Figure 7

Figure 7: SPIFFE mTLS by Envoy proxies; workloads are unaware of SPIFFE IDs.