{"id":33710,"date":"2025-11-06T05:40:58","date_gmt":"2025-11-06T02:40:58","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=33710"},"modified":"2025-11-06T05:40:58","modified_gmt":"2025-11-06T02:40:58","slug":"doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/","title":{"rendered":"DOKS’ta External Secrets Operator’\u0131 Vault ile Yap\u0131land\u0131rma Rehberi"},"content":{"rendered":"

<\/p>\n

DOKS’ta External Secrets Operator’\u0131 Vault ile Yap\u0131land\u0131rma Rehberi<\/h2>\n

Giri\u015f<\/h3>\n

Bulut tabanl\u0131 uygulamalar\u0131n y\u00fckseli\u015fiyle birlikte, g\u00fcvenlik ve \u00f6zellikle gizlilik y\u00f6netimi, modern yaz\u0131l\u0131m geli\u015ftirme ve operasyon s\u00fcre\u00e7lerinin kritik bir bile\u015feni haline gelmi\u015ftir. Kubernetes gibi konteyner orkestrasyon platformlar\u0131, uygulamalar\u0131 da\u011f\u0131tma ve \u00f6l\u00e7eklendirme konusunda devrim yaratm\u0131\u015f olsa da, hassas verilerin (API anahtarlar\u0131, veritaban\u0131 \u015fifreleri, sertifikalar vb.) g\u00fcvenli bir \u015fekilde saklanmas\u0131 ve uygulamalara sunulmas\u0131 hala karma\u015f\u0131k bir meydan okumad\u0131r. Geleneksel Kubernetes Secrets, Base64 ile kodlanm\u0131\u015f olmalar\u0131 nedeniyle g\u00fcvenlik a\u00e7\u0131s\u0131ndan yetersiz kalabilir ve merkezi bir gizlilik y\u00f6netim sistemi olmadan denetlenebilirlik ve ya\u015fam d\u00f6ng\u00fcs\u00fc y\u00f6netimi zorla\u015f\u0131r.<\/p>\n

\u0130\u015fte bu noktada HashiCorp Vault gibi merkezi gizlilik y\u00f6netim \u00e7\u00f6z\u00fcmleri devreye girer. Vault, gizliliklerin g\u00fcvenli bir \u015fekilde saklanmas\u0131n\u0131, eri\u015fim kontrol\u00fcn\u00fc, denetlenmesini ve dinamik olarak olu\u015fturulmas\u0131n\u0131 sa\u011flayan g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r. Ancak, Kubernetes uygulamalar\u0131n\u0131n bu gizliliklere do\u011frudan Vault API’si \u00fczerinden eri\u015fmesi, uygulama kodunda Vault entegrasyonu gerektirdi\u011finden ek bir y\u00fck olu\u015fturur. Bu sorunu \u00e7\u00f6zmek i\u00e7in External Secrets Operator (ESO) ortaya \u00e7\u0131km\u0131\u015ft\u0131r. ESO, Vault gibi harici gizlilik y\u00f6neticilerinde depolanan gizlilikleri Kubernetes Secrets olarak otomatik olarak senkronize eden bir Kubernetes operat\u00f6r\u00fcd\u00fcr. Bu sayede, uygulamalar standart Kubernetes Secrets’\u0131 kullanmaya devam ederken, gizlilik y\u00f6netimi Vault’un sa\u011flad\u0131\u011f\u0131 g\u00fcvenlik ve esneklikten faydalanabilir.<\/p>\n

Bu makalede, DigitalOcean Kubernetes Service (DOKS) ortam\u0131nda External Secrets Operator’\u0131 HashiCorp Vault ile nas\u0131l yap\u0131land\u0131raca\u011f\u0131m\u0131z\u0131 ad\u0131m ad\u0131m ele alaca\u011f\u0131z. DOKS, y\u00f6netilen bir Kubernetes hizmeti olarak altyap\u0131 karma\u015f\u0131kl\u0131\u011f\u0131n\u0131 azalt\u0131rken, ESO ve Vault entegrasyonu uygulamalar\u0131n\u0131z\u0131n gizliliklerini daha g\u00fcvenli ve y\u00f6netilebilir hale getirecektir. Amac\u0131m\u0131z, bu entegrasyonun temel prensiplerini, kurulum ad\u0131mlar\u0131n\u0131 ve en iyi uygulamalar\u0131n\u0131 detayl\u0131 bir \u015fekilde a\u00e7\u0131klayarak, okuyuculara pratik bir rehber sunmakt\u0131r.<\/p>\n

Neden External Secrets Operator ve Vault?<\/h3>\n

Modern bulut yerel uygulamalar\u0131nda gizlilik y\u00f6netimi, hem geli\u015ftiriciler hem de operasyon ekipleri i\u00e7in \u00f6nemli bir endi\u015fe kayna\u011f\u0131d\u0131r. Bu b\u00f6l\u00fcmde, neden Vault ve External Secrets Operator kombinasyonunun bu zorluklar\u0131 a\u015fmak i\u00e7in g\u00fc\u00e7l\u00fc bir \u00e7\u00f6z\u00fcm sundu\u011funu inceleyece\u011fiz.<\/p>\n

Kubernetes’te Gizlilik Y\u00f6netimi Zorluklar\u0131<\/h4>\n

Kubernetes, uygulamalar\u0131n da\u011f\u0131t\u0131m\u0131 ve y\u00f6netimi i\u00e7in harika bir platform olsa da, gizlilik y\u00f6netimi konusunda baz\u0131 temel eksikliklere sahiptir:<\/p>\n

* Varsay\u0131lan Olarak \u015eifreleme Yok<\/strong>: Kubernetes Secrets, varsay\u0131lan olarak yaln\u0131zca Base64 ile kodlanm\u0131\u015ft\u0131r, \u015fifrelenmemi\u015ftir. Bu, k\u00fcme eri\u015fimi olan herkesin gizlilikleri kolayca okuyabilece\u011fi anlam\u0131na gelir. Hassas veriler i\u00e7in bu durum ciddi bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131d\u0131r.
\n* Merkezi Y\u00f6netim Eksikli\u011fi<\/strong>: Her Kubernetes k\u00fcmesi kendi gizliliklerini y\u00f6netir. Birden fazla k\u00fcme veya ortam\u0131n\u0131z varsa, gizlilikleri tutarl\u0131 bir \u015fekilde y\u00f6netmek ve senkronize etmek zorla\u015f\u0131r.
\n* Eri\u015fim Kontrol\u00fc S\u0131n\u0131rlamalar\u0131<\/strong>: Kubernetes RBAC ile gizliliklere eri\u015fim kontrol edilebilir, ancak bu, hangi uygulaman\u0131n hangi gizlili\u011fe eri\u015febilece\u011fi konusunda ince taneli kontroller sa\u011flamakta zorlanabilir. Ayr\u0131ca, gizliliklere eri\u015fim denetimi (audit trail) s\u0131n\u0131rl\u0131d\u0131r.
\n* Gizlilik Ya\u015fam D\u00f6ng\u00fcs\u00fc Y\u00f6netimi<\/strong>: Gizliliklerin d\u00fczenli olarak yenilenmesi (rotation), s\u00fcrelerinin dolmas\u0131 veya iptal edilmesi gibi ya\u015fam d\u00f6ng\u00fcs\u00fc y\u00f6netimi s\u00fcre\u00e7leri, manuel olarak yap\u0131ld\u0131\u011f\u0131nda hataya a\u00e7\u0131k ve zaman al\u0131c\u0131d\u0131r.
\n* Geli\u015ftirici Deneyimi<\/strong>: Geli\u015ftiricilerin, farkl\u0131 ortamlar i\u00e7in farkl\u0131 gizlilikleri y\u00f6netmesi veya do\u011frudan Kubernetes API’si ile etkile\u015fime girmesi, geli\u015ftirme s\u00fcrecini karma\u015f\u0131kla\u015ft\u0131rabilir.<\/p>\n

Vault’un Avantajlar\u0131<\/h4>\n

HashiCorp Vault, yukar\u0131da belirtilen zorluklar\u0131n \u00fcstesinden gelmek i\u00e7in tasarlanm\u0131\u015f kapsaml\u0131 bir gizlilik y\u00f6netim \u00e7\u00f6z\u00fcm\u00fcd\u00fcr:<\/p>\n

* Merkezi Gizlilik Deposu<\/strong>: T\u00fcm gizlilikleri tek bir g\u00fcvenli, merkezi konumda depolar. Bu, gizliliklerin tutarl\u0131l\u0131\u011f\u0131n\u0131 ve y\u00f6netimini kolayla\u015ft\u0131r\u0131r.
\n* \u015eifreleme ve G\u00fcvenlik<\/strong>: Gizlilikleri depolarken ve iletirken \u015fifreleme kullan\u0131r. Bu, hassas verilerin hem depoda hem de a\u011fda g\u00fcvende olmas\u0131n\u0131 sa\u011flar.
\n* Dinamik Gizlilikler<\/strong>: Veritaban\u0131 kimlik bilgileri, API anahtarlar\u0131 gibi gizlilikleri “an\u0131nda” olu\u015fturabilir ve belirli bir s\u00fcre sonra otomatik olarak iptal edebilir. Bu, sald\u0131r\u0131 y\u00fczeyini \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131r.
\n* Geni\u015f Yetkilendirme Se\u00e7enekleri<\/strong>: Kubernetes, AWS IAM, Azure AD, GitHub ve daha fazlas\u0131 dahil olmak \u00fczere bir\u00e7ok yetkilendirme y\u00f6ntemini destekler. Bu, farkl\u0131 platformlardaki kullan\u0131c\u0131lar\u0131n ve sistemlerin Vault’a g\u00fcvenli bir \u015fekilde eri\u015fmesini sa\u011flar.
\n* Detayl\u0131 Eri\u015fim Kontrol\u00fc (ACL)<\/strong>: Hangi kullan\u0131c\u0131n\u0131n veya uygulaman\u0131n hangi gizliliklere eri\u015febilece\u011fini \u00e7ok ince taneli politikalarla tan\u0131mlayabilir.
\n* Denetim Kay\u0131tlar\u0131 (Audit Logs)<\/strong>: Vault’a yap\u0131lan her eri\u015fim ve i\u015flem, detayl\u0131 denetim kay\u0131tlar\u0131na kaydedilir. Bu, uyumluluk ve g\u00fcvenlik analizi i\u00e7in hayati \u00f6neme sahiptir.
\n* Gizlilik Yenileme ve Revoke Etme<\/strong>: Gizliliklerin otomatik olarak yenilenmesini veya iptal edilmesini sa\u011flar, b\u00f6ylece manuel m\u00fcdahaleye gerek kalmaz.<\/p>\n

External Secrets Operator’\u0131n Rol\u00fc<\/h4>\n

External Secrets Operator (ESO), Kubernetes ve harici gizlilik y\u00f6neticileri aras\u0131ndaki k\u00f6pr\u00fcd\u00fcr. Temel i\u015flevi \u015funlard\u0131r:<\/p>\n

* Senkronizasyon<\/strong>: Vault gibi harici depolarda bulunan gizlilikleri, Kubernetes k\u00fcmesi i\u00e7indeki standart Secret<\/code> objelerine d\u00f6n\u00fc\u015ft\u00fcr\u00fcr ve senkronize eder.
\n* Otomatik G\u00fcncelleme<\/strong>: Harici depodaki gizlilikler de\u011fi\u015fti\u011finde, ESO bu de\u011fi\u015fiklikleri alg\u0131lar ve ilgili Kubernetes Secret’\u0131n\u0131 otomatik olarak g\u00fcnceller. Bu, gizlilik yenileme s\u00fcre\u00e7lerini basitle\u015ftirir.
\n* Uygulama \u015eeffafl\u0131\u011f\u0131<\/strong>: Uygulamalar, Vault ile do\u011frudan etkile\u015fime girmek zorunda kalmaz. Bunun yerine, standart Kubernetes Secrets’\u0131 t\u00fcketmeye devam ederler. Bu, uygulama kodunu daha temiz ve ta\u015f\u0131nabilir hale getirir.
\n* G\u00fcvenlik ve \u0130zolasyon<\/strong>: Gizlilikler, sadece ihtiya\u00e7 duyuldu\u011funda Kubernetes’e \u00e7ekilir ve genellikle belirli bir namespace veya k\u00fcme kapsam\u0131yla s\u0131n\u0131rl\u0131d\u0131r. Vault’un yetkilendirme mekanizmalar\u0131, ESO’nun sadece yetkili gizliliklere eri\u015fmesini sa\u011flar.
\n* \u00c7oklu Depo Deste\u011fi<\/strong>: Sadece Vault de\u011fil, AWS Secrets Manager, GCP Secret Manager, Azure Key Vault gibi bir\u00e7ok farkl\u0131 harici gizlilik deposunu destekler.<\/p>\n

\u00d6zetle, Vault merkezi, g\u00fcvenli ve denetlenebilir bir gizlilik deposu sa\u011flarken, External Secrets Operator bu gizlilikleri Kubernetes uygulamalar\u0131na g\u00fcvenli ve otomatik bir \u015fekilde ula\u015ft\u0131r\u0131r. Bu kombinasyon, Kubernetes ortamlar\u0131nda gizlilik y\u00f6netimini basitle\u015ftirir, g\u00fcvenli\u011fi art\u0131r\u0131r ve geli\u015ftirici verimlili\u011fini destekler.<\/p>\n

\u00d6n Ko\u015fullar<\/h3>\n

Bu makaledeki ad\u0131mlar\u0131 ba\u015far\u0131yla takip edebilmek i\u00e7in a\u015fa\u011f\u0131daki \u00f6n ko\u015fullar\u0131n yerine getirilmi\u015f olmas\u0131 gerekmektedir:<\/p>\n

* DigitalOcean Kubernetes Service (DOKS) K\u00fcmesi<\/strong>: \u00c7al\u0131\u015f\u0131r durumda bir DOKS k\u00fcmesine sahip olman\u0131z ve kubectl<\/code> komut sat\u0131r\u0131 arac\u0131yla bu k\u00fcmeye eri\u015febiliyor olman\u0131z gerekmektedir. kubectl<\/code> yap\u0131land\u0131rman\u0131z\u0131n do\u011fru oldu\u011fundan emin olun.
\n* Helm<\/strong>: Kubernetes’e uygulama da\u011f\u0131t\u0131m\u0131 i\u00e7in bir paket y\u00f6neticisi olan Helm’in yerel makinenizde kurulu olmas\u0131 gerekmektedir. Helm 3 veya \u00fczeri bir s\u00fcr\u00fcm \u00f6nerilir.
\n* Vault<\/strong>:
\n * Vault Kurulumu<\/strong>: Bu makale, Vault’un DOKS \u00fczerinde veya eri\u015filebilir harici bir konumda kurulu ve \u00e7al\u0131\u015f\u0131r durumda oldu\u011funu varsaymaktad\u0131r. Demolar i\u00e7in DOKS \u00fczerinde Helm ile basit bir Vault kurulumu ger\u00e7ekle\u015ftirece\u011fiz. \u00dcretim ortamlar\u0131 i\u00e7in Vault’un y\u00fcksek eri\u015filebilirlik (HA) modunda ve uygun depolama backend’i ile kurulmas\u0131 \u015fiddetle tavsiye edilir.
\n * Vault CLI<\/strong>: Vault sunucusuyla etkile\u015fim kurmak i\u00e7in vault<\/code> komut sat\u0131r\u0131 arac\u0131n\u0131n yerel makinenizde kurulu olmas\u0131 gerekmektedir.
\n * Vault Eri\u015fimi<\/strong>: Vault sunucusunun adresini (VAULT_ADDR<\/code>) ve bir root token’\u0131n\u0131 veya yetkili bir token’\u0131 ayarlam\u0131\u015f olman\u0131z gerekmektedir. Bu, Vault’u ilk yap\u0131land\u0131rmak i\u00e7in gereklidir.<\/p>\n

Bu ara\u00e7lar\u0131n kurulu ve yap\u0131land\u0131r\u0131lm\u0131\u015f oldu\u011fundan emin olduktan sonra, entegrasyon ad\u0131mlar\u0131na ge\u00e7ebiliriz.<\/p>\n

Vault Kurulumu ve Temel Yap\u0131land\u0131rmas\u0131<\/h3>\n

External Secrets Operator’\u0131n Vault ile ileti\u015fim kurabilmesi i\u00e7in \u00f6ncelikle bir Vault sunucusuna ihtiyac\u0131m\u0131z var. Bu b\u00f6l\u00fcmde, DOKS \u00fczerinde Helm kullanarak basit bir Vault kurulumunu ve ESO i\u00e7in gerekli temel yap\u0131land\u0131rmalar\u0131 ele alaca\u011f\u0131z.<\/p>\n

DOKS \u00dczerinde Vault Kurulumu (Geli\u015ftirme Ortam\u0131 \u0130\u00e7in)<\/h4>\n

\u00dcretim ortamlar\u0131 i\u00e7in Vault’un y\u00fcksek eri\u015filebilirlik ve kal\u0131c\u0131 depolama ile yap\u0131land\u0131r\u0131lmas\u0131 gerekir. Ancak bu rehber i\u00e7in, Helm kullanarak tek bir replika ile basit bir Vault sunucusu kuraca\u011f\u0131z.<\/p>\n

1. Vault Helm deposunu ekleyin:<\/strong><\/p>\n

helm repo add hashicorp https:\/\/helm.releases.hashicorp.com\n    helm repo update<\/code><\/pre>\n
2.  Vault i\u00e7in bir namespace olu\u015fturun:<\/strong><\/p>\n
kubectl create namespace vault<\/code><\/pre>\n
3.  Vault’u Helm ile kurun:<\/strong>
\n    Basit bir geli\u015ftirme kurulumu i\u00e7in server.dev.enabled=true<\/code> kullanabiliriz. Bu, otomatik olarak ba\u015flatma (unseal) ve tek bir replika ile \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar.<\/p>\n
helm install vault hashicorp\/vault -n vault --set \"server.dev.enabled=true\" --set \"server.service.type=LoadBalancer\"<\/code><\/pre>\n
    server.service.type=LoadBalancer<\/code> ile Vault’a d\u0131\u015far\u0131dan eri\u015fim sa\u011flayacak bir LoadBalancer servisi olu\u015fturulur. IP adresinin atanmas\u0131 birka\u00e7 dakika s\u00fcrebilir.<\/p>\n
4.  Vault pod’unun \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n:<\/strong><\/p>\n
kubectl get pods -n vault<\/code><\/pre>\n
    Pod’un Running<\/code> durumunda olmas\u0131 gerekir.<\/p>\n
5.  Vault UI ve API eri\u015fimini sa\u011flay\u0131n:<\/strong>
\n    LoadBalancer IP adresini al\u0131n:<\/p>\n
kubectl get svc vault -n vault<\/code><\/pre>\n
    \u00c7\u0131kt\u0131da EXTERNAL-IP<\/code> s\u00fctununda bir IP adresi g\u00f6receksiniz (\u00f6rne\u011fin, 192.0.2.1<\/code>). Bu adres Vault’unuzun VAULT_ADDR<\/code> de\u011feri olacakt\u0131r.
\n    Vault UI’ye http:\/\/:8200<\/code> adresinden eri\u015febilirsiniz.
\n    VAULT_ADDR<\/code> ortam de\u011fi\u015fkenini ayarlay\u0131n:<\/p>\n
export VAULT_ADDR=\"http:\/\/:8200\"<\/code><\/pre>\n
    Geli\u015ftirme modunda kurdu\u011fumuz i\u00e7in VAULT_TOKEN<\/code> otomatik olarak olu\u015fturulur ve vault-0<\/code> pod’unun loglar\u0131nda bulunur.<\/p>\n
kubectl logs vault-0 -n vault | grep \"Root Token:\"<\/code><\/pre>\n
    \u00c7\u0131kt\u0131daki Root Token:<\/code> de\u011ferini kopyalay\u0131n ve VAULT_TOKEN<\/code> olarak ayarlay\u0131n:<\/p>\n
export VAULT_TOKEN=\"s.YOUR_ROOT_TOKEN\" # Kendi token'\u0131n\u0131zla de\u011fi\u015ftirin<\/code><\/pre>\n
    Art\u0131k vault<\/code> CLI ile Vault sunucusuyla etkile\u015fim kurabilirsiniz. \u00d6rne\u011fin:<\/p>\n
vault status<\/code><\/pre>\n
    Sealed: false<\/code> ve Initialized: true<\/code> g\u00f6rmelisiniz.<\/p>\n
Vault Yetkilendirme Y\u00f6ntemi Yap\u0131land\u0131rmas\u0131<\/h4>\n
External Secrets Operator’\u0131n Vault’a g\u00fcvenli bir \u015fekilde kimlik do\u011frulayabilmesi i\u00e7in Kubernetes Yetkilendirme Y\u00f6ntemini (Auth Method) yap\u0131land\u0131rmam\u0131z gerekir. Bu y\u00f6ntem, Kubernetes Service Account token’lar\u0131n\u0131 kullanarak Vault’a kimlik do\u011frulamas\u0131 yapmay\u0131 sa\u011flar.<\/p>\n
1.  Kubernetes Yetkilendirme Y\u00f6ntemini etkinle\u015ftirin:<\/strong><\/p>\n
vault auth enable kubernetes<\/code><\/pre>\n
2.  Vault’u Kubernetes k\u00fcmenize ba\u011flay\u0131n:<\/strong>
\n    Vault’un Kubernetes API’si ile ileti\u015fim kurabilmesi i\u00e7in baz\u0131 yap\u0131land\u0131rma parametreleri gereklidir.
\n    *   kubernetes_host<\/code>: Kubernetes API sunucusunun URL’si.
\n    *   kubernetes_ca_cert<\/code>: Kubernetes k\u00fcmenizin CA sertifikas\u0131 (Base64 kodlu).
\n    *   token_reviewer_jwt<\/code>: Vault’un Kubernetes Service Account token’lar\u0131n\u0131 do\u011frulamak i\u00e7in kullanaca\u011f\u0131 bir Service Account token’\u0131.<\/p>\n
    \u00d6nce kubernetes_host<\/code> ve kubernetes_ca_cert<\/code> de\u011ferlerini alal\u0131m:<\/p>\n
KUBERNETES_HOST=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')\n    KUBERNETES_CA_CERT=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')<\/code><\/pre>\n
    \u015eimdi Vault i\u00e7in bir token_reviewer_jwt<\/code> olu\u015fturmal\u0131y\u0131z. Bu, Vault’un Kubernetes Service Account token’lar\u0131n\u0131 do\u011frulamak i\u00e7in kullanaca\u011f\u0131 \u00f6zel bir Service Account’tur.<\/p>\n
kubectl create serviceaccount vault-token-reviewer -n vault\n    kubectl create clusterrolebinding vault-token-reviewer-binding --clusterrole=system:auth-delegator --serviceaccount=vault:vault-token-reviewer\n    TOKEN_REVIEWER_JWT=$(kubectl create token vault-token-reviewer -n vault)<\/code><\/pre>\n
    Not<\/strong>: kubectl create token<\/code> komutu, Kubernetes 1.24 ve sonras\u0131 i\u00e7in Service Account token’\u0131 olu\u015fturman\u0131n tercih edilen yoludur. Daha eski s\u00fcr\u00fcmlerde, Service Account’un secret’\u0131ndan token’\u0131 manuel olarak alman\u0131z gerekebilir.<\/p>\n
    \u015eimdi t\u00fcm bu de\u011ferleri kullanarak Vault Kubernetes auth backend’ini yap\u0131land\u0131r\u0131n:<\/p>\n
vault write auth\/kubernetes\/config \\\n        kubernetes_host=\"$KUBERNETES_HOST\" \\\n        kubernetes_ca_cert=\"$KUBERNETES_CA_CERT\" \\\n        token_reviewer_jwt=\"$TOKEN_REVIEWER_JWT\"<\/code><\/pre>\n
Vault Politikalar\u0131 Olu\u015fturma<\/h4>\n
Vault’ta gizliliklere eri\u015fimi kontrol etmek i\u00e7in politikalar (policies) tan\u0131mlamam\u0131z gerekir. Bu politika, External Secrets Operator’\u0131n belirli bir gizlilik yolundan okumas\u0131na izin verecektir.<\/p>\n
1.  Bir politika dosyas\u0131 olu\u015fturun (\u00f6rne\u011fin eso-policy.hcl<\/code>):<\/strong><\/p>\n
path \"secret\/data\/my-app\/*\" {\n      capabilities = [\"read\"]\n    }<\/code><\/pre>\n
    Bu politika, secret\/data\/my-app\/<\/code> yolu alt\u0131ndaki t\u00fcm gizliliklere okuma eri\u015fimi verir. KV v2 motoru kulland\u0131\u011f\u0131m\u0131z i\u00e7in secret\/data\/<\/code> \u00f6neki \u00f6nemlidir.<\/p>\n
2.  Politikay\u0131 Vault’a y\u00fckleyin:<\/strong><\/p>\n
vault policy write eso-policy eso-policy.hcl<\/code><\/pre>\n
Vault Rolleri Olu\u015fturma<\/h4>\n
Vault rol\u00fc, bir Kubernetes Service Account’\u0131n\u0131 bir veya daha fazla Vault politikas\u0131na ba\u011flar. ESO, bu rol\u00fc kullanarak kimlik do\u011frulamas\u0131 yapacak ve ilgili politikalarla yetkilendirilecektir.<\/p>\n
vault write auth\/kubernetes\/role\/eso-role \\\n    bound_service_account_names=external-secrets \\\n    bound_service_account_namespaces=external-secrets \\\n    policies=eso-policy \\\n    ttl=1h<\/code><\/pre>\n
Burada:
\n*   eso-role<\/code>: Olu\u015fturdu\u011fumuz rol\u00fcn ad\u0131.
\n*   bound_service_account_names<\/code>: Bu role ba\u011flanabilecek Service Account’\u0131n ad\u0131. ESO’nun varsay\u0131lan Service Account’\u0131 external-secrets<\/code>‘t\u0131r.
\n*   bound_service_account_namespaces<\/code>: Bu role ba\u011flanabilecek Service Account’\u0131n namespace’i. ESO’yu external-secrets<\/code> namespace’ine kuraca\u011f\u0131z.
\n*   policies<\/code>: Bu role atanan Vault politikalar\u0131. Daha \u00f6nce olu\u015fturdu\u011fumuz eso-policy<\/code>‘yi kullan\u0131yoruz.
\n*   ttl<\/code>: Kimlik do\u011frulama sonras\u0131 verilen token’\u0131n ge\u00e7erlilik s\u00fcresi.<\/p>\n
Gizlilik Yolu Olu\u015fturma ve De\u011fer Ekleme<\/h4>\n
\u015eimdi Vault’a ESO’nun okuyaca\u011f\u0131 bir gizlilik ekleyelim. KV v2 gizlilik motorunu kullanaca\u011f\u0131z.<\/p>\n
1.  KV v2 gizlilik motorunu etkinle\u015ftirin (e\u011fer zaten etkin de\u011filse):<\/strong><\/p>\n
vault secrets enable -path=secret kv-v2<\/code><\/pre>\n
2.  Gizlili\u011fi ekleyin:<\/strong>
\n    my-app\/db<\/code> yoluna username<\/code> ve password<\/code> de\u011ferlerini ekleyelim.<\/p>\n
vault kv put secret\/my-app\/db username=\"dbuser\" password=\"supersecretpassword\"<\/code><\/pre>\n
    Not<\/strong>: KV v2 motorunda secret\/data\/<\/code> yolu otomatik olarak eklenir. Bu nedenle vault kv put secret\/my-app\/db<\/code> komutu asl\u0131nda secret\/data\/my-app\/db<\/code> yoluna yazar.<\/p>\n
3.  Gizlili\u011fi do\u011frulay\u0131n:<\/strong><\/p>\n
vault kv get secret\/my-app\/db<\/code><\/pre>\n
    \u00c7\u0131kt\u0131da girdi\u011finiz username<\/code> ve password<\/code> de\u011ferlerini g\u00f6rmelisiniz.<\/p>\n
Vault taraf\u0131ndaki t\u00fcm temel yap\u0131land\u0131rmalar\u0131m\u0131z tamamland\u0131. Art\u0131k External Secrets Operator’\u0131 kurmaya ve yap\u0131land\u0131rmaya ge\u00e7ebiliriz.<\/p>\n
External Secrets Operator Kurulumu<\/h3>\n
External Secrets Operator’\u0131 Kubernetes k\u00fcmenize Helm kullanarak kurmak olduk\u00e7a basittir.<\/p>\n
1.  External Secrets Helm deposunu ekleyin:<\/strong><\/p>\n
helm repo add external-secrets https:\/\/charts.external-secrets.io\n    helm repo update<\/code><\/pre>\n
2.  External Secrets Operator’\u0131 kurun:<\/strong>
\n    ESO’yu kendi namespace’ine kuraca\u011f\u0131z.<\/p>\n
helm install external-secrets external-secrets\/external-secrets -n external-secrets --create-namespace<\/code><\/pre>\n
    Bu komut, external-secrets<\/code> ad\u0131nda bir namespace olu\u015fturacak ve ESO’nun t\u00fcm bile\u015fenlerini (deployment, service account, rbac vb.) bu namespace’e da\u011f\u0131tacakt\u0131r.<\/p>\n
3.  Kurulumu do\u011frulay\u0131n:<\/strong>
\n    ESO pod’lar\u0131n\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olun:<\/p>\n
kubectl get pods -n external-secrets<\/code><\/pre>\n
    external-secrets-xxx<\/code> ve external-secrets-webhook-xxx<\/code> pod’lar\u0131n\u0131n Running<\/code> durumunda olmas\u0131 gerekir.<\/p>\n
External Secrets Operator Kaynaklar\u0131n\u0131 Yap\u0131land\u0131rma<\/h3>\n
ESO kurulduktan sonra, Vault’tan gizlilikleri \u00e7ekmek i\u00e7in gerekli \u00f6zel kaynaklar\u0131 (Custom Resources) olu\u015fturmam\u0131z gerekir: SecretStore<\/code> ve ExternalSecret<\/code>.<\/p>\n
Uygulama \u0130\u00e7in Service Account Olu\u015fturma<\/h4>\n
Uygulamam\u0131z\u0131n t\u00fcketece\u011fi Kubernetes Secret’\u0131n\u0131 olu\u015fturmak ve y\u00f6netmek i\u00e7in bir Service Account’a ihtiyac\u0131m\u0131z yok. Ancak Vault’a kimlik do\u011frulamas\u0131 yapacak olan ESO’nun Service Account’\u0131 zaten Helm kurulumu s\u0131ras\u0131nda olu\u015ftu (external-secrets<\/code> namespace’inde external-secrets<\/code> SA).<\/p>\n
E\u011fer uygulamam\u0131z do\u011frudan Vault’a eri\u015fecek olsayd\u0131, o zaman uygulama i\u00e7in bir Service Account olu\u015fturup Vault’ta bir rol tan\u0131mlamam\u0131z gerekirdi. Ancak ESO senaryosunda, uygulamalar standart Kubernetes Secrets’\u0131 kullan\u0131r, bu nedenle do\u011frudan Vault ile etkile\u015fime girmezler.<\/p>\n
SecretStore Olu\u015fturma<\/h4>\n
SecretStore<\/code> (veya ClusterSecretStore<\/code>), External Secrets Operator’a harici gizlilik y\u00f6neticisiyle (bu durumda Vault) nas\u0131l ileti\u015fim kuraca\u011f\u0131n\u0131 ve kimlik do\u011frulayaca\u011f\u0131n\u0131 bildirir. SecretStore<\/code> bir namespace’e \u00f6zg\u00fcyken, ClusterSecretStore<\/code> k\u00fcme genelinde kullan\u0131labilir. Bu \u00f6rnekte, SecretStore<\/code> kullanaca\u011f\u0131z.<\/p>\n
1.  SecretStore<\/code> YAML dosyas\u0131n\u0131 olu\u015fturun (\u00f6rne\u011fin vault-secretstore.yaml<\/code>):<\/strong><\/p>\n
apiVersion: external-secrets.io\/v1beta1\n    kind: SecretStore\n    metadata:\n      name: vault-secret-store\n      namespace: default # Bu SecretStore'u kullanacak uygulamalar\u0131n namespace'i\n    spec:\n      provider:\n        vault:\n          server: \"http:\/\/:8200\" # Vault sunucunuzun EXTERNAL-IP'si\n          path: \"kubernetes\" # Vault'taki Kubernetes auth method'un yolu\n          version: \"v2\" # KV motorunun s\u00fcr\u00fcm\u00fc\n          auth:\n            kubernetes:\n              mountPath: \"kubernetes\" # Vault'taki Kubernetes auth method'un yolu\n              serviceAccountRef:\n                name: external-secrets # ESO'nun Service Account'\u0131\n                namespace: external-secrets # ESO'nun Service Account'\u0131n\u0131n namespace'i\n              role: \"eso-role\" # Vault'ta tan\u0131mlad\u0131\u011f\u0131m\u0131z rol<\/code><\/pre>\n
    server<\/code> alan\u0131n\u0131 Vault’unuzun EXTERNAL_IP<\/code>‘si ile g\u00fcncellemeyi unutmay\u0131n.<\/p>\n
2.  SecretStore<\/code>‘u uygulay\u0131n:<\/strong><\/p>\n
kubectl apply -f vault-secretstore.yaml<\/code><\/pre>\n
3.  SecretStore<\/code>‘un durumunu kontrol edin:<\/strong><\/p>\n
kubectl get secretstore vault-secret-store -n default<\/code><\/pre>\n
    READY<\/code> s\u00fctununun True<\/code> olmas\u0131 gerekir. Herhangi bir hata varsa, kubectl describe secretstore vault-secret-store -n default<\/code> komutuyla detaylara bakabilirsiniz.<\/p>\n
ExternalSecret Olu\u015fturma<\/h4>\n
ExternalSecret<\/code> kayna\u011f\u0131, ESO’ya hangi harici gizlili\u011fi hangi Kubernetes Secret’\u0131na d\u00f6n\u00fc\u015ft\u00fcrece\u011fini s\u00f6yler.<\/p>\n
1.  ExternalSecret<\/code> YAML dosyas\u0131n\u0131 olu\u015fturun (\u00f6rne\u011fin my-app-external-secret.yaml<\/code>):<\/strong><\/p>\n
apiVersion: external-secrets.io\/v1beta1\n    kind: ExternalSecret\n    metadata:\n      name: my-app-db-external-secret\n      namespace: default # Kubernetes Secret'\u0131n\u0131n olu\u015fturulaca\u011f\u0131 namespace\n    spec:\n      refreshInterval: \"1m\" # Gizliliklerin ne s\u0131kl\u0131kla yenilenece\u011fi\n      secretStoreRef:\n        name: vault-secret-store # Kullan\u0131lacak SecretStore'un ad\u0131\n        kind: SecretStore\n      target:\n        name: my-app-db-secret # Olu\u015fturulacak Kubernetes Secret'\u0131n\u0131n ad\u0131\n        creationPolicy: Owner # Secret'\u0131n sahibi ExternalSecret olacak\n      data:\n        - secretKey: DB_USERNAME # Kubernetes Secret'\u0131ndaki anahtar\n          remoteRef:\n            key: secret\/data\/my-app\/db # Vault'taki gizlili\u011fin tam yolu (KV v2 i\u00e7in 'data' dahil)\n            property: username # Vault gizlili\u011findeki alan ad\u0131\n        - secretKey: DB_PASSWORD # Kubernetes Secret'\u0131ndaki anahtar\n          remoteRef:\n            key: secret\/data\/my-app\/db # Vault'taki gizlili\u011fin tam yolu\n            property: password # Vault gizlili\u011findeki alan ad\u0131<\/code><\/pre>\n
    Burada remoteRef.key<\/code> alan\u0131n\u0131n secret\/data\/my-app\/db<\/code> \u015feklinde olmas\u0131 \u00f6nemlidir, \u00e7\u00fcnk\u00fc KV v2 motoru gizlilikleri dahili olarak data<\/code> anahtar\u0131 alt\u0131nda saklar.<\/p>\n
2.  ExternalSecret<\/code>‘\u0131 uygulay\u0131n:<\/strong><\/p>\n
kubectl apply -f my-app-external-secret.yaml<\/code><\/pre>\n
3.  ExternalSecret<\/code>‘\u0131n durumunu kontrol edin:<\/strong><\/p>\n
kubectl get externalsecret my-app-db-external-secret -n default<\/code><\/pre>\n
    READY<\/code> s\u00fctununun True<\/code> olmas\u0131 gerekir.<\/p>\n
Uygulama Entegrasyonu ve Test<\/h3>\n
External Secrets Operator, Vault’tan gizlilikleri ba\u015far\u0131yla \u00e7ekip Kubernetes Secret’\u0131na d\u00f6n\u00fc\u015ft\u00fcrd\u00fc\u011f\u00fcnde, uygulamalar\u0131n\u0131z bu Secret’\u0131 standart Kubernetes y\u00f6ntemleriyle kullanabilir.<\/p>\n
Kubernetes Secret’\u0131 Do\u011frulama<\/h4>\n
ESO’nun ExternalSecret<\/code> tan\u0131m\u0131n\u0131za g\u00f6re bir Kubernetes Secret’\u0131 olu\u015fturup olu\u015fturmad\u0131\u011f\u0131n\u0131 kontrol edelim.<\/p>\n
kubectl get secret my-app-db-secret -n default -o yaml<\/code><\/pre>\n
\u00c7\u0131kt\u0131 a\u015fa\u011f\u0131daki gibi olmal\u0131 (Base64 kodlu de\u011ferlerle):<\/p>\n
apiVersion: v1\ndata:\n  DB_PASSWORD: c3VwZXJzZWNyZXRwYXNzd29yZA== # \"supersecretpassword\" Base64 kodlu hali\n  DB_USERNAME: ZGJ1c2Vy # \"dbuser\" Base64 kodlu hali\nkind: Secret\nmetadata:\n  name: my-app-db-secret\n  namespace: default\n  # ... di\u011fer metadata ...\ntype: Opaque<\/code><\/pre>\n
data<\/code> alan\u0131ndaki de\u011ferleri Base64’ten \u00e7\u00f6zerek do\u011frulayabilirsiniz:<\/p>\n
echo \"c3VwZXJzZWNyZXRwYXNzd29yZA==\" | base64 --decode\necho \"ZGJ1c2Vy\" | base64 --decode<\/code><\/pre>\n
E\u011fer gizlilik do\u011fru bir \u015fekilde olu\u015fturulduysa, ESO entegrasyonu ba\u015far\u0131l\u0131 demektir.<\/p>\n
Uygulaman\u0131n Secret’\u0131 Kullanmas\u0131<\/h4>\n
\u015eimdi basit bir test pod’u da\u011f\u0131tarak bu Kubernetes Secret’\u0131n\u0131 nas\u0131l kullanabilece\u011fimizi g\u00f6sterelim.<\/p>\n
1.  Test Pod’u YAML dosyas\u0131 olu\u015fturun (\u00f6rne\u011fin test-app-pod.yaml<\/code>):<\/strong><\/p>\n
apiVersion: v1\n    kind: Pod\n    metadata:\n      name: test-app\n      namespace: default\n    spec:\n      containers:\n      - name: test-app-container\n        image: busybox\n        command: [\"sh\", \"-c\", \"echo 'DB_USERNAME: $DB_USERNAME' && echo 'DB_PASSWORD: $DB_PASSWORD' && sleep 3600\"]\n        envFrom:\n        - secretRef:\n            name: my-app-db-secret # Olu\u015fturdu\u011fumuz Kubernetes Secret'\u0131n\u0131n ad\u0131\n      restartPolicy: Never<\/code><\/pre>\n
    Bu Pod, my-app-db-secret<\/code> adl\u0131 Secret’taki t\u00fcm anahtarlar\u0131 ortam de\u011fi\u015fkenleri olarak y\u00fckler ve bu de\u011ferleri ekrana yazd\u0131r\u0131r.<\/p>\n
2.  Test Pod’u da\u011f\u0131t\u0131n:<\/strong><\/p>\n
kubectl apply -f test-app-pod.yaml<\/code><\/pre>\n
3.  Pod’un loglar\u0131n\u0131 kontrol edin:<\/strong><\/p>\n
kubectl logs test-app -n default<\/code><\/pre>\n
    Loglarda a\u015fa\u011f\u0131daki gibi bir \u00e7\u0131kt\u0131 g\u00f6rmelisiniz:<\/p>\n
DB_USERNAME: dbuser\n    DB_PASSWORD: supersecretpassword<\/code><\/pre>\n
    Bu, uygulaman\u0131z\u0131n Vault’tan ESO arac\u0131l\u0131\u011f\u0131yla gelen gizlilikleri ba\u015far\u0131yla kulland\u0131\u011f\u0131n\u0131 g\u00f6sterir.<\/p>\n
De\u011fi\u015fikliklerin Senkronizasyonu<\/h4>\n
External Secrets Operator’\u0131n en g\u00fc\u00e7l\u00fc \u00f6zelliklerinden biri, harici gizlilik deposundaki de\u011fi\u015fiklikleri otomatik olarak alg\u0131lay\u0131p Kubernetes Secret’\u0131n\u0131 g\u00fcncellemesidir.<\/p>\n
1.  Vault’taki gizlili\u011fi g\u00fcncelleyin:<\/strong><\/p>\n
vault kv put secret\/my-app\/db username=\"newdbuser\" password=\"newsupersecretpassword\"<\/code><\/pre>\n
2.  Birka\u00e7 dakika bekleyin (ExternalSecret’taki refreshInterval<\/code> s\u00fcresi kadar, \u00f6rne\u011fin 1 dakika).<\/strong><\/p>\n
3.  Kubernetes Secret’\u0131n\u0131 tekrar kontrol edin:<\/strong><\/p>\n
kubectl get secret my-app-db-secret -n default -o yaml<\/code><\/pre>\n
    data<\/code> alan\u0131ndaki DB_USERNAME<\/code> ve DB_PASSWORD<\/code> de\u011ferlerinin Base64 kodlu yeni de\u011ferlere g\u00fcncellendi\u011fini g\u00f6receksiniz.<\/p>\n
4.  Test Pod’u silip tekrar olu\u015fturun (e\u011fer ortam de\u011fi\u015fkenleri kullan\u0131yorsan\u0131z, Pod’un yeniden ba\u015flat\u0131lmas\u0131 gerekir):<\/strong><\/p>\n
kubectl delete pod test-app -n default\n    kubectl apply -f test-app-pod.yaml\n    kubectl logs test-app -n default<\/code><\/pre>\n
    Loglarda yeni kullan\u0131c\u0131 ad\u0131 ve \u015fifre de\u011ferlerini g\u00f6rmelisiniz. Bu, gizliliklerin ba\u015far\u0131l\u0131 bir \u015fekilde yenilendi\u011fini ve uygulaman\u0131n g\u00fcncel de\u011ferleri ald\u0131\u011f\u0131n\u0131 g\u00f6sterir.<\/p>\n
Geli\u015fmi\u015f Yap\u0131land\u0131rma ve En \u0130yi Uygulamalar<\/h3>\n
External Secrets Operator ve Vault entegrasyonu, temel kurulumun \u00f6tesinde bir\u00e7ok geli\u015fmi\u015f yap\u0131land\u0131rma ve en iyi uygulama sunar.<\/p>\n
Gizlilik Yenileme (Secret Rotation)<\/h4>\n
ExternalSecret<\/code> kayna\u011f\u0131ndaki refreshInterval<\/code> parametresi, ESO’nun harici gizlilik deposunu ne s\u0131kl\u0131kla kontrol edece\u011fini ve Kubernetes Secret’\u0131n\u0131 g\u00fcncelleyece\u011fini belirler. Bu, gizlilik yenileme politikalar\u0131n\u0131 otomatikle\u015ftirmenin anahtar\u0131d\u0131r. \u00d6rne\u011fin, veritaban\u0131 \u015fifrelerini d\u00fczenli olarak de\u011fi\u015ftiren bir Vault dinamik gizlilik motoru kullan\u0131yorsan\u0131z, ESO bu yeni kimlik bilgilerini otomatik olarak Kubernetes’e senkronize edecektir.<\/p>\n
Dinamik Gizlilikler (Dynamic Secrets)<\/h4>\n
Vault’un dinamik gizlilikler \u00f6zelli\u011fi, belirli bir s\u00fcre i\u00e7in ge\u00e7erli olan ve otomatik olarak iptal edilen kimlik bilgileri olu\u015fturur (\u00f6rne\u011fin, bir veritaban\u0131 i\u00e7in k\u0131sa \u00f6m\u00fcrl\u00fc kullan\u0131c\u0131 ad\u0131\/\u015fifre \u00e7ifti). ESO, bu dinamik gizlilikleri de \u00e7ekebilir. Tek yapman\u0131z gereken ExternalSecret<\/code> tan\u0131m\u0131n\u0131zda remoteRef.key<\/code> alan\u0131n\u0131 dinamik gizlilik yolunu g\u00f6sterecek \u015fekilde yap\u0131land\u0131rmakt\u0131r. ESO, token’\u0131n veya gizlili\u011fin TTL’i doldu\u011funda otomatik olarak yenisini talep edecek ve Kubernetes Secret’\u0131n\u0131 g\u00fcncelleyecektir.<\/p>\n
Farkl\u0131 Gizlilik Motorlar\u0131<\/h4>\n
Vault, KV (anahtar\/de\u011fer) motoru d\u0131\u015f\u0131nda bir\u00e7ok farkl\u0131 gizlilik motorunu destekler:
\n*   Veritaban\u0131 Gizlilik Motoru<\/strong>: PostgreSQL, MySQL gibi veritabanlar\u0131 i\u00e7in dinamik kimlik bilgileri olu\u015fturur.
\n*   AWS Gizlilik Motoru<\/strong>: AWS IAM kimlik bilgileri olu\u015fturur.
\n*   PKI Gizlilik Motoru<\/strong>: Sertifikalar ve \u00f6zel anahtarlar olu\u015fturur.
\nESO, bu motorlardan gelen gizlilikleri de \u00e7ekebilir. SecretStore<\/code> yap\u0131land\u0131rman\u0131zda Vault provider alt\u0131nda kv<\/code> yerine ilgili motorun yolunu ve versiyonunu belirtmeniz yeterlidir.<\/p>\n
Yetkilendirme Stratejileri<\/h4>\n
*   Vault Politikalar\u0131<\/strong>: Vault’ta en az ayr\u0131cal\u0131k prensibiyle politikalar olu\u015fturun. ESO’nun Service Account’\u0131na sadece ihtiyac\u0131 olan gizlilik yollar\u0131na eri\u015fim izni verin.
\n*   Kubernetes RBAC<\/strong>: Kubernetes i\u00e7inde SecretStore<\/code> ve ExternalSecret<\/code> kaynaklar\u0131na eri\u015fimi RBAC ile k\u0131s\u0131tlay\u0131n. Hangi ekibin veya kullan\u0131c\u0131n\u0131n hangi gizlilik tan\u0131mlar\u0131n\u0131 olu\u015fturabilece\u011fini kontrol edin.
\n*   Namespace \u0130zolasyonu<\/strong>: Her uygulama veya ekip i\u00e7in ayr\u0131 Kubernetes namespace’leri ve bu namespace’lere \u00f6zel SecretStore<\/code>‘lar kullan\u0131n. Bu, gizlilik eri\u015fimini daha da izole eder.<\/p>\n
G\u00fcvenlik \u0130pu\u00e7lar\u0131<\/h4>\n
*   Vault HA Kurulumu<\/strong>: \u00dcretim ortamlar\u0131nda Vault’u y\u00fcksek eri\u015filebilirlik (HA) modunda da\u011f\u0131t\u0131n ve kal\u0131c\u0131 depolama backend’i (\u00f6rne\u011fin, Consul, Integrated Storage) kullan\u0131n.
\n*   TLS Kullan\u0131m\u0131<\/strong>: Vault ile ESO aras\u0131ndaki t\u00fcm ileti\u015fimin TLS \u00fczerinden \u015fifrelendi\u011finden emin olun. SecretStore<\/code> tan\u0131m\u0131nda server<\/code> URL’sini https<\/code> olarak belirtin ve gerekti\u011finde sertifika do\u011frulamas\u0131n\u0131 yap\u0131land\u0131r\u0131n.
\n*   Denetim Kay\u0131tlar\u0131<\/strong>: Vault’un denetim kay\u0131tlar\u0131n\u0131 etkinle\u015ftirin ve merkezi bir loglama sistemine g\u00f6nderin. Bu, kimin ne zaman hangi gizlili\u011fe eri\u015fti\u011fini izlemenizi sa\u011flar.
\n*   Gizliliklerin \u015eifrelenmesi<\/strong>: Kubernetes Secrets’\u0131, k\u00fcme d\u00fczeyinde KMS (Key Management Service) veya bir \u015fifreleme sa\u011flay\u0131c\u0131s\u0131 (encryption provider) ile \u015fifreleyerek depoda (at-rest) da g\u00fcvende tuttu\u011funuzdan emin olun. DOKS gibi y\u00f6netilen Kubernetes hizmetleri genellikle bu \u00f6zelli\u011fi sa\u011flar.
\n*   refreshInterval<\/code> Optimizasyonu<\/strong>: refreshInterval<\/code>‘\u0131 \u00e7ok k\u0131sa ayarlamak Vault’a gereksiz y\u00fck bindirebilir. Uygulaman\u0131z\u0131n gizlilik yenileme tolerans\u0131na g\u00f6re uygun bir de\u011fer se\u00e7in.<\/p>\n
\u00dcretim Ortam\u0131 \u0130\u00e7in Dikkat Edilmesi Gerekenler<\/h4>\n
*   Vault Yedekleme ve Geri Y\u00fckleme<\/strong>: Vault verilerini d\u00fczenli olarak yedekleyin ve felaket kurtarma planlar\u0131n\u0131z\u0131n bir par\u00e7as\u0131 olarak geri y\u00fckleme prosed\u00fcrlerini test edin.
\n*   \u0130zleme ve Uyar\u0131lar<\/strong>: Vault ve External Secrets Operator’\u0131n durumunu, performans\u0131n\u0131 ve loglar\u0131n\u0131 izleyin. Herhangi bir hata veya beklenmedik davran\u0131\u015f durumunda uyar\u0131lar al\u0131n.
\n*   Versiyon Y\u00f6netimi<\/strong>: Vault ve ESO’nun g\u00fcncel ve desteklenen versiyonlar\u0131n\u0131 kulland\u0131\u011f\u0131n\u0131zdan emin olun. G\u00fcvenlik yamalar\u0131n\u0131 ve yeni \u00f6zellikleri takip edin.
\n*   Terraform veya GitOps<\/strong>: T\u00fcm bu yap\u0131land\u0131rmalar\u0131 (Vault politikalar\u0131, rolleri, ESO kaynaklar\u0131) Terraform veya GitOps ara\u00e7lar\u0131 (Argo CD, Flux CD) ile kod olarak y\u00f6netmek, tutarl\u0131l\u0131\u011f\u0131 ve tekrarlanabilirli\u011fi sa\u011flar.<\/p>\n
Sonu\u00e7<\/h3>\n
Bu makalede, DigitalOcean Kubernetes Service (DOKS) ortam\u0131nda External Secrets Operator’\u0131 HashiCorp Vault ile entegre etmenin kapsaml\u0131 bir rehberini sunduk. Kubernetes’in yerel gizlilik y\u00f6netimindeki eksikliklerini ve Vault’un merkezi, g\u00fcvenli ve denetlenebilir bir \u00e7\u00f6z\u00fcm olarak nas\u0131l \u00f6ne \u00e7\u0131kt\u0131\u011f\u0131n\u0131 inceledik. Ard\u0131ndan, External Secrets Operator’\u0131n bu iki d\u00fcnyay\u0131 nas\u0131l bir araya getirdi\u011fini ve uygulamalar\u0131n standart Kubernetes Secrets’\u0131 kullanmaya devam ederken Vault’un g\u00fcc\u00fcnden faydalanmas\u0131n\u0131 sa\u011flad\u0131\u011f\u0131n\u0131 g\u00f6sterdik.<\/p>\n
Ad\u0131m ad\u0131m Vault kurulumu, Kubernetes yetkilendirme y\u00f6ntemi yap\u0131land\u0131rmas\u0131, politika ve rol tan\u0131mlamalar\u0131 ile Vault’a gizlilik ekleme s\u00fcre\u00e7lerini tamamlad\u0131k. Daha sonra External Secrets Operator’\u0131 Helm ile kurduk ve SecretStore<\/code> ile ExternalSecret<\/code> kaynaklar\u0131n\u0131 olu\u015fturarak Vault’taki gizlilikleri Kubernetes’e senkronize ettik. Son olarak, bir test uygulamas\u0131yla bu entegrasyonun \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulad\u0131k ve gizlilik de\u011fi\u015fikliklerinin otomatik olarak nas\u0131l senkronize edildi\u011fini g\u00f6zlemledik.<\/p>\n
Bu entegrasyon, Kubernetes ortamlar\u0131nda gizlilik y\u00f6netimini \u00f6nemli \u00f6l\u00e7\u00fcde basitle\u015ftirir, g\u00fcvenli\u011fi art\u0131r\u0131r ve geli\u015ftirici verimlili\u011fini destekler. Uygulamalar\u0131n\u0131z\u0131n hassas verilerini g\u00fcvenli bir \u015fekilde y\u00f6netmek i\u00e7in merkezi bir \u00e7\u00f6z\u00fcm ar\u0131yorsan\u0131z, External Secrets Operator ve Vault kombinasyonu g\u00fc\u00e7l\u00fc ve esnek bir se\u00e7enektir. Geli\u015fmi\u015f yap\u0131land\u0131rma ve en iyi uygulamalar\u0131 takip ederek, bu \u00e7\u00f6z\u00fcm\u00fc \u00fcretim ortamlar\u0131n\u0131zda g\u00fcvenle kullanabilirsiniz. Bu rehberin, DOKS \u00fczerindeki Kubernetes k\u00fcmelerinizde g\u00fcvenli gizlilik y\u00f6netimini uygulaman\u0131za yard\u0131mc\u0131 olaca\u011f\u0131n\u0131 umuyoruz.
\n<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"DOKS’ta External Secrets Operator’\u0131 Vault ile Yap\u0131land\u0131rma Rehberi\nGiri\u015f\nBulut tabanl\u0131 uygulamalar\u0131n y\u00fckseli\u015fiyle birlikte, g\u00fcvenlik ve \u00f6z","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-33710","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nDOKS'ta External Secrets Operator'\u0131 Vault ile Yap\u0131land\u0131rma Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DOKS'ta External Secrets Operator'\u0131 Vault ile Yap\u0131land\u0131rma Rehberi\" \/>\n<meta property=\"og:description\" content=\"DOKS'ta External Secrets Operator'\u0131 Vault ile Yap\u0131land\u0131rma Rehberi Giri\u015f Bulut tabanl\u0131 uygulamalar\u0131n y\u00fckseli\u015fiyle birlikte, g\u00fcvenlik ve \u00f6z\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-06T02:40:58+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"21 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"DOKS’ta External Secrets Operator’\u0131 Vault ile Yap\u0131land\u0131rma Rehberi\",\"datePublished\":\"2025-11-06T02:40:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/\"},\"wordCount\":3466,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/\",\"name\":\"DOKS'ta External Secrets Operator'\u0131 Vault ile Yap\u0131land\u0131rma Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-11-06T02:40:58+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"DOKS’ta External Secrets Operator’\u0131 Vault ile Yap\u0131land\u0131rma Rehberi\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"DOKS'ta External Secrets Operator'\u0131 Vault ile Yap\u0131land\u0131rma Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/","og_locale":"tr_TR","og_type":"article","og_title":"DOKS'ta External Secrets Operator'\u0131 Vault ile Yap\u0131land\u0131rma Rehberi","og_description":"DOKS'ta External Secrets Operator'\u0131 Vault ile Yap\u0131land\u0131rma Rehberi Giri\u015f Bulut tabanl\u0131 uygulamalar\u0131n y\u00fckseli\u015fiyle birlikte, g\u00fcvenlik ve \u00f6z","og_url":"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-11-06T02:40:58+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"21 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"DOKS’ta External Secrets Operator’\u0131 Vault ile Yap\u0131land\u0131rma Rehberi","datePublished":"2025-11-06T02:40:58+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/"},"wordCount":3466,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/","url":"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/","name":"DOKS'ta External Secrets Operator'\u0131 Vault ile Yap\u0131land\u0131rma Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-11-06T02:40:58+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/doksta-external-secrets-operatori-vault-ile-yapilandirma-rehberi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"DOKS’ta External Secrets Operator’\u0131 Vault ile Yap\u0131land\u0131rma Rehberi"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=33710"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33710\/revisions"}],"predecessor-version":[{"id":33711,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33710\/revisions\/33711"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=33710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=33710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=33710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}