<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 675" preserveAspectRatio="xMidYMid meet" data-image-type="selection fact comparison evaluation decision request-chain architecture-flow 能力边界 决策路径 排查决策树 信号关系">
<title>Kubernetes 准入控制排查决策树与请求链路图</title>
<desc>image_type=selection fact comparison evaluation decision request-chain architecture-flow 能力边界 决策路径 排查决策树 信号关系; target_section=准入控制请求链路; purpose=为准入控制排查展示 Request 经过 Authentication、Authorization、Admission 后写入 etcd 的位置，帮助判断失败信号来自 RBAC、Admission 还是存储前链路; key_terms=API Server, Authentication, Authorization, Admission, etcd, Request, selection, evaluation, 能力边界, 决策路径, 排查决策树, 信号关系; reader_task=在排查中理解准入控制发生在认证授权之后、持久化之前。</desc>
<style>text{font-family:system-ui,Arial,Helvetica,"Microsoft YaHei","PingFang SC",sans-serif;fill:#172033}.h{font-size:26px;font-weight:700}.t{font-size:20px;font-weight:700}.s{font-size:16px}.box{rx:18;fill:#fff;stroke:#cbd5e1;stroke-width:2}.req{fill:#eef7ff;stroke:#5aa6d8}.auth{fill:#f1f8ee;stroke:#68b66f}.adm{fill:#fff4e8;stroke:#dd9b42}.db{fill:#f1edff;stroke:#9477d6}.arrow{stroke:#345a7e;stroke-width:3;fill:none;marker-end:url(#a)}.note{rx:20;fill:#eaf0f8;stroke:#a8b7ca}</style>
<defs><marker id="a" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto"><path d="M2,2 L10,6 L2,10 Z" fill="#345a7e"/></marker></defs>
<rect width="1200" height="675" fill="#f7f9fc"/>
<text x="600" y="76" text-anchor="middle" class="h">准入控制位于认证授权之后、写入 etcd 之前</text>
<rect x="105" y="225" width="150" height="112" class="box req"/><text x="180" y="267" text-anchor="middle" class="t">Request</text><text x="180" y="296" text-anchor="middle" class="s">创建或更新</text><text x="180" y="321" text-anchor="middle" class="s">资源对象</text>
<rect x="315" y="225" width="165" height="112" class="box auth"/><text x="398" y="267" text-anchor="middle" class="t">Authentication</text><text x="398" y="296" text-anchor="middle" class="s">确认调用者</text>
<rect x="540" y="225" width="165" height="112" class="box auth"/><text x="623" y="267" text-anchor="middle" class="t">Authorization</text><text x="623" y="296" text-anchor="middle" class="s">判断权限</text>
<rect x="765" y="205" width="185" height="152" class="box adm"/><text x="858" y="251" text-anchor="middle" class="t">Admission</text><text x="858" y="282" text-anchor="middle" class="s">修改或校验</text><text x="858" y="309" text-anchor="middle" class="s">可放行或拒绝</text><text x="858" y="336" text-anchor="middle" class="s">策略对象</text>
<rect x="1010" y="225" width="125" height="112" class="box db"/><text x="1073" y="267" text-anchor="middle" class="t">etcd</text><text x="1073" y="296" text-anchor="middle" class="s">持久化</text>
<path d="M267 281 L303 281" class="arrow"/><path d="M492 281 L528 281" class="arrow"/><path d="M717 281 L753 281" class="arrow"/><path d="M962 281 L998 281" class="arrow"/>
<rect x="255" y="470" width="690" height="88" class="note"/><text x="600" y="507" text-anchor="middle" class="t">RBAC 解决谁能做什么</text><text x="600" y="540" text-anchor="middle" class="s">Admission 解决这个对象是否符合平台策略</text>
</svg>
