graph TD
    subgraph Component["KServe AutoGluon Server"]
        Server["autogluonserver<br/>(model serving container)"]
    end

    subgraph NoRBAC["RBAC Configuration"]
        direction TB
        Note["No RBAC roles or bindings<br/><br/>This component is a model server container<br/>that runs within a pod managed by KServe.<br/>It does NOT access the Kubernetes API.<br/><br/>RBAC permissions are managed by<br/>the KServe controller."]
    end

    subgraph ManagedBy["RBAC Managed By"]
        KServeCtrl["KServe Controller<br/>(manages pod ServiceAccount,<br/>RBAC, and Secret mounts)"]
    end

    subgraph Secrets["Secrets Access"]
        StorageCreds["(storage credentials)<br/>Type: Opaque<br/>Purpose: S3/GCS/Azure/HF creds<br/>Provisioned by: User / Platform Admin<br/>Auto-Rotate: No"]
    end

    subgraph AuthN["Authentication & Authorization"]
        direction TB
        AppAuth["Application Level: None<br/>No auth in autogluonserver code"]
        PlatformAuth["Platform Level: Enforced<br/>• Gateway API + kube-rbac-proxy<br/>• Istio mTLS (service mesh)<br/>• Bearer Token validation"]
    end

    Server -->|"no k8s API access"| NoRBAC
    KServeCtrl -->|"manages RBAC for"| Server
    KServeCtrl -->|"mounts into pod"| StorageCreds
    StorageCreds -->|"available to"| Server

    %% Styling
    style Server fill:#4a90e2,stroke:#333,color:#fff
    style Note fill:#f9f9f9,stroke:#999
    style KServeCtrl fill:#7ed321,stroke:#333,color:#fff
    style StorageCreds fill:#f5a623,stroke:#333
    style AppAuth fill:#f8cecc,stroke:#b85450
    style PlatformAuth fill:#d5e8d4,stroke:#82b366
