<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="675" viewBox="0 0 1200 675" preserveAspectRatio="xMidYMid meet" role="img" aria-labelledby="title desc" data-image-type="matrix">
  <title id="title">RBAC授权对象关系矩阵</title>
  <desc id="desc">image_type=matrix; target_section=K8sRBAC最小权限先看这4类对象关系; purpose=区分权限规则、绑定关系和运行身份; key_terms=Role,ClusterRole,RoleBinding,ClusterRoleBinding,verbs,resources,namespace; reader_task=快速区分需要检查的授权对象、绑定对象和运行身份风险。</desc>
  <defs>
    <style>
      text{font-family:system-ui,Arial,Helvetica,"Microsoft YaHei","PingFang SC",sans-serif;fill:#172033}.label{font-size:22px;font-weight:700}.small{font-size:16px;fill:#526070}.mid{font-size:18px;fill:#263247}.tiny{font-size:14px;fill:#64748b}.card{fill:#fff;stroke:#c9d6e8;stroke-width:2}.rule{fill:#eef6ff;stroke:#a9c8eb;stroke-width:2}.bind{fill:#fff8ed;stroke:#e4be80;stroke-width:2}.id{fill:#eefaf6;stroke:#9bcfbd;stroke-width:2}.risk{fill:#fff4ee;stroke:#e7a386;stroke-width:2}
    </style>
  </defs>
  <rect width="1200" height="675" fill="#f3f7fb"/>
  <rect x="70" y="52" width="1060" height="570" rx="28" fill="#ffffff" stroke="#d9e4f2" stroke-width="2"/>
  <text x="600" y="96" text-anchor="middle" class="label">授权对象关系</text>
  <text x="600" y="126" text-anchor="middle" class="small">按规则、绑定、运行身份三层核对</text>

  <rect x="120" y="170" width="300" height="132" rx="22" class="rule"/>
  <text x="270" y="210" text-anchor="middle" class="label">权限规则层</text>
  <text x="270" y="242" text-anchor="middle" class="mid" font-weight="700">Role</text>
  <text x="270" y="268" text-anchor="middle" class="small">namespace内资源</text>

  <rect x="450" y="170" width="300" height="132" rx="22" class="rule"/>
  <text x="600" y="210" text-anchor="middle" class="label">复用规则</text>
  <text x="600" y="242" text-anchor="middle" class="mid" font-weight="700">ClusterRole</text>
  <text x="600" y="268" text-anchor="middle" class="small">集群级或跨空间复用</text>

  <rect x="780" y="170" width="300" height="132" rx="22" class="bind"/>
  <text x="930" y="210" text-anchor="middle" class="label">绑定关系层</text>
  <text x="930" y="242" text-anchor="middle" class="mid" font-weight="700">Binding对象</text>
  <text x="930" y="268" text-anchor="middle" class="small">决定权限给谁</text>

  <rect x="120" y="350" width="300" height="132" rx="22" class="bind"/>
  <text x="270" y="390" text-anchor="middle" class="label">范围边界</text>
  <text x="270" y="422" text-anchor="middle" class="mid" font-weight="700">命名空间 / 集群</text>
  <text x="270" y="448" text-anchor="middle" class="small">优先收窄授权范围</text>

  <rect x="450" y="350" width="300" height="132" rx="22" class="id"/>
  <text x="600" y="390" text-anchor="middle" class="label">运行身份层</text>
  <text x="600" y="422" text-anchor="middle" class="mid" font-weight="700">专用运行身份</text>
  <text x="600" y="448" text-anchor="middle" class="small">工作负载实际使用</text>

  <rect x="780" y="350" width="300" height="132" rx="22" class="risk"/>
  <text x="930" y="390" text-anchor="middle" class="label">风险边界</text>
  <text x="930" y="422" text-anchor="middle" class="mid" font-weight="700">动词与资源范围</text>
  <text x="930" y="448" text-anchor="middle" class="small">每项授权都要可解释</text>

  <rect x="150" y="548" width="900" height="2" fill="#e6edf5"/>
  <text x="600" y="583" text-anchor="middle" class="tiny">检查顺序：规则授予什么操作，再看绑定给谁，最后确认哪个运行身份实际使用</text>
</svg>
