digraph G {
  subgraph cluster_baremetal {
     label="(Bare Metal|Virtual) Node"
    spireDownstreamAgent3 [label="Downstream Spire Agent"];
    userWorkload3 [label="External User Workload"];
  }
  subgraph cluster_k8s {
    label="Cluster: K8S";
    subgraph cluster_root_release {
      label="Helm Release: Namespace=spire-root Name=spire";
      subgraph cluster_ns_root {
        label="Namespace: spire-root"
        spireRoot [label="Root Spire Server"];
      }
      subgraph cluster_ns_1_system {
        label="Namespace: spire-system"
        spireUpstreamAgent1 [label="Upstream Spire Agent/CSI"];
      }
    }
    subgraph cluster_nested1_release {
      label="Helm Release: Namespace=spire-server Name=spire"
      subgraph cluster_ns_nested_server {
        label="Namespace: spire-server";
        spireServerNested1 [label="Internal Nested Spire Server"];
      }
      subgraph cluster_ns_nested_system {
        label="Namespace: spire-system";
        spireDownstreamAgent1 [label="Downstream Spire Agent/CSI"];
      }
    }
    subgraph cluster_ns_nested_system {
      label="Namespace: user";
      userWorkload1 [label="User Workload"];
    }
    subgraph cluster_ns_nested2_system {
      label="Namespace: user-other";
      userWorkload2 [label="Other User Workload"];
    }
    subgraph cluster_nested3_release {
      label="Helm Release: Namespace=spire-external Name=spire"
      subgraph cluster_ns_nested2_system {
        label="Namespace: spire-external";
        spireServerNested2 [label="External Nested Spire Server"];
      }
    }
    spireRoot -> spireUpstreamAgent1;
    spireUpstreamAgent1 -> spireServerNested1;
    spireServerNested1 -> spireDownstreamAgent1;
    spireDownstreamAgent1 -> userWorkload1;
    spireDownstreamAgent1 -> userWorkload2;
    spireUpstreamAgent1 -> spireServerNested2;
    spireServerNested2 -> spireDownstreamAgent3;
    spireDownstreamAgent3 -> userWorkload3;
  }
}