<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="675" viewBox="0 0 1200 675" preserveAspectRatio="xMidYMid meet" role="img" aria-labelledby="title desc" data-image-type="concept-boundary">
  <title id="title">NetworkPolicy默认连通与隔离边界</title>
  <desc id="desc">image_type=概念关系图/边界示意图；target_section=先回答一个问题：NetworkPolicy到底管什么；用途=建立默认连通、策略选中后隔离、CNI执行的心智模型；关键术语=K8s网络策略、NetworkPolicy、Pod、默认连通、默认拒绝、Ingress、Egress、CNI；reader_task=理解Pod访问控制边界从开放网络到策略执行的变化。visual_precheck=core_text_inside_8_percent_safe_area,no_transform_layout,inter_panel_arrows_only,arrows_stop_in_inter_card_gap,text_inside_cards.</desc>
  <defs>
    <marker id="arrow" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto"><path d="M2,2 L10,6 L2,10 Z" fill="#2563eb"/></marker>
    <style><![CDATA[text{font-family:system-ui,Arial,Helvetica,"Microsoft YaHei","PingFang SC",sans-serif;fill:#0f172a}.h{font-size:22px;font-weight:700}.b{font-size:18px}.s{font-size:15px;fill:#475569}.panel{fill:#fff;stroke:#dbeafe;stroke-width:2}.policy{fill:#fff7ed;stroke:#f97316;stroke-width:2}.line{stroke:#2563eb;stroke-width:3;fill:none;marker-end:url(#arrow)}]]></style>
  </defs>
  <rect width="1200" height="675" fill="#f8fafc"/>
  <text x="600" y="96" text-anchor="middle" class="h">访问边界由选中对象、方向规则与CNI能力共同决定</text>
  <rect class="panel" x="130" y="150" width="260" height="330" rx="24"/>
  <text x="260" y="200" text-anchor="middle" class="h">默认连通</text>
  <text x="260" y="286" text-anchor="middle" class="b">Pod A ↔ Pod B</text>
  <text x="260" y="320" text-anchor="middle" class="s">策略未选中时可互访</text>
  <text x="260" y="390" text-anchor="middle" class="b">未被策略选中</text>
  <text x="260" y="420" text-anchor="middle" class="s">不要假设已经隔离</text>
  <path class="line" d="M404 315 H456"/>
  <rect class="policy" x="470" y="150" width="260" height="330" rx="24"/>
  <text x="600" y="200" text-anchor="middle" class="h">策略选中</text>
  <text x="600" y="286" text-anchor="middle" class="b">目标Pod</text>
  <text x="600" y="320" text-anchor="middle" class="s">Ingress / Egress</text>
  <text x="600" y="390" text-anchor="middle" class="b">规则成为白名单</text>
  <text x="600" y="420" text-anchor="middle" class="s">未允许方向被拒绝</text>
  <path class="line" d="M744 315 H796"/>
  <rect class="panel" x="810" y="150" width="260" height="330" rx="24"/>
  <text x="940" y="200" text-anchor="middle" class="h">CNI执行</text>
  <text x="940" y="286" text-anchor="middle" class="b">数据面规则</text>
  <text x="940" y="320" text-anchor="middle" class="s">插件负责落地</text>
  <text x="940" y="390" text-anchor="middle" class="b">允许或拒绝</text>
  <text x="940" y="420" text-anchor="middle" class="s">以实际执行为准</text>
  <rect x="250" y="545" width="700" height="48" rx="24" fill="#eef2ff" stroke="#6366f1" stroke-width="1.5"/>
  <text x="600" y="576" text-anchor="middle" class="b">边界判断顺序：Pod是否被选中 → 方向是否声明 → CNI是否执行</text>
</svg>
