomatik olarak bu ge\u00e7ici veritaban\u0131 kullan\u0131c\u0131s\u0131n\u0131 siler veya \u015fifresini de\u011fi\u015ftirir. Servis, yeni bir ba\u011flant\u0131 kurmas\u0131 gerekti\u011finde Vault'tan yeni kimlik bilgileri ister.<\/p>\n<p><strong>Bu Yakla\u015f\u0131m\u0131n Faydalar\u0131:<\/strong><\/p>\n<p>*   <strong>Geli\u015ftirilmi\u015f G\u00fcvenlik:<\/strong> S\u0131rlar hi\u00e7bir zaman sabit kodlanmaz, diskte saklanmaz veya uzun s\u00fcre aktif kalmaz. Her servis kendi benzersiz, k\u0131sa \u00f6m\u00fcrl\u00fc kimlik bilgilerini kullan\u0131r.<br \/>\n*   <strong>Otomatik Rotasyon:<\/strong> S\u0131rlar\u0131n manuel rotasyonu ihtiyac\u0131n\u0131 ortadan kald\u0131r\u0131r.<br \/>\n*   <strong>En Az Ayr\u0131cal\u0131k:<\/strong> Her servise yaln\u0131zca ihtiyac\u0131 olan minimum veritaban\u0131 yetkisi verilir.<br \/>\n*   <strong>Kapsaml\u0131 Denetim:<\/strong> Vault, hangi servisin ne zaman hangi kimlik bilgilerini talep etti\u011fini ve ne kadar s\u00fcreyle kulland\u0131\u011f\u0131n\u0131 detayl\u0131 olarak kaydeder.<br \/>\n*   <strong>Basitle\u015ftirilmi\u015f Operasyonlar:<\/strong> S\u0131r y\u00f6netimi karma\u015f\u0131kl\u0131\u011f\u0131n\u0131 otomasyon ile azalt\u0131r.<\/p>\n<p>Bu ger\u00e7ek d\u00fcnya senaryosu, Vault'un modern, da\u011f\u0131t\u0131k sistemlerde kimlik bilgilerini nas\u0131l g\u00fcvenli ve verimli bir \u015fekilde y\u00f6netebilece\u011fini a\u00e7\u0131k\u00e7a g\u00f6stermektedir.<\/p>\n<h2>Hashicorp Vault G\u00fcvenli\u011fini En \u00dcst D\u00fczeye \u00c7\u0131karmak \u0130\u00e7in \u0130leri D\u00fczey \u0130pu\u00e7lar\u0131 Nelerdir?<\/h2>\n<p>Vault'u da\u011f\u0131tmak, g\u00fcvenlik duru\u015funuzu \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131rman\u0131n ilk ad\u0131m\u0131d\u0131r. Ancak en y\u00fcksek d\u00fczeyde g\u00fcvenlik ve kullan\u0131labilirlik sa\u011flamak i\u00e7in baz\u0131 ileri d\u00fczey stratejileri ve yap\u0131land\u0131rmalar\u0131 uygulamak kritik \u00f6neme sahiptir.<\/p>\n<aside class=\"expert-tip\">\n  Uzman \u0130pucu: Otomatik M\u00fch\u00fcr A\u00e7ma (Auto Unseal) \u00f6zelli\u011fini kullan\u0131rken, anahtarlar\u0131n sakland\u0131\u011f\u0131 KMS (Key Management Service) katman\u0131n\u0131n g\u00fcvenli\u011fini sa\u011flamak i\u00e7in ayr\u0131 bir titizlik g\u00f6sterin. KMS'e eri\u015fim politikalar\u0131 en k\u0131s\u0131tl\u0131 seviyede olmal\u0131d\u0131r. Bu teknikle operasyonel y\u00fck\u00fc azalt\u0131rken g\u00fcvenli\u011fi s\u00fcrd\u00fcrebilirsiniz.<br \/>\n<\/aside>\n<ol>\n<li><strong>Y\u00fcksek Eri\u015filebilirlik (High Availability - HA) Kurulumu:<\/strong><br \/>\n        Tek bir Vault sunucusu, bir ar\u0131za noktas\u0131 olu\u015fturur. \u00dcretim ortamlar\u0131nda Vault'un her zaman eri\u015filebilir olmas\u0131n\u0131 sa\u011flamak i\u00e7in y\u00fcksek eri\u015filebilirlik (HA) modunda da\u011f\u0131t\u0131lmal\u0131d\u0131r. Bu, birden fazla Vault d\u00fc\u011f\u00fcm\u00fcn\u00fcn ayn\u0131 depolama arka ucuna (\u00f6rne\u011fin, Integrated Storage'\u0131n Raft modu) ba\u011flanarak aktif\/pasif bir k\u00fcme olu\u015fturmas\u0131n\u0131 i\u00e7erir. Yaln\u0131zca bir d\u00fc\u011f\u00fcm aktif olabilir (lider), di\u011ferleri pasif kal\u0131r ve birincil d\u00fc\u011f\u00fcm ar\u0131zaland\u0131\u011f\u0131nda g\u00f6revi devralmaya haz\u0131rd\u0131r. Bu, Vault hizmetinin kesintisiz devaml\u0131l\u0131\u011f\u0131n\u0131 garanti eder.<\/li>\n<li><strong>Otomatik M\u00fch\u00fcr A\u00e7ma (Auto Unseal):<\/strong><br \/>\n        Her Vault sunucusu ba\u015flat\u0131ld\u0131\u011f\u0131nda veya yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda manuel olarak m\u00fch\u00fcr a\u00e7ma i\u015flemi gereklidir. Bu, b\u00fcy\u00fck k\u00fcmelerde veya otomatik \u00f6l\u00e7eklendirme senaryolar\u0131nda operasyonel bir engel olu\u015fturabilir. Otomatik m\u00fch\u00fcr a\u00e7ma \u00f6zelli\u011fi, Vault'un master \u015fifreleme anahtar\u0131n\u0131 AWS KMS, Azure Key Vault veya Google Cloud KMS gibi bir KMS sa\u011flay\u0131c\u0131s\u0131na sarmalayarak bu sorunu \u00e7\u00f6zer. Bu sayede Vault, yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda KMS ile otomatik olarak etkile\u015fim kurarak kendi kendini m\u00fch\u00fcrden a\u00e7abilir. Bu, operasyonel y\u00fck\u00fc azalt\u0131rken g\u00fcvenlik prensiplerinden \u00f6d\u00fcn vermez, \u00e7\u00fcnk\u00fc anahtarlar yine de bir donan\u0131m g\u00fcvenlik mod\u00fcl\u00fc (HSM) benzeri bir hizmet taraf\u0131ndan korunur.<\/li>\n<li><strong>Namespace'ler (\u00c7oklu Kirac\u0131l\u0131k):<\/strong><br \/>\n        Vault Enterprise s\u00fcr\u00fcm\u00fcnde sunulan namespace'ler, tek bir Vault \u00f6rne\u011fi i\u00e7inde \u00e7oklu kirac\u0131l\u0131k (multi-tenancy) sa\u011flamak i\u00e7in kullan\u0131l\u0131r. Bu, b\u00fcy\u00fck kurulu\u015flar\u0131n farkl\u0131 departmanlar, ekipler veya projeler i\u00e7in izole edilmi\u015f s\u0131r y\u00f6netimi ortamlar\u0131 olu\u015fturmas\u0131na olanak tan\u0131r. Her namespace kendi s\u0131r motorlar\u0131na, kimlik do\u011frulama y\u00f6ntemlerine ve politikalar\u0131na sahip olabilir, bu da yetki ayr\u0131m\u0131n\u0131 ve daha iyi y\u00f6netimi m\u00fcmk\u00fcn k\u0131lar.<\/li>\n<li><strong>Performans \u0130yile\u015ftirmeleri (Caching ve Batching):<\/strong><br \/>\n        Y\u00fcksek trafikli ortamlarda Vault'un performans\u0131n\u0131 optimize etmek \u00f6nemlidir. Vault istemcileri, s\u0131k eri\u015filen s\u0131rlar\u0131 \u00f6nbelle\u011fe alarak Vault sunucusuna yap\u0131lan \u00e7a\u011fr\u0131 say\u0131s\u0131n\u0131 azaltabilir. Ayr\u0131ca, Vault API'si toplu i\u015flemler (batch operations) i\u00e7in destek sunar, bu da birden fazla s\u0131r i\u015flemini tek bir API \u00e7a\u011fr\u0131s\u0131nda birle\u015ftirerek a\u011f gecikmesini azalt\u0131r ve genel verimi art\u0131r\u0131r.<\/li>\n<li><strong>Felaket Kurtarma (Disaster Recovery - DR):<\/strong><br \/>\n        Vault'un HA kurulumu, bir d\u00fc\u011f\u00fcm\u00fcn ar\u0131zalanmas\u0131na kar\u015f\u0131 koruma sa\u011flarken, t\u00fcm veri merkezini etkileyen bir felaket durumunda verilerinizi korumak i\u00e7in felaket kurtarma stratejileri d\u00fc\u015f\u00fcn\u00fclmelidir. Vault, DR i\u00e7in aktif\/pasif replikasyon veya yedekleme ve geri y\u00fckleme mekanizmalar\u0131 sunar. \u00d6zellikle \u00e7oklu co\u011frafi b\u00f6lgelerde \u00e7al\u0131\u015fan kurulu\u015flar i\u00e7in DR replikasyonu hayati \u00f6nem ta\u015f\u0131r.<\/li>\n<li><strong>Kapsaml\u0131 \u0130zleme ve Uyar\u0131lar:<\/strong><br \/>\n        Vault'un sa\u011fl\u0131kl\u0131 \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan ve g\u00fcvenlik olaylar\u0131n\u0131n an\u0131nda tespit edildi\u011finden emin olmak i\u00e7in kapsaml\u0131 izleme ve uyar\u0131 sistemleri kurmak \u015fartt\u0131r. Prometheus ve Grafana gibi ara\u00e7lar, Vault'un metriklerini (API \u00e7a\u011fr\u0131lar\u0131, kiralama s\u00fcreleri, CPU\/bellek kullan\u0131m\u0131) toplamak ve g\u00f6rselle\u015ftirmek i\u00e7in kullan\u0131labilir. Denetim g\u00fcnl\u00fckleri (audit logs) i\u00e7in merkezi bir g\u00fcnl\u00fck y\u00f6netim sistemi (\u00f6rn. ELK Stack, Splunk) kullan\u0131larak g\u00fcvenlik olaylar\u0131 i\u00e7in uyar\u0131lar yap\u0131land\u0131r\u0131lmal\u0131d\u0131r.<\/li>\n<\/ol>\n<p>Bu ileri d\u00fczey ipu\u00e7lar\u0131, Vault da\u011f\u0131t\u0131m\u0131n\u0131z\u0131n sadece g\u00fcvenli de\u011fil, ayn\u0131 zamanda operasyonel olarak dayan\u0131kl\u0131, \u00f6l\u00e7eklenebilir ve y\u00f6netilebilir olmas\u0131n\u0131 sa\u011flar.<\/p>\n<h2>Sonu\u00e7: Hashicorp Vault ile Gelece\u011fin S\u0131r Y\u00f6netimi<\/h2>\n<p>Hashicorp Vault, modern, dinamik ve bulut tabanl\u0131 altyap\u0131larda s\u0131r y\u00f6netimi paradigmalar\u0131n\u0131 k\u00f6kten de\u011fi\u015ftiren bir platformdur. Bu makale boyunca, Vault'un y\u00fcksek seviye mimarisini, temel bile\u015fenlerini (depolama arka ucu, s\u0131r motorlar\u0131, kimlik do\u011frulama y\u00f6ntemleri, denetim cihazlar\u0131) ve kilit kavramlar\u0131n\u0131 (s\u0131rlar, belirte\u00e7ler, politikalar, m\u00fch\u00fcrleme, kiralama) detayl\u0131 bir \u015fekilde inceledik. Ayr\u0131ca, mikroservisler i\u00e7in dinamik veritaban\u0131 kimlik bilgisi y\u00f6netimi gibi ger\u00e7ek d\u00fcnya senaryolar\u0131yla Vault'un pratik faydalar\u0131n\u0131 g\u00f6rd\u00fck ve ileri d\u00fczey da\u011f\u0131t\u0131m ipu\u00e7lar\u0131yla g\u00fcvenlik duru\u015funuzu nas\u0131l maksimize edebilece\u011finizi ke\u015ffettik.<\/p>\n<p>Vault, s\u0131rlar\u0131 merkezi bir konumda g\u00fcvenli bir \u015fekilde depolaman\u0131n \u00f6tesine ge\u00e7erek, otomatik rotasyon, k\u0131sa \u00f6m\u00fcrl\u00fc kimlik bilgileri, ayr\u0131nt\u0131l\u0131 denetim kay\u0131tlar\u0131 ve esnek eri\u015fim kontrol\u00fc gibi \u00f6zellikler sunar. Bu, geli\u015ftiricilerin g\u00fcvenlik endi\u015feleri olmadan yenilik yapmas\u0131na olanak tan\u0131rken, operasyon ve g\u00fcvenlik ekiplerinin s\u0131r ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fc tamamen otomatikle\u015ftirmesini ve riskleri \u00f6nemli \u00f6l\u00e7\u00fcde azaltmas\u0131n\u0131 sa\u011flar. G\u00fcn\u00fcm\u00fcz\u00fcn tehdit ortam\u0131nda, hassas verilerin korunmas\u0131 her zamankinden daha kritik hale gelmi\u015ftir ve Hashicorp Vault, bu zorlu\u011fun \u00fcstesinden gelmek i\u00e7in g\u00fcvenilir ve g\u00fc\u00e7l\u00fc bir \u00e7\u00f6z\u00fcm sunmaktad\u0131r. Vault ile gelece\u011fin g\u00fcvenli s\u0131r y\u00f6netimini kucaklay\u0131n.<\/p>\n<h3>S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h3>\n<ol>\n<li>\n        <strong>Vault ile geleneksel \u015fifre y\u00f6neticileri aras\u0131ndaki temel fark nedir?<\/strong><\/p>\n<p>Geleneksel \u015fifre y\u00f6neticileri genellikle insan kullan\u0131c\u0131lar\u0131n \u015fifrelerini g\u00fcvenli bir \u015fekilde saklamas\u0131na odaklan\u0131rken, Vault hem insan hem de makine taraf\u0131ndan kullan\u0131lan s\u0131rlar (API anahtarlar\u0131, veritaban\u0131 kimlik bilgileri, sertifikalar vb.) i\u00e7in tasarlanm\u0131\u015ft\u0131r. Vault dinamik s\u0131r \u00fcretme, kiralama, otomatik rotasyon ve kapsaml\u0131 entegrasyon yetenekleri sunarak \u00e7ok daha geni\u015f bir g\u00fcvenlik ve otomasyon kapsam\u0131 sa\u011flar.<\/p>\n<\/li>\n<li>\n        <strong>Vault'un \"m\u00fch\u00fcrl\u00fc\" (sealed) olmas\u0131 ne anlama gelir ve neden \u00f6nemlidir?<\/strong><\/p>\n<p>Vault'un \"m\u00fch\u00fcrl\u00fc\" olmas\u0131, sunucunun \u00e7al\u0131\u015f\u0131r durumda olmas\u0131na ra\u011fmen, s\u0131rlar\u0131 \u015fifrelemek ve \u00e7\u00f6zmek i\u00e7in gereken ana \u015fifreleme anahtar\u0131na (master key) sahip olmad\u0131\u011f\u0131 anlam\u0131na gelir. Bu durum, Vault sunucusu ele ge\u00e7irilse bile depolanan \u015fifreli s\u0131rlar\u0131n if\u015fa olmas\u0131n\u0131 engeller. M\u00fch\u00fcr a\u00e7ma (unseal) i\u015flemi, yetkilendirilmi\u015f ki\u015filerin anahtar par\u00e7alar\u0131n\u0131 sa\u011flayarak Vault'u aktif hale getirmesiyle ger\u00e7ekle\u015ftirilir ve bu, tek bir ki\u015finin s\u0131rlar\u0131 ele ge\u00e7irmesini \u00f6nleyen bir g\u00fcvenlik mekanizmas\u0131d\u0131r.<\/p>\n<\/li>\n<li>\n        <strong>Dinamik s\u0131rlar g\u00fcvenlik i\u00e7in neden daha iyidir?<\/strong><\/p>\n<p>Dinamik s\u0131rlar, sadece ihtiya\u00e7 duyuldu\u011fu s\u00fcrece var olan, k\u0131sa \u00f6m\u00fcrl\u00fc kimlik bilgileridir. Bu, s\u0131rlar\u0131n maruz kalma s\u00fcresini \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131r. Bir s\u0131r ele ge\u00e7irilse bile, kiralama s\u00fcresi k\u0131sa oldu\u011fu i\u00e7in potansiyel zarar s\u0131n\u0131rl\u0131d\u0131r. Ayr\u0131ca, dinamik s\u0131rlar otomatik olarak rotasyon ve iptal edilebilir, bu da manuel m\u00fcdahale ihtiyac\u0131n\u0131 ortadan kald\u0131r\u0131r ve insan hatas\u0131 riskini azalt\u0131r.<\/p>\n<\/li>\n<li>\n        <strong>Hashicorp Vault hangi depolama arka u\u00e7lar\u0131n\u0131 destekler?<\/strong><\/p>\n<p>Hashicorp Vault, Integrated Storage (yerle\u015fik Raft tabanl\u0131 depolama), Consul, PostgreSQL, MySQL, Amazon S3, Azure Blob Storage, Google Cloud Storage ve daha bir\u00e7ok farkl\u0131 depolama arka ucunu destekler. Bu \u00e7e\u015fitlilik, kurulu\u015flar\u0131n mevcut altyap\u0131lar\u0131yla en iyi uyum sa\u011flayan \u00e7\u00f6z\u00fcm\u00fc se\u00e7melerine olanak tan\u0131r.<\/p>\n<\/li>\n<li>\n        <strong>Vault'ta politikalar ne i\u015fe yarar ve nas\u0131l uygulan\u0131r?<\/strong><\/p>\n<p>Vault'ta politikalar, kimlerin veya hangi uygulamalar\u0131n hangi s\u0131rlara ve Vault yollar\u0131na eri\u015febilece\u011fini tan\u0131mlayan Eri\u015fim Kontrol Listeleri (ACL'ler) gibidir. En az ayr\u0131cal\u0131k (least privilege) ilkesini uygulamak i\u00e7in kullan\u0131l\u0131rlar. Her belirte\u00e7 veya kimlik do\u011frulama y\u00f6ntemi, bir veya daha fazla politikayla ili\u015fkilendirilir. Bu politikalar, belirli yollar \u00fczerinde hangi i\u015flemlerin (okuma, yazma, silme, listeleme) yap\u0131labilece\u011fini belirtir ve JSON veya HCL format\u0131nda tan\u0131mlan\u0131r.<\/p>\n<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"Hashicorp Vault, g\u00fcn\u00fcm\u00fcz\u00fcn karma\u015f\u0131k IT altyap\u0131lar\u0131nda s\u0131r y\u00f6netimi sorunlar\u0131na \u00e7\u00f6z\u00fcm sunan g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r. Bu makalede, Vault&#8217;un y\u00fcksek&hellip;","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-31981","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Hashicorp Vault: G\u00fcvenli S\u0131r Y\u00f6netimi ve Y\u00fcksek Seviye Mimarisi<\/title>\n<meta name=\"description\" content=\"Bu, Vault&#039;un t\u00fcm verilerini (s\u0131rlar, politikalar, yap\u0131land\u0131rmalar vb.) \u015fifrelenmi\u015f bir bi\u00e7imde kal\u0131c\u0131 olarak depolad\u0131\u011f\u0131 katmand\u0131r. Vault, bu depolama katman\u0131na do\u011frudan eri\u015fim sa\u011flamaz ve depolanan veriler \u015fifreli oldu\u011fu i\u00e7in, depolama arka ucunun kendisi ele ge\u00e7irilse bile s\u0131rlar\u0131n\u0131z g\u00fcvende kal\u0131r. Vault, bir\u00e7ok farkl\u0131 depolama arka ucunu destekler:\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hashicorp Vault: G\u00fcvenli S\u0131r Y\u00f6netimi ve Y\u00fcksek Seviye Mimarisi\" \/>\n<meta property=\"og:description\" content=\"Bu, Vault&#039;un t\u00fcm verilerini (s\u0131rlar, politikalar, yap\u0131land\u0131rmalar vb.) \u015fifrelenmi\u015f bir bi\u00e7imde kal\u0131c\u0131 olarak depolad\u0131\u011f\u0131 katmand\u0131r. Vault, bu depolama katman\u0131na do\u011frudan eri\u015fim sa\u011flamaz ve depolanan veriler \u015fifreli oldu\u011fu i\u00e7in, depolama arka ucunun kendisi ele ge\u00e7irilse bile s\u0131rlar\u0131n\u0131z g\u00fcvende kal\u0131r. Vault, bir\u00e7ok farkl\u0131 depolama arka ucunu destekler:\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-16T06:31:22+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"23 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Hashicorp Vault: G\u00fcvenli S\u0131r Y\u00f6netimi ve Y\u00fcksek Seviye Mimarisi\",\"datePublished\":\"2025-10-16T06:31:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/\"},\"wordCount\":4560,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/\",\"name\":\"Hashicorp Vault: G\u00fcvenli S\u0131r Y\u00f6netimi ve Y\u00fcksek Seviye Mimarisi\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-10-16T06:31:22+00:00\",\"description\":\"Bu, Vault'un t\u00fcm verilerini (s\u0131rlar, politikalar, yap\u0131land\u0131rmalar vb.) \u015fifrelenmi\u015f bir bi\u00e7imde kal\u0131c\u0131 olarak depolad\u0131\u011f\u0131 katmand\u0131r. Vault, bu depolama katman\u0131na do\u011frudan eri\u015fim sa\u011flamaz ve depolanan veriler \u015fifreli oldu\u011fu i\u00e7in, depolama arka ucunun kendisi ele ge\u00e7irilse bile s\u0131rlar\u0131n\u0131z g\u00fcvende kal\u0131r. Vault, bir\u00e7ok farkl\u0131 depolama arka ucunu destekler:\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hashicorp Vault: G\u00fcvenli S\u0131r Y\u00f6netimi ve Y\u00fcksek Seviye Mimarisi\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Hashicorp Vault: G\u00fcvenli S\u0131r Y\u00f6netimi ve Y\u00fcksek Seviye Mimarisi","description":"Bu, Vault'un t\u00fcm verilerini (s\u0131rlar, politikalar, yap\u0131land\u0131rmalar vb.) \u015fifrelenmi\u015f bir bi\u00e7imde kal\u0131c\u0131 olarak depolad\u0131\u011f\u0131 katmand\u0131r. Vault, bu depolama katman\u0131na do\u011frudan eri\u015fim sa\u011flamaz ve depolanan veriler \u015fifreli oldu\u011fu i\u00e7in, depolama arka ucunun kendisi ele ge\u00e7irilse bile s\u0131rlar\u0131n\u0131z g\u00fcvende kal\u0131r. Vault, bir\u00e7ok farkl\u0131 depolama arka ucunu destekler:","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/","og_locale":"tr_TR","og_type":"article","og_title":"Hashicorp Vault: G\u00fcvenli S\u0131r Y\u00f6netimi ve Y\u00fcksek Seviye Mimarisi","og_description":"Bu, Vault'un t\u00fcm verilerini (s\u0131rlar, politikalar, yap\u0131land\u0131rmalar vb.) \u015fifrelenmi\u015f bir bi\u00e7imde kal\u0131c\u0131 olarak depolad\u0131\u011f\u0131 katmand\u0131r. Vault, bu depolama katman\u0131na do\u011frudan eri\u015fim sa\u011flamaz ve depolanan veriler \u015fifreli oldu\u011fu i\u00e7in, depolama arka ucunun kendisi ele ge\u00e7irilse bile s\u0131rlar\u0131n\u0131z g\u00fcvende kal\u0131r. Vault, bir\u00e7ok farkl\u0131 depolama arka ucunu destekler:","og_url":"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-10-16T06:31:22+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"23 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Hashicorp Vault: G\u00fcvenli S\u0131r Y\u00f6netimi ve Y\u00fcksek Seviye Mimarisi","datePublished":"2025-10-16T06:31:22+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/"},"wordCount":4560,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/","url":"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/","name":"Hashicorp Vault: G\u00fcvenli S\u0131r Y\u00f6netimi ve Y\u00fcksek Seviye Mimarisi","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-10-16T06:31:22+00:00","description":"Bu, Vault'un t\u00fcm verilerini (s\u0131rlar, politikalar, yap\u0131land\u0131rmalar vb.) \u015fifrelenmi\u015f bir bi\u00e7imde kal\u0131c\u0131 olarak depolad\u0131\u011f\u0131 katmand\u0131r. Vault, bu depolama katman\u0131na do\u011frudan eri\u015fim sa\u011flamaz ve depolanan veriler \u015fifreli oldu\u011fu i\u00e7in, depolama arka ucunun kendisi ele ge\u00e7irilse bile s\u0131rlar\u0131n\u0131z g\u00fcvende kal\u0131r. Vault, bir\u00e7ok farkl\u0131 depolama arka ucunu destekler:","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/hashicorp-vault-guvenli-sir-yonetimi-ve-yuksek-seviye-mimarisi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Hashicorp Vault: G\u00fcvenli S\u0131r Y\u00f6netimi ve Y\u00fcksek Seviye Mimarisi"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/31981","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=31981"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/31981\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=31981"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=31981"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=31981"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}