<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="675" viewBox="0 0 1200 675" preserveAspectRatio="xMidYMid meet" role="img" data-image-type="identity_flow_diagram">
  <title>ServiceAccount令牌轮换身份链路图</title>
  <desc>image_type=identity_flow_diagram; section=ServiceAccount身份不等于一条RBAC规则; purpose=说明 Pod、ServiceAccount、令牌、API Server、RBAC 和审计之间的身份链路; key_terms=Pod, ServiceAccount, 令牌, API Server, RBAC, 审计; reader_task=区分身份、凭据、授权和审计在 Kubernetes 身份安全中的位置。</desc>
  <defs><marker id="a-sa1" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto" markerUnits="strokeWidth"><path d="M2,2 L10,6 L2,10 Z" fill="#7c2d12"/></marker><style>.bg{fill:#fff8f4}.pod{fill:#ffedd5;stroke:#f97316;stroke-width:2}.id{fill:#fef3c7;stroke:#d97706;stroke-width:2}.api{fill:#eef2ff;stroke:#6366f1;stroke-width:2}.rbac{fill:#ecfdf5;stroke:#16a34a;stroke-width:2}.audit{fill:#f8fafc;stroke:#64748b;stroke-width:2}.label{fill:#fff7ed;stroke:#fb923c;stroke-width:2}.label2{fill:#fef3c7;stroke:#f59e0b;stroke-width:2}.t1{font:700 24px system-ui,Arial,'Microsoft YaHei',sans-serif;fill:#7c2d12}.t2{font:700 19px system-ui,Arial,'Microsoft YaHei',sans-serif;fill:#0f172a}.t3{font:16px system-ui,Arial,'Microsoft YaHei',sans-serif;fill:#334155}.s{font:14px system-ui,Arial,'Microsoft YaHei',sans-serif;fill:#475569}.line{stroke:#7c2d12;stroke-width:3;fill:none;marker-end:url(#a-sa1)}.dash{stroke:#64748b;stroke-width:3;fill:none;stroke-dasharray:8 8;marker-end:url(#a-sa1)}</style></defs>
  <rect class="bg" width="1200" height="675"/>
  <text class="t1" x="600" y="78" text-anchor="middle">ServiceAccount 令牌轮换贯穿身份、访问和审计</text>
  <text class="s" x="600" y="108" text-anchor="middle">先确认 Pod 使用哪个身份，再检查凭据如何生成、授权如何生效、访问如何留痕</text>

  <rect class="label" x="118" y="150" width="194" height="54" rx="27"/>
  <text class="s" x="215" y="183" text-anchor="middle">身份不等于权限</text>
  <rect class="label2" x="840" y="150" width="250" height="54" rx="27"/>
  <text class="s" x="965" y="183" text-anchor="middle">轮换关注凭据生命周期</text>

  <rect class="pod" x="110" y="292" width="170" height="122" rx="20"/>
  <text class="t2" x="195" y="332" text-anchor="middle">Pod</text><text class="t3" x="195" y="364" text-anchor="middle">读取挂载文件</text><text class="t3" x="195" y="390" text-anchor="middle">发起 API 调用</text>
  <rect class="id" x="360" y="210" width="190" height="116" rx="20"/>
  <text class="t2" x="455" y="250" text-anchor="middle">ServiceAccount</text><text class="t3" x="455" y="282" text-anchor="middle">工作负载身份</text><text class="t3" x="455" y="308" text-anchor="middle">绑定到 Pod</text>
  <rect class="id" x="360" y="424" width="190" height="116" rx="20"/>
  <text class="t2" x="455" y="464" text-anchor="middle">短期令牌</text><text class="t3" x="455" y="496" text-anchor="middle">限定生命周期</text><text class="t3" x="455" y="522" text-anchor="middle">降低持续风险</text>
  <rect class="api" x="640" y="292" width="184" height="122" rx="20"/>
  <text class="t2" x="732" y="332" text-anchor="middle">API Server</text><text class="t3" x="732" y="364" text-anchor="middle">认证请求身份</text><text class="t3" x="732" y="390" text-anchor="middle">校验访问边界</text>
  <rect class="rbac" x="902" y="228" width="174" height="116" rx="20"/>
  <text class="t2" x="989" y="268" text-anchor="middle">RBAC</text><text class="t3" x="989" y="300" text-anchor="middle">判断可做什么</text><text class="t3" x="989" y="326" text-anchor="middle">最小权限</text>
  <rect class="audit" x="902" y="424" width="174" height="116" rx="20"/>
  <text class="t2" x="989" y="464" text-anchor="middle">审计</text><text class="t3" x="989" y="496" text-anchor="middle">记录身份和动作</text><text class="t3" x="989" y="522" text-anchor="middle">支撑追踪</text>

  <path class="line" d="M280 353 H336"/>
  <path class="dash" d="M455 326 V400"/>
  <path class="line" d="M550 482 C596 482 610 394 626 374"/>
  <path class="line" d="M824 346 C858 326 870 298 878 286"/>
  <path class="dash" d="M824 382 C858 404 872 452 878 476"/>
</svg>
