<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="680" viewBox="0 0 1200 680">
  <rect width="1200" height="680" fill="#fff7ed"/>
  <defs>
    <marker id="arrow" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto"><path d="M2,2 L10,6 L2,10 Z" fill="#ea580c"/></marker>
  </defs>
  <g font-family="Arial, 'Microsoft YaHei', sans-serif">
    <text x="70" y="72" font-size="30" font-weight="700" fill="#1f2937">证书异常排查路径</text>
    <text x="70" y="106" font-size="17" fill="#6b7280">从报错现象进入，逐步定位客户端、控制面、kubelet 或集群根证书问题</text>

    <rect x="465" y="132" width="270" height="74" rx="18" fill="#ffffff" stroke="#fb923c" stroke-width="2"/>
    <text x="600" y="163" text-anchor="middle" font-size="21" font-weight="700" fill="#9a3412">访问失败或组件报错</text>
    <text x="600" y="190" text-anchor="middle" font-size="15" fill="#c2410c">x509、Unauthorized、TLS handshake</text>

    <line x1="600" y1="206" x2="600" y2="244" stroke="#ea580c" stroke-width="3" marker-end="url(#arrow)"/>
    <polygon points="600,244 752,314 600,384 448,314" fill="#ffedd5" stroke="#f97316" stroke-width="2"/>
    <text x="600" y="305" text-anchor="middle" font-size="19" font-weight="700" fill="#9a3412">先判断故障面</text>
    <text x="600" y="332" text-anchor="middle" font-size="15" fill="#c2410c">单用户、单节点、控制面或全局</text>

    <line x1="448" y1="314" x2="246" y2="314" stroke="#ea580c" stroke-width="3" marker-end="url(#arrow)"/>
    <line x1="600" y1="384" x2="600" y2="455" stroke="#ea580c" stroke-width="3" marker-end="url(#arrow)"/>
    <line x1="752" y1="314" x2="956" y2="314" stroke="#ea580c" stroke-width="3" marker-end="url(#arrow)"/>

    <rect x="86" y="255" width="160" height="118" rx="18" fill="#fef2f2" stroke="#ef4444" stroke-width="2"/>
    <text x="166" y="293" text-anchor="middle" font-size="20" font-weight="700" fill="#991b1b">kubectl 失败</text>
    <text x="166" y="322" text-anchor="middle" font-size="15" fill="#b91c1c">检查 kubeconfig</text>
    <text x="166" y="347" text-anchor="middle" font-size="15" fill="#b91c1c">用户证书和上下文</text>

    <rect x="520" y="455" width="160" height="118" rx="18" fill="#eef2ff" stroke="#6366f1" stroke-width="2"/>
    <text x="600" y="493" text-anchor="middle" font-size="20" font-weight="700" fill="#3730a3">节点异常</text>
    <text x="600" y="522" text-anchor="middle" font-size="15" fill="#4338ca">检查 kubelet</text>
    <text x="600" y="547" text-anchor="middle" font-size="15" fill="#4338ca">client/server 证书</text>

    <rect x="956" y="255" width="170" height="118" rx="18" fill="#ecfeff" stroke="#0891b2" stroke-width="2"/>
    <text x="1041" y="293" text-anchor="middle" font-size="20" font-weight="700" fill="#155e75">控制面异常</text>
    <text x="1041" y="322" text-anchor="middle" font-size="15" fill="#0e7490">检查 apiserver</text>
    <text x="1041" y="347" text-anchor="middle" font-size="15" fill="#0e7490">etcd 与前端证书</text>

    <rect x="275" y="496" width="172" height="88" rx="16" fill="#ffffff" stroke="#fed7aa"/>
    <text x="361" y="529" text-anchor="middle" font-size="18" font-weight="700" fill="#9a3412">过期确认</text>
    <text x="361" y="555" text-anchor="middle" font-size="14" fill="#c2410c">openssl / kubeadm</text>

    <rect x="754" y="496" width="172" height="88" rx="16" fill="#ffffff" stroke="#fed7aa"/>
    <text x="840" y="529" text-anchor="middle" font-size="18" font-weight="700" fill="#9a3412">影响评估</text>
    <text x="840" y="555" text-anchor="middle" font-size="14" fill="#c2410c">范围、窗口、回滚点</text>

    <path d="M246 352 C298 420 317 456 344 490" fill="none" stroke="#ea580c" stroke-width="3" marker-end="url(#arrow)"/>
    <path d="M680 514 C705 518 728 524 750 533" fill="none" stroke="#ea580c" stroke-width="3" marker-end="url(#arrow)"/>
    <path d="M956 352 C905 421 883 457 858 490" fill="none" stroke="#ea580c" stroke-width="3" marker-end="url(#arrow)"/>

    <rect x="72" y="620" width="1056" height="38" rx="19" fill="#ffffff" stroke="#fdba74"/>
    <text x="600" y="644" text-anchor="middle" font-size="15" fill="#9a3412">排查原则：先缩小影响面，再确认过期对象，最后选择续期、分发、重启和回滚顺序</text>
  </g>
</svg>
