diff --git a/.github/tests/charts.json b/.github/tests/charts.json
index eb72d77..e1ab03e 100644
--- a/.github/tests/charts.json
+++ b/.github/tests/charts.json
@@ -2,12 +2,12 @@
   {
     "name": "kube-prometheus-stack",
     "repo": "https://prometheus-community.github.io/helm-charts",
-    "version": "45.26.0"
+    "version": "45.29.0"
   },
   {
     "name": "cert-manager",
     "repo": "https://charts.jetstack.io",
-    "version": "v1.11.1"
+    "version": "v1.12.0"
   },
   {
     "name": "ingress-nginx",
@@ -17,11 +17,11 @@
   {
     "name": "mysql",
     "repo": "https://charts.bitnami.com/bitnami",
-    "version": "9.7.2"
+    "version": "9.10.1"
   },
   {
     "name": "postgresql",
     "repo": "https://charts.bitnami.com/bitnami",
-    "version": "12.2.2"
+    "version": "12.5.3"
   }
 ]
diff --git a/.github/tests/spire-oidc-insecure/values.yaml b/.github/tests/spire-oidc-insecure/values.yaml
index 4c1124e..86f7159 100644
--- a/.github/tests/spire-oidc-insecure/values.yaml
+++ b/.github/tests/spire-oidc-insecure/values.yaml
@@ -1,3 +1,23 @@
+spire-server:
+  ingress:
+    enabled: true
+    className: "nginx"
+    annotations:
+      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+      nginx.ingress.kubernetes.io/ssl-redirect: "true"
+      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    hosts:
+    - host: ingress-nginx-controller.spire-oidc-insecure
+      paths:
+        - path: /
+          pathType: Prefix
+
+spire-agent:
+  server:
+    address: ingress-nginx-controller.spire-oidc-insecure
+    port: 443
+
 spiffe-oidc-discovery-provider:
   enabled: true
 
diff --git a/.github/tests/tornjak/install.sh b/.github/tests/tornjak/install.sh
new file mode 100755
index 0000000..bfb0139
--- /dev/null
+++ b/.github/tests/tornjak/install.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+helm install \
+  --namespace spire-server \
+  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
+  --values "${SCRIPTPATH}/../../../examples/tornjak/values.yaml" \
+  spire charts/spire --wait
+helm test spire -n spire-server
diff --git a/.github/tests/tornjak/post-install.sh b/.github/tests/tornjak/post-install.sh
new file mode 100755
index 0000000..c5040ec
--- /dev/null
+++ b/.github/tests/tornjak/post-install.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status spire-server spire-system
+
+kubectl rollout status --watch --timeout 180s --namespace spire-server deployments.apps spire-tornjak-frontend
+kubectl -n spire-server get deploy spire-tornjak-frontend
+kubectl -n spire-server get service spire-tornjak-frontend
+
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details spire-server
+  get_namespace_details spire-system
+fi
diff --git a/.github/tests/tornjak/pre-install.sh b/.github/tests/tornjak/pre-install.sh
new file mode 100755
index 0000000..b33d1ed
--- /dev/null
+++ b/.github/tests/tornjak/pre-install.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+kubectl create namespace spire-system
+kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace spire-server
+kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml
index e129967..4f3fbf2 100644
--- a/.github/workflows/check-versions.yaml
+++ b/.github/workflows/check-versions.yaml
@@ -36,6 +36,7 @@ jobs:
         id: cpr
         uses: peter-evans/create-pull-request@v5.0.1
         with:
+          token: ${{ secrets.GITHUB_TOKEN }}
           title: Bump test chart dependencies
           branch: bump-test-chart-deps
           commit-message: Bump test chart dependencies
diff --git a/.github/workflows/helm-chart-ci-ignore.yaml b/.github/workflows/helm-chart-ci-ignore.yaml
new file mode 100644
index 0000000..b5e1ef7
--- /dev/null
+++ b/.github/workflows/helm-chart-ci-ignore.yaml
@@ -0,0 +1,60 @@
+name: Helm Chart CI
+
+on:
+  pull_request:
+    types: [synchronize, opened, reopened]
+    paths-ignore:
+      - 'charts/**'
+      - '.github/workflows/helm-chart-ci.yaml'
+      - '.github/kind/conf/kind-config.yaml'
+      - '.github/tests/**/*.yaml'
+      - '.github/tests/**/*.sh'
+      - '.github/tests/**/*.json'
+      - 'examples/**/*.yaml'
+      - 'helm-docs.sh'
+
+jobs:
+  lint-chart:
+    runs-on: ubuntu-22.04
+    steps:
+      - run: 'echo "Skipping linter"'
+
+  checks:
+    runs-on: ubuntu-22.04
+    steps:
+      - run: 'echo "Skipping checks"'
+
+  build-matrix:
+    name: Build matrix
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3.5.2
+
+      - id: set-matrix
+        name: Collect all tests
+        run: |
+          tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
+          tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
+          echo "tests=$tests_json" >> $GITHUB_OUTPUT
+
+    outputs:
+      tests: ${{ steps.set-matrix.outputs.tests }}
+
+  test:
+    runs-on: ubuntu-22.04
+    needs:
+      - build-matrix
+
+    strategy:
+      matrix:
+        k8s:
+          - v1.27.0
+          - v1.26.3
+          - v1.25.8
+        values:
+          - ${{ fromJson(needs.build-matrix.outputs.tests) }}
+
+    steps:
+      - run: 'echo "Skipping tests"'
diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
index 4ac7bb0..a41d2e7 100644
--- a/.github/workflows/helm-chart-ci.yaml
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -10,6 +10,7 @@ on:
       - '.github/kind/conf/kind-config.yaml'
       - '.github/tests/**/*.yaml'
       - '.github/tests/**/*.sh'
+      - '.github/tests/**/*.json'
       - 'examples/**/*.yaml'
       - 'helm-docs.sh'
 
@@ -92,14 +93,6 @@ jobs:
         with:
           version: ${{ env.CHART_TESTING_VERSION }}
 
-      - name: Run chart-testing (list-changed)
-        id: list-changed
-        run: |
-          changed=$(ct list-changed --target-branch ${{ github.base_ref }})
-          if [[ -n "$changed" ]]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
-          fi
-
       - name: Run chart-testing (lint)
         run: |
           ct lint --debug ${{ github.base_ref != 'release' && '--check-version-increment=false' || '' }} \
@@ -114,8 +107,6 @@ jobs:
 
     needs: [lint-chart]
 
-    if: needs.lint-chart.outputs.changed == 'true'
-
     steps:
       - name: Checkout
         uses: actions/checkout@v3.5.2
@@ -137,8 +128,6 @@ jobs:
       - lint-chart
       - build-matrix
 
-    if: needs.lint-chart.outputs.changed == 'true'
-
     strategy:
       fail-fast: false
       matrix:
@@ -153,7 +142,6 @@ jobs:
           - v1.24.12
           - v1.23.17
           - v1.22.17
-          - v1.21.14
         values:
           - ${{ fromJson(needs.build-matrix.outputs.tests) }}
 
@@ -179,7 +167,7 @@ jobs:
           version: ${{ env.CHART_TESTING_VERSION }}
 
       - name: Create kind ${{ matrix.k8s }} cluster
-        uses: helm/kind-action@v1.5.0
+        uses: helm/kind-action@v1.7.0
         # Only build a kind cluster if there are chart changes to test.
         with:
           version: v0.18.0
@@ -209,6 +197,7 @@ jobs:
             "${TEST_DIR}/install.sh"
           else
             ct install --debug \
+              --charts "charts/spire" \
               --namespace "${scenario}" \
               --target-branch ${{ github.base_ref }} \
               --exclude-deprecated \
diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml
index 357d965..035ae8b 100644
--- a/.github/workflows/helm-release.yaml
+++ b/.github/workflows/helm-release.yaml
@@ -29,7 +29,7 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Setup cosign
-        uses: sigstore/cosign-installer@v3.0.3
+        uses: sigstore/cosign-installer@v3.0.5
         with:
           cosign-release: v2.0.2
 
diff --git a/README.md b/README.md
index d5e947b..e14c7a5 100644
--- a/README.md
+++ b/README.md
@@ -23,9 +23,9 @@ Unless otherwise noted in an application chart README, the following dependencie
 |:-----------|:-------------------|
 | SPIRE      | `1.5.3`+, `1.6.x`  |
 | Helm       | `3.x`              |
-| Kubernetes | `1.21+`            |
+| Kubernetes | `1.22+`            |
 
-> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.21`.*
+> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.22`.*
 
 ## Contributing
 
diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml
index 62af05f..ff67d9d 100644
--- a/charts/spire/Chart.yaml
+++ b/charts/spire/Chart.yaml
@@ -3,8 +3,8 @@ name: spire
 description: >
   A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
 type: application
-version: 0.7.0
-appVersion: "1.6.3"
+version: 0.8.0
+appVersion: "1.6.4"
 keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
 home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
 sources:
@@ -38,6 +38,10 @@ dependencies:
     condition: spiffe-oidc-discovery-provider.enabled
     repository: file://./charts/spiffe-oidc-discovery-provider
     version: 0.1.0
+  - name: tornjak-frontend
+    condition: tornjak-frontend.enabled
+    repository: file://./charts/tornjak-frontend
+    version: 0.1.0
 annotations:
   artifacthub.io/category: security
   artifacthub.io/license: Apache-2.0
diff --git a/charts/spire/README.md b/charts/spire/README.md
index e77bf5c..079d710 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square)
+![Version: 0.8.0](https://img.shields.io/badge/Version-0.8.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.4](https://img.shields.io/badge/AppVersion-1.6.4-informational?style=flat-square)
 [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
 
 A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -19,9 +19,9 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi
 |:-----------|:-------------------|
 | SPIRE      | `1.5.3+`, `1.6.3+` |
 | Helm       | `3.x`              |
-| Kubernetes | `1.21+`            |
+| Kubernetes | `1.22+`            |
 
-> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.21`.*
+> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
 
 ## Prerequisites
 
@@ -96,14 +96,13 @@ Now you can interact with the Spire agent socket from your own application. The
 
 ## Requirements
 
-Kubernetes: `>=1.21.0-0`
-
 | Repository | Name | Version |
 |------------|------|---------|
 | file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 |
 | file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 |
 | file://./charts/spire-agent | spire-agent | 0.1.0 |
 | file://./charts/spire-server | spire-server | 0.1.0 |
+| file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 |
 
 ## Values
 
@@ -114,20 +113,22 @@ Kubernetes: `>=1.21.0-0`
 | global.spire.clusterName | string | `"example-cluster"` |  |
 | global.spire.image.registry | string | `""` | Override all Spire image registries at once |
 | global.spire.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers |
-| spiffe-csi-driver.enabled | bool | `true` |  |
-| spiffe-oidc-discovery-provider.enabled | bool | `false` |  |
-| spire-agent.enabled | bool | `true` |  |
+| spiffe-csi-driver.enabled | bool | `true` | Enables deployment of CSI driver |
+| spiffe-oidc-discovery-provider.enabled | bool | `false` | Enables deployment of OIDC discovery provider |
+| spire-agent.enabled | bool | `true` | Enables deployment of SPIRE Agent(s) |
 | spire-agent.nameOverride | string | `"agent"` |  |
-| spire-server.controllerManager.enabled | bool | `true` |  |
-| spire-server.enabled | bool | `true` |  |
+| spire-server.controllerManager.enabled | bool | `true` | Enables deployment of Controller Manager |
+| spire-server.enabled | bool | `true` | Enables deployment of SPIRE Server |
 | spire-server.nameOverride | string | `"server"` |  |
+| tornjak-frontend.enabled | bool | `false` | Enables deployment of Tornjak frontend/UI (Not for production) |
 | spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
 | spiffe-csi-driver.fullnameOverride | string | `""` |  |
 | spiffe-csi-driver.healthChecks.port | int | `9809` |  |
 | spiffe-csi-driver.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | spiffe-csi-driver.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | spiffe-csi-driver.image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry |
-| spiffe-csi-driver.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
+| spiffe-csi-driver.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
+| spiffe-csi-driver.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spiffe-csi-driver.imagePullSecrets | list | `[]` |  |
 | spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` |  |
 | spiffe-csi-driver.nameOverride | string | `""` |  |
@@ -135,7 +136,8 @@ Kubernetes: `>=1.21.0-0`
 | spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | spiffe-csi-driver.nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from |
 | spiffe-csi-driver.nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry |
-| spiffe-csi-driver.nodeDriverRegistrar.image.version | string | `"v2.6.2"` |  |
+| spiffe-csi-driver.nodeDriverRegistrar.image.tag | string | `"v2.8.0"` | Overrides the image tag |
+| spiffe-csi-driver.nodeDriverRegistrar.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spiffe-csi-driver.nodeDriverRegistrar.resources | object | `{}` |  |
 | spiffe-csi-driver.nodeSelector | object | `{}` |  |
 | spiffe-csi-driver.pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. |
@@ -168,7 +170,8 @@ Kubernetes: `>=1.21.0-0`
 | spiffe-oidc-discovery-provider.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | spiffe-oidc-discovery-provider.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | spiffe-oidc-discovery-provider.image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry |
-| spiffe-oidc-discovery-provider.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
+| spiffe-oidc-discovery-provider.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
+| spiffe-oidc-discovery-provider.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spiffe-oidc-discovery-provider.imagePullSecrets | list | `[]` |  |
 | spiffe-oidc-discovery-provider.ingress.annotations | object | `{}` |  |
 | spiffe-oidc-discovery-provider.ingress.className | string | `""` |  |
@@ -181,7 +184,8 @@ Kubernetes: `>=1.21.0-0`
 | spiffe-oidc-discovery-provider.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | spiffe-oidc-discovery-provider.insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
 | spiffe-oidc-discovery-provider.insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry |
-| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` |  |
+| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag |
+| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spiffe-oidc-discovery-provider.insecureScheme.nginx.resources | object | `{}` |  |
 | spiffe-oidc-discovery-provider.nameOverride | string | `""` |  |
 | spiffe-oidc-discovery-provider.namespaceOverride | string | `""` |  |
@@ -201,7 +205,8 @@ Kubernetes: `>=1.21.0-0`
 | spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
 | spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry |
-| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` |  |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.tag | string | `"0.11.0"` | Overrides the image tag |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.resources | object | `{}` |  |
 | spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
 | spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.labels | object | `{}` |  |
@@ -220,7 +225,8 @@ Kubernetes: `>=1.21.0-0`
 | spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
-| spire-agent.image.version | string | `""` |  |
+| spire-agent.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
+| spire-agent.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spire-agent.imagePullSecrets | list | `[]` |  |
 | spire-agent.initContainers | list | `[]` |  |
 | spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
@@ -250,7 +256,8 @@ Kubernetes: `>=1.21.0-0`
 | spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
 | spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry |
-| spire-agent.waitForIt.image.version | string | `"latest-20230113"` |  |
+| spire-agent.waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag |
+| spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spire-agent.waitForIt.resources | object | `{}` |  |
 | spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
 | spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
@@ -281,7 +288,8 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | spire-server.controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | spire-server.controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
-| spire-server.controllerManager.image.version | string | `"0.2.2"` |  |
+| spire-server.controllerManager.image.tag | string | `"0.2.2"` | Overrides the image tag |
+| spire-server.controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spire-server.controllerManager.resources | object | `{}` |  |
 | spire-server.controllerManager.securityContext | object | `{}` |  |
 | spire-server.controllerManager.service.annotations | object | `{}` |  |
@@ -289,9 +297,10 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.controllerManager.service.type | string | `"ClusterIP"` |  |
 | spire-server.controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` |  |
 | spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
-| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
-| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry |
-| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` |  |
+| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
+| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
+| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.tag | string | `""` | Overrides the image tag |
+| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
 | spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
 | spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
@@ -308,12 +317,27 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.federation.bundleEndpoint.address | string | `"0.0.0.0"` |  |
 | spire-server.federation.bundleEndpoint.port | int | `8443` |  |
 | spire-server.federation.enabled | bool | `false` |  |
+| spire-server.federation.ingress.annotations | object | `{}` |  |
+| spire-server.federation.ingress.className | string | `""` |  |
+| spire-server.federation.ingress.enabled | bool | `false` |  |
+| spire-server.federation.ingress.hosts[0].host | string | `"spire-server-federation.example.org"` |  |
+| spire-server.federation.ingress.hosts[0].paths[0].path | string | `"/"` |  |
+| spire-server.federation.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` |  |
+| spire-server.federation.ingress.tls | list | `[]` |  |
 | spire-server.fullnameOverride | string | `""` |  |
 | spire-server.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | spire-server.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | spire-server.image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
-| spire-server.image.version | string | `""` |  |
+| spire-server.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
+| spire-server.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spire-server.imagePullSecrets | list | `[]` |  |
+| spire-server.ingress.annotations | object | `{}` |  |
+| spire-server.ingress.className | string | `""` |  |
+| spire-server.ingress.enabled | bool | `false` |  |
+| spire-server.ingress.hosts[0].host | string | `"spire-server.example.org"` |  |
+| spire-server.ingress.hosts[0].paths[0].path | string | `"/"` |  |
+| spire-server.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` |  |
+| spire-server.ingress.tls | list | `[]` |  |
 | spire-server.initContainers | list | `[]` |  |
 | spire-server.jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
 | spire-server.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
@@ -321,7 +345,7 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.namespaceOverride | string | `""` |  |
 | spire-server.nodeAttestor.k8sPsat.enabled | bool | `true` |  |
 | spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` |  |
-| spire-server.nodeSelector | object | `{}` |  |
+| spire-server.nodeSelector | object | `{}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) |
 | spire-server.notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
 | spire-server.persistence.accessMode | string | `"ReadWriteOnce"` |  |
 | spire-server.persistence.size | string | `"1Gi"` |  |
@@ -343,6 +367,17 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
 | spire-server.tolerations | list | `[]` |  |
 | spire-server.topologySpreadConstraints | list | `[]` |  |
+| spire-server.tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | persistent DB for storing Tornjak specific information |
+| spire-server.tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) |
+| spire-server.tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy |
+| spire-server.tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from |
+| spire-server.tornjak.image.repository | string | `"spiffe/tornjak-backend"` | The repository within the registry |
+| spire-server.tornjak.image.tag | string | `"v1.2.1"` | Overrides the image tag |
+| spire-server.tornjak.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
+| spire-server.tornjak.resources | object | `{}` |  |
+| spire-server.tornjak.service.annotations | object | `{}` |  |
+| spire-server.tornjak.service.port | int | `10000` |  |
+| spire-server.tornjak.service.type | string | `"ClusterIP"` |  |
 | spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
 | spire-server.upstreamAuthority.certManager.enabled | bool | `false` |  |
 | spire-server.upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
@@ -355,5 +390,38 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
 | spire-server.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
 | spire-server.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
+| spire-server.upstreamAuthority.spire.enabled | bool | `false` |  |
+| spire-server.upstreamAuthority.spire.server.address | string | `""` |  |
+| spire-server.upstreamAuthority.spire.server.port | int | `8081` |  |
+| tornjak-frontend.affinity | object | `{}` |  |
+| tornjak-frontend.apiServerURL | string | `"http://localhost:10000/"` | URL of the Tornjak APIs (backend) Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. |
+| tornjak-frontend.fullnameOverride | string | `""` |  |
+| tornjak-frontend.image.pullPolicy | string | `"IfNotPresent"` |  |
+| tornjak-frontend.image.registry | string | `"ghcr.io"` |  |
+| tornjak-frontend.image.repository | string | `"spiffe/tornjak-frontend"` |  |
+| tornjak-frontend.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
+| tornjak-frontend.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
+| tornjak-frontend.imagePullSecrets | list | `[]` |  |
+| tornjak-frontend.labels | object | `{}` |  |
+| tornjak-frontend.nameOverride | string | `""` |  |
+| tornjak-frontend.namespaceOverride | string | `""` |  |
+| tornjak-frontend.nodeSelector | object | `{"kubernetes.io/arch":"amd64"}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) |
+| tornjak-frontend.podSecurityContext | object | `{}` |  |
+| tornjak-frontend.securityContext | object | `{}` |  |
+| tornjak-frontend.service.annotations | object | `{}` |  |
+| tornjak-frontend.service.port | int | `3000` |  |
+| tornjak-frontend.service.type | string | `"ClusterIP"` |  |
+| tornjak-frontend.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| tornjak-frontend.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| tornjak-frontend.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+| tornjak-frontend.spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator |
+| tornjak-frontend.startupProbe.enabled | bool | `true` | Enable startupProbe on Tornjak frontend container |
+| tornjak-frontend.startupProbe.failureThreshold | int | `6` | Failure threshold for startupProbe |
+| tornjak-frontend.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for startupProbe |
+| tornjak-frontend.startupProbe.periodSeconds | int | `10` | Period seconds for startupProbe |
+| tornjak-frontend.startupProbe.successThreshold | int | `1` | Success threshold for startupProbe |
+| tornjak-frontend.startupProbe.timeoutSeconds | int | `5` | Timeout seconds for startupProbe |
+| tornjak-frontend.tolerations | list | `[]` |  |
+| tornjak-frontend.topologySpreadConstraints | list | `[]` |  |
 
 ----------------------------------------------
diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl
index f2dd15d..3e85623 100644
--- a/charts/spire/README.md.gotmpl
+++ b/charts/spire/README.md.gotmpl
@@ -21,9 +21,9 @@
 |:-----------|:-------------------|
 | SPIRE      | `1.5.3+`, `1.6.3+` |
 | Helm       | `3.x`              |
-| Kubernetes | `1.21+`            |
+| Kubernetes | `1.22+`            |
 
-> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. *The first version we tested this chart with is `1.21`.*
+> **Note**: For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden. 
 
 ## Prerequisites
 
@@ -87,7 +87,9 @@ Now you can interact with the Spire agent socket from your own application. The
 
 {{ template "chart.sourcesSection" . }}
 
-{{ template "chart.requirementsSection" . }}
+{{ template "chart.requirementsHeader" . }}
+
+{{ template "chart.requirementsTable" . }}
 
 {{ template "chart.valuesSection" . }}
 
diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md
index 0eb23d9..20e39c7 100644
--- a/charts/spire/charts/spiffe-csi-driver/README.md
+++ b/charts/spire/charts/spiffe-csi-driver/README.md
@@ -19,7 +19,8 @@ A Helm chart to install the SPIFFE CSI driver.
 | image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry |
-| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
+| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
+| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | imagePullSecrets | list | `[]` |  |
 | kubeletPath | string | `"/var/lib/kubelet"` |  |
 | nameOverride | string | `""` |  |
@@ -27,7 +28,8 @@ A Helm chart to install the SPIFFE CSI driver.
 | nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from |
 | nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry |
-| nodeDriverRegistrar.image.version | string | `"v2.6.2"` |  |
+| nodeDriverRegistrar.image.tag | string | `"v2.8.0"` | Overrides the image tag |
+| nodeDriverRegistrar.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | nodeDriverRegistrar.resources | object | `{}` |  |
 | nodeSelector | object | `{}` |  |
 | pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. |
diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml
index 5169312..c39be02 100644
--- a/charts/spire/charts/spiffe-csi-driver/values.yaml
+++ b/charts/spire/charts/spiffe-csi-driver/values.yaml
@@ -8,8 +8,10 @@ image:
   repository: spiffe/spiffe-csi-driver
   # -- The image pull policy
   pullPolicy: IfNotPresent
-  # -- Overrides the image tag whose default is the chart appVersion
+  # -- This value is deprecated in favor of tag. (Will be removed in a future release)
   version: ""
+  # -- Overrides the image tag whose default is the chart appVersion
+  tag: ""
 resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious
   # choice for the user. This also increases chances charts run on environments with little
@@ -63,7 +65,10 @@ nodeDriverRegistrar:
     repository: sig-storage/csi-node-driver-registrar
     # -- The image pull policy
     pullPolicy: IfNotPresent
-    version: v2.6.2
+    # -- This value is deprecated in favor of tag. (Will be removed in a future release)
+    version: ""
+    # -- Overrides the image tag
+    tag: v2.8.0
   resources: {}
     # We usually recommend not to specify default resources and to leave this as a conscious
     # choice for the user. This also increases chances charts run on environments with little
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
index ac3134e..3c1e049 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
@@ -3,4 +3,4 @@ name: spiffe-oidc-discovery-provider
 description: A Helm chart to install the SPIFFE OIDC discovery provider.
 type: application
 version: 0.1.0
-appVersion: "1.6.3"
+appVersion: "1.6.4"
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
index ea7627d..6f15a51 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square)
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.4](https://img.shields.io/badge/AppVersion-1.6.4-informational?style=flat-square)
 
 A Helm chart to install the SPIFFE OIDC discovery provider.
 
@@ -34,7 +34,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry |
-| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
+| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion |
+| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | imagePullSecrets | list | `[]` |  |
 | ingress.annotations | object | `{}` |  |
 | ingress.className | string | `""` |  |
@@ -47,7 +48,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
 | insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry |
-| insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` |  |
+| insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag |
+| insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | insecureScheme.nginx.resources | object | `{}` |  |
 | nameOverride | string | `""` |  |
 | namespaceOverride | string | `""` |  |
@@ -67,7 +69,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
 | telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry |
-| telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` |  |
+| telemetry.prometheus.nginxExporter.image.tag | string | `"0.11.0"` | Overrides the image tag |
+| telemetry.prometheus.nginxExporter.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | telemetry.prometheus.nginxExporter.resources | object | `{}` |  |
 | telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
 | telemetry.prometheus.podMonitor.labels | object | `{}` |  |
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml
index ba3cf8c..f71db7d 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml
@@ -1,42 +1,16 @@
 {{- if .Values.ingress.enabled -}}
 {{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
-{{- $port := .Values.service.port }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ $fullName }}
   namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
   labels:
-    {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
+    {{ include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
   {{- with .Values.ingress.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  {{- if .Values.ingress.tls }}
-  tls:
-    {{- range .Values.ingress.tls }}
-    - hosts:
-        {{- range .hosts }}
-        - {{ . | quote }}
-        {{- end }}
-      secretName: {{ .secretName }}
-    {{- end }}
-  {{- end }}
-  rules:
-    {{- range .Values.ingress.hosts }}
-    - host: {{ .host | quote }}
-      http:
-        paths:
-          {{- range .paths }}
-          - path: {{ .path }}
-            pathType: {{ .pathType }}
-            backend:
-              service:
-                name: {{ $fullName }}
-                port:
-                  number: {{ $port }}
-          {{- end }}
-    {{- end }}
+  {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }}
 {{- end }}
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
index bf829bc..b1e27b8 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
@@ -16,8 +16,10 @@ image:
   repository: spiffe/oidc-discovery-provider
   # -- The image pull policy
   pullPolicy: IfNotPresent
-  # -- Overrides the image tag whose default is the chart appVersion
+  # -- This value is deprecated in favor of tag. (Will be removed in a future release)
   version: ""
+  # -- Overrides the image tag whose default is the chart appVersion
+  tag: ""
 
 resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious
@@ -65,13 +67,16 @@ insecureScheme:
       repository: nginxinc/nginx-unprivileged
       # -- The image pull policy
       pullPolicy: IfNotPresent
-      version: 1.23.2-alpine
+      # -- This value is deprecated in favor of tag. (Will be removed in a future release)
+      version: ""
+      # -- Overrides the image tag
+      tag: 1.24.0-alpine
       # chainguard image does not support the templates feature
       # https://github.com/chainguard-images/nginx/issues/43
       # registry: cgr.dev
       # repository: chainguard/nginx
       # pullPolicy: IfNotPresent
-      # version: "1.23.2"
+      # tag: "1.23.2"
     resources: {}
       # We usually recommend not to specify default resources and to leave this as a conscious
       # choice for the user. This also increases chances charts run on environments with little
@@ -146,7 +151,10 @@ telemetry:
         repository: nginx/nginx-prometheus-exporter
         # -- The image pull policy
         pullPolicy: IfNotPresent
-        version: "0.11.0"
+        # -- This value is deprecated in favor of tag. (Will be removed in a future release)
+        version: ""
+        # -- Overrides the image tag
+        tag: "0.11.0"
 
       resources: {}
         # We usually recommend not to specify default resources and to leave this as a conscious
diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml
index 8655cd3..5a566bc 100644
--- a/charts/spire/charts/spire-agent/Chart.yaml
+++ b/charts/spire/charts/spire-agent/Chart.yaml
@@ -3,4 +3,4 @@ name: spire-agent
 description: A Helm chart to install the SPIRE agent.
 type: application
 version: 0.1.0
-appVersion: "1.6.3"
+appVersion: "1.6.4"
diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md
index a0a5b4d..ec6a0ac 100644
--- a/charts/spire/charts/spire-agent/README.md
+++ b/charts/spire/charts/spire-agent/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square)
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.4](https://img.shields.io/badge/AppVersion-1.6.4-informational?style=flat-square)
 
 A Helm chart to install the SPIRE agent.
 
@@ -25,7 +25,8 @@ A Helm chart to install the SPIRE agent.
 | image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
-| image.version | string | `""` |  |
+| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
+| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | imagePullSecrets | list | `[]` |  |
 | initContainers | list | `[]` |  |
 | logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
@@ -55,7 +56,8 @@ A Helm chart to install the SPIRE agent.
 | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
 | waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry |
-| waitForIt.image.version | string | `"latest-20230113"` |  |
+| waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag |
+| waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | waitForIt.resources | object | `{}` |  |
 | workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
 | workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml
index 2a1f9d1..afd4453 100644
--- a/charts/spire/charts/spire-agent/values.yaml
+++ b/charts/spire/charts/spire-agent/values.yaml
@@ -9,8 +9,10 @@ image:
   repository: spiffe/spire-agent
   # -- The image pull policy
   pullPolicy: IfNotPresent
-  # Overrides the image tag whose default is the chart appVersion.
+  # -- This value is deprecated in favor of tag. (Will be removed in a future release)
   version: ""
+  # -- Overrides the image tag whose default is the chart appVersion.
+  tag: ""
 
 imagePullSecrets: []
 nameOverride: ""
@@ -86,7 +88,10 @@ waitForIt:
     repository: chainguard/wait-for-it
     # -- The image pull policy
     pullPolicy: IfNotPresent
-    version: latest-20230113
+    # -- This value is deprecated in favor of tag. (Will be removed in a future release)
+    version: ""
+    # -- Overrides the image tag
+    tag: latest-20230517
   resources: {}
 
 # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml
index cb30c50..3614da4 100644
--- a/charts/spire/charts/spire-server/Chart.yaml
+++ b/charts/spire/charts/spire-server/Chart.yaml
@@ -3,4 +3,4 @@ name: spire-server
 description: A Helm chart to install the SPIRE server.
 type: application
 version: 0.1.0
-appVersion: "1.6.3"
+appVersion: "1.6.4"
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index efc2ba5..ef7fa06 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square)
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.4](https://img.shields.io/badge/AppVersion-1.6.4-informational?style=flat-square)
 
 A Helm chart to install the SPIRE server.
 
@@ -44,7 +44,8 @@ A Helm chart to install the SPIRE server.
 | controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
-| controllerManager.image.version | string | `"0.2.2"` |  |
+| controllerManager.image.tag | string | `"0.2.2"` | Overrides the image tag |
+| controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | controllerManager.resources | object | `{}` |  |
 | controllerManager.securityContext | object | `{}` |  |
 | controllerManager.service.annotations | object | `{}` |  |
@@ -52,9 +53,10 @@ A Helm chart to install the SPIRE server.
 | controllerManager.service.type | string | `"ClusterIP"` |  |
 | controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` |  |
 | controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
-| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
-| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry |
-| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` |  |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"rancher/kubectl"` | The repository within the registry |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.tag | string | `""` | Overrides the image tag |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
 | dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
 | dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
@@ -71,12 +73,27 @@ A Helm chart to install the SPIRE server.
 | federation.bundleEndpoint.address | string | `"0.0.0.0"` |  |
 | federation.bundleEndpoint.port | int | `8443` |  |
 | federation.enabled | bool | `false` |  |
+| federation.ingress.annotations | object | `{}` |  |
+| federation.ingress.className | string | `""` |  |
+| federation.ingress.enabled | bool | `false` |  |
+| federation.ingress.hosts[0].host | string | `"spire-server-federation.example.org"` |  |
+| federation.ingress.hosts[0].paths[0].path | string | `"/"` |  |
+| federation.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` |  |
+| federation.ingress.tls | list | `[]` |  |
 | fullnameOverride | string | `""` |  |
 | image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
-| image.version | string | `""` |  |
+| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
+| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | imagePullSecrets | list | `[]` |  |
+| ingress.annotations | object | `{}` |  |
+| ingress.className | string | `""` |  |
+| ingress.enabled | bool | `false` |  |
+| ingress.hosts[0].host | string | `"spire-server.example.org"` |  |
+| ingress.hosts[0].paths[0].path | string | `"/"` |  |
+| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` |  |
+| ingress.tls | list | `[]` |  |
 | initContainers | list | `[]` |  |
 | jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
 | logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
@@ -84,7 +101,7 @@ A Helm chart to install the SPIRE server.
 | namespaceOverride | string | `""` |  |
 | nodeAttestor.k8sPsat.enabled | bool | `true` |  |
 | nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` |  |
-| nodeSelector | object | `{}` |  |
+| nodeSelector | object | `{}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) |
 | notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
 | persistence.accessMode | string | `"ReadWriteOnce"` |  |
 | persistence.size | string | `"1Gi"` |  |
@@ -106,6 +123,17 @@ A Helm chart to install the SPIRE server.
 | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
+| tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | persistent DB for storing Tornjak specific information |
+| tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) |
+| tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy |
+| tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from |
+| tornjak.image.repository | string | `"spiffe/tornjak-backend"` | The repository within the registry |
+| tornjak.image.tag | string | `"v1.2.1"` | Overrides the image tag |
+| tornjak.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
+| tornjak.resources | object | `{}` |  |
+| tornjak.service.annotations | object | `{}` |  |
+| tornjak.service.port | int | `10000` |  |
+| tornjak.service.type | string | `"ClusterIP"` |  |
 | trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
 | upstreamAuthority.certManager.enabled | bool | `false` |  |
 | upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
@@ -118,5 +146,8 @@ A Helm chart to install the SPIRE server.
 | upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
 | upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
 | upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
+| upstreamAuthority.spire.enabled | bool | `false` |  |
+| upstreamAuthority.spire.server.address | string | `""` |  |
+| upstreamAuthority.spire.server.port | int | `8081` |  |
 
 ----------------------------------------------
diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt
index b013798..1c00883 100644
--- a/charts/spire/charts/spire-server/templates/NOTES.txt
+++ b/charts/spire/charts/spire-server/templates/NOTES.txt
@@ -4,3 +4,20 @@ Installed {{ .Chart.Name }}…
 
   kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \
     spire-server entry show
+
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+
+Installed {{ include "spire-tornjak.fullname" . }}…
+
+### WARNING ###
+
+Tornjak runs without authentication and is therefore NOT suitable to run in production environments.
+Only use in test environments!
+
+Access Tornjak:
+
+    kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.backend" . }} {{ .Values.tornjak.service.port }}:10000
+
+Open browser to: http://localhost:{{ .Values.tornjak.service.port }}
+
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 3fcff92..af1e652 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -105,6 +105,15 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
+{{- define "spire-server.kubectl-image" }}
+{{- $root := deepCopy . }}
+{{- $tag := (default $root.image.tag $root.image.version) | toString }}
+{{- if eq (len $tag) 0 }}
+{{- $_ := set $root.image "tag" (regexReplaceAll "^(v?\\d+\\.\\d+\\.\\d+).*" $root.KubeVersion "${1}") }}
+{{- end }}
+{{- include "spire-lib.image" $root }}
+{{- end }}
+
 {{- define "spire-server.config-mysql-query" }}
 {{- $lst := list }}
 {{- range . }}
@@ -153,3 +162,19 @@ Create the name of the service account to use
 {{- end }}
 {{- $config | toYaml }}
 {{- end }}
+
+{{/*
+Tornjak specific section
+*/}}
+
+{{- define "spire-tornjak.fullname" -}}
+{{ include "spire-server.fullname" . | trimSuffix "-server" }}-tornjak
+{{- end }}
+
+{{- define "spire-tornjak.config" -}}
+{{ include "spire-tornjak.fullname" . }}-config
+{{- end }}
+
+{{- define "spire-tornjak.backend" -}}
+{{ include "spire-tornjak.fullname" . }}-backend
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index 6b2ff71..ad22824 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -1,4 +1,5 @@
 {{- define "spire-server.yaml-config" -}}
+{{- $upstreamAuthorityUsed := 0 }}
 {{- $root := . }}
 server:
   bind_address: "0.0.0.0"
@@ -59,6 +60,7 @@ plugins:
 
   {{- with .Values.upstreamAuthority.disk }}
   {{- if eq (.enabled | toString) "true" }}
+  {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
   UpstreamAuthority:
     - disk:
         plugin_data:
@@ -72,6 +74,7 @@ plugins:
 
   {{- with .Values.upstreamAuthority.certManager }}
   {{- if eq (.enabled | toString) "true" }}
+  {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
   UpstreamAuthority:
     - cert-manager:
         plugin_data:
@@ -85,6 +88,21 @@ plugins:
   {{- end }}
   {{- end }}
 
+  {{- with .Values.upstreamAuthority.spire }}
+  {{- if eq (.enabled | toString) "true" }}
+  {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
+  UpstreamAuthority:
+    - spire:
+        plugin_data:
+          server_address: {{ .server.address | quote }}
+          server_port: {{ .server.port }}
+          workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock"
+  {{- end }}
+  {{- end }}
+{{- if gt $upstreamAuthorityUsed 1 }}
+{{- fail "You can only enable a single Upstream Authority." }}
+{{- end }}
+
 health_checks:
   listener_enabled: true
   bind_address: "0.0.0.0"
diff --git a/charts/spire/charts/spire-server/templates/federation-ingress.yaml b/charts/spire/charts/spire-server/templates/federation-ingress.yaml
new file mode 100644
index 0000000..013be91
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/federation-ingress.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.federation.enabled }}
+{{- if .Values.federation.ingress.enabled -}}
+{{- $svcName := include "spire-server.fullname" . }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ printf "%s-federation" $svcName }}
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:
+    {{ include "spire-server.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "global" .Values.global) | nindent 2 }}
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/ingress.yaml b/charts/spire/charts/spire-server/templates/ingress.yaml
new file mode 100644
index 0000000..56da8c8
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/ingress.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "spire-server.fullname" . -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:
+    {{ include "spire-server.labels" . | nindent 4}}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
index 37fd2a8..39607e2 100644
--- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
@@ -63,23 +63,25 @@ spec:
       - name: post-install-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
-        command:
-        - /bin/sh
-        - -c
-        - |-
-          kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
-          {
-            "webhooks":[
-              {
-                "name":"vclusterspiffeid.kb.io",
-                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
-              },
-              {
-                "name":"vclusterfederatedtrustdomain.kb.io",
-                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
-              }
-            ]
-          }'
+        image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
+        args:
+          - patch
+          - validatingwebhookconfiguration
+          - {{ include "spire-controller-manager.fullname" . }}-webhook
+          - --type=strategic
+          - -p
+          - |
+            {
+              "webhooks":[
+                {
+                  "name":"vclusterspiffeid.kb.io",
+                  "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+                },
+                {
+                  "name":"vclusterfederatedtrustdomain.kb.io",
+                  "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+                }
+              ]
+            }
 {{- end }}
 {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
index f73e9f2..d518116 100644
--- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
@@ -63,23 +63,25 @@ spec:
       - name: post-upgrade-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
-        command:
-        - /bin/sh
-        - -c
-        - |-
-          kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
-          {
-            "webhooks":[
-              {
-                "name":"vclusterspiffeid.kb.io",
-                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
-              },
-              {
-                "name":"vclusterfederatedtrustdomain.kb.io",
-                "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
-              }
-            ]
-          }'
+        image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
+        args:
+          - patch
+          - validatingwebhookconfiguration
+          - {{ include "spire-controller-manager.fullname" . }}-webhook
+          - --type=strategic
+          - -p
+          - |
+            {
+              "webhooks":[
+                {
+                  "name":"vclusterspiffeid.kb.io",
+                  "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+                },
+                {
+                  "name":"vclusterfederatedtrustdomain.kb.io",
+                  "failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
+                }
+              ]
+            }
 {{- end }}
 {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
index d2445bc..47f8ab1 100644
--- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
@@ -63,23 +63,25 @@ spec:
       - name: post-install-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
-        command:
-        - /bin/sh
-        - -c
-        - |-
-          kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
-          {
-            "webhooks":[
-              {
-                "name":"vclusterspiffeid.kb.io",
-                "failurePolicy":"Ignore"
-              },
-              {
-                "name":"vclusterfederatedtrustdomain.kb.io",
-                "failurePolicy":"Ignore"
-              }
-            ]
-          }'
+        image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
+        args:
+          - patch
+          - validatingwebhookconfiguration
+          - {{ include "spire-controller-manager.fullname" . }}-webhook
+          - --type=strategic
+          - -p
+          - |
+            {
+              "webhooks":[
+                {
+                  "name":"vclusterspiffeid.kb.io",
+                  "failurePolicy":"Ignore"
+                },
+                {
+                  "name":"vclusterfederatedtrustdomain.kb.io",
+                  "failurePolicy":"Ignore"
+                }
+              ]
+            }
 {{- end }}
 {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index f9e6262..e76def0 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -1,6 +1,7 @@
 {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
 {{- $configSum2 := (include (print $.Template.BasePath "/secret.yaml") . | sha256sum) }}
 {{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
+{{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }}
 {{- $fullname := include "spire-server.fullname" . }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -26,6 +27,7 @@ spec:
         checksum/config: {{ $configSum }}
         checksum/config2: {{ $configSum2 }}
         checksum/config3: {{ $configSum3 }}
+        checksum/configTornjak: {{ $configSumTornjak }}
         {{- with .Values.podAnnotations }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
@@ -155,6 +157,47 @@ spec:
               mountPath: /tmp
               readOnly: false
         {{- end }}
+
+        {{- if eq (.Values.tornjak.enabled | toString) "true" }}
+        - name: tornjak
+          securityContext:
+            {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tornjak.image "global" .Values.global) }}
+          imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
+          startupProbe:
+            httpGet:
+              scheme: HTTP
+              port: 10000
+            failureThreshold: 3
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          args:
+            - --spire-config
+            - /run/spire/config/server.conf
+            - --tornjak-config
+            - /run/spire/tornjak-config/server.conf
+          ports:
+            - name: tornjak
+              containerPort: 10000
+              protocol: TCP
+          resources:
+            {{- toYaml .Values.tornjak.resources | nindent 12 }}
+          volumeMounts:
+            - name: {{ include "spire-tornjak.config" . }}
+              mountPath: /run/spire/tornjak-config
+            - name: spire-server-socket
+              mountPath: /tmp/spire-server/private
+              readOnly: true
+            - name: spire-config
+              mountPath: /run/spire/config
+              readOnly: true
+            - name: spire-data
+              mountPath: /run/spire/data
+              readOnly: false
+        {{- end }}
+
         {{- if gt (len .Values.extraContainers) 0 }}
         {{- toYaml .Values.extraContainers | nindent 8 }}
         {{- end }}
@@ -192,6 +235,14 @@ spec:
           configMap:
             name: {{ include "spire-controller-manager.fullname" . }}
         {{- end }}
+        {{- if eq (.Values.tornjak.enabled | toString) "true" }}
+        {{- if .Values.tornjak.config }}
+        - name: {{ include "spire-tornjak.config" . }}
+          configMap:
+            defaultMode: 420
+            name: {{ include "spire-tornjak.config" . }}
+        {{- end }}
+        {{- end }}
         {{- if gt (len .Values.extraVolumes) 0 }}
         {{- toYaml .Values.extraVolumes | nindent 8 }}
         {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
new file mode 100644
index 0000000..5b38692
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
@@ -0,0 +1,22 @@
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "spire-tornjak.fullname" . }}-test-connection"
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  securityContext:
+    {{- toYaml .Values.podSecurityContext | nindent 4 }}
+  containers:
+    - name: curl-tornjak-backend
+      image: cgr.dev/chainguard/bash:latest
+      command: ['curl']
+      args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.backend" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.port }}']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+  restartPolicy: Never
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/tornjak-config.yaml b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
new file mode 100644
index 0000000..16a8f61
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
@@ -0,0 +1,28 @@
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire-tornjak.config" . }}
+  namespace: {{ include "spire-server.namespace" . }}
+data:
+  server.conf: |
+    server {
+      spire_socket_path = "unix:///tmp/spire-server/private/api.sock" # socket to communicate with SPIRE server
+
+      http {
+        enabled = true # if true, opens HTTP server
+        port = "10000" # if HTTP enabled, opens HTTP listen port at container port 10000
+      }
+    }
+
+    plugins {
+    {{- if .Values.tornjak.config.dataStore }}
+      DataStore "sql" {
+        plugin_data {
+          drivername = "{{ .Values.tornjak.config.dataStore.driver }}"
+          filename = "{{ .Values.tornjak.config.dataStore.file }}"
+        }
+      }
+    {{- end }}
+    }
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/tornjak-service.yaml b/charts/spire/charts/spire-server/templates/tornjak-service.yaml
new file mode 100644
index 0000000..a4a95bd
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/tornjak-service.yaml
@@ -0,0 +1,22 @@
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ include "spire-server.namespace" . }}
+  name: {{ include "spire-tornjak.backend" . }}
+  {{- with .Values.tornjak.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.tornjak.service.type }}
+  selector:
+   {{- include "spire-server.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: {{ include "spire-tornjak.backend" . }}
+      port: {{ .Values.tornjak.service.port }}
+      targetPort: tornjak
+      protocol: TCP
+{{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 2d31c5c..48e95ef 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -12,8 +12,10 @@ image:
   repository: spiffe/spire-server
   # -- The image pull policy
   pullPolicy: IfNotPresent
-  # Overrides the image tag whose default is the chart appVersion.
+  # -- This value is deprecated in favor of tag. (Will be removed in a future release)
   version: ""
+  # -- Overrides the image tag whose default is the chart appVersion.
+  tag: ""
 
 imagePullSecrets: []
 nameOverride: ""
@@ -70,6 +72,7 @@ autoscaling:
   targetCPUUtilizationPercentage: 80
   # targetMemoryUtilizationPercentage: 80
 
+# -- Select specific nodes to run on (currently only amd64 is supported by Tornjak)
 nodeSelector: {}
 
 tolerations: []
@@ -124,6 +127,26 @@ federation:
     port: 8443
     address: "0.0.0.0"
 
+  ingress:
+    enabled: false
+    className: ""
+    annotations: {}
+      # kubernetes.io/ingress.class: nginx
+      # kubernetes.io/tls-acme: "true"
+      # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+      # If Profile Type == https_spiffe:
+      # nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    hosts:
+      - host: spire-server-federation.example.org
+        paths:
+          - path: /
+            pathType: Prefix
+    tls: []
+    #  - hosts:
+    #      - spire-server-federation.example.org
+    #    If Profile Type == https_web:
+    #    secretName: spire-server-federation-tls
+
 ca_subject:
   country: NL
   organization: Example
@@ -152,6 +175,11 @@ upstreamAuthority:
     # -- Specify to use a namespace other then the one the chart is installed into
     namespace: ""
     kube_config_file: ""
+  spire:
+    enabled: false
+    server:
+      address: ""
+      port: 8081
 
 notifier:
   k8sbundle:
@@ -168,8 +196,10 @@ controllerManager:
     repository: spiffe/spire-controller-manager
     # -- The image pull policy
     pullPolicy: IfNotPresent
-    # Overrides the image tag whose default is the chart appVersion.
-    version: "0.2.2"
+    # -- This value is deprecated in favor of tag. (Will be removed in a future release)
+    version: ""
+    # -- Overrides the image tag
+    tag: "0.2.2"
 
   resources: {}
     # We usually recommend not to specify default resources and to leave this as a conscious
@@ -223,12 +253,15 @@ controllerManager:
     upgradeHook:
       image:
         # -- The OCI registry to pull the image from
-        registry: cgr.dev
+        registry: docker.io
         # -- The repository within the registry
-        repository: chainguard/kubectl
+        repository: rancher/kubectl
         # -- The image pull policy
         pullPolicy: IfNotPresent
-        version: latest
+        # -- This value is deprecated in favor of tag. (Will be removed in a future release)
+        version: ""
+        # -- Overrides the image tag
+        tag: ""
 
 telemetry:
   prometheus:
@@ -239,6 +272,24 @@ telemetry:
       namespace: ""
       labels: {}
 
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    # nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+  hosts:
+    - host: spire-server.example.org
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+  #  - secretName: spire-server-tls
+  #    hosts:
+  #      - spire-server.example.org
+
 extraVolumes: []
 extraVolumeMounts: []
 extraContainers: []
@@ -255,3 +306,39 @@ nodeAttestor:
   k8sPsat:
     enabled: true
     serviceAccountAllowList: []
+
+# tornjak - Tornjak specific configuration
+tornjak:
+  # -- Deploys Tornjak API (backend) (Not for production)
+  enabled: false
+  image:
+    # -- The OCI registry to pull the Tornjak image from
+    registry: ghcr.io
+    # -- The repository within the registry
+    repository: spiffe/tornjak-backend
+    # -- The Tornjak image pull policy
+    pullPolicy: IfNotPresent
+    # -- This value is deprecated in favor of tag. (Will be removed in a future release)
+    version: ""
+    # -- Overrides the image tag
+    tag: "v1.2.1"
+  service:
+    type: ClusterIP
+    port: 10000
+    annotations: {}
+  config:
+    # -- persistent DB for storing Tornjak specific information
+    dataStore:
+      driver: "sqlite3"
+      file: "/run/spire/data/tornjak.sqlite3"
+  resources: {}
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    # limits:
+    #   cpu: 100m
+    #   memory: 128Mi
+    # requests:
+    #   cpu: 100m
+    #   memory: 128Mi
diff --git a/charts/spire/charts/tornjak-frontend/Chart.yaml b/charts/spire/charts/tornjak-frontend/Chart.yaml
new file mode 100644
index 0000000..532f259
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/Chart.yaml
@@ -0,0 +1,14 @@
+apiVersion: v2
+name: tornjak-frontend
+description: A Helm chart to deploy Tornjak frontend
+type: application
+version: 0.1.0
+appVersion: "v1.2.1"
+home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
+sources:
+  - https://github.com/spiffe/tornjak
+icon: https://raw.githubusercontent.com/spiffe/tornjak/main/logos/logo%2Btornjak.2132x1291.png
+maintainers:
+  - name: mrsabath
+    email: mrsabath@gmail.com
+    url: https://mrsabath.github.io
diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md
new file mode 100644
index 0000000..2bbeeae
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/README.md
@@ -0,0 +1,82 @@
+# tornjak-frontend
+
+<!-- This README.md is generated. Please edit README.md.gotmpl -->
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.2.1](https://img.shields.io/badge/AppVersion-v1.2.1-informational?style=flat-square)
+[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
+
+A Helm chart to deploy Tornjak frontend
+
+**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
+
+## Version support
+
+> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
+> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
+> we do aim for as much stability as possible.
+
+| Dependency | Supported Versions |
+|:-----------|:-------------------|
+| SPIRE      | `1.5.3+`, `1.6.x`  |
+| Tornjak    | `1.0.x`            |
+| Helm       | `3.x`              |
+
+## Prerequisites
+
+This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`).
+This URL needs to be reachable from your web browser and can therefore not be a cluster internal URL.
+
+Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally,
+Tornjak APIs are typically available at `http://localhost:10000`.
+Review Tornjak documentation for more details.
+
+## Usage
+
+Since this is just a demo version, to access Tornjak APIs you can use
+port forwarding. See the chart NOTES output for more details.
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| mrsabath | <mrsabath@gmail.com> | <https://mrsabath.github.io> |
+
+## Source Code
+
+* <https://github.com/spiffe/tornjak>
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| affinity | object | `{}` |  |
+| apiServerURL | string | `"http://localhost:10000/"` | URL of the Tornjak APIs (backend) Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. |
+| fullnameOverride | string | `""` |  |
+| image.pullPolicy | string | `"IfNotPresent"` |  |
+| image.registry | string | `"ghcr.io"` |  |
+| image.repository | string | `"spiffe/tornjak-frontend"` |  |
+| image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. |
+| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
+| imagePullSecrets | list | `[]` |  |
+| labels | object | `{}` |  |
+| nameOverride | string | `""` |  |
+| namespaceOverride | string | `""` |  |
+| nodeSelector | object | `{"kubernetes.io/arch":"amd64"}` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) |
+| podSecurityContext | object | `{}` |  |
+| securityContext | object | `{}` |  |
+| service.annotations | object | `{}` |  |
+| service.port | int | `3000` |  |
+| service.type | string | `"ClusterIP"` |  |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+| spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator |
+| startupProbe.enabled | bool | `true` | Enable startupProbe on Tornjak frontend container |
+| startupProbe.failureThreshold | int | `6` | Failure threshold for startupProbe |
+| startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for startupProbe |
+| startupProbe.periodSeconds | int | `10` | Period seconds for startupProbe |
+| startupProbe.successThreshold | int | `1` | Success threshold for startupProbe |
+| startupProbe.timeoutSeconds | int | `5` | Timeout seconds for startupProbe |
+| tolerations | list | `[]` |  |
+| topologySpreadConstraints | list | `[]` |  |
+----------------------------------------------
diff --git a/charts/spire/charts/tornjak-frontend/README.md.gotmpl b/charts/spire/charts/tornjak-frontend/README.md.gotmpl
new file mode 100644
index 0000000..152b7dc
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/README.md.gotmpl
@@ -0,0 +1,47 @@
+{{ template "chart.header" . }}
+
+<!-- This README.md is generated. Please edit README.md.gotmpl -->
+
+{{ template "chart.deprecationWarning" . }}
+
+{{ template "chart.badgesSection" . }}
+[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
+
+{{ template "chart.description" . }}
+
+{{ template "chart.homepageLine" . }}
+
+## Version support
+
+> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
+> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
+> we do aim for as much stability as possible.
+
+| Dependency | Supported Versions |
+|:-----------|:-------------------|
+| SPIRE      | `1.5.3+`, `1.6.x`  |
+| Tornjak    | `1.0.x`            |
+| Helm       | `3.x`              |
+
+## Prerequisites
+
+This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`).
+This URL needs to be reachable from your web browser and can therefore not be a cluster internal URL.
+
+Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally,
+Tornjak APIs are typically available at `http://localhost:10000`.
+Review Tornjak documentation for more details.
+
+## Usage
+
+Since this is just a demo version, to access Tornjak APIs you can use
+port forwarding. See the chart NOTES output for more details.
+
+{{ template "chart.maintainersSection" . }}
+
+{{ template "chart.sourcesSection" . }}
+
+{{ template "chart.requirementsSection" . }}
+
+{{ template "chart.valuesSection" . }}
+----------------------------------------------
diff --git a/charts/spire/charts/tornjak-frontend/templates/NOTES.txt b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
new file mode 100644
index 0000000..85a568e
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
@@ -0,0 +1,30 @@
+Installed {{ .Chart.Name }}…
+
+Name: {{ include "tornjak-frontend.name" . }}
+Fullname: {{ include "tornjak-frontend.fullname" . }}
+Your release is named: {{ .Release.Name }}
+Namespace: {{ include "tornjak-frontend.namespace" . }}
+
+Tornjak UI (Frontend)
+  image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
+  pull policy: {{ .Values.image.pullPolicy }}
+  Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }}
+  SPIRE health check enabled:  "{{ .Values.spireHealthCheck.enabled }}"
+
+### WARNING ###
+
+Tornjak runs without authentication and is therefore NOT suitable to run in production environments.
+Only use in test environments!
+
+Access Tornjak:
+
+  kubectl -n {{ include "tornjak-frontend.namespace" . }} port-forward service/{{ include "tornjak-frontend.fullname" . }} {{ .Values.service.port }}:3000
+
+Ensure you have port-forwarding for tornjak-backend as well.
+
+Open browser to: http://localhost:{{ .Values.service.port }}
+
+To learn more about the release, try:
+
+  $ helm status {{ .Release.Name }}
+  $ helm get all {{ .Release.Name }}
diff --git a/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl
new file mode 100644
index 0000000..0dadaeb
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl
@@ -0,0 +1,85 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "tornjak-frontend.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "tornjak-frontend.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "tornjak-frontend.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "tornjak-frontend.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "tornjak-frontend.labels" -}}
+helm.sh/chart: {{ include "tornjak-frontend.chart" . }}
+{{ include "tornjak-frontend.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "tornjak-frontend.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "tornjak-frontend.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "tornjak-frontend.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "tornjak-frontend.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create URL for accessing Tornjak APIs
+*/}}
+{{- define "tornjak-frontend.apiURL" -}}
+{{- if .Values.apiServerURL -}}
+{{- .Values.apiServerURL -}}
+{{- else }}
+{{- $feurl := print "http://localhost:" .Values.service.port }}
+{{- $feurl }}
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
new file mode 100644
index 0000000..180f90b
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "tornjak-frontend.fullname" . }}
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "tornjak-frontend.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "tornjak-frontend.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "tornjak-frontend.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name:  {{ include "tornjak-frontend.fullname" . }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          env:
+            - name: REACT_APP_API_SERVER_URI
+              value: {{ include "tornjak-frontend.apiURL" . }}
+            {{- if eq (.Values.spireHealthCheck.enabled | toString) "true" }}
+            - name: REACT_APP_SPIRE_HEALTH_CHECK_ENABLE
+              value: "{{ .Values.spireHealthCheck.enabled }}"
+            {{- end }}
+          {{- if .Values.startupProbe.enabled }}
+          startupProbe:
+            httpGet:
+              scheme: HTTP
+              port: {{ .Values.service.port }}
+            failureThreshold: {{ .Values.startupProbe.failureThreshold }}
+            initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.startupProbe.periodSeconds }}
+            successThreshold: {{ .Values.startupProbe.successThreshold }}
+            timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
+          {{- end }}
+          volumeMounts:
+            - name: cache
+              mountPath: /usr/src/app/
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: cache
+          emptyDir: {}
diff --git a/charts/spire/charts/tornjak-frontend/templates/service.yaml b/charts/spire/charts/tornjak-frontend/templates/service.yaml
new file mode 100644
index 0000000..6208d9a
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/service.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  name: {{ include "tornjak-frontend.fullname" . }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  selector:
+    {{- include "tornjak-frontend.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: {{ include "tornjak-frontend.fullname" . }}
+      port: {{ .Values.service.port }}
+      targetPort: http
diff --git a/charts/spire/charts/tornjak-frontend/templates/serviceaccount.yaml b/charts/spire/charts/tornjak-frontend/templates/serviceaccount.yaml
new file mode 100644
index 0000000..15640ac
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/serviceaccount.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "tornjak-frontend.serviceAccountName" . }}
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml
new file mode 100644
index 0000000..4afec45
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "tornjak-frontend.fullname" . }}-test-connection"
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  securityContext:
+    {{- toYaml .Values.podSecurityContext | nindent 4 }}
+  containers:
+    - name: curl-tornjak-frontend
+      image: cgr.dev/chainguard/bash:latest
+      command: ['curl']
+      args: ['-k', '-s', '-f', 'http://{{ include "tornjak-frontend.fullname" . }}.{{ include "tornjak-frontend.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+  restartPolicy: Never
+
diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml
new file mode 100644
index 0000000..60eddbd
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/values.yaml
@@ -0,0 +1,90 @@
+# Default values for Tornjak UI (Frontend).
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+image:
+  registry: ghcr.io
+  repository: spiffe/tornjak-frontend
+  pullPolicy: IfNotPresent
+  # -- This value is deprecated in favor of tag. (Will be removed in a future release)
+  version: ""
+  # -- Overrides the image tag whose default is the chart appVersion.
+  tag: ""
+
+imagePullSecrets: []
+nameOverride: ""
+namespaceOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  # -- Specifies whether a service account should be created
+  create: true
+  # -- Annotations to add to the service account
+  annotations: {}
+  # -- The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+labels: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+service:
+  type: ClusterIP
+  port: 3000
+  annotations: {}
+
+# -- Select specific nodes to run on (currently only amd64 is supported by Tornjak)
+nodeSelector:
+  kubernetes.io/arch: amd64
+
+affinity: {}
+
+tolerations: []
+
+topologySpreadConstraints: []
+
+# -- Provide minimal resources to prevent accidental crashes due to resource exhaustion
+# resources:
+#   requests:
+#     cpu: 50m
+#     memory: 128Mi
+#   limits:
+#     cpu: 100m
+#     memory: 512Mi
+
+# -- URL of the Tornjak APIs (backend)
+# Since Tornjak Frontend runs in the browser, this URL must be accessible from
+# the machine running a browser.
+apiServerURL: "http://localhost:10000/"  # 👈 Use it for minikube or kind
+
+# SPIRE Healthchecker indicator
+spireHealthCheck:
+  # -- Enables the SPIRE Healthchecker indicator
+  enabled: true
+
+## Configure extra options for Tornjak frontend container's startup probe
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
+##
+startupProbe:
+  # -- Enable startupProbe on Tornjak frontend container
+  enabled: true
+  # -- Initial delay seconds for startupProbe
+  initialDelaySeconds: 5
+  # -- Period seconds for startupProbe
+  periodSeconds: 10
+  # -- Timeout seconds for startupProbe
+  timeoutSeconds: 5
+  # -- Failure threshold for startupProbe
+  failureThreshold: 6
+  # -- Success threshold for startupProbe
+  successThreshold: 1
diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl
index 4c0c492..eac2298 100644
--- a/charts/spire/templates/_spire-lib.tpl
+++ b/charts/spire/templates/_spire-lib.tpl
@@ -40,13 +40,53 @@
 
 {{- define "spire-lib.image" -}}
 {{- $registry := include "spire-lib.registry" . }}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" $registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" $registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" $registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" $registry .image.repository -}}
-{{- end -}}
+{{- $repo := .image.repository }}
+{{- $tag := (default .image.tag .image.version) | toString }}
+{{- if eq (substr 0 7 $tag) "sha256:" }}
+{{- printf "%s/%s@%s" $registry $repo $tag }}
+{{- else if .appVersion }}
+{{- printf "%s/%s:%s" $registry $repo (default .appVersion $tag) }}
+{{- else if $tag }}
+{{- printf "%s/%s:%s" $registry $repo $tag }}
+{{- else }}
+{{- printf "%s/%s" $registry $repo }}
+{{- end }}
+{{- end }}
+
+{{/* Takes in a dictionary with keys:
+ * ingress - the standardized ingress object
+ * svcName - The service to route to
+ * port - which port on the service to use
+*/}}
+{{ define "spire-lib.ingress-spec" }}
+{{- $svcName := .svcName }}
+{{- $port := .port }}
+{{- with .ingress.className }}
+ingressClassName: {{ . | quote }}
+{{- end }}
+{{- if .ingress.tls }}
+tls:
+  {{- range .ingress.tls }}
+  - hosts:
+      {{- range .hosts }}
+      - {{ . | quote }}
+      {{- end }}
+    secretName: {{ .secretName | quote }}
+  {{- end }}
+{{- end }}
+rules:
+  {{- range .ingress.hosts }}
+  - host: {{ .host | quote }}
+    http:
+      paths:
+        {{- range .paths }}
+        - path: {{ .path }}
+          pathType: {{ .pathType }}
+          backend:
+            service:
+              name: {{ $svcName | quote }}
+              port:
+                number: {{ $port }}
+        {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index 76ca445..c6ba849 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -26,18 +26,27 @@ global:
 
 # subcharts
 spire-server:
+  # -- Enables deployment of SPIRE Server
   enabled: true
   nameOverride: server
 
   controllerManager:
+    # -- Enables deployment of Controller Manager
     enabled: true
 
 spire-agent:
+  # -- Enables deployment of SPIRE Agent(s)
   enabled: true
   nameOverride: agent
 
 spiffe-csi-driver:
+  # -- Enables deployment of CSI driver
   enabled: true
 
 spiffe-oidc-discovery-provider:
+  # -- Enables deployment of OIDC discovery provider
+  enabled: false
+
+tornjak-frontend:
+  # -- Enables deployment of Tornjak frontend/UI (Not for production)
   enabled: false
diff --git a/examples/production/README.md b/examples/production/README.md
index 0514ca4..8b7b196 100644
--- a/examples/production/README.md
+++ b/examples/production/README.md
@@ -12,3 +12,25 @@ helm upgrade --install --namespace spire-server spire charts/spire -f values.yam
 ```
 
 See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
+
+If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
+
+```shell
+-f values-expose-spire-server-ingress-nginx.yaml
+```
+
+If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
+you have two options as described here:
+https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles
+
+If you chose profile https_web, use:
+
+```shell
+-f values-expose-federation-https-web-ingress-nginx.yaml
+```
+
+If you chose profile https_spiffe, use:
+
+```shell
+-f values-expose-federation-https-spiffe-ingress-nginx.yaml
+```
diff --git a/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml b/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml
new file mode 100644
index 0000000..35aa85a
--- /dev/null
+++ b/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml
@@ -0,0 +1,25 @@
+spire-server:
+  federation:
+    enabled: true
+    ingress:
+      enabled: true
+      annotations:
+        nginx.ingress.kubernetes.io/ssl-redirect: "true"
+        nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+        nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+        nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+
+        # Optional settings you may put in your own values.
+        # kubernetes.io/ingress.class: nginx
+        # kubernetes.io/tls-acme: "true"
+
+      # className: nginx
+ 
+      hosts:
+        - host: spire-server-federation.example.org
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - hosts:
+            - spire-server-federation.example.org
diff --git a/examples/production/values-export-federation-https-web-ingress-nginx.yaml b/examples/production/values-export-federation-https-web-ingress-nginx.yaml
new file mode 100644
index 0000000..e238c13
--- /dev/null
+++ b/examples/production/values-export-federation-https-web-ingress-nginx.yaml
@@ -0,0 +1,25 @@
+spire-server:
+  federation:
+    enabled: true
+    ingress:
+      enabled: true
+      annotations:
+        nginx.ingress.kubernetes.io/ssl-redirect: "true"
+        nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+        nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+
+        # Optional settings you may put in your own values.
+        # kubernetes.io/ingress.class: nginx
+        # kubernetes.io/tls-acme: "true"
+
+      # className: nginx
+ 
+      hosts:
+        - host: spire-server-federation.example.org
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - hosts:
+            - spire-server-federation.example.org
+          secretName: spire-server-federation-tls
diff --git a/examples/production/values-export-spire-server-ingress-nginx.yaml b/examples/production/values-export-spire-server-ingress-nginx.yaml
new file mode 100644
index 0000000..dceac42
--- /dev/null
+++ b/examples/production/values-export-spire-server-ingress-nginx.yaml
@@ -0,0 +1,25 @@
+spire-server:
+  ingress:
+    enabled: true
+    annotations:
+      nginx.ingress.kubernetes.io/ssl-redirect: "true"
+      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+
+      # Optional settings you may put in your own values.
+      # kubernetes.io/tls-acme: "true"
+      # kubernetes.io/ingress.class: nginx
+
+    # className: nginx
+
+    # You must override these in your own values file with the appropriate hostname
+    # and secret or it wont start.
+    hosts:
+      - host: spire-server.example.org
+        paths:
+          - path: /
+            pathType: Prefix
+    tls:
+      - hosts:
+          - spire-server.example.org
diff --git a/examples/production/values.yaml b/examples/production/values.yaml
index d81d285..683666a 100644
--- a/examples/production/values.yaml
+++ b/examples/production/values.yaml
@@ -24,9 +24,6 @@ spire-server:
     seccompProfile:
       type: RuntimeDefault
 
-  dataStorage:
-    enabled: true
-
   logLevel: info
 
   controllerManager:
@@ -77,3 +74,18 @@ spiffe-oidc-discovery-provider:
       drop: [ALL]
     seccompProfile:
       type: RuntimeDefault
+
+tornjak-frontend:
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: false
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
diff --git a/examples/tornjak/README.md b/examples/tornjak/README.md
new file mode 100644
index 0000000..4108c3b
--- /dev/null
+++ b/examples/tornjak/README.md
@@ -0,0 +1,37 @@
+# Recommended setup to deploy Tornjak
+
+> **Warning**: The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
+
+To install Spire with the least privileges possible we deploy spire across 2 namespaces.
+
+```shell
+kubectl create namespace "spire-system"
+kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace "spire-server"
+kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
+
+# deploy SPIRE with Tornjak enabled
+helm upgrade --install --namespace spire-server \
+  --values ../production/values.yaml \
+  --values ./values.yaml \
+  --render-subchart-notes \
+  spire charts/spire
+
+# test the Tornjak deployment
+helm test spire -n spire-server
+```
+
+## Access tornjak
+
+To access Tornjak you will have to use port-forwarding for the time being *(until we add authentication and ingress)*.
+
+Run following commands from your shell, if you ran with different values your namespace might differ. Consult the install notes printed when running above `helm upgrade` command in that case.
+
+```shell
+kubectl -n spire-server port-forward service/spire-tornjak-backend 10000:10000
+kubectl -n spire-server port-forward service/spire-tornjak-frontend 3000:3000
+```
+
+You can now access Tornjak at [localhost:3000](http://localhost:3000).
+
+See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
diff --git a/examples/tornjak/values.yaml b/examples/tornjak/values.yaml
new file mode 100644
index 0000000..a407265
--- /dev/null
+++ b/examples/tornjak/values.yaml
@@ -0,0 +1,17 @@
+spire-server:
+  tornjak:
+    enabled: true
+
+tornjak-frontend:
+  enabled: true
+  service:
+    type: ClusterIP
+    port: 3000
+  apiServerURL: "http://localhost:10000/"
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 100m
+      memory: 512Mi
diff --git a/project/maintainers.md b/project/maintainers.md
new file mode 100644
index 0000000..9de70bc
--- /dev/null
+++ b/project/maintainers.md
@@ -0,0 +1,237 @@
+<!-- vim: filetype=markdown colorcolumn=80
+-->
+
+# Maintainers handbook
+
+This document is a guide for maintainers across the spire/helm-chart effort to
+provide a consistent user interface for those going through the review process.
+
+## The Pull Request
+
+Pull requests are submitted through GitHub. They are contributions to change
+the project. There is no difference between code and non-code submissions, in
+procedure or policy.
+
+All maintainers should consider that pull requests are gifts. The project
+survives due to the effort of frequent contributors and their generosity. As
+such, to encourage future submissions, the default approach to handling a merge
+request should be gratitude, even if the request cannot be merged.
+
+## Roles
+
+There are two primary roles within the scope of a pull request.
+
+- Committer - one who offers code to be merged.
+- Maintainer - one who merges the code.
+
+To ensure that all code receives a proper review, these roles are mutually
+exclusive for each pull request. Within the scope of a pull request, a
+Committer cannot be a Maintainer, nor can a Maintainer be a Committer.
+
+For abandoned pull requests still requiring work, or efforts transferred between
+people, a Maintainer may become a Committer, invalidating any of their prior
+review work. 
+
+### Committers
+
+Committers are people contributing changes to the repository. The first
+committer is typically the one that opens the pull request. Additional people
+can become committers in the same merge request if they change the pull request
+directly.
+
+Suggestions to a committer by a maintainer, such as commentary that with a
+change the merge request might be accepted, does not make a maintainer a
+committer, as the committer will choose to include the change at their discretion.
+
+### Maintainers
+
+Maintainers hold a dual role in the project. They are ambassadors of the
+effort as well as the gatekeepers permitting changes to the repository. As
+ambassadors, maintainers must present a fair and impartial demeanor when
+dealing with contributors.
+
+Failure to be fair or impartial reflects poorly on the released product, as
+guilt by association taints the product. The process of reviewing a merge
+request often includes conflict. Contributors can become defensive about work
+they've done while maintainers can become adamant in the changes they request.
+
+To prevent a breakdown in the review process, the project encourages all
+reviewers to adhere to a standard set of review best practices. Reviewers
+should familiarize themselves with these practices and suggest updates to keep
+the practices relevant over time.
+
+## Review Standards
+
+These standards serve to prevent problems from cropping up during a review. The 
+intent is that consistent application of these standards permits a consistent 
+review process, leading to repeatable, suprise free, outcomes during a review.
+
+The intent of maintaining standards is to enhance productivity and improve team
+morale. In the event the standards have a negative impact on productivity or
+morale, the standard itself should be questioned. To clarify the kinds of
+productivity to be improved, the intent is to reduce the time between initial
+submission of a merge request and its resolution.
+
+### Challenges to the Review Process
+
+Whenever possible, a maintainer should not argue a point about the review
+standards with a contributor. Instead they should provide this document to the
+contributor, indicating that changes to the review process are to be initiated
+with a standard-altering Issue.
+
+In the exceedingly rare situation that a reviewer opts to ignore a review
+standard during a merge request, the reviewer must indicate they are purposefully
+ignoring the standard and the reason why. There are valid reasons to ignore
+standards, but whenever possible a maintainer should uphold the standard or
+change it.
+
+### Review Outcomes
+
+From the Maintainers point of view, all merge requests require one of four
+actions:
+
+- The maintainer accepts the pull request.
+- The maintainer rejects the pull request.
+- The maintainer requests the pull request be altered.
+- The maintainer rewrites some or all of the pull request, becoming a
+  committer.
+
+Suggestions to the committer that a merge request be altered do not constitute
+becoming an committer, even if the maintainer provides the lines of code
+being suggested.
+
+### Review Tempo
+
+Maintainers should set aside and appropriate amount of time when reviewing. The
+initial suggestion is one hour. Most reviews will complete well under this time,
+but a few will take longer. Longer reviews should include review breaks, so the
+reviewer remains fresh and attentive. Attempting a three hour long review often
+yields worse results than two or three shorter efforts with breaks.
+
+The concept of going slow to complete items quickly is not a new one. With a
+little extra time, comments can be thoughtful instead of reactive.
+
+### Review Goals
+
+Each review should have a defined set of goals established prior to the main
+work of the review. The review process often challenges the committer, in the
+hopes of improving the merge request. Keeping the review scoped to goals avoids
+scenarios where the reviewer's requests seem capricious or autocratic.
+
+The current list of review goals include:
+
+- Keeping the code base readable
+- Keeping the code base search-able
+- Keeping the code base understandable
+- Keeping the code base maintainable
+- Keeping the code base testable
+- Keeping the code base functional
+
+Note that quality, stability, and robustness are purposefully not included in
+this list: 
+
+- Quality is the combination of readable and testable.
+- Stability is the combination of understandable, functional, and testable.
+- Robustness is the combination of maintainable, functional, and testable.
+
+Code standards are being developed to clarify specific tests to support these
+goals.
+
+### Developer Testing prior to Review
+
+Each submission should assume that the committer ran the unit tests and 
+small-scale (not requiring an environment) integration tests prior to submission.
+The merge request CI pipeline also runs these tests automatically. Failure to
+pass them leads to an automatic call for merge request modification.
+
+Attempts to pass this requirement by disabling tests or modifying them such that
+they are effectively disabled are strongly discouraged. They violate the review
+goals by reducing maintainability (no new failures will be detected) and
+possibly functionality (for scenarios outside of the current mindset).
+
+At their leisure, maintainers may suggest code changes to make the test suite pass.
+Doing so is never required, nor part of the minimum duties of a maintainer.
+
+### Reviewer Count
+
+Two passing reviews are required for code to be merged. 
+
+Whenever possible, the number of reviewers should be limited, as each additional
+reviewer presents an extra set of communication channels between the review and
+themselves. 
+
+- One reviewer has one channel between the committer and the reviewer
+- Increasing to two, adds one channel to the the committer, and one to the 
+  reviewers.
+- Increasing to three, adds one channel to the committer, and two to the
+  reviewers.
+- Increasing to four, adds one channel to the committer, and three to the
+  reviewers.
+
+The amount of possible communication grows such that 
+`commChannels(reviewers) = reviewers + reviewers(reviewers-1)/2` leads to an 
+`O(n^2)` number of channels. Thus, keeping reviewer count low is critical to
+velocity.
+
+### Reviewer Consensus
+
+Reviewers should coordinate among themselves when differences of opinion arise
+in a review. The first reviewer is likely to make a statement before being
+aware of the difference of opinion; but, once a difference of opinion is known,
+the reviewers should coordinate privately to find a unified presentation of the
+desired features to communicate back to the committer.
+
+The committer has no role in the evaluation of options to determine the proper
+path forward, including them only diminishes the efficiency of the process and
+increases the stress they endure while they observe the discussion. Once a path
+is agreed upon:
+
+- If the request to the committer was reversed, the reviewer making that stance
+  should present the new path.
+- If the request to the committer was refined, the second reviewer should 
+  present the refined path.
+
+If no path forward can be agreed upon, the proposed path that is closest to the
+committer submission is the accepted path. This guideline exists to promote
+cooperation among reviewers. Ideas of merit which don't become part of the
+merge request should be submitted as new issues and reviewed independently.
+
+### Review Automation
+
+Reviewers have a commitment to continuous improvement of the review process.
+Whenever a reviewer sees an opportunity to reduce the manpower involved in the
+review process by automating a portion of the process, the reviewer should
+create an issue and submit it as an improvement to the CI process.
+
+Improvements are subject to the same review process and the same review goals
+as other committer offerings. Readability, search-ability, understanding,
+maintenance, testing, and functionality are goals of the review process just as
+they are of the product code. 
+
+Lack of speed in the review process is viewed as a failure to make the process
+maintainable, understandable, and functional.
+
+### Review Communication
+
+Reviewers are encouraged to have meaningful dialogues with contributors and
+reviewers during a merge request. For these dialogues to be effective, the
+purpose of each communication should be considered. Mixing purposes in
+communication creates problems in understanding intent, retarding progress.
+Scope your communications to move efforts forward.
+
+Avoid mixing the following communication scopes:
+
+- Status update
+- Decision making
+- Problem solving
+- Team building
+- Information sharing
+- Brainstorming
+
+Combining these scopes reduce the effectiveness of the communication. Ideally
+they should be done in different settings. Mixing a brainstorming session with
+a decision making session disrupts the evaluation of pros and cons with new
+options. Attempting to problem solve a technical issue during a status update
+draws focus away from identifying the challenges of delivering the project,
+replacing them with the challenges of solving a single problem in the project.
+