diff --git a/docs/img/k8s/agent.svg b/docs/img/k8s/agent.svg
deleted file mode 100644
index c1569fb15296d..0000000000000
--- a/docs/img/k8s/agent.svg
+++ /dev/null
@@ -1 +0,0 @@
-
\ No newline at end of file
diff --git a/docs/pages/kubernetes-access/getting-started.mdx b/docs/pages/kubernetes-access/getting-started.mdx
index d4d674ff720df..f84340e25e32e 100644
--- a/docs/pages/kubernetes-access/getting-started.mdx
+++ b/docs/pages/kubernetes-access/getting-started.mdx
@@ -29,8 +29,8 @@ Standalone Teleport Cluster](./register-clusters/static-kubeconfig.mdx).
## Deployment overview
-In this guide, we deploy the Teleport Kubernetes Service, which connects
-Kubernetes cluster `cookie` to Teleport cluster `tele.example.com`:
+In this guide, we deploy the Teleport Kubernetes Service, which connects a
+Kubernetes cluster to a Teleport cluster:
@@ -39,9 +39,20 @@ domain name, e.g., `mytenant.teleport.sh`, rather than `teleport.example.com`.
-
- 
-
+```mermaid
+flowchart TB
+subgraph priv[Private Network]
+ ks[Teleport Kubernetes Service]<--> kube[Kubernetes API Server]
+end
+
+subgraph pub[ ]
+ Users-- "kubectl get pods (mTLS)" -->proxy[Teleport Proxy Service\nteleport.example.com]
+end
+
+style pub fill:#0000,stroke:#0000;
+
+ks<-- Encrypted Tunnel -->proxy
+```
## Step 1/3. Get a join token
@@ -73,7 +84,7 @@ commands, assigning `PROXY_ADDR` to the address of your Auth Service or Proxy
Service.
```code
-$ PROXY_ADDR=tele.example.com:443
+$ PROXY_ADDR=teleport.example.com:443
# Install Kubernetes agent. It dials back to the Teleport cluster at $PROXY_ADDR
$ CLUSTER=cookie