<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="675" viewBox="0 0 1200 675" preserveAspectRatio="xMidYMid meet" role="img" aria-labelledby="title desc" data-image-type="decision_tree">
  <title id="title">私有镜像仓库证书链的节点信任排查决策树</title>
  <desc id="desc">image_type: decision_tree; target_section: x509问题通常不在Deployment里; purpose: 用五个独立卡片展示私有CA、节点信任、containerd配置、registry证书和拉取验证之间的排查决策树; key_terms: 私有CA, 节点信任, containerd配置, registry证书, SAN, 拉取验证; reader_task: 判断证书链问题应在仓库、节点系统信任、运行时配置还是验证节奏中检查。</desc>
  <defs><style>text{font-family:system-ui,Arial,Helvetica,sans-serif,'Microsoft YaHei','PingFang SC','Noto Sans CJK SC';fill:#172033}.h{font-size:22px;font-weight:700}.b{font-size:17px;fill:#314158}.s{font-size:15px;fill:#58708f}.card{fill:#ffffff;stroke:#b9d4ff;stroke-width:2}.mid{fill:#eef6ff;stroke:#86b7ff;stroke-width:2}.strip{fill:#ecfeff;stroke:#7dd3fc;stroke-width:2}.badge{font-size:16px;font-weight:700;fill:#075985}</style></defs>
  <rect width="1200" height="675" fill="#f6faff"/>
  <rect x="58" y="58" width="1084" height="552" rx="30" fill="#ffffff" stroke="#d8e7ff" stroke-width="2"/>
  <rect class="card" x="88" y="148" width="180" height="190" rx="22"/>
  <text class="h" x="178" y="194" text-anchor="middle">私有CA</text>
  <text class="b" x="178" y="238" text-anchor="middle">签发根链</text>
  <text class="b" x="178" y="272" text-anchor="middle">纳入基线</text>
  <text class="s" x="178" y="312" text-anchor="middle">信任源头</text>
  <rect class="card" x="308" y="148" width="180" height="190" rx="22"/>
  <text class="h" x="398" y="194" text-anchor="middle">节点信任</text>
  <text class="b" x="398" y="238" text-anchor="middle">系统信任库</text>
  <text class="b" x="398" y="272" text-anchor="middle">节点池一致</text>
  <text class="s" x="398" y="312" text-anchor="middle">生效范围</text>
  <rect class="mid" x="528" y="148" width="180" height="190" rx="22"/>
  <text class="h" x="618" y="194" text-anchor="middle">运行时</text>
  <text class="b" x="618" y="238" text-anchor="middle">证书目录</text>
  <text class="b" x="618" y="272" text-anchor="middle">配置重载</text>
  <text class="s" x="618" y="312" text-anchor="middle">运行时口径</text>
  <rect class="card" x="748" y="148" width="180" height="190" rx="22"/>
  <text class="h" x="838" y="194" text-anchor="middle">仓库证书</text>
  <text class="b" x="838" y="238" text-anchor="middle">SAN覆盖</text>
  <text class="b" x="838" y="272" text-anchor="middle">地址一致</text>
  <text class="s" x="838" y="312" text-anchor="middle">身份校验</text>
  <rect class="card" x="968" y="148" width="180" height="190" rx="22"/>
  <text class="h" x="1058" y="194" text-anchor="middle">拉取验证</text>
  <text class="b" x="1058" y="238" text-anchor="middle">TLS校验</text>
  <text class="b" x="1058" y="272" text-anchor="middle">镜像可拉取</text>
  <text class="s" x="1058" y="312" text-anchor="middle">结果证据</text>
  <rect class="strip" x="128" y="414" width="944" height="92" rx="24"/>
  <text class="badge" x="600" y="452" text-anchor="middle">治理顺序</text>
  <text class="b" x="600" y="486" text-anchor="middle">先核对私有CA和SAN，再做单节点验证，最后进入节点池灰度</text>
  <rect class="strip" x="220" y="536" width="760" height="48" rx="18"/>
  <text class="s" x="600" y="567" text-anchor="middle">证书链治理要同时覆盖仓库侧身份、节点侧信任和运行时生效状态</text>
</svg>
