<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="680" viewBox="0 0 1200 680">
  <rect width="1200" height="680" fill="#f8fafc"/>
  <text x="60" y="72" font-family="Arial, 'Microsoft YaHei', sans-serif" font-size="34" font-weight="700" fill="#0f172a">Kubernetes NetworkPolicy示意图</text>
  <text x="60" y="112" font-family="Arial, 'Microsoft YaHei', sans-serif" font-size="18" fill="#475569">通过命名空间和标签选择器限制Pod之间的访问关系</text>
  <defs><marker id="arrow" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto"><path d="M2,2 L10,6 L2,10 Z" fill="#16a34a"/></marker><marker id="deny" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto"><path d="M2,2 L10,6 L2,10 Z" fill="#dc2626"/></marker></defs>
  <g font-family="Arial, 'Microsoft YaHei', sans-serif">
    <rect x="110" y="190" width="330" height="320" rx="24" fill="#ffffff" stroke="#94a3b8" stroke-width="2"/>
    <text x="275" y="235" text-anchor="middle" font-size="24" font-weight="700" fill="#0f172a">frontend 命名空间</text>
    <rect x="170" y="300" width="210" height="80" rx="18" fill="#dbeafe" stroke="#2563eb" stroke-width="2"/>
    <text x="275" y="348" text-anchor="middle" font-size="22" font-weight="700" fill="#1e3a8a">web Pod</text>

    <rect x="500" y="190" width="330" height="320" rx="24" fill="#ffffff" stroke="#94a3b8" stroke-width="2"/>
    <text x="665" y="235" text-anchor="middle" font-size="24" font-weight="700" fill="#0f172a">backend 命名空间</text>
    <rect x="560" y="270" width="210" height="72" rx="18" fill="#f0fdf4" stroke="#16a34a" stroke-width="2"/>
    <text x="665" y="314" text-anchor="middle" font-size="22" font-weight="700" fill="#166534">api Pod</text>
    <rect x="560" y="380" width="210" height="72" rx="18" fill="#fee2e2" stroke="#dc2626" stroke-width="2"/>
    <text x="665" y="424" text-anchor="middle" font-size="22" font-weight="700" fill="#991b1b">db Pod</text>

    <line x1="380" y1="340" x2="548" y2="306" stroke="#16a34a" stroke-width="4" marker-end="url(#arrow)"/>
    <text x="460" y="305" font-size="16" fill="#166534">允许</text>

    <line x1="380" y1="350" x2="548" y2="416" stroke="#dc2626" stroke-width="4" marker-end="url(#deny)"/>
    <text x="455" y="425" font-size="16" fill="#991b1b">拒绝</text>

    <rect x="885" y="250" width="220" height="180" rx="22" fill="#eef2ff" stroke="#4f46e5" stroke-width="2"/>
    <text x="995" y="300" text-anchor="middle" font-size="22" font-weight="700" fill="#3730a3">NetworkPolicy</text>
    <text x="995" y="338" text-anchor="middle" font-size="16" fill="#4338ca">按命名空间</text>
    <text x="995" y="366" text-anchor="middle" font-size="16" fill="#4338ca">按标签</text>
    <text x="995" y="394" text-anchor="middle" font-size="16" fill="#4338ca">按方向控制</text>

    <rect x="240" y="570" width="720" height="48" rx="24" fill="#eff6ff" stroke="#bfdbfe"/>
    <text x="600" y="601" text-anchor="middle" font-size="18" fill="#1e40af">NetworkPolicy的关键是把访问关系显式化，默认不必要的流量不应放行</text>
  </g>
</svg>