Support Nested Spire with External Agent (#117)

examples/production/values.yaml

@@ -46,6 +46,11 @@ spiffe-csi-driver:
   namespaceOverride: spire-system
   priorityClassName: system-node-critical
 
+
+upstream-spiffe-csi-driver:
+  namespaceOverride: spire-system
+  priorityClassName: system-node-critical
+
 spire-agent:
   enabled: true
   namespaceOverride: spire-system
@@ -69,6 +74,24 @@ spire-agent:
 
   logLevel: info
 
+upstream-spire-agent:
+  namespaceOverride: spire-system
+  priorityClassName: system-node-critical
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
+
+  logLevel: info
+
 spiffe-oidc-discovery-provider:
   enabled: true
   config: