Support Nested Spire with External Agent (#117)

charts/spire/values.yaml

@@ -13,6 +13,9 @@ global:
     # -- Override all instances of bundleConfigMap
     bundleConfigMap: ""
 
+    # -- Set what address to use for the upstream server when using nested spire
+    upstreamServerAddress: ""
+
     image:
       # -- Override all Spire image registries at once
       registry: ""
@@ -41,10 +44,35 @@ spire-agent:
   enabled: true
   nameOverride: agent
 
+upstream:
+  # -- enable upstream agent and driver for use with nested spire.
+  enabled: false
+
+upstream-spire-agent:
+  # @ignored
+  upstream: true
+  nameOverride: agent-upstream
+  bundleConfigMap: spire-bundle-upstream
+
+  socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
+  serviceAccount:
+    name: spire-agent-upstream
+  healthChecks:
+    port: 9981
+  telemetry:
+    prometheus:
+      port: 9989
+
 spiffe-csi-driver:
   # -- Enables deployment of CSI driver
   enabled: true
 
+upstream-spiffe-csi-driver:
+  pluginName: upstream.csi.spiffe.io
+  agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
+  healthChecks:
+    port: 9810
+
 spiffe-oidc-discovery-provider:
   # -- Enables deployment of OIDC discovery provider
   enabled: false