diff --git a/.github/kind/conf/kind-config.yaml b/.github/kind/conf/kind-config.yaml
new file mode 100644
index 0000000..6c900fe
--- /dev/null
+++ b/.github/kind/conf/kind-config.yaml
@@ -0,0 +1,17 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+kubeadmConfigPatches:
+  - |
+    apiVersion: kubeadm.k8s.io/v1beta2
+    kind: ClusterConfiguration
+    metadata:
+      name: config
+    apiServer:
+      extraArgs:
+        service-account-key-file: /etc/kubernetes/pki/sa.pub
+        service-account-signing-key-file: /etc/kubernetes/pki/sa.key
+        service-account-issuer: api,spire-agent
+        api-audiences: api,spire-server
+        # admission-control-config-file: /etc/kubernetes/pki/admctrl/admission-control.yaml
+nodes:
+  - role: control-plane
diff --git a/.github/scripts/helm-docs.sh b/.github/scripts/helm-docs.sh
new file mode 100755
index 0000000..d77d15c
--- /dev/null
+++ b/.github/scripts/helm-docs.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPTPATH=$(dirname "$0")
+HELM_DOCS_VERSION="1.11.0"
+
+case "$(uname -s)" in
+    Linux*)
+      machine=Linux
+      shasum=sha256sum
+      exe=helm-docs
+      ;;
+    Darwin*)
+      machine=Darwin
+      shasum=shasum
+      exe=helm-docs
+      ;;
+    MINGW64*)
+      machine=Windows
+      shasum=sha256sum
+      exe=helm-docs.exe
+      ;;
+esac
+
+function install_helm_docs {
+    curl -LO https://github.com/norwoodj/helm-docs/releases/download/v"${HELM_DOCS_VERSION}"/helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz
+    curl -L --output /tmp/checksums_helm-docs.txt https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt
+    grep helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz /tmp/checksums_helm-docs.txt | $shasum -c -
+    mkdir -p "$SCRIPTPATH/bin"
+    tar -xf helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz ${exe}
+    mv ${exe} "$SCRIPTPATH/bin/"
+    rm helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz
+}
+
+if [ ! -f "$SCRIPTPATH/bin/${exe}" ] ; then
+  install_helm_docs
+elif [[ ! "$("$SCRIPTPATH/bin/${exe}" --version)" =~ .*"$HELM_DOCS_VERSION".* ]] ; then
+  install_helm_docs
+else
+  echo "Using '$("$SCRIPTPATH/bin/${exe}" --version)'"
+fi
+
+# validate docs
+"$SCRIPTPATH/bin/${exe}"
+git diff --exit-code
diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
new file mode 100644
index 0000000..c064f83
--- /dev/null
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -0,0 +1,127 @@
+name: Helm Chart CI
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'charts/**'
+      - '.github/workflows/helm-chart-ci.yml'
+      - '.github/scripts/*.sh'
+      - '.github/kind/conf/kind-config.yaml'
+
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  HELM_VERSION: v3.10.2
+  PYTHON_VERSION: 3.11.1
+  CHART_TESTING_VERSION: v3.7.1
+
+jobs:
+  check-docs:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3.2.0
+
+      - name: Verify Docs updated
+        run: .github/scripts/helm-docs.sh
+
+  lint-chart:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3.2.0
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v3.5
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Setup chart-testing
+        uses: helm/chart-testing-action@v2.3.1
+        with:
+          version: ${{ env.CHART_TESTING_VERSION }}
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(ct list-changed --target-branch main)
+          if [[ -n "$changed" ]]; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Run chart-testing (lint)
+        run: |
+          ct lint --debug \
+            --target-branch main
+
+    outputs:
+      changed: ${{ steps.list-changed.outputs.changed }}
+
+  test:
+    runs-on: ubuntu-22.04
+    needs:
+      - lint-chart
+
+    if: needs.lint-chart.outputs.changed == 'true'
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Choose tags corresponding to the version of Kind being used.
+        # At a minimum, we should test the currently supported versions of
+        # Kubernetes, but can go back farther as long as we don't need heroics
+        # to pull it off (i.e. kubectl version juggling).
+        k8s:
+          - v1.25.3
+          - v1.24.7
+          - v1.23.13
+          - v1.22.15
+          - v1.21.14
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3.2.0
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v3.5
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Setup chart-testing
+        uses: helm/chart-testing-action@v2.3.1
+        with:
+          version: ${{ env.CHART_TESTING_VERSION }}
+
+      - name: Create kind ${{ matrix.k8s }} cluster
+        uses: helm/kind-action@v1.4.0
+        # Only build a kind cluster if there are chart changes to test.
+        with:
+          version: v0.17.0
+          node_image: kindest/node:${{ matrix.k8s }}
+          config: .github/kind/conf/kind-config.yaml
+          verbosity: 1
+
+      - name: Run chart-testing (install)
+        run: |
+          ct install --debug \
+            --target-branch main \
+            --exclude-deprecated
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..bcaef3e
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.github/scripts/bin