<?xml version="1.0" encoding="UTF-8"?>
<mxfile host="app.diagrams.net" agent="KubeDaily Enterprise Security Architecture"><diagram id="securityarchitecture" name="03 · Layered security reference architecture">
    <mxGraphModel dx="1750" dy="1000" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="3500" pageHeight="2220" math="0" shadow="0" background="#FFFFFF">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="securityarchitecture_v1" value="LAYERED SECURITY REFERENCE ARCHITECTURE" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#FFFFFF;fontSize=33;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="36" y="20" width="3428" height="50" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v2" value="KubeDaily-inspired topology: API request chain  /  supply chain  /  node isolation  /  network datapath  /  detection &amp; controls" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#AFC4D8;fontSize=16;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="37" y="74" width="3426" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v3" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#264765;strokeColor=#365D7D;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="2915" y="27" width="546" height="48" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v4" value="EDITABLE DRAW.IO  •  REFERENCE ARCHITECTURE" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D7E8FA;fontSize=13;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2923" y="27" width="530" height="48" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v5" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#CFDBE8;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="24" y="133" width="3452" height="74" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v6" value="" vertex="1" parent="1" style="rounded=1;arcSize=5;whiteSpace=wrap;html=1;fillColor=#387CC5;strokeColor=#387CC5;strokeWidth=0.1;fontColor=#14243A;">
          <mxGeometry x="45" y="152" width="17" height="33" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v7" value="IDENTITY &amp; API" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=15;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="151" width="590" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v8" value="" vertex="1" parent="1" style="rounded=1;arcSize=5;whiteSpace=wrap;html=1;fillColor=#22806E;strokeColor=#22806E;strokeWidth=0.1;fontColor=#14243A;">
          <mxGeometry x="731" y="152" width="17" height="33" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v9" value="TRUST &amp; WORKLOADS" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=15;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="759" y="151" width="590" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v10" value="" vertex="1" parent="1" style="rounded=1;arcSize=5;whiteSpace=wrap;html=1;fillColor=#D34E5B;strokeColor=#D34E5B;strokeWidth=0.1;fontColor=#14243A;">
          <mxGeometry x="1417" y="152" width="17" height="33" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v11" value="ATTACK ENTRY" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=15;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1445" y="151" width="590" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v12" value="" vertex="1" parent="1" style="rounded=1;arcSize=5;whiteSpace=wrap;html=1;fillColor=#B37B27;strokeColor=#B37B27;strokeWidth=0.1;fontColor=#14243A;">
          <mxGeometry x="2103" y="152" width="17" height="33" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v13" value="ARTIFACT &amp; SUPPLY CHAIN" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=15;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2131" y="151" width="590" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v14" value="" vertex="1" parent="1" style="rounded=1;arcSize=5;whiteSpace=wrap;html=1;fillColor=#7D63B0;strokeColor=#7D63B0;strokeWidth=0.1;fontColor=#14243A;">
          <mxGeometry x="2789" y="152" width="17" height="33" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v15" value="DETECTION / RESPONSE" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=15;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2817" y="151" width="590" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v16" value="" vertex="1" parent="1" style="rounded=1;arcSize=15;whiteSpace=wrap;html=1;fillColor=#FAFCFE;strokeColor=#B9C9D7;strokeWidth=2.6;dashed=1;dashPattern=7 5;fontColor=#14243A;">
          <mxGeometry x="24" y="255" width="573" height="1660" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v17" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FAFCFE;strokeColor=#B9C9D7;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="40" y="238" width="330" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v18" value="EXTERNAL SYSTEMS / ATTACK SURFACES" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#55718B;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="48" y="238" width="314" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v19" value="Outside cluster trust boundary" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#647A91;fontSize=13;fontFamily=Arial;fontStyle=0;align=right;verticalAlign=middle;spacing=0;">
          <mxGeometry x="102" y="268" width="475" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v20" value="" vertex="1" parent="1" style="rounded=1;arcSize=15;whiteSpace=wrap;html=1;fillColor=#FFFBFB;strokeColor=#E7A6AD;strokeWidth=2.6;dashed=1;dashPattern=7 5;fontColor=#14243A;">
          <mxGeometry x="630" y="255" width="2195" height="1660" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v21" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FFFBFB;strokeColor=#E7A6AD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="646" y="238" width="200" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v22" value="KUBERNETES CLUSTER" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D34E5B;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="654" y="238" width="184" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v23" value="Cluster security boundary" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#647A91;fontSize=13;fontFamily=Arial;fontStyle=0;align=right;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2330" y="268" width="475" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v24" value="" vertex="1" parent="1" style="rounded=1;arcSize=15;whiteSpace=wrap;html=1;fillColor=#F6FAFF;strokeColor=#83ADDD;strokeWidth=2.6;dashed=1;dashPattern=7 5;fontColor=#14243A;">
          <mxGeometry x="666" y="337" width="2120" height="617" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v25" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F6FAFF;strokeColor=#83ADDD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="682" y="320" width="294" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v26" value="CONTROL PLANE / API TRUST ZONE" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="690" y="320" width="278" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v27" value="Protect cluster administrative operations" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#647A91;fontSize=13;fontFamily=Arial;fontStyle=0;align=right;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2291" y="350" width="475" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v28" value="" vertex="1" parent="1" style="rounded=1;arcSize=15;whiteSpace=wrap;html=1;fillColor=#F5FBF8;strokeColor=#7DBCA9;strokeWidth=2.6;dashed=1;dashPattern=7 5;fontColor=#14243A;">
          <mxGeometry x="666" y="982" width="2120" height="872" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v29" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F5FBF8;strokeColor=#7DBCA9;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="682" y="965" width="200" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v30" value="WORKER / DATA PLANE" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#22806E;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="690" y="965" width="184" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v31" value="Namespaces are organizational, not strong isolation" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#647A91;fontSize=13;fontFamily=Arial;fontStyle=0;align=right;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2291" y="995" width="475" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v32" value="" vertex="1" parent="1" style="rounded=1;arcSize=8;whiteSpace=wrap;html=1;fillColor=#E6EEF7;strokeColor=#C6D5E5;strokeWidth=1;fontColor=#14243A;">
          <mxGeometry x="44" y="290" width="531" height="43" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v33" value="01  IDENTITY + ADMIN ACCESS" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=17;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="58" y="290" width="503" height="43" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v34" label="" tags="Access.Operator Access.Cli" help="Administrator identity; restrict permissions and protect kubeconfig" slug="Operator">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F0F5FA;strokeColor=#B7C7D9;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="58" y="359" width="245" height="106" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v35" value="Platform operator" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#526C84;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="366" width="215" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v36" value="kubectl  •  short-lived cert / OIDC" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="67" y="403" width="227" height="56" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v37" label="" tags="Api.Authn Api.Authn.Identity" help="OIDC issuer validates identity, Kubernetes API checks presented token" slug="IdentityProvider">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="319" y="359" width="243" height="106" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v38" value="Identity provider (IdP)" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="334" y="366" width="213" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v39" value="OIDC / signed JWT / MFA" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="328" y="403" width="225" height="56" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v40" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FFF5E4;strokeColor=#E1BB70;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="58" y="488" width="245" height="102" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v41" value="GitOps / CI identity" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#B37B27;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="495" width="215" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v42" value="Service user  •  scoped token" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="67" y="532" width="227" height="52" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v43" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FDEEF0;strokeColor=#E7A6AD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="319" y="488" width="243" height="102" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v44" value="External adversary" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D34E5B;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="334" y="495" width="213" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v45" value="TA01 / TA06 · stolen token" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="328" y="532" width="225" height="52" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v46" value="" vertex="1" parent="1" style="rounded=1;arcSize=8;whiteSpace=wrap;html=1;fillColor=#E6EEF7;strokeColor=#C6D5E5;strokeWidth=1;fontColor=#14243A;">
          <mxGeometry x="44" y="645" width="531" height="43" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v47" value="02  SOFTWARE SUPPLY CHAIN" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#B37B27;fontSize=17;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="58" y="645" width="503" height="43" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v48" label="" tags="SupplyChain SupplyChain.Git" slug="SourceControl" help="Protected branches, reviews, secret scanning and pinned dependencies.">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FFF5E4;strokeColor=#E1BB70;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="56" y="716" width="234" height="98" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v49" value="Source repository" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#B37B27;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="71" y="723" width="204" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v50" value="Branch approvals / signed commits" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="65" y="760" width="216" height="48" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v51" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FFF5E4;strokeColor=#E1BB70;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="317" y="716" width="243" height="98" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v52" value="CI image builder" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#B37B27;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="332" y="723" width="213" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v53" value="Isolated build + dependency lockfile" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="326" y="760" width="225" height="48" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v54" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FFF5E4;strokeColor=#E1BB70;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="56" y="852" width="234" height="98" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v55" value="Provenance + SBOM" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#B37B27;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="71" y="859" width="204" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v56" value="SLSA-style attestations / scan" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="65" y="896" width="216" height="48" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v57" label="" tags="SupplyChain SupplyChain.Registry" slug="Registry" help="Image must be pinned by digest; verify signatures at admission.">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FFF5E4;strokeColor=#E1BB70;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="317" y="852" width="243" height="98" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v58" value="Container registry" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#B37B27;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="332" y="859" width="213" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v59" value="Immutable digest / signed image" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="326" y="896" width="225" height="48" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v60" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#B37B27;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="290" y="762" as="sourcePoint" />
            <mxPoint x="317" y="762" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v61" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#B37B27;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="438" y="814" as="sourcePoint" />
            <mxPoint x="172" y="852" as="targetPoint" />
            <Array as="points">
              <mxPoint x="438" y="836" />
              <mxPoint x="172" y="836" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v62" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#B37B27;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="290" y="900" as="sourcePoint" />
            <mxPoint x="317" y="900" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v63" value="" vertex="1" parent="1" style="rounded=1;arcSize=10;whiteSpace=wrap;html=1;fillColor=#FDEEF0;strokeColor=#E7A6AD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="58" y="983" width="500" height="139" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v64" value="Threats from this zone" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D34E5B;fontSize=16;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="71" y="993" width="474" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v65" value="•  AV04: malicious image / package" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="1026" width="470" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v66" value="•  AV28: compromised CI / GitOps" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="1051" width="470" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v67" value="•  AV17: forged artifact metadata" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="1076" width="470" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v68" value="" vertex="1" parent="1" style="rounded=1;arcSize=8;whiteSpace=wrap;html=1;fillColor=#E6EEF7;strokeColor=#C6D5E5;strokeWidth=1;fontColor=#14243A;">
          <mxGeometry x="44" y="1155" width="531" height="43" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v69" value="03  CLIENT &amp; NETWORK ENTRY" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=17;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="58" y="1155" width="503" height="43" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v70" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FDEEF0;strokeColor=#E7A6AD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="58" y="1228" width="234" height="98" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v71" value="Internet client" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D34E5B;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="1235" width="204" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v72" value="Untrusted request  •  TA01" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="67" y="1272" width="216" height="48" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v73" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F0F5FA;strokeColor=#B7C7D9;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="317" y="1228" width="243" height="98" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v74" value="DNS / External LB" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#526C84;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="332" y="1235" width="213" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v75" value="TLS 443 / TCP load-balancing" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="326" y="1272" width="225" height="48" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v76" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#D34E5B;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="292" y="1278" as="sourcePoint" />
            <mxPoint x="317" y="1278" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v77" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F2EEFA;strokeColor=#B3A3D1;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="58" y="1370" width="234" height="96" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v78" value="Cloud IAM / KMS" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#7D63B0;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="1377" width="204" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v79" value="Storage keys  •  workload identities" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="67" y="1414" width="216" height="46" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v80" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F2EEFA;strokeColor=#B3A3D1;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="317" y="1370" width="243" height="96" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v81" value="Secrets manager" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#7D63B0;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="332" y="1377" width="213" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v82" value="External secrets / CSI provider" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="326" y="1414" width="225" height="46" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v83" value="" vertex="1" parent="1" style="rounded=1;arcSize=10;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="58" y="1507" width="500" height="137" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v84" value="Key trust boundary rules" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="71" y="1517" width="474" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v85" value="•  TLS and client/server identity on control traffic" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="1550" width="470" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v86" value="•  Minimize credentials and secret projection" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="1575" width="470" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v87" value="•  Cloud permissions need separate scoping" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="1600" width="470" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v88" value="" vertex="1" parent="1" style="rounded=1;arcSize=10;whiteSpace=wrap;html=1;fillColor=#FDEEF0;strokeColor=#E7A6AD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="58" y="1671" width="500" height="142" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v89" value="External attack vectors" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D34E5B;fontSize=16;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="71" y="1681" width="474" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v90" value="•  AV01: public workload exploit" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="1714" width="470" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v91" value="•  AV02: leaked kubeconfig / token" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="1739" width="470" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v92" value="•  AV22: DNS / service discovery poisoning" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="73" y="1764" width="470" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v93" value="" vertex="1" parent="1" style="rounded=1;arcSize=13;whiteSpace=wrap;html=1;fillColor=#F7FBFF;strokeColor=#9BBBDD;strokeWidth=2;fontColor=#14243A;">
          <mxGeometry x="696" y="381" width="1503" height="300" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v94" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="726" y="394" width="580" height="48" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v95" value="kube-apiserver  •  HTTPS TCP/6443" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=21;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="734" y="394" width="564" height="48" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v96" value="REQUEST HANDLING  •  SIMPLIFIED ORDER" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#647A91;fontSize=15;fontFamily=Arial;fontStyle=1;align=right;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1370" y="406" width="790" height="29" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v97" label="" tags="Api" help="Entry / TLS — API HTTPS endpoint" slug="ApiStep1">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="725" y="469" width="262" height="116" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v98" value="Entry / TLS" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="740" y="476" width="232" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v99" value="API HTTPS endpoint" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="734" y="513" width="244" height="66" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v100" label="" tags="Api Api.Authn" help="AuthN — OIDC / cert / token" slug="ApiStep2">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1014" y="469" width="262" height="116" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v101" value="AuthN" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1029" y="476" width="232" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v102" value="OIDC / cert / token" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1023" y="513" width="244" height="66" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v103" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="988" y="527" as="sourcePoint" />
            <mxPoint x="1014" y="527" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <object id="securityarchitecture_v104" label="" tags="Api Api.Authz Api.Rbac" help="AuthZ — RBAC / webhook" slug="ApiStep3">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1303" y="469" width="262" height="116" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v105" value="AuthZ" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1318" y="476" width="232" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v106" value="RBAC / webhook" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1312" y="513" width="244" height="66" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v107" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1277" y="527" as="sourcePoint" />
            <mxPoint x="1303" y="527" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <object id="securityarchitecture_v108" label="" tags="Api Api.Admission" help="Admission (writes) — PSA + policies" slug="ApiStep4">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1592" y="469" width="262" height="116" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v109" value="Admission (writes)" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1607" y="476" width="232" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v110" value="PSA + policies" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1601" y="513" width="244" height="66" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v111" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1566" y="527" as="sourcePoint" />
            <mxPoint x="1592" y="527" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <object id="securityarchitecture_v112" label="" tags="Api" help="Object storage — etcd persistence" slug="ApiStep5">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1881" y="469" width="262" height="116" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v113" value="Object storage" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1896" y="476" width="232" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v114" value="etcd persistence" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1890" y="513" width="244" height="66" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v115" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1855" y="527" as="sourcePoint" />
            <mxPoint x="1881" y="527" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v116" value="" vertex="1" parent="1" style="rounded=1;arcSize=10;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="732" y="594" width="1403" height="74" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v117" value="Enforcement points" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="745" y="604" width="1377" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v118" value="API Priority &amp; Fairness / rate protections  •  Authentication, authorization and admission  •  Audit record for eligible API requests" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="747" y="635" width="1373" height="30" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v119" label="" tags="ControlPlane.Etcd" help="Kubernetes API persists cluster state in etcd; encryption at rest is not automatic for all installations." slug="Etcd">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F2EEFA;strokeColor=#B3A3D1;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="2230" y="390" width="529" height="167" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v120" value="etcd datastore" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#7D63B0;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2245" y="397" width="499" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v121" value="TLS/2379 • peer TLS/2380&#10;Secrets need encryption-at-rest configuration" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2239" y="434" width="511" height="117" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v122" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EEF9F0;strokeColor=#85C293;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2230" y="585" width="529" height="95" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v123" value="API audit stream" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#257850;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2245" y="592" width="499" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v124" value="Request / actor / verb / object" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2239" y="629" width="511" height="45" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v125" label="" tags="ControlPlane Api.Controllers" help="kube-controller-manager interacts with the Kubernetes API with distinct identity and RBAC." slug="Controller0">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="705" y="727" width="390" height="144" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v126" value="kube-controller-manager" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=17;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="720" y="734" width="360" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v127" value="Control loops · secure metrics 10257" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="714" y="771" width="372" height="94" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v128" label="" tags="ControlPlane Api.Controllers" help="kube-scheduler interacts with the Kubernetes API with distinct identity and RBAC." slug="Controller1">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1117" y="727" width="390" height="144" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v129" value="kube-scheduler" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=17;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1132" y="734" width="360" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v130" value="Scheduling · secure metrics 10259" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1126" y="771" width="372" height="94" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v131" label="" tags="ControlPlane Api.Controllers" help="cloud-controller-manager interacts with the Kubernetes API with distinct identity and RBAC." slug="Controller2">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1529" y="727" width="390" height="144" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v132" value="cloud-controller-manager" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=17;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1544" y="734" width="360" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v133" value="Provider-specific control loop" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1538" y="771" width="372" height="94" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v134" label="" tags="ControlPlane Api.Controllers" help="Custom operator / CRDs interacts with the Kubernetes API with distinct identity and RBAC." slug="Controller3">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1941" y="727" width="390" height="144" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v135" value="Custom operator / CRDs" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=17;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1956" y="734" width="360" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v136" value="Crossplane / resource reconciliation" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1950" y="771" width="372" height="94" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v137" label="" tags="ControlPlane Api.Controllers" help="cert-manager interacts with the Kubernetes API with distinct identity and RBAC." slug="Controller4">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="2353" y="727" width="390" height="144" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v138" value="cert-manager" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=17;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2368" y="734" width="360" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v139" value="Certificate issuance and renewals" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2362" y="771" width="372" height="94" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v140" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="303" y="408" as="sourcePoint" />
            <mxPoint x="725" y="506" as="targetPoint" />
            <Array as="points">
              <mxPoint x="630" y="408" />
              <mxPoint x="630" y="506" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v141" value="" vertex="1" parent="1" style="rounded=1;arcSize=7;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#D5DEE7;strokeWidth=1;fontColor=#14243A;">
          <mxGeometry x="470" y="447" width="139.5" height="28" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v142" value="kubectl / HTTPS" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=12;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="478" y="447" width="123.5" height="28" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v143" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="441" y="465" as="sourcePoint" />
            <mxPoint x="1014" y="475" as="targetPoint" />
            <Array as="points">
              <mxPoint x="441" y="480" />
              <mxPoint x="630" y="480" />
              <mxPoint x="630" y="475" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v144" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#D34E5B;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="303" y="540" as="sourcePoint" />
            <mxPoint x="725" y="561" as="targetPoint" />
            <Array as="points">
              <mxPoint x="615" y="540" />
              <mxPoint x="615" y="561" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v145" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="2133" y="513" as="sourcePoint" />
            <mxPoint x="2230" y="476" as="targetPoint" />
            <Array as="points">
              <mxPoint x="2215" y="513" />
              <mxPoint x="2215" y="476" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v146" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#7D63B0;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="2390" y="557" as="sourcePoint" />
            <mxPoint x="2390" y="585" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v147" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=1.6;startArrow=none;endArrow=none;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="900" y="727" as="sourcePoint" />
            <mxPoint x="1410" y="681" as="targetPoint" />
            <Array as="points">
              <mxPoint x="900" y="697" />
              <mxPoint x="1410" y="697" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v148" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=1.6;startArrow=none;endArrow=none;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1312" y="727" as="sourcePoint" />
            <mxPoint x="1410" y="681" as="targetPoint" />
            <Array as="points">
              <mxPoint x="1312" y="697" />
              <mxPoint x="1410" y="697" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v149" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=1.6;startArrow=none;endArrow=none;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1724" y="727" as="sourcePoint" />
            <mxPoint x="1410" y="681" as="targetPoint" />
            <Array as="points">
              <mxPoint x="1724" y="697" />
              <mxPoint x="1410" y="697" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v150" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=1.6;startArrow=none;endArrow=none;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="2136" y="727" as="sourcePoint" />
            <mxPoint x="1410" y="681" as="targetPoint" />
            <Array as="points">
              <mxPoint x="2136" y="697" />
              <mxPoint x="1410" y="697" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v151" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=1.6;startArrow=none;endArrow=none;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="2548" y="727" as="sourcePoint" />
            <mxPoint x="1410" y="681" as="targetPoint" />
            <Array as="points">
              <mxPoint x="2548" y="697" />
              <mxPoint x="1410" y="697" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v152" value="" vertex="1" parent="1" style="rounded=1;arcSize=15;whiteSpace=wrap;html=1;fillColor=#F5FBF8;strokeColor=#7DBCA9;strokeWidth=2.6;dashed=1;dashPattern=7 5;fontColor=#14243A;">
          <mxGeometry x="700" y="1058" width="1002" height="665" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v153" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F5FBF8;strokeColor=#7DBCA9;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="716" y="1041" width="267" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v154" value="WORKER NODE A / application" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#22806E;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="724" y="1041" width="251" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v155" value="Shared kernel + CNI" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#647A91;fontSize=13;fontFamily=Arial;fontStyle=0;align=right;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1207" y="1071" width="475" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v156" value="" vertex="1" parent="1" style="rounded=1;arcSize=15;whiteSpace=wrap;html=1;fillColor=#F5FBF8;strokeColor=#7DBCA9;strokeWidth=2.6;dashed=1;dashPattern=7 5;fontColor=#14243A;">
          <mxGeometry x="1722" y="1058" width="1023" height="665" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v157" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F5FBF8;strokeColor=#7DBCA9;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="1738" y="1041" width="321" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v158" value="WORKER NODE B / internal services" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#22806E;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1746" y="1041" width="305" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v159" value="Shared kernel + CNI" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#647A91;fontSize=13;fontFamily=Arial;fontStyle=0;align=right;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2250" y="1071" width="475" height="25" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v160" label="" tags="ControlPlane.Kubelet" help="Kubelet is node agent; privileged API access and 10250 need scoping." slug="Kubelet0">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="727" y="1110" width="294.3333333333333" height="100" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v161" value="kubelet" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=17;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="742" y="1117" width="264.3333333333333" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v162" value="API stream + CRI / kubelet HTTPS 10250" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="736" y="1154" width="276.3333333333333" height="50" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v163" label="" tags="Node.RuntimeSecurity" slug="Runtime0">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F0F5FA;strokeColor=#B7C7D9;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1054.3333333333333" y="1110" width="294.3333333333333" height="100" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v164" value="Container runtime" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#526C84;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1069.3333333333333" y="1117" width="264.3333333333333" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v165" value="containerd / CRI-O · CRI socket" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1063.3333333333333" y="1154" width="276.3333333333333" height="50" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v166" label="" tags="Network.Cni Network.Policy" slug="Cni0">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF8F4;strokeColor=#7DBCA9;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1381.6666666666665" y="1110" width="294.3333333333333" height="100" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v167" value="CNI data path" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#22806E;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1396.6666666666665" y="1117" width="264.3333333333333" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v168" value="Network policy / conntrack" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1390.6666666666665" y="1154" width="276.3333333333333" height="50" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v169" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="874.1666666666666" y="1210" as="sourcePoint" />
            <mxPoint x="874.1666666666666" y="1240" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v170" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#526C84;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1201.5" y="1210" as="sourcePoint" />
            <mxPoint x="1201.5" y="1240" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v171" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#22806E;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1528.8333333333333" y="1210" as="sourcePoint" />
            <mxPoint x="1528.8333333333333" y="1240" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <object id="securityarchitecture_v172" label="" tags="ControlPlane.Kubelet" help="Kubelet is node agent; privileged API access and 10250 need scoping." slug="Kubelet1">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1748" y="1110" width="301.6666666666667" height="100" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v173" value="kubelet" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=17;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1763" y="1117" width="271.6666666666667" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v174" value="API stream + CRI / kubelet HTTPS 10250" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1757" y="1154" width="283.6666666666667" height="50" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v175" label="" tags="Node.RuntimeSecurity" slug="Runtime1">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F0F5FA;strokeColor=#B7C7D9;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="2082.6666666666665" y="1110" width="301.6666666666667" height="100" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v176" value="Container runtime" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#526C84;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2097.6666666666665" y="1117" width="271.6666666666667" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v177" value="containerd / CRI-O · CRI socket" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2091.6666666666665" y="1154" width="283.6666666666667" height="50" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v178" label="" tags="Network.Cni Network.Policy" slug="Cni1">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF8F4;strokeColor=#7DBCA9;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="2417.3333333333335" y="1110" width="301.6666666666667" height="100" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v179" value="CNI data path" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#22806E;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2432.3333333333335" y="1117" width="271.6666666666667" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v180" value="Network policy / conntrack" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2426.3333333333335" y="1154" width="283.6666666666667" height="50" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v181" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1898.8333333333333" y="1210" as="sourcePoint" />
            <mxPoint x="1898.8333333333333" y="1240" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v182" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#526C84;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="2233.5" y="1210" as="sourcePoint" />
            <mxPoint x="2233.5" y="1240" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v183" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#22806E;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="2568.166666666667" y="1210" as="sourcePoint" />
            <mxPoint x="2568.166666666667" y="1240" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v184" value="" vertex="1" parent="1" style="rounded=1;arcSize=15;whiteSpace=wrap;html=1;fillColor=#F6FAFF;strokeColor=#83ADDD;strokeWidth=2.6;dashed=1;dashPattern=7 5;fontColor=#14243A;">
          <mxGeometry x="740" y="1262" width="926" height="310" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v185" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F6FAFF;strokeColor=#83ADDD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="756" y="1245" width="200" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v186" value="NAMESPACE: app-prod" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="764" y="1245" width="184" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v187" value="RBAC scoped; policy via CNI" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#647A91;fontSize=13;fontFamily=Arial;fontStyle=0;align=right;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1171" y="1275" width="475" height="25" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v188" label="" tags="Network.Service Network.Service.EndpointSlice" slug="ServiceEndpoints">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF8F4;strokeColor=#7DBCA9;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="763" y="1312" width="275" height="110" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v189" value="Service / EndpointSlice" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#22806E;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="778" y="1319" width="245" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v190" value="ClusterIP:443 -&gt; PodIP:8080" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="772" y="1356" width="257" height="60" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v191" label="" tags="Workload Namespace.Resources" slug="FrontendPod">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF8F4;strokeColor=#7DBCA9;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1061" y="1312" width="282" height="110" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v192" value="Pod: frontend" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#22806E;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1076" y="1319" width="252" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v193" value="App + projected ServiceAccount token" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1070" y="1356" width="264" height="60" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v194" label="" tags="ProcessSecurity ProcessSecurity.Seccomp" slug="ApiPod">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF8F4;strokeColor=#7DBCA9;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1367" y="1312" width="272" height="110" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v195" value="Pod: API" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#22806E;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1382" y="1319" width="242" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v196" value="seccomp / non-root / read-only FS" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1376" y="1356" width="254" height="60" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v197" label="" tags="Network.Policy" slug="NetworkPolicy">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EEF9F0;strokeColor=#85C293;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="763" y="1441" width="275" height="106" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v198" value="NetworkPolicy" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#257850;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="778" y="1448" width="245" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v199" value="Default deny; explicit L3 / L4 allow" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="772" y="1485" width="257" height="56" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v200" label="" tags="Workload.Volume" slug="SecretSources">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F2EEFA;strokeColor=#B3A3D1;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1061" y="1441" width="282" height="106" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v201" value="Secret / ConfigMap" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#7D63B0;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1076" y="1448" width="252" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v202" value="Volume / env / projected files" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1070" y="1485" width="264" height="56" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v203" label="" tags="Namespace.Psa" slug="PodSecurityAdmission">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EEF9F0;strokeColor=#85C293;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1367" y="1441" width="272" height="106" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v204" value="Pod Security Admission" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#257850;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1382" y="1448" width="242" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v205" value="Restricted profile where feasible" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1376" y="1485" width="254" height="56" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v206" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#22806E;strokeWidth=2.8;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1038" y="1363" as="sourcePoint" />
            <mxPoint x="1061" y="1363" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v207" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#22806E;strokeWidth=2.8;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1343" y="1363" as="sourcePoint" />
            <mxPoint x="1367" y="1363" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v208" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#7D63B0;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1202" y="1441" as="sourcePoint" />
            <mxPoint x="1202" y="1422" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <object id="securityarchitecture_v209" label="" tags="Workload" slug="NodeBComp0">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF8F4;strokeColor=#7DBCA9;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1764" y="1312" width="299" height="110" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v210" value="Pod: internal API" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#22806E;fontSize=17;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1779" y="1319" width="269" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v211" value="Identity-checked service / mTLS optional" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1773" y="1356" width="281" height="60" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v212" label="" tags="Workload" slug="NodeBComp1">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F2EEFA;strokeColor=#B3A3D1;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="2088" y="1312" width="299" height="110" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v213" value="Pod: database" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#7D63B0;fontSize=17;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2103" y="1319" width="269" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v214" value="PVC / CSI / scoped Secret" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2097" y="1356" width="281" height="60" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v215" label="" tags="Network.ServiceMesh" slug="NodeBComp2">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="2412" y="1312" width="299" height="110" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v216" value="Service mesh proxy" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=17;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2427" y="1319" width="269" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v217" value="Optional east-west mTLS, authz" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2421" y="1356" width="281" height="60" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v218" label="" tags="Node.RuntimeSecurity Node.Observability" slug="RuntimeSensors">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EEF9F0;strokeColor=#85C293;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="1764" y="1441" width="299" height="106" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v219" value="eBPF observability" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#257850;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1779" y="1448" width="269" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v220" value="Falco / Tetragon / Hubble (optional)" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1773" y="1485" width="281" height="56" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v221" label="" tags="Workload.Volume" slug="StorageCsi">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F2EEFA;strokeColor=#B3A3D1;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="2088" y="1441" width="299" height="106" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v222" value="Storage / CSI" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#7D63B0;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2103" y="1448" width="269" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v223" value="PVC -&gt; volume plugin / provider" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2097" y="1485" width="281" height="56" as="geometry" />
        </mxCell>
        <object id="securityarchitecture_v224" label="" tags="Network.Egress Network.Egress.Gateway" slug="EgressGateway">
          <mxCell vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F0F5FA;strokeColor=#B7C7D9;strokeWidth=1.8;fontColor=#14243A;">
            <mxGeometry x="2412" y="1441" width="299" height="106" as="geometry" />
          </mxCell>
        </object>
        <mxCell id="securityarchitecture_v225" value="Egress gateway / NAT" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#526C84;fontSize=18;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2427" y="1448" width="269" height="38" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v226" value="Policy -&gt; SNAT -&gt; external service" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2421" y="1485" width="281" height="56" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v227" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#22806E;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1639" y="1367" as="sourcePoint" />
            <mxPoint x="1764" y="1380" as="targetPoint" />
            <Array as="points">
              <mxPoint x="1743" y="1367" />
              <mxPoint x="1743" y="1380" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v228" value="" vertex="1" parent="1" style="rounded=1;arcSize=7;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#D5DEE7;strokeWidth=1;fontColor=#14243A;">
          <mxGeometry x="1570" y="1268" width="178.0" height="28" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v229" value="East-west: allowlist" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#22806E;fontSize=12;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1578" y="1268" width="162.0" height="28" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v230" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#7D63B0;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="2200" y="1422" as="sourcePoint" />
            <mxPoint x="2200" y="1441" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v231" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#22806E;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="2570" y="1422" as="sourcePoint" />
            <mxPoint x="2570" y="1441" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v232" value="" vertex="1" parent="1" style="rounded=1;arcSize=7;whiteSpace=wrap;html=1;fillColor=#F8FAFC;strokeColor=#C4D3E2;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="735" y="1591" width="934" height="103" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v233" value="NODE A KERNEL / CONTAINER SECURITY" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#526C84;fontSize=15;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="750" y="1596" width="900" height="27" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v234" value="Linux namespaces • cgroups • capabilities • SELinux/AppArmor • seccomp • user namespaces" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=14;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="752" y="1634" width="895" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v235" value="" vertex="1" parent="1" style="rounded=1;arcSize=7;whiteSpace=wrap;html=1;fillColor=#F8FAFC;strokeColor=#C4D3E2;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="1750" y="1591" width="975" height="103" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v236" value="NODE B KERNEL / CONTAINER SECURITY" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#526C84;fontSize=15;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1765" y="1596" width="925" height="27" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v237" value="Runtime socket protections • hostPath restrictions • hardening • node isolation" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=14;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="1765" y="1634" width="925" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v238" value="" vertex="1" parent="1" style="rounded=1;arcSize=10;whiteSpace=wrap;html=1;fillColor=#FFF5E4;strokeColor=#E1BB70;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="731" y="1749" width="1985" height="88" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v239" value="Important boundary caveat" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#B37B27;fontSize=16;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="744" y="1759" width="1959" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v240" value="•  Namespaces are NOT a hard multi-tenant security boundary." vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="746" y="1792" width="1955" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v241" value="•  A privileged Pod or host socket can undermine isolation." vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="746" y="1817" width="1955" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v242" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="560" y="1275" as="sourcePoint" />
            <mxPoint x="800" y="1312" as="targetPoint" />
            <Array as="points">
              <mxPoint x="610" y="1275" />
              <mxPoint x="610" y="1844" />
              <mxPoint x="800" y="1844" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v243" value="" vertex="1" parent="1" style="rounded=1;arcSize=7;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#D5DEE7;strokeWidth=1;fontColor=#14243A;">
          <mxGeometry x="680" y="1814" width="147.2" height="28" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v244" value="Ingress: TLS 443" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=12;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="688" y="1814" width="131.2" height="28" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v245" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#B37B27;strokeWidth=3;startArrow=none;endArrow=block;endFill=1;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="560" y="900" as="sourcePoint" />
            <mxPoint x="1157" y="1110" as="targetPoint" />
            <Array as="points">
              <mxPoint x="616" y="900" />
              <mxPoint x="616" y="1040" />
              <mxPoint x="1157" y="1040" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v246" value="" vertex="1" parent="1" style="rounded=1;arcSize=7;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#D5DEE7;strokeWidth=1;fontColor=#14243A;">
          <mxGeometry x="782" y="1008" width="101.0" height="28" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v247" value="Image pull" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#B37B27;fontSize=12;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="790" y="1008" width="85.0" height="28" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v248" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#22806E;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1225" y="1749" as="sourcePoint" />
            <mxPoint x="1225" y="1723" as="targetPoint" />
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v249" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#387CC5;strokeWidth=2.5;startArrow=none;endArrow=block;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="2462" y="1070" as="sourcePoint" />
            <mxPoint x="2160" y="955" as="targetPoint" />
            <Array as="points">
              <mxPoint x="2462" y="1020" />
              <mxPoint x="2160" y="1020" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v250" value="" vertex="1" parent="1" style="rounded=1;arcSize=7;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#D5DEE7;strokeWidth=1;fontColor=#14243A;">
          <mxGeometry x="2140" y="990" width="178.0" height="28" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v251" value="kubelet API / status" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=12;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2148" y="990" width="162.0" height="28" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v252" value="" vertex="1" parent="1" style="rounded=1;arcSize=15;whiteSpace=wrap;html=1;fillColor=#F6FAFF;strokeColor=#83ADDD;strokeWidth=2.6;dashed=1;dashPattern=7 5;fontColor=#14243A;">
          <mxGeometry x="2861" y="255" width="610" height="565" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v253" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F6FAFF;strokeColor=#83ADDD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="2877" y="238" width="258" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v254" value="SECURITY POLICY &amp; CONTROLS" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2885" y="238" width="242" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v255" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EEF9F0;strokeColor=#85C293;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="301" width="560" height="68" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v256" value="IDENTITY  ·  C02 / C03" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#257850;fontSize=15;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="308" width="530" height="30.6" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v257" value="MFA, short-lived credentials, least privilege" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="345" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v258" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EEF9F0;strokeColor=#85C293;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="378" width="560" height="68" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v259" value="API POLICY  ·  C08 / C12" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#257850;fontSize=15;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="385" width="530" height="30.6" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v260" value="PSA + validating / mutating webhooks" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="422" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v261" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EEF9F0;strokeColor=#85C293;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="455" width="560" height="68" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v262" value="NETWORK  ·  C09 / C22" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#257850;fontSize=15;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="462" width="530" height="30.6" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v263" value="Default-deny policy, egress controls, mTLS" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="499" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v264" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EEF9F0;strokeColor=#85C293;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="532" width="560" height="68" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v265" value="RUNTIME  ·  C11 / C16 / C17" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#257850;fontSize=15;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="539" width="530" height="30.6" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v266" value="seccomp, MAC, no dangerous host access" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="576" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v267" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EEF9F0;strokeColor=#85C293;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="609" width="560" height="68" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v268" value="SUPPLY  ·  C13 / C14" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#257850;fontSize=15;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="616" width="530" height="30.6" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v269" value="Artifact signing, digest pinning, SBOM" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="653" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v270" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EEF9F0;strokeColor=#85C293;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="686" width="560" height="68" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v271" value="DATA  ·  C06 / C23" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#257850;fontSize=15;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="693" width="530" height="30.6" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v272" value="KMS etcd encryption, Secret access controls" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="730" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v273" value="" vertex="1" parent="1" style="rounded=1;arcSize=15;whiteSpace=wrap;html=1;fillColor=#F6FAFF;strokeColor=#83ADDD;strokeWidth=2.6;dashed=1;dashPattern=7 5;fontColor=#14243A;">
          <mxGeometry x="2861" y="865" width="610" height="485" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v274" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#F6FAFF;strokeColor=#83ADDD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="2877" y="848" width="240" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v275" value="OBSERVABILITY / EVIDENCE" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2885" y="848" width="224" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v276" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="911" width="560" height="72" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v277" value="API audit events" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="918" width="530" height="32.4" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v278" value="Who / verb / object / response" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="955" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v279" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="994" width="560" height="72" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v280" value="CNI flow telemetry" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="1001" width="530" height="32.4" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v281" value="Source/destination + deny" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="1038" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v282" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="1077" width="560" height="72" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v283" value="Runtime detection" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="1084" width="530" height="32.4" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v284" value="Process, file, syscall, capabilities" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="1121" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v285" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="1160" width="560" height="72" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v286" value="Image / admission logs" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="1167" width="530" height="32.4" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v287" value="Signature, policy decisions" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="1204" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v288" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="1243" width="560" height="72" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v289" value="Central SIEM / triage" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="1250" width="530" height="32.4" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v290" value="Correlate by workload and identity" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="1287" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v291" value="" vertex="1" parent="1" style="rounded=1;arcSize=15;whiteSpace=wrap;html=1;fillColor=#FFFBFB;strokeColor=#E7A6AD;strokeWidth=2.6;dashed=1;dashPattern=7 5;fontColor=#14243A;">
          <mxGeometry x="2861" y="1395" width="610" height="430" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v292" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FFFBFB;strokeColor=#E7A6AD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="2877" y="1378" width="231" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v293" value="ATTACK-PATH ANNOTATIONS" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D34E5B;fontSize=16;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2885" y="1378" width="215" height="35" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v294" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FDEEF0;strokeColor=#E7A6AD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="1443" width="560" height="64" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v295" value="P1 · AV02 / AV28" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D34E5B;fontSize=15;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="1450" width="530" height="28.8" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v296" value="Stolen kubeconfig -&gt; API privilege" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="1487" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v297" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FDEEF0;strokeColor=#E7A6AD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="1515" width="560" height="64" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v298" value="P2 · AV01 / AV03" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D34E5B;fontSize=15;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="1522" width="530" height="28.8" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v299" value="Public app -&gt; token abuse" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="1559" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v300" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FDEEF0;strokeColor=#E7A6AD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="1587" width="560" height="64" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v301" value="P3 · AV04 / AV28" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D34E5B;fontSize=15;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="1594" width="530" height="28.8" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v302" value="Supply-chain tampering -&gt; Pod" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="1631" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v303" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FDEEF0;strokeColor=#E7A6AD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="1659" width="560" height="64" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v304" value="P4 · AV18" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D34E5B;fontSize=15;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="1666" width="530" height="28.8" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v305" value="Allowed east-west route -&gt; pivot" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="1703" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v306" value="" vertex="1" parent="1" style="rounded=1;arcSize=11;whiteSpace=wrap;html=1;fillColor=#FDEEF0;strokeColor=#E7A6AD;strokeWidth=1.8;fontColor=#14243A;">
          <mxGeometry x="2885" y="1731" width="560" height="64" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v307" value="P5 · AV14 / AV15" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#D34E5B;fontSize=15;fontFamily=Arial;fontStyle=1;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2900" y="1738" width="530" height="28.8" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v308" value="Pod privilege -&gt; node compromise" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=12;fontFamily=Arial;fontStyle=0;align=center;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2894" y="1775" width="542" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v309" value="" vertex="1" parent="1" style="rounded=1;arcSize=10;whiteSpace=wrap;html=1;fillColor=#EAF3FF;strokeColor=#83ADDD;strokeWidth=1.5;fontColor=#14243A;">
          <mxGeometry x="2868" y="1866" width="595" height="176" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v310" value="Diagram conventions" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#387CC5;fontSize=16;fontFamily=Arial;fontStyle=1;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2881" y="1876" width="569" height="25" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v311" value="•  Blue = authorized / expected data flow" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2883" y="1909" width="565" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v312" value="•  Red = threat or candidate exploit path" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2883" y="1934" width="565" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v313" value="•  Dashed boundary = distinct trust context" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2883" y="1959" width="565" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v314" value="•  KubeDaily-authored, independently editable" vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#263F59;fontSize=13;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="2883" y="1984" width="565" height="22" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v315" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#D34E5B;strokeWidth=2.8;startArrow=none;endArrow=block;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="562" y="531" as="sourcePoint" />
            <mxPoint x="711" y="610" as="targetPoint" />
            <Array as="points">
              <mxPoint x="630" y="531" />
              <mxPoint x="630" y="610" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v316" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#D34E5B;strokeWidth=2.8;startArrow=none;endArrow=block;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="1555" y="1422" as="sourcePoint" />
            <mxPoint x="1775" y="1312" as="targetPoint" />
            <Array as="points">
              <mxPoint x="1555" y="1276" />
              <mxPoint x="1775" y="1276" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v317" value="" edge="1" parent="1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeColor=#22806E;strokeWidth=2;startArrow=none;endArrow=block;endFill=1;dashed=1;dashPattern=8 5;">
          <mxGeometry relative="1" as="geometry">
            <mxPoint x="2660" y="1550" as="sourcePoint" />
            <mxPoint x="2861" y="1740" as="targetPoint" />
            <Array as="points">
              <mxPoint x="2740" y="1550" />
              <mxPoint x="2740" y="1740" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="securityarchitecture_v318" value="MODEL NOTES: External/cloud services are illustrative. Ports, components and enforcement depend on distribution, CNI and deployment; validate before use in production." vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#647A91;fontSize=14;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="35" y="2120" width="3300" height="26" as="geometry" />
        </mxCell>
        <mxCell id="securityarchitecture_v319" value="Reference concepts: kubernetesdaily.github.io (MIT-licensed repository)  •  This is an original topology derived from the prior threat-model pages, not a copied SVG." vertex="1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=none;fontColor=#647A91;fontSize=14;fontFamily=Arial;fontStyle=0;align=left;verticalAlign=middle;spacing=0;">
          <mxGeometry x="35" y="2150" width="3300" height="27" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
  </mxfile>