flowfish/docs/04-technology-stack.md

# Flowfish - Teknoloji Seçimi ve Gerekçeleri

## 🎯 Genel Bakış

Flowfish platformu için seçilen teknolojiler, yüksek performans, ölçeklenebilirlik, güvenilirlik ve geliştirici üretkenliği prensiplerine göre belirlenmiştir.

---

## 📊 Teknoloji Stack Özeti

| Katman | Teknoloji | Versiyon |
|--------|-----------|----------|
| **Veri Toplama** | Inspektor Gadget + eBPF | Latest |
| **Backend** | Python + FastAPI | 3.11+ / 0.100+ |
| **Frontend** | React + TypeScript | 18+ / 5+ |
| **UI Framework** | Ant Design | 5+ |
| **Graph Viz** | Cytoscape.js | 3.26+ |
| **İlişkisel DB** | PostgreSQL | 15+ |
| **Graph DB** | Neo4j | 3.6+ |
| **Time-series DB** | ClickHouse | 23+ |
| **Cache** | Redis | 7+ |
| **Container** | Docker | 20.10+ |
| **Orchestration** | Kubernetes/OpenShift | 1.27+ / 4.13+ |

---

## 🔬 Veri Toplama: Inspektor Gadget + eBPF

### Seçim Gerekçeleri

**Neden Inspektor Gadget?**
- ✅ **Kubernetes Native**: K8s/OpenShift için özel tasarlanmış
- ✅ **eBPF Powered**: Çekirdek seviyesinde veri toplama, sıfır overhead
- ✅ **Zero Application Change**: Uygulama değişikliği gerektirmez
- ✅ **DaemonSet Architecture**: Kolay deployment, otomatik scaling
- ✅ **Rich Gadget Library**: Network, DNS, TCP, process, syscall, file tracking
- ✅ **Open Source**: MIT lisanslı, aktif topluluk

**Alternatifler ve Neden Seçilmedi:**

| Alternatif | Artıları | Eksileri | Neden Seçilmedi |
|------------|----------|----------|-----------------|
| **Service Mesh (Istio/Linkerd)** | L7 metrics, mTLS | Sidecar injection gerekli, yüksek overhead | Uygulama değişikliği gerektirir |
| **APM Tools (Datadog, New Relic)** | Zengin UI, kolay kurulum | Ücretli, vendor lock-in | Maliyetli, dışa bağımlı |
| **Custom eBPF Programs** | Tam kontrol | Geliştirme karmaşıklığı | Yüksek development cost |
| **Network Sniffer (tcpdump)** | Basit | Performans etkisi yüksek | Scalability sorunları |

### Teknik Detaylar

**eBPF (Extended Berkeley Packet Filter)**:
- Linux kernel 4.4+ desteği
- In-kernel execution (user-space'e geçiş yok)
- Verifiable bytecode (güvenli çalıştırma)
- CO-RE (Compile Once Run Everywhere)
- Minimal CPU/memory overhead (<1-2%)

**Inspektor Gadget Gadget'leri**:
- `trace_network`: TCP/UDP connection tracking
- `trace_dns`: DNS query/response logging
- `trace_tcp`: TCP lifecycle events
- `trace_exec`: Process execution tracking
- `trace_open`: File access monitoring
- `trace_bind`: Port binding detection

---

## 🚀 Backend: Python + FastAPI

### Seçim Gerekçeleri

**Python**:
- ✅ **Ecosystem**: Zengin kütüphane desteği (data processing, ML/AI)
- ✅ **LLM Integration**: OpenAI, LangChain gibi kütüphaneler native Python
- ✅ **Async Support**: asyncio ile modern async programming
- ✅ **Developer Productivity**: Hızlı development, readable syntax

**FastAPI**:
- ✅ **High Performance**: Starlette + Pydantic, Go/Node.js seviyesinde hız
- ✅ **Automatic OpenAPI**: Swagger UI otomatik oluşturulur
- ✅ **Type Safety**: Pydantic ile compile-time type checking
- ✅ **Async Native**: Native async/await support
- ✅ **Dependency Injection**: Clean, testable code
- ✅ **WebSocket Support**: Real-time communication

**Alternatifler**:

| Alternatif | Neden Seçilmedi |
|------------|-----------------|
| **Django** | Monolithic, REST dışı ihtiyaçlar için overhead |
| **Flask** | Sync-only, modern features eksik |
| **Go (Gin/Echo)** | Python ecosystem ve LLM entegrasyonu daha zayıf |
| **Node.js (Express)** | Callback hell, type safety zayıf |

---

## ⚛️ Frontend: React + TypeScript + Ant Design

### Seçim Gerekçeleri

**React 18**:
- ✅ **Industry Standard**: Geniş topluluk, bol kaynak
- ✅ **Component-Based**: Reusable, maintainable components
- ✅ **Hooks**: Modern state management
- ✅ **Virtual DOM**: Efficient rendering
- ✅ **Server Components**: Future-proof (RSC)

**TypeScript**:
- ✅ **Type Safety**: Compile-time hata yakalama
- ✅ **Better IntelliSense**: IDE desteği mükemmel
- ✅ **Refactoring**: Safe rename, move operations
- ✅ **Documentation**: Types = self-documenting code

**Ant Design (antd)**:
- ✅ **Enterprise-Grade**: Fortune 500 şirketleri kullanıyor
- ✅ **Comprehensive**: 60+ high-quality components
- ✅ **Consistent**: Unified design language
- ✅ **Customizable**: Theme support, CSS-in-JS
- ✅ **Accessible**: WCAG 2.0 AA compliant
- ✅ **I18n**: Multi-language support built-in

**Alternatifler**:

| Alternatif | Neden Seçilmedi |
|------------|-----------------|
| **Vue.js** | Daha küçük ecosystem, daha az enterprise adoption |
| **Angular** | Steep learning curve, verbose |
| **Material-UI** | Ant Design daha enterprise-focused |
| **Chakra UI** | Daha genç, daha az battle-tested |

---

## 🎨 Graph Görselleştirme: Cytoscape.js

### Seçim Gerekçeleri

**Cytoscape.js**:
- ✅ **Purpose-Built**: Graph visualization için özel tasarlanmış
- ✅ **Performance**: 1000+ node/edge handle eder
- ✅ **Extensible**: Plugin ecosystem
- ✅ **Layout Algorithms**: Hierarchical, force-directed, circular, grid
- ✅ **Styling**: CSS-like styling system
- ✅ **Events**: Rich interaction events
- ✅ **Export**: PNG, JPG, JSON export

**Alternatifler**:

| Alternatif | Artıları | Eksileri |
|------------|----------|----------|
| **D3.js** | Çok esnek, powerful | Steep learning curve, verbose |
| **Vis.js** | Kolay kullanım | Performans sorunları (>500 nodes) |
| **Sigma.js** | Hızlı rendering | Feature set sınırlı |
| **React Flow** | React-native | Graph algorithms eksik |

---

## 🗄️ Veritabanları

### PostgreSQL 15+ (İlişkisel Veri)

**Seçim Gerekçeleri**:
- ✅ **ACID Compliance**: Güvenilir transactions
- ✅ **JSONB Support**: Flexible schema için JSON storage
- ✅ **Full-Text Search**: Built-in search capabilities
- ✅ **Extensions**: PostGIS, pg_trgm, btree_gin
- ✅ **Replication**: Streaming replication, logical replication
- ✅ **Partitioning**: Table partitioning for large datasets
- ✅ **Mature**: 30+ years, production-proven

**Kullanım Alanları**:
- User accounts, roles, permissions
- Cluster ve namespace metadata
- Analysis configurations
- Anomaly ve change records
- Audit logs

**Alternatifler Neden Seçilmedi**:
- **MySQL**: JSONB desteği zayıf, replication complex
- **MongoDB**: ACID guarantees zayıf, not ideal for relational data

### Neo4j 3.6+ (Graph Veritabanı)

**Seçim Gerekçeleri**:
- ✅ **Distributed**: Native distributed architecture
- ✅ **Scale**: Trillions of vertices/edges desteği
- ✅ **Performance**: Sub-millisecond graph traversal
- ✅ **GQL (nGQL)**: SQL-like graph query language
- ✅ **Open Source**: Apache 2.0 license
- ✅ **Kubernetes-Friendly**: Helm charts, operators
- ✅ **Consistency**: Strong consistency via Raft

**Kullanım Alanları**:
- Workload dependencies (Pod → Deployment → Service)
- Communication edges (COMMUNICATES_WITH)
- Dependency chains (DEPENDS_ON)
- Graph traversal queries (upstream/downstream)

**Alternatifler**:

| Alternatif | Neden Seçilmedi |
|------------|-----------------|
| **Neo4j** | Ücretli (enterprise), Cypher proprietary |
| **JanusGraph** | Performance Neo4j'den düşük |
| **Amazon Neptune** | Vendor lock-in, cloud-only |
| **ArangoDB** | Multi-model karmaşıklık |

### ClickHouse 23+ (Time-Series/OLAP)

**Seçim Gerekçeleri**:
- ✅ **Columnar Storage**: Yüksek compression (10-100x)
- ✅ **Fast Queries**: Billions of rows, sub-second queries
- ✅ **Aggregations**: Pre-aggregation via materialized views
- ✅ **TTL Support**: Automatic data cleanup
- ✅ **Partitioning**: Date/time based partitioning
- ✅ **Replication**: Built-in replication
- ✅ **SQL**: Standard SQL dialect

**Kullanım Alanları**:
- Network flow events (raw eBPF data)
- DNS queries, TCP connections
- HTTP requests, metrics
- Process events, syscall traces
- Aggregated request metrics

**Alternatifler**:

| Alternatif | Neden Seçilmedi |
|------------|-----------------|
| **TimescaleDB** | PostgreSQL extension, daha yavaş |
| **InfluxDB** | Non-SQL, limited query capabilities |
| **Elasticsearch** | Resource-heavy, complex operations |
| **Prometheus** | Short retention, not for raw events |

### Redis 7+ (Cache & Real-time)

**Seçim Gerekçeleri**:
- ✅ **In-Memory**: Microsecond latency
- ✅ **Pub/Sub**: Real-time event streaming
- ✅ **Data Structures**: Lists, sets, sorted sets, hashes
- ✅ **TTL**: Automatic expiration
- ✅ **Persistence**: RDB + AOF
- ✅ **Clustering**: Native clustering support
- ✅ **Sentinel**: Automatic failover

**Kullanım Alanları**:
- Session storage (JWT tokens)
- Real-time metrics cache
- Rate limiting counters
- Pub/Sub for WebSocket updates
- Distributed locks

---

## 🐳 Container & Orchestration

### Docker

**Seçim Gerekçeleri**:
- ✅ **Industry Standard**: De facto containerization platform
- ✅ **Image Registry**: Docker Hub, private registries
- ✅ **Multi-Stage Builds**: Optimized images
- ✅ **BuildKit**: Fast, efficient builds

### Kubernetes / OpenShift

**Seçim Gerekçeleri**:
- ✅ **Cloud-Native Standard**: Industry standard orchestration
- ✅ **Auto-Scaling**: HPA, VPA
- ✅ **Self-Healing**: Automatic restarts, health checks
- ✅ **Service Discovery**: Built-in DNS
- ✅ **Storage**: PersistentVolumes, StorageClasses
- ✅ **Security**: RBAC, NetworkPolicies, PodSecurityPolicies
- ✅ **OpenShift**: Enterprise features, operatorlar, built-in monitoring

---

## 🔐 Kimlik Doğrulama

### JWT (JSON Web Tokens)

**Seçim Gerekçeleri**:
- ✅ **Stateless**: Sunucu-side session gerektirmez
- ✅ **Scalable**: Horizontal scaling friendly
- ✅ **Cross-Domain**: CORS-friendly
- ✅ **Standard**: RFC 7519
- ✅ **Libraries**: Her dil için mature library

### OAuth 2.0 / OpenID Connect

**Seçim Gerekçeleri**:
- ✅ **SSO**: Single Sign-On support
- ✅ **Enterprise**: Azure AD, Okta, Keycloak entegrasyonu
- ✅ **Delegation**: Secure delegation of access
- ✅ **Standard**: Industry standard protocol

---

## 📊 Monitoring & Observability

### Önerilen Stack (Opsiyonel)

| Component | Teknoloji | Amaç |
|-----------|-----------|------|
| **Metrics** | Prometheus | Time-series metrics |
| **Logs** | Loki / ELK | Centralized logging |
| **Tracing** | Jaeger / Tempo | Distributed tracing |
| **Dashboards** | Grafana | Visualization |
| **Alerting** | Alertmanager | Alert management |

---

## 🎯 Sonuç

Flowfish technology stack, modern cloud-native uygulama geliştirme best practice'lerini takip eder:

**✅ Performans**: eBPF, FastAPI, ClickHouse, Redis  
**✅ Ölçeklenebilirlik**: Kubernetes, distributed databases  
**✅ Güvenilirlik**: PostgreSQL ACID, replication  
**✅ Developer Experience**: Python, TypeScript, React  
**✅ Maintainability**: Type safety, test frameworks  
**✅ Open Source**: Vendor lock-in yok, community support  

**Versiyon**: 1.0.0  
**Son Güncelleme**: Ocak 2025