{"id":44776,"date":"2026-09-19T09:07:53","date_gmt":"2026-09-19T06:07:53","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/"},"modified":"2026-09-19T09:08:23","modified_gmt":"2026-09-19T06:08:23","slug":"oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/","title":{"rendered":"OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim"},"content":{"rendered":"<h2>OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim<\/h2>\n<p>Modern bulut tabanl\u0131 uygulamalar ve otomasyon s\u00fcre\u00e7leri, s\u00fcrekli olarak farkl\u0131 hizmetlere ve kaynaklara eri\u015fim ihtiyac\u0131 duyar. Bu eri\u015fimi sa\u011flaman\u0131n geleneksel yolu, uzun \u00f6m\u00fcrl\u00fc API anahtarlar\u0131, hizmet hesaplar\u0131 veya statik kimlik bilgileri kullanmakt\u0131. Ancak bu y\u00f6ntemler, g\u00fcvenlik a\u00e7\u0131klar\u0131, y\u00f6netim zorluklar\u0131 ve uyumluluk sorunlar\u0131 gibi ciddi riskleri beraberinde getirir. Peki, GitHub Actions, Kubernetes podlar\u0131 veya yapay zeka ajanlar\u0131 gibi i\u015f y\u00fcklerinin, kal\u0131c\u0131 kimlik bilgileri olmaks\u0131z\u0131n OCI (Oracle Cloud Infrastructure) kaynaklar\u0131na g\u00fcvenli bir \u015fekilde eri\u015fmesini nas\u0131l sa\u011flayabiliriz? \u0130\u015fte tam bu noktada OCI Workload Identity Federation (\u0130\u015f Y\u00fck\u00fc Kimlik Federasyonu) devreye giriyor ve bu makale, bu devrim niteli\u011findeki \u00e7\u00f6z\u00fcm\u00fc derinlemesine inceleyerek, modern bulut g\u00fcvenli\u011fi paradigmalar\u0131n\u0131 nas\u0131l yeniden \u015fekillendirdi\u011fini anlatacak.<\/p>\n<h3>Kal\u0131c\u0131 Kimlik Bilgisi Olmadan Eri\u015fim Neden Bu Kadar \u00d6nemli?<\/h3>\n<p>Geleneksel g\u00fcvenlik yakla\u015f\u0131mlar\u0131, genellikle statik kimlik bilgilerinin (API anahtarlar\u0131, \u015fifreler) olu\u015fturulmas\u0131, da\u011f\u0131t\u0131lmas\u0131 ve y\u00f6netilmesi \u00fczerine kuruludur. Ancak bu yakla\u015f\u0131m, \u00f6zellikle otomasyonun ve dinamik i\u015f y\u00fcklerinin yayg\u0131nla\u015ft\u0131\u011f\u0131 g\u00fcn\u00fcm\u00fcz DevOps ve bulut ortamlar\u0131nda bir dizi \u00f6nemli zorluk yarat\u0131r. \u0130lk olarak, bu t\u00fcr kimlik bilgileri s\u0131zd\u0131r\u0131ld\u0131\u011f\u0131nda veya k\u00f6t\u00fcye kullan\u0131ld\u0131\u011f\u0131nda, ciddi g\u00fcvenlik ihlallerine yol a\u00e7abilir. Bir anahtar\u0131n s\u00fcresi dolana veya manuel olarak iptal edilene kadar s\u0131n\u0131rs\u0131z eri\u015fim sa\u011flamas\u0131, risk fakt\u00f6r\u00fcn\u00fc art\u0131r\u0131r. \u0130kinci olarak, bu kimlik bilgilerinin g\u00fcvenli bir \u015fekilde depolanmas\u0131, d\u00f6nd\u00fcr\u00fclmesi ve ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fcn y\u00f6netilmesi karma\u015f\u0131k ve hataya a\u00e7\u0131k bir s\u00fcre\u00e7tir. Geli\u015ftiricilerin ve operasyon ekiplerinin otonom sistemler i\u00e7in s\u00fcrekli olarak anahtar y\u00f6netimiyle u\u011fra\u015fmas\u0131, verimlili\u011fi d\u00fc\u015f\u00fcr\u00fcr ve insan hatas\u0131 riskini art\u0131r\u0131r. \u00dc\u00e7\u00fcnc\u00fc olarak, uyumluluk standartlar\u0131 (\u00f6rne\u011fin SOC 2, HIPAA, GDPR), kimlik bilgilerinin g\u00fcvenli bir \u015fekilde y\u00f6netilmesini ve eri\u015fimlerin en az ayr\u0131cal\u0131k ilkesine (least privilege) g\u00f6re verilmesini gerektirir. Statik anahtarlar\u0131n bu gereksinimleri kar\u015f\u0131lamas\u0131 genellikle zordur.<\/p>\n<p>\u0130\u015fte tam da bu nedenlerle, kal\u0131c\u0131 kimlik bilgisi olmadan eri\u015fim (credential-less access) kavram\u0131 b\u00fcy\u00fck \u00f6nem kazanm\u0131\u015ft\u0131r. Bu yakla\u015f\u0131m, i\u015f y\u00fcklerinin OCI gibi bulut sa\u011flay\u0131c\u0131lar\u0131na do\u011frudan, k\u0131sa \u00f6m\u00fcrl\u00fc ve otomatik olarak verilen token&#8217;lar (jetonlar) arac\u0131l\u0131\u011f\u0131yla kimlik do\u011frulamas\u0131 yapmas\u0131na olanak tan\u0131r. Bu token&#8217;lar, belirli bir s\u00fcre sonra ge\u00e7erlili\u011fini yitirir ve yeniden olu\u015fturulmas\u0131 gerekir, bu da bir g\u00fcvenlik ihlali durumunda potansiyel zarar\u0131 en aza indirir. Ayr\u0131ca, kimlik bilgisi y\u00f6netimi y\u00fck\u00fcn\u00fc ortadan kald\u0131rarak operasyonel verimlili\u011fi art\u0131r\u0131r ve g\u00fcvenlik duru\u015funu \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirir. Bu sayede ekipler, altyap\u0131 g\u00fcvenli\u011fine daha az, i\u015f de\u011feri yaratmaya daha fazla odaklanabilir. OCI Workload Identity Federation, bu vizyonu ger\u00e7e\u011fe d\u00f6n\u00fc\u015ft\u00fcren g\u00fc\u00e7l\u00fc bir mekanizmad\u0131r.<\/p>\n<h3>OCI Workload Identity Federation Nedir ve Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/h3>\n<p>OCI Workload Identity Federation (\u0130\u015f Y\u00fck\u00fc Kimlik Federasyonu), d\u0131\u015f bir kimlik sa\u011flay\u0131c\u0131s\u0131 (Identity Provider &#8211; IdP) ile OCI IAM (Identity and Access Management) aras\u0131nda bir g\u00fcven ili\u015fkisi kurarak, i\u015f y\u00fcklerinin OCI kaynaklar\u0131na kal\u0131c\u0131 kimlik bilgileri olmadan eri\u015fmesini sa\u011flayan bir g\u00fcvenlik \u00f6zelli\u011fidir. Bu mekanizma, OIDC (OpenID Connect) protokol\u00fcn\u00fc temel al\u0131r ve i\u015f y\u00fcklerinin kendilerini do\u011frulamak i\u00e7in k\u0131sa \u00f6m\u00fcrl\u00fc, kriptografik olarak imzalanm\u0131\u015f jetonlar (token) kullanmas\u0131na izin verir.<\/p>\n<p>Temel olarak, federasyon s\u00fcreci \u015fu ad\u0131mlar\u0131 i\u00e7erir:<\/p>\n<ol>\n<li><strong>Harici Kimlik Sa\u011flay\u0131c\u0131s\u0131 (External Identity Provider):<\/strong> GitHub Actions, Kubernetes Service Account&#8217;lar veya di\u011fer OIDC uyumlu sa\u011flay\u0131c\u0131lar, i\u015f y\u00fck\u00fcn\u00fcn kimli\u011fini do\u011frular ve bu do\u011frulaman\u0131n bir kan\u0131t\u0131 olarak bir OIDC jetonu olu\u015fturur. Bu jeton, i\u015f y\u00fck\u00fcn\u00fcn kimli\u011fi ve di\u011fer ilgili nitelikler (\u00f6rne\u011fin, GitHub deposu ad\u0131, Kubernetes ad alan\u0131) hakk\u0131nda bilgiler i\u00e7erir.<\/li>\n<li><strong>G\u00fcven Politikas\u0131 (Trust Policy):<\/strong> OCI IAM&#8217;de, belirli bir harici kimlik sa\u011flay\u0131c\u0131s\u0131na g\u00fcvenen ve hangi ko\u015fullar alt\u0131nda OCI kaynaklar\u0131na eri\u015fim izni verilece\u011fini tan\u0131mlayan bir &#8220;Kimlik Sa\u011flay\u0131c\u0131&#8221; nesnesi olu\u015fturulur. Bu nesneye ek olarak, bir &#8220;G\u00fcven Politikas\u0131&#8221; (Trust Policy) tan\u0131mlan\u0131r. Bu politika, harici IdP&#8217;den gelen OIDC jetonunun hangi niteliklerini (\u00f6rne\u011fin, &#8220;repo:my-org\/my-repo:ref:refs\/heads\/main&#8221; gibi GitHub Actions ba\u011flam\u0131) kontrol edece\u011fini ve bu niteliklere dayanarak OCI&#8217;da hangi &#8220;i\u015f y\u00fck\u00fc kimli\u011finin&#8221; (workload identity) olu\u015fturulaca\u011f\u0131n\u0131 belirtir.<\/li>\n<li><strong>Jeton De\u011fi\u015fimi (Token Exchange):<\/strong> \u0130\u015f y\u00fck\u00fc, harici IdP&#8217;den ald\u0131\u011f\u0131 OIDC jetonunu OCI IAM&#8217;e sunar. OCI IAM, bu jetonu G\u00fcven Politikas\u0131&#8217;nda tan\u0131mlanan kurallara g\u00f6re do\u011frular ve e\u011fer jeton ge\u00e7erliyse, i\u015f y\u00fck\u00fcne OCI kaynaklar\u0131na eri\u015fim i\u00e7in kullanabilece\u011fi k\u0131sa \u00f6m\u00fcrl\u00fc bir OCI oturum jetonu (session token) verir.<\/li>\n<li><strong>Kaynak Eri\u015fimi (Resource Access):<\/strong> \u0130\u015f y\u00fck\u00fc, ald\u0131\u011f\u0131 OCI oturum jetonunu kullanarak OCI CLI, SDK&#8217;lar veya API&#8217;ler arac\u0131l\u0131\u011f\u0131yla OCI kaynaklar\u0131na (\u00f6rne\u011fin, Object Storage, Autonomous Database, Compute) eri\u015fim sa\u011flar. Bu jetonun \u00f6mr\u00fc k\u0131sad\u0131r (genellikle birka\u00e7 dakika ila bir saat) ve s\u00fcresi doldu\u011funda otomatik olarak yenilenmesi gerekir.<\/li>\n<\/ol>\n<p>Bu mekanizma sayesinde, hassas API anahtarlar\u0131n\u0131n veya hizmet hesab\u0131 kimlik bilgilerinin hi\u00e7bir zaman i\u015f y\u00fck\u00fc ortam\u0131na da\u011f\u0131t\u0131lmas\u0131na gerek kalmaz. G\u00fcven, tamamen kriptografik olarak imzalanm\u0131\u015f jetonlar ve OCI IAM&#8217;deki merkezi politikalar arac\u0131l\u0131\u011f\u0131yla y\u00f6netilir. Bu, g\u00fcvenlik duru\u015funu \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirirken, kimlik bilgisi y\u00f6netim y\u00fck\u00fcn\u00fc de ortadan kald\u0131r\u0131r. \u0130\u015f y\u00fckleri, yaln\u0131zca ihtiya\u00e7 duyduklar\u0131 anda ve yaln\u0131zca ihtiya\u00e7 duyduklar\u0131 kaynaklara, ge\u00e7ici yetkilendirmelerle eri\u015febilirler. Bu sayede, &#8220;en az ayr\u0131cal\u0131k&#8221; ilkesi (principle of least privilege) en etkili \u015fekilde uygulanm\u0131\u015f olur.<\/p>\n<h3>GitHub Actions ile OCI Kaynaklar\u0131na G\u00fcvenli Eri\u015fim Nas\u0131l Sa\u011flan\u0131r?<\/h3>\n<p>GitHub Actions, modern CI\/CD (S\u00fcrekli Entegrasyon\/S\u00fcrekli Teslimat) s\u00fcre\u00e7lerinin temel ta\u015flar\u0131ndan biridir. Genellikle kod da\u011f\u0131t\u0131m\u0131, altyap\u0131 provizyonu veya bulut hizmetleriyle etkile\u015fim gibi g\u00f6revleri otomatikle\u015ftirmek i\u00e7in kullan\u0131l\u0131r. Bu t\u00fcr otomasyonlarda, GitHub Actions i\u015f ak\u0131\u015flar\u0131n\u0131n OCI kaynaklar\u0131na g\u00fcvenli bir \u015fekilde eri\u015fmesi kritik \u00f6neme sahiptir. Geleneksel olarak, bu eri\u015fim i\u00e7in OCI kullan\u0131c\u0131 anahtarlar\u0131 veya API anahtarlar\u0131 GitHub Actions s\u0131rlar\u0131 (secrets) olarak saklan\u0131rd\u0131. Ancak bu durum, s\u0131zd\u0131r\u0131lma riski, anahtar d\u00f6nd\u00fcrme zorluklar\u0131 ve genel g\u00fcvenlik endi\u015feleri yarat\u0131r. OCI Workload Identity Federation, bu soruna zarif bir \u00e7\u00f6z\u00fcm sunar.<\/p>\n<h4>Vaka Analizi: GitHub Actions ile OCI Object Storage&#8217;a Dosya Y\u00fckleme<\/h4>\n<p>Bir yaz\u0131l\u0131m ekibi, yeni bir uygulama s\u00fcr\u00fcm\u00fcn\u00fc derledikten sonra, derlenmi\u015f dosyalar\u0131 OCI Object Storage&#8217;daki bir depoya (bucket) otomatik olarak y\u00fcklemek istiyor. Bu i\u015flem, GitHub Actions i\u015f ak\u0131\u015f\u0131 taraf\u0131ndan ger\u00e7ekle\u015ftirilecek. Ekip, kal\u0131c\u0131 OCI kimlik bilgileri kullanmak yerine, Workload Identity Federation&#8217;\u0131 kullanarak g\u00fcvenli\u011fi art\u0131rmay\u0131 hedefliyor.<\/p>\n<p><strong>Ad\u0131m 1: OCI IAM&#8217;de Bir Kimlik Sa\u011flay\u0131c\u0131 Olu\u015fturma<\/strong><\/p>\n<p>\u0130lk olarak, OCI konsolunda veya OCI CLI kullanarak GitHub Actions i\u00e7in bir OIDC Kimlik Sa\u011flay\u0131c\u0131 olu\u015fturmam\u0131z gerekiyor. Bu sa\u011flay\u0131c\u0131, GitHub&#8217;\u0131n OIDC jetonlar\u0131n\u0131 do\u011frulayacak ve ona g\u00fcvenece\u011fimizi belirtecek.<\/p>\n<div class=\"code-container\">\n<pre><code>\noci iam identity-provider create --protocol \"OIDC\" \\\n--name \"GitHubActionsIdP\" \\\n--description \"GitHub Actions OIDC Identity Provider\" \\\n--metadata-url \"https:\/\/token.actions.githubusercontent.com\/.well-known\/openid-configuration\" \\\n--tenant-id \"ocid1.tenancy.oc1..aaaaaaaaxxxxxx\"\n  <\/code><\/pre>\n<\/div>\n<p>Bu komut, GitHub Actions&#8217;\u0131n OIDC yap\u0131land\u0131rma URL&#8217;sini kullanarak bir IdP olu\u015fturur. <code>tenant-id<\/code> k\u0131sm\u0131n\u0131 kendi OCI kirac\u0131 OCID&#8217;nizle de\u011fi\u015ftirmeyi unutmay\u0131n.<\/p>\n<p><strong>Ad\u0131m 2: OCI Politikas\u0131 Tan\u0131mlama ve G\u00fcven \u0130li\u015fkisi Kurma<\/strong><\/p>\n<p>\u015eimdi, GitHub Actions i\u015f ak\u0131\u015f\u0131m\u0131z\u0131n OCI&#8217;da hangi ayr\u0131cal\u0131klara sahip olaca\u011f\u0131n\u0131 belirten bir OCI politikas\u0131 olu\u015fturmal\u0131y\u0131z. Bu politika, GitHub&#8217;dan gelen OIDC jetonunun belirli niteliklerine dayanarak bir g\u00fcven ili\u015fkisi kuracak. \u00d6rne\u011fin, yaln\u0131zca belirli bir depodan ve belirli bir daldan gelen i\u015f ak\u0131\u015flar\u0131n\u0131n eri\u015fmesine izin verebiliriz.<\/p>\n<div class=\"code-container\">\n<pre><code>\n# Bir dinamik grup olu\u015fturulur, ancak federasyon i\u00e7in do\u011frudan bir dinamik grup olu\u015fturmay\u0131z.\n# Bunun yerine, bir ilke ile do\u011frudan IdP'den gelen kimlikleri yetkilendiririz.\n# A\u015fa\u011f\u0131daki politika, \"GitHubActionsIdP\" sa\u011flay\u0131c\u0131s\u0131ndan gelen ve belirli bir repo'dan\n# (my-org\/my-repo) ve daldan (main) olan i\u015f y\u00fcklerine Object Storage'a eri\u015fim izni verir.\n\n# Bu politika, 'ocid1.tenancy.oc1..aaaaaaaaxxxxxx' kirac\u0131s\u0131nda yer alan 'GitHubActionsIdP'\n# kimlik sa\u011flay\u0131c\u0131s\u0131ndan gelen ve 'my-org\/my-repo' deposundaki 'main' dal\u0131ndan\n# y\u00fcr\u00fct\u00fclen GitHub Actions i\u015f y\u00fcklerinin 'my-bucket' adl\u0131 Object Storage\n# kovas\u0131na 'nesne okuma' ve 'nesne yazma' yetkisi verir.\n# 'sub' alan\u0131, OIDC jetonundaki subject (konu) alan\u0131na kar\u015f\u0131l\u0131k gelir.\n# GitHub Actions i\u00e7in bu genellikle 'repo:org\/repo:ref:refs\/heads\/branch' format\u0131ndad\u0131r.\n\noci iam policy create --compartment-id \"ocid1.compartment.oc1..aaaaaaaayyyyyy\" \\\n--name \"GitHubActionsObjectStorageAccess\" \\\n--description \"Allow GitHub Actions to upload objects to a specific bucket\" \\\n--statements '[\"ALLOW FEDERATED-USER \\'ocid1.identityprovider.oc1..aaaaaaaazzzzzz\\' TO MANAGE objects IN compartment id ocid1.compartment.oc1..aaaaaaaayyyyyy WHERE ANY {request.principal.type = \\'GitHubActionsIdP\\', request.principal.sub = \\'repo:my-org\/my-repo:ref:refs\/heads\/main\\'}\"]'\n  <\/code><\/pre>\n<\/div>\n<p>Yukar\u0131daki politika \u00f6rne\u011finde, <code>ocid1.identityprovider.oc1..aaaaaaaazzzzzz<\/code> sizin olu\u015fturdu\u011funuz GitHubActionsIdP&#8217;nin OCID&#8217;si olmal\u0131d\u0131r. <code>my-org\/my-repo<\/code> ve <code>my-bucket<\/code> de\u011ferlerini kendi GitHub organizasyonunuz\/deponuz ve OCI Object Storage kovan ad\u0131n\u0131zla de\u011fi\u015ftirin. <code>ocid1.compartment.oc1..aaaaaaaayyyyyy<\/code> ise kovan\u0131n bulundu\u011fu b\u00f6lmenin OCID&#8217;sidir.<\/p>\n<p><strong>Ad\u0131m 3: GitHub Actions \u0130\u015f Ak\u0131\u015f\u0131n\u0131 Yap\u0131land\u0131rma<\/strong><\/p>\n<p>Son olarak, GitHub Actions i\u015f ak\u0131\u015f\u0131 dosyam\u0131z\u0131 (\u00f6rne\u011fin, <code>.github\/workflows\/deploy.yml<\/code>) OCI kaynaklar\u0131na eri\u015fmek i\u00e7in yap\u0131land\u0131rmam\u0131z gerekiyor. GitHub Actions&#8217;\u0131n OIDC jetonunu OCI&#8217;ye sunmas\u0131n\u0131 sa\u011flayacak ve OCI CLI&#8217;yi kullanarak Object Storage&#8217;a eri\u015fece\u011fiz.<\/p>\n<div class=\"code-container\">\n<pre><code>\nname: OCI Object Storage Deployment\n\non:\n  push:\n    branches:\n      - main\n\npermissions:\n  id-token: write # Bu izni GitHub Actions'\u0131n OIDC jetonu almas\u0131 i\u00e7in ekleyin\n  contents: read\n\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout code\n        uses: actions\/checkout@v4\n\n      - name: Setup OCI CLI\n        uses: oracle-actions\/setup-oci-cli@v1\n        with:\n          release: 'latest'\n\n      - name: Configure OCI CLI with Workload Identity Federation\n        run: |\n          # OCI CLI'y\u0131 Workload Identity Federation ile yap\u0131land\u0131r\u0131n\n          # Bu komut, GitHub Actions'\u0131n OIDC jetonunu OCI'ya sunmas\u0131n\u0131 sa\u011flar.\n          # OCI CLI otomatik olarak OIDC jetonunu al\u0131p bir OCI oturum jetonuna d\u00f6n\u00fc\u015ft\u00fcr\u00fcr.\n          # OCI_REGION ve OCI_TENANCY_OCID ortam de\u011fi\u015fkenlerini ayarlay\u0131n.\n          echo \"OCI_REGION=${{ secrets.OCI_REGION }}\" >> $GITHUB_ENV\n          echo \"OCI_TENANCY_OCID=${{ secrets.OCI_TENANCY_OCID }}\" >> $GITHUB_ENV\n          echo \"OCI_AUTH=federated_token\" >> $GITHUB_ENV # OCI CLI'ya federasyon kullanmas\u0131n\u0131 s\u00f6yleyin\n\n      - name: Upload files to OCI Object Storage\n        env:\n          BUCKET_NAME: my-application-artifacts\n          FILE_TO_UPLOAD: my-app-v1.0.0.zip # Kendi dosya ad\u0131n\u0131z\u0131 buraya yaz\u0131n\n        run: |\n          # \u00d6rnek bir dosya olu\u015ftur (ger\u00e7ek uygulamada derleme \u00e7\u0131kt\u0131s\u0131 olacakt\u0131r)\n          echo \"Bu benim uygulama dosyam.\" > $FILE_TO_UPLOAD\n          \n          # OCI Object Storage'a dosya y\u00fckle\n          oci os object put -bn $BUCKET_NAME --file $FILE_TO_UPLOAD --name $FILE_TO_UPLOAD\n          echo \"Dosya '$FILE_TO_UPLOAD' ba\u015far\u0131yla '$BUCKET_NAME' kovas\u0131na y\u00fcklendi.\"\n  <\/code><\/pre>\n<\/div>\n<p>Bu i\u015f ak\u0131\u015f\u0131, <code>id-token: write<\/code> iznini kullanarak GitHub Actions&#8217;\u0131n OIDC jetonunu almas\u0131n\u0131 sa\u011flar. Ard\u0131ndan, <code>oracle-actions\/setup-oci-cli@v1<\/code> eylemi OCI CLI&#8217;yi kurar. <code>OCI_AUTH=federated_token<\/code> ortam de\u011fi\u015fkeni, OCI CLI&#8217;ya kimlik do\u011frulamas\u0131 i\u00e7in Workload Identity Federation kullanmas\u0131n\u0131 s\u00f6yler. OCI CLI otomatik olarak GitHub taraf\u0131ndan sa\u011flanan OIDC jetonunu al\u0131r ve OCI IAM ile de\u011fi\u015f toku\u015f yaparak k\u0131sa \u00f6m\u00fcrl\u00fc bir oturum jetonu elde eder. Bu oturum jetonu daha sonra OCI Object Storage&#8217;a dosya y\u00fcklemek i\u00e7in kullan\u0131l\u0131r. Bu s\u00fcre\u00e7te hi\u00e7bir kal\u0131c\u0131 OCI API anahtar\u0131 veya \u015fifresi GitHub Actions s\u0131rlar\u0131nda saklanmaz, bu da g\u00fcvenli\u011fi \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131r.<\/p>\n<h3>Kubernetes \u0130\u015f Y\u00fckleri OCI Hizmetlerine Nas\u0131l Eri\u015fir?<\/h3>\n<p>Kubernetes k\u00fcmeleri, genellikle OCI Object Storage, OCI Autonomous Database veya OCI Container Registry gibi \u00e7e\u015fitli OCI hizmetleriyle etkile\u015fim kuran uygulamalar\u0131 bar\u0131nd\u0131r\u0131r. Bu etkile\u015fimler i\u00e7in Kubernetes podlar\u0131n\u0131n OCI kaynaklar\u0131na kimlik do\u011frulamas\u0131 yapmas\u0131 gerekir. Geleneksel y\u00f6ntemler, OCI API anahtarlar\u0131n\u0131 Kubernetes s\u0131rlar\u0131 (secrets) olarak depolamay\u0131 ve bunlar\u0131 podlara enjekte etmeyi i\u00e7erir. Ancak bu yakla\u015f\u0131m, s\u0131r y\u00f6netimi karma\u015f\u0131kl\u0131\u011f\u0131, s\u0131zd\u0131r\u0131lma riski ve anahtar d\u00f6nd\u00fcrme gibi g\u00fcvenlik endi\u015felerini beraberinde getirir. OCI Workload Identity Federation, Kubernetes podlar\u0131n\u0131n kal\u0131c\u0131 kimlik bilgileri olmadan OCI&#8217;ye g\u00fcvenli bir \u015fekilde eri\u015fmesini sa\u011flayarak bu sorunlara modern bir \u00e7\u00f6z\u00fcm sunar.<\/p>\n<h4>Vaka Analizi: Kubernetes Podu OCI Object Storage&#8217;dan Konfig\u00fcrasyon Okuma<\/h4>\n<p>Bir mikro hizmet uygulamas\u0131, Kubernetes k\u00fcmesinde \u00e7al\u0131\u015f\u0131yor ve ba\u015flang\u0131\u00e7ta OCI Object Storage&#8217;dan konfig\u00fcrasyon dosyalar\u0131n\u0131 okumas\u0131 gerekiyor. Geli\u015ftirme ekibi, bu podun OCI&#8217;ye eri\u015fimi i\u00e7in s\u0131rlar\u0131 kullanmak yerine, Kubernetes Service Account&#8217;\u0131n\u0131 OCI Workload Identity Federation ile entegre ederek daha g\u00fcvenli bir y\u00f6ntem uygulamak istiyor.<\/p>\n<p><strong>Ad\u0131m 1: OCI IAM&#8217;de Bir Kimlik Sa\u011flay\u0131c\u0131 Olu\u015fturma (Kubernetes i\u00e7in)<\/strong><\/p>\n<p>\u00d6ncelikle, OCI IAM&#8217;de Kubernetes k\u00fcmemiz i\u00e7in bir OIDC Kimlik Sa\u011flay\u0131c\u0131 olu\u015fturmal\u0131y\u0131z. Bu, Kubernetes k\u00fcmesinin API sunucusunun OIDC ke\u015fif u\u00e7 noktas\u0131n\u0131 kullanacakt\u0131r.<\/p>\n<div class=\"code-container\">\n<pre><code>\n# Kubernetes API sunucusunun OIDC ke\u015fif u\u00e7 noktas\u0131n\u0131 bulun.\n# Genellikle 'https:\/\/<KUBERNETES_API_SERVER_IP_OR_HOSTNAME>\/.well-known\/openid-configuration' \u015feklindedir.\n# OCI Container Engine for Kubernetes (OKE) kullan\u0131yorsan\u0131z, bu URL OKE k\u00fcmenizin detaylar\u0131nda bulunur.\n\n# \u00d6rnek bir OCI CLI komutu:\noci iam identity-provider create --protocol \"OIDC\" \\\n--name \"KubernetesIdP\" \\\n--description \"Kubernetes Cluster OIDC Identity Provider\" \\\n--metadata-url \"https:\/\/<OKE_API_SERVER_IP_OR_HOSTNAME>\/.well-known\/openid-configuration\" \\\n--tenant-id \"ocid1.tenancy.oc1..aaaaaaaaxxxxxx\"\n  <\/code><\/pre>\n<\/div>\n<p><code>&lt;OKE_API_SERVER_IP_OR_HOSTNAME&gt;<\/code> k\u0131sm\u0131n\u0131 kendi Kubernetes k\u00fcmenizin API sunucusu adresiyle de\u011fi\u015ftirmeniz gerekmektedir. OKE kullan\u0131yorsan\u0131z, bu bilgiyi OKE konsolundan alabilirsiniz.<\/p>\n<p><strong>Ad\u0131m 2: OCI Politikas\u0131 Tan\u0131mlama ve G\u00fcven \u0130li\u015fkisi Kurma<\/strong><\/p>\n<p>\u015eimdi, Kubernetes podlar\u0131m\u0131z\u0131n OCI&#8217;da hangi ayr\u0131cal\u0131klara sahip olaca\u011f\u0131n\u0131 belirten bir OCI politikas\u0131 olu\u015fturmal\u0131y\u0131z. Bu politika, Kubernetes Service Account&#8217;\u0131ndan gelen OIDC jetonunun belirli niteliklerine dayanarak bir g\u00fcven ili\u015fkisi kuracak.<\/p>\n<div class=\"code-container\">\n<pre><code>\n# Bu politika, 'KubernetesIdP' sa\u011flay\u0131c\u0131s\u0131ndan gelen ve belirli bir Kubernetes Service Account'\u0131na\n# (\u00f6rne\u011fin, 'my-namespace\/my-service-account') sahip i\u015f y\u00fcklerine Object Storage'a eri\u015fim izni verir.\n# 'sub' alan\u0131, OIDC jetonundaki subject (konu) alan\u0131na kar\u015f\u0131l\u0131k gelir.\n# Kubernetes i\u00e7in bu genellikle 'system:serviceaccount:namespace:serviceaccountname' format\u0131ndad\u0131r.\n\noci iam policy create --compartment-id \"ocid1.compartment.oc1..aaaaaaaayyyyyy\" \\\n--name \"KubernetesObjectStorageReader\" \\\n--description \"Allow Kubernetes pods to read objects from a specific bucket\" \\\n--statements '[\"ALLOW FEDERATED-USER \\'ocid1.identityprovider.oc1..aaaaaaaazzzzzz\\' TO READ objects IN compartment id ocid1.compartment.oc1..aaaaaaaayyyyyy WHERE ANY {request.principal.type = \\'KubernetesIdP\\', request.principal.sub = \\'system:serviceaccount:my-namespace:my-service-account\\'}\"]'\n  <\/code><\/pre>\n<\/div>\n<p>Yukar\u0131daki politika \u00f6rne\u011finde, <code>ocid1.identityprovider.oc1..aaaaaaaazzzzzz<\/code> sizin olu\u015fturdu\u011funuz KubernetesIdP&#8217;nin OCID&#8217;si olmal\u0131d\u0131r. <code>my-namespace<\/code> ve <code>my-service-account<\/code> de\u011ferlerini kendi Kubernetes ad alan\u0131n\u0131z ve hizmet hesab\u0131 ad\u0131n\u0131zla de\u011fi\u015ftirin. <code>ocid1.compartment.oc1..aaaaaaaayyyyyy<\/code> ise kovan\u0131n bulundu\u011fu b\u00f6lmenin OCID&#8217;sidir.<\/p>\n<p><strong>Ad\u0131m 3: Kubernetes Service Account ve Pod Tan\u0131m\u0131n\u0131 Yap\u0131land\u0131rma<\/strong><\/p>\n<p>Kubernetes taraf\u0131nda, OCI&#8217;ye eri\u015fecek pod i\u00e7in bir Service Account olu\u015fturmal\u0131 ve bu Service Account&#8217;\u0131 pod tan\u0131m\u0131na atamal\u0131y\u0131z. Kubernetes, pod&#8217;a otomatik olarak OIDC jetonunu enjekte edecektir.<\/p>\n<div class=\"code-container\">\n<pre><code>\n# my-service-account.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: my-service-account\n  namespace: my-namespace # Kendi ad alan\u0131n\u0131z\u0131 buraya yaz\u0131n\n  annotations:\n    # Bu annotation, Kubernetes'in OIDC jetonunu pod'a enjekte etmesini sa\u011flar.\n    # Bu ad alan\u0131, OCI IAM'de tan\u0131mlad\u0131\u011f\u0131n\u0131z kimlik sa\u011flay\u0131c\u0131s\u0131n\u0131n ad\u0131d\u0131r.\n    # Not: Baz\u0131 Kubernetes s\u00fcr\u00fcmlerinde bu annotation'a gerek kalmayabilir,\n    # do\u011frudan pod'un OIDC jetonu almas\u0131 sa\u011flanabilir.\n    # Ancak, OCI'nin bekledi\u011fi belirli bir format i\u00e7in bu annotation'\u0131 kullanmak iyi bir uygulamad\u0131r.\n    # oracle.com\/workload-identity-federation: \"true\" # \u00d6rnek bir annotation, OCI entegrasyonuna g\u00f6re de\u011fi\u015febilir\n    # Daha yayg\u0131n olarak, Kubernetes'in kendisi jetonu bir dosya olarak ba\u011flar.\n    # OCI SDK'lar\u0131 ve CLI, bu jetonu otomatik olarak bulup kullanabilir.\nserviceAccountToken:\n  expirationSeconds: 3600 # Jetonun ge\u00e7erlilik s\u00fcresi (\u00f6rne\u011fin 1 saat)\n  audience: \"oci\" # OIDC jetonunun hedef kitlesi (OCI taraf\u0131ndan beklenen de\u011fer)\n  <\/code><\/pre>\n<\/div>\n<div class=\"code-container\">\n<pre><code>\n# my-app-pod.yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: my-app-config-reader\n  namespace: my-namespace # Kendi ad alan\u0131n\u0131z\u0131 buraya yaz\u0131n\nspec:\n  serviceAccountName: my-service-account # Yukar\u0131da olu\u015fturdu\u011fumuz Service Account'\u0131 kullan\u0131n\n  containers:\n  - name: config-reader\n    image: busybox # Basit bir \u00f6rnek i\u00e7in busybox kullan\u0131yoruz\n    command: [\"sh\", \"-c\"]\n    args:\n      - |\n        echo \"OCI CLI ve SDK'lar otomatik olarak OIDC jetonunu bulacakt\u0131r.\"\n        echo \"OCI_REGION ve OCI_TENANCY_OCID ortam de\u011fi\u015fkenlerini ayarlay\u0131n.\"\n        # OCI SDK'lar\u0131 veya CLI, \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token dosyas\u0131n\u0131 otomatik olarak okuyabilir.\n        # Bu jeton, OCI IAM'e sunularak k\u0131sa \u00f6m\u00fcrl\u00fc bir oturum jetonu al\u0131nmas\u0131n\u0131 sa\u011flar.\n        \n        # OCI CLI'y\u0131 veya SDK'y\u0131 kullanarak Object Storage'dan dosya oku\n        # Bu k\u0131s\u0131m, ger\u00e7ek uygulaman\u0131zda OCI SDK's\u0131n\u0131 veya CLI'y\u0131 \u00e7a\u011f\u0131racakt\u0131r.\n        # \u00d6rne\u011fin: oci os object get -bn my-config-bucket --name config.json --file \/tmp\/config.json\n        echo \"Konfig\u00fcrasyon dosyas\u0131 okunuyor...\"\n        # Ger\u00e7ek uygulamada, OCI SDK's\u0131n\u0131 kullanarak Object Storage'a eri\u015fim sa\u011flan\u0131r.\n        # \u00d6rne\u011fin, Python SDK's\u0131:\n        # import oci\n        # config = oci.config.from_file(file_location=\"~\/.oci\/config\")\n        # identity_client = oci.identity.IdentityClient(config)\n        # auth = oci.auth.signers.InstancePrincipalsSecurityTokenSigner()\n        # object_storage_client = oci.object_storage.ObjectStorageClient(config, signer=auth)\n        # ...\n        \n        # Basit bir sim\u00fclasyon:\n        sleep 30\n        echo \"Konfig\u00fcrasyon okuma sim\u00fclasyonu tamamland\u0131.\"\n  <\/code><\/pre>\n<\/div>\n<p>Bu yap\u0131land\u0131rmada, <code>my-service-account<\/code> adl\u0131 bir Service Account olu\u015fturulur ve <code>my-app-config-reader<\/code> podu bu Service Account&#8217;\u0131 kullan\u0131r. Kubernetes, bu podun dosya sistemine (<code>\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token<\/code> yoluna) Service Account i\u00e7in k\u0131sa \u00f6m\u00fcrl\u00fc bir OIDC jetonu ba\u011flar. OCI SDK&#8217;lar\u0131 ve CLI, bu jetonu otomatik olarak alg\u0131lay\u0131p OCI IAM ile de\u011fi\u015f toku\u015f ederek k\u0131sa \u00f6m\u00fcrl\u00fc bir OCI oturum jetonu elde edebilir. B\u00f6ylece, pod, OCI Object Storage&#8217;a kal\u0131c\u0131 kimlik bilgileri olmadan g\u00fcvenli bir \u015fekilde eri\u015febilir. Bu y\u00f6ntem, Kubernetes ortamlar\u0131nda OCI kaynaklar\u0131na eri\u015fim i\u00e7in hem g\u00fcvenli\u011fi hem de y\u00f6netilebilirli\u011fi \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131r.<\/p>\n<h3>Yapay Zeka (AI) Ajanlar\u0131 ve OCI Kimlik Federasyonu: Gelece\u011fin G\u00fcvenli\u011fi<\/h3>\n<p>Yapay zeka (AI) ve makine \u00f6\u011frenimi (ML) modelleri, g\u00fcn\u00fcm\u00fcz\u00fcn veri odakl\u0131 d\u00fcnyas\u0131nda giderek daha merkezi bir rol oynamaktad\u0131r. Bu modeller, genellikle b\u00fcy\u00fck veri k\u00fcmelerine eri\u015fmek, OCI Data Science servisleri gibi \u00f6zel AI\/ML hizmetlerini kullanmak veya sonu\u00e7lar\u0131 OCI Object Storage&#8217;a kaydetmek gibi g\u00f6revler i\u00e7in OCI kaynaklar\u0131yla etkile\u015fim kurar. Geleneksel kimlik bilgisi y\u00f6netimi y\u00f6ntemleri, AI\/ML i\u015f y\u00fcklerinin dinamik ve genellikle k\u0131sa \u00f6m\u00fcrl\u00fc do\u011fas\u0131 g\u00f6z \u00f6n\u00fcne al\u0131nd\u0131\u011f\u0131nda yetersiz kalabilir. \u00d6zellikle otonom AI ajanlar\u0131 veya sunucusuz fonksiyonlar (OCI Functions) gibi ortamlarda, kal\u0131c\u0131 kimlik bilgileri kullanmak \u00f6nemli g\u00fcvenlik riskleri ve y\u00f6netim y\u00fckleri yarat\u0131r. OCI Workload Identity Federation, AI ajanlar\u0131 i\u00e7in de g\u00fcvenli, \u00f6l\u00e7eklenebilir ve y\u00f6netilebilir bir eri\u015fim kontrol\u00fc sa\u011flar.<\/p>\n<h4>Vaka Analizi: OCI Functions \u00dczerinde \u00c7al\u0131\u015fan Bir AI Ajan\u0131 OCI Vision API&#8217;sini Kullan\u0131yor<\/h4>\n<p>Bir \u015firket, y\u00fcklenen g\u00f6rselleri analiz etmek i\u00e7in OCI Functions \u00fczerinde \u00e7al\u0131\u015fan bir yapay zeka ajan\u0131 geli\u015ftiriyor. Bu ajan, g\u00f6rselleri ald\u0131ktan sonra OCI Vision API&#8217;sini \u00e7a\u011f\u0131rarak nesne tan\u0131ma veya metin \u00e7\u0131karma i\u015flemleri yap\u0131yor ve sonu\u00e7lar\u0131 OCI Object Storage&#8217;a kaydediyor. Bu ajan\u0131n OCI Vision ve Object Storage&#8217;a eri\u015fimi i\u00e7in kal\u0131c\u0131 kimlik bilgileri kullanmak yerine Workload Identity Federation&#8217;\u0131 kullanarak g\u00fcvenli\u011fi sa\u011flamas\u0131 gerekiyor.<\/p>\n<p><strong>Ad\u0131m 1: OCI IAM&#8217;de OCI Functions i\u00e7in Dinamik Grup ve Politika Olu\u015fturma<\/strong><\/p>\n<p>OCI Functions, yerle\u015fik bir Workload Identity Federation mekanizmas\u0131na sahiptir. Fonksiyonlar, &#8220;Instance Principals&#8221; (\u00d6rnek As\u0131l Kimlikler) ad\u0131 verilen bir mekanizma arac\u0131l\u0131\u011f\u0131yla kendilerini do\u011frularlar. Bu, asl\u0131nda OCI&#8217;nin kendi i\u00e7inde y\u00f6netti\u011fi bir federasyon t\u00fcr\u00fcd\u00fcr.<\/p>\n<div class=\"code-container\">\n<pre><code>\n# Bir dinamik grup olu\u015fturun. Bu grup, belirli bir b\u00f6lmedeki t\u00fcm fonksiyonlar\u0131 i\u00e7erecektir.\noci iam dynamic-group create \\\n--name \"MyAIFunctionsDynamicGroup\" \\\n--description \"Dynamic group for AI Functions in my AI compartment\" \\\n--matching-rule \"ALL {resource.type = 'fnfunc', resource.compartment.id = 'ocid1.compartment.oc1..aaaaaaaayyyyyy'}\"\n\n# Bu dinamik grubun OCI Vision ve Object Storage'a eri\u015fmesine izin veren bir politika olu\u015fturun.\noci iam policy create --compartment-id \"ocid1.compartment.oc1..aaaaaaaayyyyyy\" \\\n--name \"AIFunctionsAccessPolicy\" \\\n--description \"Allow AI Functions to use OCI Vision and Object Storage\" \\\n--statements '[\"ALLOW DYNAMIC-GROUP \\'MyAIFunctionsDynamicGroup\\' TO USE ai-vision-family IN compartment id ocid1.compartment.oc1..aaaaaaaayyyyyy\", \"ALLOW DYNAMIC-GROUP \\'MyAIFunctionsDynamicGroup\\' TO MANAGE objects IN compartment id ocid1.compartment.oc1..aaaaaaaayyyyyy\"]'\n  <\/code><\/pre>\n<\/div>\n<p>Burada, <code>ocid1.compartment.oc1..aaaaaaaayyyyyy<\/code> fonksiyonlar\u0131n\u0131z\u0131n ve ilgili kaynaklar\u0131n bulundu\u011fu b\u00f6lmenin OCID&#8217;sidir. <code>ai-vision-family<\/code> OCI Vision API&#8217;leri i\u00e7in kullan\u0131lan bir yetkilendirme fiilidir.<\/p>\n<p><strong>Ad\u0131m 2: OCI Function Kodunu Geli\u015ftirme<\/strong><\/p>\n<p>\u015eimdi, OCI Functions \u00fczerinde \u00e7al\u0131\u015facak AI ajan\u0131n\u0131n kodunu yazmal\u0131y\u0131z. Bu kod, OCI SDK&#8217;lar\u0131n\u0131 kullanarak OCI Vision API&#8217;sini \u00e7a\u011f\u0131racak ve sonu\u00e7lar\u0131 Object Storage&#8217;a kaydedecektir. \u00d6nemli olan nokta, kodun kimlik do\u011frulamas\u0131 i\u00e7in \u00f6zel bir API anahtar\u0131 veya \u015fifre i\u00e7ermemesi, bunun yerine OCI SDK&#8217;lar\u0131n\u0131n otomatik olarak Instance Principals mekanizmas\u0131n\u0131 kullanmas\u0131na izin vermesidir.<\/p>\n<div class=\"code-container\">\n<pre><code>\n# Python \u00f6rne\u011fi (fn_app.py)\nimport oci\nimport os\nimport io\nimport json\n\n# OCI SDK, Instance Principals ile otomatik olarak kimlik do\u011frulamas\u0131 yapar.\n# Herhangi bir kimlik bilgisi manuel olarak sa\u011flanmaz.\nsigner = oci.auth.signers.InstancePrincipalsSecurityTokenSigner()\n\n# Vision istemcisi\nvision_client = oci.ai_vision.AIServiceVisionClient({}, signer=signer)\n\n# Object Storage istemcisi\nobject_storage_client = oci.object_storage.ObjectStorageClient({}, signer=signer)\n\ndef handler(ctx, data: io.BytesIO = None):\n    try:\n        body = json.loads(data.getvalue())\n        image_url = body.get(\"image_url\")\n        bucket_name = body.get(\"bucket_name\", os.environ.get(\"DEFAULT_BUCKET\"))\n        object_name = body.get(\"object_name\")\n\n        if not image_url or not bucket_name or not object_name:\n            raise ValueError(\"image_url, bucket_name ve object_name gerekli.\")\n\n        # G\u00f6rseli Object Storage'dan oku\n        get_object_response = object_storage_client.get_object(bucket_name, object_name)\n        image_content = get_object_response.data.content\n\n        # OCI Vision API'sini kullanarak g\u00f6rseli analiz et\n        analyze_image_details = oci.ai_vision.models.AnalyzeImageDetails(\n            features=[\n                oci.ai_vision.models.ImageTextDetectionFeature(),\n                oci.ai_vision.models.ImageObjectDetectionFeature()\n            ],\n            image=oci.ai_vision.models.Image(\n                source=\"INLINE\",\n                data=base64.b64encode(image_content).decode('utf-8')\n            )\n        )\n        analyze_image_response = vision_client.analyze_image(analyze_image_details)\n        \n        # Analiz sonu\u00e7lar\u0131n\u0131 Object Storage'a kaydet\n        results_object_name = f\"analysis_results\/{object_name}.json\"\n        object_storage_client.put_object(\n            bucket_name, \n            results_object_name, \n            json.dumps(analyze_image_response.data.to_dict(), indent=2)\n        )\n\n        return {\"status\": \"success\", \"message\": f\"G\u00f6rsel analiz edildi ve sonu\u00e7lar '{results_object_name}' olarak kaydedildi.\"}\n\n    except Exception as e:\n        import traceback\n        traceback.print_exc()\n        return {\"status\": \"error\", \"message\": str(e)}, 500\n  <\/code><\/pre>\n<\/div>\n<p>Bu Python kodu \u00f6rne\u011finde, <code>oci.auth.signers.InstancePrincipalsSecurityTokenSigner()<\/code> kullan\u0131larak kimlik do\u011frulamas\u0131 yap\u0131l\u0131r. Bu imzalay\u0131c\u0131, fonksiyonun \u00e7al\u0131\u015ft\u0131\u011f\u0131 ortamdan otomatik olarak k\u0131sa \u00f6m\u00fcrl\u00fc bir kimlik jetonu al\u0131r ve OCI hizmet \u00e7a\u011fr\u0131lar\u0131n\u0131 imzalamak i\u00e7in kullan\u0131r. Geli\u015ftiricinin herhangi bir hassas kimlik bilgisini koda g\u00f6mmesine veya ortam de\u011fi\u015fkenleri arac\u0131l\u0131\u011f\u0131yla y\u00f6netmesine gerek kalmaz. Bu, AI ajanlar\u0131n\u0131n OCI kaynaklar\u0131na g\u00fcvenli bir \u015fekilde eri\u015fmesini sa\u011flarken, geli\u015ftirme ve operasyonel karma\u015f\u0131kl\u0131\u011f\u0131 en aza indirir. Bu t\u00fcr bir federasyon, AI\/ML i\u015f y\u00fcklerinin h\u0131zla da\u011f\u0131t\u0131lmas\u0131 ve g\u00fcvenli bir \u015fekilde \u00f6l\u00e7eklenmesi i\u00e7in idealdir.<\/p>\n<h3>\u0130leri D\u00fczey Kullan\u0131m \u0130pu\u00e7lar\u0131 ve En \u0130yi Uygulamalar<\/h3>\n<p>OCI Workload Identity Federation&#8217;\u0131 etkin bir \u015fekilde kullanmak, sadece temel kurulum ad\u0131mlar\u0131n\u0131 takip etmekten \u00f6teye ge\u00e7er. G\u00fcvenli\u011fi en \u00fcst d\u00fczeye \u00e7\u0131karmak ve y\u00f6netimi kolayla\u015ft\u0131rmak i\u00e7in baz\u0131 ileri d\u00fczey ipu\u00e7lar\u0131 ve en iyi uygulamalar\u0131 g\u00f6z \u00f6n\u00fcnde bulundurmak \u00f6nemlidir.<\/p>\n<ul>\n<li><strong>En Az Ayr\u0131cal\u0131k \u0130lkesi (Principle of Least Privilege):<\/strong> Her zaman i\u015f y\u00fcklerinin yaln\u0131zca ihtiya\u00e7 duyduklar\u0131 kaynaklara ve yaln\u0131zca ihtiya\u00e7 duyduklar\u0131 eylemleri ger\u00e7ekle\u015ftirecek \u015fekilde eri\u015fimini sa\u011flay\u0131n. OCI politikalar\u0131n\u0131zda, <code>request.principal.sub<\/code> gibi OIDC jetonu niteliklerini kullanarak eri\u015fimi m\u00fcmk\u00fcn oldu\u011funca daralt\u0131n. \u00d6rne\u011fin, belirli bir GitHub deposu ve dal\u0131 veya belirli bir Kubernetes ad alan\u0131 ve hizmet hesab\u0131 i\u00e7in ayr\u0131 ayr\u0131 politikalar tan\u0131mlay\u0131n. Geni\u015f kapsaml\u0131 <code>MANAGE ALL RESOURCES<\/code> gibi ifadelerden ka\u00e7\u0131n\u0131n.<\/li>\n<li><strong>Jeton \u00d6mr\u00fc Y\u00f6netimi:<\/strong> OCI taraf\u0131ndan verilen oturum jetonlar\u0131n\u0131n \u00f6mr\u00fc k\u0131sad\u0131r (genellikle 1 saat). OCI SDK&#8217;lar\u0131 ve CLI, bu jetonlar\u0131 otomatik olarak yenileyecek \u015fekilde tasarlanm\u0131\u015ft\u0131r. Ancak, \u00f6zel uygulamalar geli\u015ftiriyorsan\u0131z, jeton yenileme mekanizmalar\u0131n\u0131 do\u011fru bir \u015fekilde uygulad\u0131\u011f\u0131n\u0131zdan emin olun. Jeton \u00f6mr\u00fcn\u00fc \u00e7ok uzun tutmak, g\u00fcvenlik riskini art\u0131r\u0131rken, \u00e7ok k\u0131sa tutmak performans\u0131 etkileyebilir.<\/li>\n<li><strong>Denetim (Auditing) ve \u0130zleme:<\/strong> OCI Cloud Guard ve OCI Audit hizmetlerini kullanarak federasyon tabanl\u0131 eri\u015fimleri s\u00fcrekli olarak denetleyin ve izleyin. Kimlik sa\u011flay\u0131c\u0131dan gelen jeton de\u011fi\u015fimlerini ve OCI kaynak eri\u015fimlerini kaydedin. Anormal eri\u015fim denemelerini veya yetkisiz eri\u015fimleri tespit etmek i\u00e7in uyar\u0131lar ve alarmlar kurun. Bu, g\u00fcvenlik olaylar\u0131na h\u0131zl\u0131 yan\u0131t vermenizi sa\u011flar.<\/li>\n<li><strong>\u00c7oklu Ortamlar \u0130\u00e7in Federasyon Stratejileri:<\/strong> Birden fazla GitHub deposu, Kubernetes k\u00fcmesi veya AI ortam\u0131 i\u00e7in federasyon kullan\u0131yorsan\u0131z, her biri i\u00e7in ayr\u0131 kimlik sa\u011flay\u0131c\u0131lar\u0131 veya daha gran\u00fcler politikalar tan\u0131mlayarak y\u00f6netimi kolayla\u015ft\u0131rabilirsiniz. \u00d6rne\u011fin, her \u00fcretim ortam\u0131 i\u00e7in ayr\u0131 bir OIDC IdP olu\u015fturmak veya IdP i\u00e7inde farkl\u0131 <code>sub<\/code> de\u011ferlerini kullanarak farkl\u0131 ortamlar\u0131 ay\u0131rmak iyi bir yakla\u015f\u0131md\u0131r.<\/li>\n<li><strong>Kimlik Sa\u011flay\u0131c\u0131 URL&#8217;lerinin G\u00fcvenli\u011fi:<\/strong> Kimlik sa\u011flay\u0131c\u0131n\u0131z\u0131n (GitHub, Kubernetes) OIDC ke\u015fif u\u00e7 noktas\u0131 URL&#8217;sinin g\u00fcvenli oldu\u011fundan ve manip\u00fcle edilemedi\u011finden emin olun. Bu URL&#8217;ler, OCI&#8217;nin g\u00fcven ili\u015fkisini kurdu\u011fu kritik noktalard\u0131r.<\/li>\n<li><strong>Ortam De\u011fi\u015fkenleri ve SDK Kullan\u0131m\u0131:<\/strong> M\u00fcmk\u00fcnse, <code>OCI_AUTH=federated_token<\/code> gibi ortam de\u011fi\u015fkenlerini veya OCI SDK&#8217;lar\u0131n\u0131n yerle\u015fik federasyon deste\u011fini kullan\u0131n. Bu, kimlik do\u011frulama s\u00fcrecini basitle\u015ftirir ve uygulaman\u0131z\u0131n kodunda hassas kimlik bilgileri bar\u0131nd\u0131rma ihtiyac\u0131n\u0131 ortadan kald\u0131r\u0131r.<\/li>\n<li><strong>Hata Y\u00f6netimi ve Yeniden Denemeler:<\/strong> Federasyon jetonlar\u0131 ge\u00e7ici oldu\u011fundan, a\u011f sorunlar\u0131 veya ge\u00e7ici hizmet kesintileri nedeniyle jeton de\u011fi\u015fimi veya kaynak eri\u015fiminde hatalar olu\u015fabilir. Uygulamalar\u0131n\u0131zda uygun hata y\u00f6netimi ve yeniden deneme (retry) mekanizmalar\u0131 uygulayarak dayan\u0131kl\u0131l\u0131\u011f\u0131 art\u0131r\u0131n.<\/li>\n<li><strong>Otomatik Da\u011f\u0131t\u0131m (IaC):<\/strong> Kimlik sa\u011flay\u0131c\u0131lar\u0131n\u0131, politikalar\u0131 ve di\u011fer OCI kaynaklar\u0131n\u0131 Terraform gibi Altyap\u0131 olarak Kod (Infrastructure as Code &#8211; IaC) ara\u00e7lar\u0131yla y\u00f6netin. Bu, yap\u0131land\u0131rmalar\u0131n tutarl\u0131 olmas\u0131n\u0131 sa\u011flar, insan hatas\u0131n\u0131 azalt\u0131r ve da\u011f\u0131t\u0131m s\u00fcre\u00e7lerini otomatize eder.<\/li>\n<\/ul>\n<p>Bu en iyi uygulamalar\u0131 takip ederek, OCI Workload Identity Federation&#8217;\u0131n sundu\u011fu g\u00fcvenlik ve operasyonel avantajlardan tam olarak yararlanabilir, bulut ortamlar\u0131n\u0131zdaki i\u015f y\u00fckleri i\u00e7in sa\u011flam ve g\u00fcvenli bir kimlik y\u00f6netimi \u00e7er\u00e7evesi olu\u015fturabilirsiniz.<\/p>\n<h3>Sonu\u00e7<\/h3>\n<p>OCI Workload Identity Federation, modern bulut g\u00fcvenli\u011fi paradigmas\u0131nda \u00f6nemli bir ad\u0131m\u0131 temsil etmektedir. Geleneksel olarak kullan\u0131lan uzun \u00f6m\u00fcrl\u00fc kimlik bilgilerinin getirdi\u011fi riskleri ortadan kald\u0131rarak, GitHub Actions, Kubernetes i\u015f y\u00fckleri ve yapay zeka ajanlar\u0131 gibi otomasyon ve dinamik sistemlerin OCI kaynaklar\u0131na kal\u0131c\u0131 kimlik bilgileri olmadan, g\u00fcvenli ve verimli bir \u015fekilde eri\u015fmesini sa\u011flar. Bu sayede, g\u00fcvenlik duru\u015fu g\u00fc\u00e7lenir, y\u00f6netim y\u00fck\u00fc azal\u0131r ve &#8220;en az ayr\u0131cal\u0131k&#8221; ilkesi \u00e7ok daha etkin bir \u015fekilde uygulanabilir hale gelir.<\/p>\n<p>Bu makalede, Workload Identity Federation&#8217;\u0131n temel \u00e7al\u0131\u015fma prensiplerini, GitHub Actions ve Kubernetes ile ad\u0131m ad\u0131m entegrasyon \u00f6rneklerini ve yapay zeka ajanlar\u0131 i\u00e7in nas\u0131l kullan\u0131labilece\u011fini detayl\u0131 bir \u015fekilde inceledik. Ayr\u0131ca, ileri d\u00fczey kullan\u0131m ipu\u00e7lar\u0131 ve en iyi uygulamalarla, bu teknolojinin potansiyelini tam olarak nas\u0131l kullanabilece\u011finizi g\u00f6sterdik. OCI Workload Identity Federation&#8217;\u0131 benimsemek, yaln\u0131zca g\u00fcvenlik risklerini azaltmakla kalmaz, ayn\u0131 zamanda DevOps s\u00fcre\u00e7lerini h\u0131zland\u0131r\u0131r ve bulut altyap\u0131n\u0131z\u0131n genel g\u00fcvenilirli\u011fini art\u0131r\u0131r. Gelece\u011fin bulut g\u00fcvenli\u011fi, kal\u0131c\u0131 kimlik bilgisi olmayan eri\u015fim \u00fczerine in\u015fa edilmektedir ve OCI, bu gelece\u011fi bug\u00fcn sunmaktad\u0131r.<\/p>\n<h3>S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h3>\n<h4>1. OCI Workload Identity Federation hangi OCI hizmetleriyle \u00e7al\u0131\u015f\u0131r?<\/h4>\n<p>OCI Workload Identity Federation, OCI IAM taraf\u0131ndan yetkilendirilen t\u00fcm OCI hizmetleriyle \u00e7al\u0131\u015f\u0131r. Bu, Object Storage, Autonomous Database, Compute (Sanal Makineler ve Bare Metal), Container Registry, Functions, Data Science ve di\u011fer bir\u00e7ok OCI hizmetini kapsar. Temel olarak, bir OCI politikas\u0131 arac\u0131l\u0131\u011f\u0131yla eri\u015fim izni verebildi\u011finiz her hizmete Workload Identity Federation ile eri\u015febilirsiniz.<\/p>\n<h4>2. OCI Workload Identity Federation kullanman\u0131n maliyeti nedir?<\/h4>\n<p>OCI Workload Identity Federation&#8217;\u0131n kendisi i\u00e7in do\u011frudan bir maliyet yoktur. OCI IAM hizmetinin bir par\u00e7as\u0131 olarak sunulur ve OCI aboneli\u011finizin kapsam\u0131nda yer al\u0131r. Ancak, bu \u00f6zelli\u011fi kullanmak i\u00e7in entegre etti\u011finiz harici kimlik sa\u011flay\u0131c\u0131lar\u0131n\u0131n (\u00f6rne\u011fin, GitHub Enterprise i\u00e7in baz\u0131 maliyetler olabilir) veya OCI kaynaklar\u0131n\u0131n (\u00f6rne\u011fin, Object Storage, Compute) kullan\u0131m\u0131na ili\u015fkin standart OCI maliyetleri ge\u00e7erlidir.<\/p>\n<h4>3. Geleneksel anahtar y\u00f6netimine g\u00f6re Workload Identity Federation&#8217;\u0131n ba\u015fl\u0131ca farklar\u0131 nelerdir?<\/h4>\n<p>Ba\u015fl\u0131ca fark, Workload Identity Federation&#8217;\u0131n kal\u0131c\u0131, uzun \u00f6m\u00fcrl\u00fc kimlik bilgileri (API anahtarlar\u0131, \u015fifreler) kullanmamas\u0131d\u0131r. Bunun yerine, k\u0131sa \u00f6m\u00fcrl\u00fc, kriptografik olarak imzalanm\u0131\u015f jetonlar arac\u0131l\u0131\u011f\u0131yla kimlik do\u011frulama yapar. Bu, kimlik bilgilerinin s\u0131zd\u0131r\u0131lma riskini ortadan kald\u0131r\u0131r, anahtar d\u00f6nd\u00fcrme y\u00fck\u00fcn\u00fc azalt\u0131r, &#8220;en az ayr\u0131cal\u0131k&#8221; ilkesini daha etkin uygular ve genel g\u00fcvenlik duru\u015funu \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirir. Geleneksel anahtar y\u00f6netimi daha fazla manuel m\u00fcdahale ve risk i\u00e7erir.<\/p>\n<h4>4. Hangi durumlarda OCI Workload Identity Federation kullanmal\u0131y\u0131m?<\/h4>\n<p>Workload Identity Federation&#8217;\u0131 \u00f6zellikle \u015fu durumlarda kullanmal\u0131s\u0131n\u0131z:<\/p>\n<ul>\n<li>CI\/CD boru hatlar\u0131 (\u00f6rne\u011fin, GitHub Actions, GitLab CI) OCI kaynaklar\u0131na eri\u015fim gerektirdi\u011finde.<\/li>\n<li>Kubernetes k\u00fcmelerinde \u00e7al\u0131\u015fan uygulamalar\u0131n OCI hizmetleriyle etkile\u015fim kurmas\u0131 gerekti\u011finde.<\/li>\n<li>Sunucusuz fonksiyonlar (OCI Functions) veya di\u011fer k\u0131sa \u00f6m\u00fcrl\u00fc i\u015f y\u00fcklerinin OCI kaynaklar\u0131na eri\u015fmesi gerekti\u011finde.<\/li>\n<li>Yapay zeka\/makine \u00f6\u011frenimi i\u015f y\u00fcklerinin OCI veri depolar\u0131na veya AI hizmetlerine g\u00fcvenli eri\u015fim sa\u011flamas\u0131 gerekti\u011finde.<\/li>\n<li>G\u00fcvenli\u011fi art\u0131rmak, kimlik bilgisi y\u00f6netim y\u00fck\u00fcn\u00fc azaltmak ve uyumluluk gereksinimlerini kar\u015f\u0131lamak istedi\u011finizde.<\/li>\n<\/ul>\n<h4>5. Di\u011fer bulut sa\u011flay\u0131c\u0131lar\u0131nda OCI Workload Identity Federation&#8217;a benzer \u00e7\u00f6z\u00fcmler var m\u0131?<\/h4>\n<p>Evet, b\u00fcy\u00fck bulut sa\u011flay\u0131c\u0131lar\u0131n\u0131n \u00e7o\u011fu, i\u015f y\u00fckleri i\u00e7in benzer kimlik federasyonu \u00e7\u00f6z\u00fcmleri sunmaktad\u0131r:<\/p>\n<ul>\n<li><strong>AWS:<\/strong> IAM Roles for Service Accounts (IRSA) ile Kubernetes i\u00e7in ve OpenID Connect (OIDC) sa\u011flay\u0131c\u0131lar\u0131 arac\u0131l\u0131\u011f\u0131yla GitHub Actions gibi di\u011fer i\u015f y\u00fckleri i\u00e7in benzer yetenekler sunar.<\/li>\n<li><strong>Azure:<\/strong> Workload Identity Federation \u00f6zelli\u011fi, Azure AD (Active Directory) ile GitHub Actions gibi d\u0131\u015f IdP&#8217;ler aras\u0131nda g\u00fcven ili\u015fkileri kurarak benzer i\u015flevsellik sa\u011flar.<\/li>\n<li><strong>Google Cloud:<\/strong> Workload Identity, Kubernetes Service Account&#8217;lar\u0131n\u0131 Google Cloud Service Account&#8217;lar\u0131na ba\u011flayarak ve Workload Identity Federation ile d\u0131\u015f kimlik sa\u011flay\u0131c\u0131lar\u0131n\u0131 entegre ederek benzer bir yakla\u015f\u0131m sunar.<\/li>\n<\/ul>\n<p>Bu \u00e7\u00f6z\u00fcmlerin hepsi, kal\u0131c\u0131 kimlik bilgisi olmadan g\u00fcvenli eri\u015fim sa\u011flamak i\u00e7in OIDC standard\u0131n\u0131 temel al\u0131r.<\/p>\n<p>#OCI #CloudSecurity #IdentityFederation #GitHubActions #Kubernetes #AI #DevOps<\/p>\n<div class=\"github-example-link\"><strong>\u00d6rnek kod:<\/strong> <a href=\"https:\/\/github.com\/fatihsoysalcom\/oci-workload-identity-python-access\" target=\"_blank\" rel=\"noopener noreferrer\">github.com\/fatihsoysalcom\/oci-workload-identity-python-access<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"oci iam identity-provider create &#8211;protocol &#8220;OIDC&#8221; \\ &#8211;name &#8220;GitHubActionsIdP&#8221; \\ &#8211;description &#8220;GitHub Actions OIDC Identity Provider&#8221; \\ &#8211;metadata-url &#8220;https:\/\/token. actions.","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1491],"tags":[],"class_list":{"0":"post-44776","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-kubernetes","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim\" \/>\n<meta property=\"og:description\" content=\"oci iam identity-provider create --protocol &quot;OIDC&quot;  --name &quot;GitHubActionsIdP&quot;  --description &quot;GitHub Actions OIDC Identity Provider&quot;  --metadata-url &quot;https:\/\/token. actions.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-19T06:07:53+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-19T06:08:23+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"27 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim\",\"datePublished\":\"2026-09-19T06:07:53+00:00\",\"dateModified\":\"2026-09-19T06:08:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/\"},\"wordCount\":3988,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Kubernetes\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/\",\"name\":\"OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-09-19T06:07:53+00:00\",\"dateModified\":\"2026-09-19T06:08:23+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/","og_locale":"tr_TR","og_type":"article","og_title":"OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim","og_description":"oci iam identity-provider create --protocol \"OIDC\"  --name \"GitHubActionsIdP\"  --description \"GitHub Actions OIDC Identity Provider\"  --metadata-url \"https:\/\/token. actions.","og_url":"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-09-19T06:07:53+00:00","article_modified_time":"2026-09-19T06:08:23+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"27 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim","datePublished":"2026-09-19T06:07:53+00:00","dateModified":"2026-09-19T06:08:23+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/"},"wordCount":3988,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Kubernetes"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/","url":"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/","name":"OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-09-19T06:07:53+00:00","dateModified":"2026-09-19T06:08:23+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/oci-workload-identity-federation-github-kubernetes-ve-ai-icin-kalici-kimlik-bilgisi-olmadan-guvenli-erisim\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"OCI Workload Identity Federation: GitHub, Kubernetes ve AI \u0130\u00e7in Kal\u0131c\u0131 Kimlik Bilgisi Olmadan G\u00fcvenli Eri\u015fim"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/44776","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=44776"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/44776\/revisions"}],"predecessor-version":[{"id":44777,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/44776\/revisions\/44777"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=44776"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=44776"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=44776"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}