digraph G {
  subgraph cluster_root {
    label="Cluster: Root K8S";
    subgraph cluster_root_release {
      label="Helm Release: Namespace=spire-root Name=spire"
      spireRoot [label="Root Spire Server"];
    }
  }
  subgraph cluster_nested1 {
    label="Cluster: K8S Workload 1";
    subgraph cluster_nested1_release {
      label="Helm Release: Namespace=spire-server Name=spire"
      subgraph cluster_nested1_ns1 {
        label="Namespace: spire-system"
        spireUpstreamAgent1 [label="Upstream Spire Agent/CSI"];
      }
      subgraph cluster_nested1_ns2 {
        label="Namespace: spire-server"
        spireServerNested1 [label="Nested Spire Server"];
      }
      subgraph cluster_nested1_ns3 {
        label="Namespace: spire-system"
        spireDownstreamAgent1 [label="Downstream Spire Agent/CSI"];
      }
    }
    subgraph cluster_nested1_user {
      label="Namespace: user"
      userWorkload1 [label="User Workload"];
    }
  }
  subgraph cluster_nested2 {
    label="Cluster: K8S Workload 2";
    subgraph cluster_nested2_release {
      label="Helm Release: Namespace=spire-server Name=spire"
      subgraph cluster_nested2_ns1 {
        label="Namespace: spire-system"
        spireUpstreamAgent2 [label="Upstream Spire Agent/CSI"];
      }
      subgraph cluster_nested2_ns2 {
        label="Namespace: spire-server"
        spireServerNested2 [label="Nested Spire Server"];
      }
      subgraph cluster_nested2_ns3 {
        label="Namespace: spire-system"
        spireDownstreamAgent2 [label="Downstream Spire Agent/CSI"];
      }
    }
    subgraph cluster_nested2_user {
      label="Namespace: user"
      userWorkload2 [label="Other User Workload"];
    }
  }
  spireRoot -> spireUpstreamAgent1;
  spireRoot -> spireUpstreamAgent2;
  spireUpstreamAgent1 -> spireServerNested1;
  spireServerNested1 -> spireDownstreamAgent1;
  spireDownstreamAgent1 -> userWorkload1;
  spireUpstreamAgent2 -> spireServerNested2;
  spireServerNested2 -> spireDownstreamAgent2;
  spireDownstreamAgent2 -> userWorkload2;
}