diff --git a/.github/scripts/update-versions.sh b/.github/scripts/update-versions.sh
new file mode 100755
index 0000000..2be760e
--- /dev/null
+++ b/.github/scripts/update-versions.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+
+CHARTJSON="${SCRIPTPATH}/../tests/charts.json"
+
+jq -r ".[].name" "${CHARTJSON}" | while read -r CHART; do
+  ENTRYQUERY='.[] | select(.name == "'$CHART'")'
+  REPO_URL="$(jq -r "$ENTRYQUERY | .repo" "${CHARTJSON}")"
+  VERSION="$(jq -r "$ENTRYQUERY | .version" "${CHARTJSON}")"
+  echo Processing: "${CHART}"
+  echo "  repo: ${REPO_URL}"
+  echo "  current version: ${VERSION}"
+  helm repo add "${CHART}" "${REPO_URL}" > /dev/null
+  helm repo update "${CHART}" > /dev/null
+  LATEST_VERSION=$(helm search repo --regexp "${CHART}/${CHART}\v" -o json | jq -r '.[0].version')
+  echo "  latest version: ${LATEST_VERSION}"
+  if [ "x${VERSION}" != "x${LATEST_VERSION}" ]; then
+    echo "  New version found!"
+    jq "(${ENTRYQUERY}).version |= \"${LATEST_VERSION}\"" "${CHARTJSON}" > /tmp/$$
+    mv /tmp/$$ "${CHARTJSON}"
+  fi
+done
diff --git a/.github/tests/charts.json b/.github/tests/charts.json
new file mode 100644
index 0000000..eb72d77
--- /dev/null
+++ b/.github/tests/charts.json
@@ -0,0 +1,27 @@
+[
+  {
+    "name": "kube-prometheus-stack",
+    "repo": "https://prometheus-community.github.io/helm-charts",
+    "version": "45.26.0"
+  },
+  {
+    "name": "cert-manager",
+    "repo": "https://charts.jetstack.io",
+    "version": "v1.11.1"
+  },
+  {
+    "name": "ingress-nginx",
+    "repo": "https://kubernetes.github.io/ingress-nginx",
+    "version": "4.6.1"
+  },
+  {
+    "name": "mysql",
+    "repo": "https://charts.bitnami.com/bitnami",
+    "version": "9.7.2"
+  },
+  {
+    "name": "postgresql",
+    "repo": "https://charts.bitnami.com/bitnami",
+    "version": "12.2.2"
+  }
+]
diff --git a/.github/tests/charts.sh b/.github/tests/charts.sh
new file mode 100644
index 0000000..d83af09
--- /dev/null
+++ b/.github/tests/charts.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' .github/tests/charts.json)
+VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' .github/tests/charts.json)
+eval "$REPOS"
+eval "$VERSIONS"
diff --git a/.github/tests/common.sh b/.github/tests/common.sh
new file mode 100755
index 0000000..c550721
--- /dev/null
+++ b/.github/tests/common.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+get_namespace_details () {
+cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### Namespace $1
+
+#### Events
+
+\`\`\`shell
+$(kubectl --request-timeout=30s get events --output wide --namespace "$1")
+\`\`\`
+
+#### Pods
+
+\`\`\`shell
+$(kubectl --request-timeout=30s describe pods --namespace "$1")
+\`\`\`
+
+#### Logs
+
+\`\`\`shell
+$(kubectl get pods -o name -n "$1" | while read -r line; do echo logs for "${line}"; kubectl logs -n "$1" "${line}" --all-containers=true --ignore-errors=true; done)
+\`\`\`
+
+EOF
+}
+
+k_wait () {
+  kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
+}
+
+k_rollout_status () {
+  kubectl rollout status --watch --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
+}
+
+get_spire_release_name () {
+  helm ls -A | grep '^spire' | awk '{print $1}'
+}
+
+print_spire_workload_status () {
+  local ns1
+  local ns2
+
+  ns1="$1"
+  ns2="${2:-$1}"
+
+  release_name="$(get_spire_release_name)"
+
+  cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### Spire
+
+| Namespace | Workload                                       | Status |
+| --------- | ---------------------------------------------- | ------ |
+| ${ns1}    | ${release_name}-server                         | <pre>$(k_rollout_status "${ns1}" statefulset "${release_name}-server")</pre> |
+| ${ns2}    | ${release_name}-spiffe-csi-driver              | <pre>$(k_rollout_status "${ns2}" daemonset "${release_name}-spiffe-csi-driver")</pre> |
+| ${ns2}    | ${release_name}-agent                          | <pre>$(k_rollout_status "${ns2}" daemonset "${release_name}-agent")</pre> |
+| ${ns1}    | ${release_name}-spiffe-oidc-discovery-provider | <pre>$(k_rollout_status "${ns1}" deployments.apps "${release_name}-spiffe-oidc-discovery-provider")</pre> |
+
+EOF
+}
+
+print_helm_releases () {
+  cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### Releases
+
+$(helm ls -A | sed 's/\t/ | /g' | sed 's/^/| /' | sed 's/$/ |/' | sed '/^| NAME.*/a| - | - | - | - | - | - | - |')
+
+EOF
+}
diff --git a/.github/tests/extras/post-install.sh b/.github/tests/extras/post-install.sh
new file mode 100644
index 0000000..1278f29
--- /dev/null
+++ b/.github/tests/extras/post-install.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status "${scenario}"
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details "${scenario}"
+fi
diff --git a/.github/tests/federation-bundle-endpoint/post-install.sh b/.github/tests/federation-bundle-endpoint/post-install.sh
new file mode 100644
index 0000000..1278f29
--- /dev/null
+++ b/.github/tests/federation-bundle-endpoint/post-install.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status "${scenario}"
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details "${scenario}"
+fi
diff --git a/.github/tests/namespace-override/post-install.sh b/.github/tests/namespace-override/post-install.sh
index c565da6..7fbaf11 100755
--- a/.github/tests/namespace-override/post-install.sh
+++ b/.github/tests/namespace-override/post-install.sh
@@ -2,59 +2,18 @@
 
 set -x
 
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH=$(dirname "$SCRIPT")
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
 
-k_wait () {
-  kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
-}
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
 
-k_rollout_status () {
-  kubectl rollout status --watch --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
-}
+print_helm_releases
+print_spire_workload_status spire-server spire-system
 
-RELEASE=$(helm ls --no-headers -n "${scenario}" | awk '{print $1}' | grep 'spire-[^-]*$')
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details spire-server
+  get_namespace_details spire-systen
+fi
 
-cat <<EOF >>"$GITHUB_STEP_SUMMARY"
-### release
-| release |
-| ------- |
-| $RELEASE |
-
-### spire
-| workload | Status |
-| -------- | ------ |
-| spire-server | <pre>$(k_rollout_status spire-server statefulset "${RELEASE}-server")</pre> |
-| spire-spiffe-csi-driver | <pre>$(k_rollout_status spire-system daemonset "${RELEASE}-spiffe-csi-driver")</pre> |
-| spire-agent | <pre>$(k_rollout_status spire-system daemonset "${RELEASE}-agent")</pre> |
-| spire-spiffe-oidc-discovery-provider | <pre>$(k_wait spire-server deployments.apps "${RELEASE}-spiffe-oidc-discovery-provider")</pre> |
-EOF
-
-if [ $1 -ne 0 ]; then
-  echo
-  echo '```'
-  echo '==> Events of namespace spire-server'
-  echo '........................................................................................................................'
-  echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-server'
-  kubectl --request-timeout=30s get events --output wide --namespace spire-server
-  echo '........................................................................................................................'
-  echo '<== Events of namespace spire-server'
-  echo '........................................................................................................................'
-  echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-server'
-  kubectl --request-timeout=30s describe pods --namespace spire-server
-  echo '========================================================================================================================'
-  echo '==> Events of namespace spire-system'
-  echo '........................................................................................................................'
-  echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-system'
-  kubectl --request-timeout=30s get events --output wide --namespace spire-system
-  echo '........................................................................................................................'
-  echo '<== Events of namespace spire-system'
-  echo '........................................................................................................................'
-  echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system'
-  kubectl --request-timeout=30s describe pods --namespace spire-system
-  echo '========================================================================================================================'
-  kubectl get pods -o name -n spire-server | while read line; do echo logs for $line; kubectl logs -n spire-server $line --all-containers=true --ignore-errors=true; done
-  kubectl get pods -o name -n spire-system | while read line; do echo logs for $line; kubectl logs -n spire-system $line --all-containers=true --ignore-errors=true; done
-  echo '========================================================================================================================'
-  echo '```'
-fi | cat >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/tests/namespace-override/pre-install.sh b/.github/tests/namespace-override/pre-install.sh
index 91bd6f0..3d778a6 100755
--- a/.github/tests/namespace-override/pre-install.sh
+++ b/.github/tests/namespace-override/pre-install.sh
@@ -1,3 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
+
 kubectl create namespace "spire-system"
 kubectl create namespace "spire-server"
diff --git a/.github/tests/namespace-override/values.yaml b/.github/tests/namespace-override/values.yaml
index 36a4336..fdff671 100644
--- a/.github/tests/namespace-override/values.yaml
+++ b/.github/tests/namespace-override/values.yaml
@@ -21,6 +21,7 @@ spire-agent:
   enabled: true
   namespaceOverride: spire-system
   serviceAccount:
+    # -- The name of the service account to use.
     name: spire-agent
   server:
     namespaceOverride: spire-server
diff --git a/.github/tests/no-spire-controller-manager/post-install.sh b/.github/tests/no-spire-controller-manager/post-install.sh
new file mode 100644
index 0000000..1278f29
--- /dev/null
+++ b/.github/tests/no-spire-controller-manager/post-install.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status "${scenario}"
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details "${scenario}"
+fi
diff --git a/.github/tests/production-example/install.sh b/.github/tests/production-example/install.sh
index 442a97b..c2b5cfe 100755
--- a/.github/tests/production-example/install.sh
+++ b/.github/tests/production-example/install.sh
@@ -2,8 +2,8 @@
 
 set -xe
 
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH=$(dirname "$SCRIPT")
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
 
 helm install \
   --namespace spire-server \
diff --git a/.github/tests/production-example/post-install.sh b/.github/tests/production-example/post-install.sh
index ee0963e..29335e6 100755
--- a/.github/tests/production-example/post-install.sh
+++ b/.github/tests/production-example/post-install.sh
@@ -2,50 +2,17 @@
 
 set -x
 
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH=$(dirname "$SCRIPT")
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
 
-k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
-k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
 
-function get_namespace_details {
-cat <<EOF >>"$GITHUB_STEP_SUMMARY"
-### Namespace $1
+print_helm_releases
+print_spire_workload_status spire-server spire-system
 
-#### Events
-
-\`\`\`shell
-$(kubectl --request-timeout=30s get events --output wide --namespace "$1")
-\`\`\`
-
-#### Pods
-
-\`\`\`shell
-$(kubectl --request-timeout=30s describe pods --namespace "$1")
-\`\`\`
-
-#### Logs
-
-\`\`\`shell
-$(kubectl get pods -o name -n "$1" | while read -r line; do echo logs for "${line}"; kubectl logs -n "$1" "${line}" --all-containers=true --ignore-errors=true; done)
-\`\`\`
-
-EOF
-}
-
-cat <<EOF >>"$GITHUB_STEP_SUMMARY"
-### spire
-
-| workload                             | Status |
-| ------------------------------------ | ------ |
-| spire-server                         | "$("${k_rollout_status[@]}" spire-server statefulset spire-server)" |
-| spire-controller-manager             | "$("${k_rollout_status[@]}" spire-server statefulset spire-controller-manager)" |
-| spire-spiffe-oidc-discovery-provider | "$("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" |
-| spire-spiffe-csi-driver              | "$("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver)" |
-| spire-agent                          | "$("${k_rollout_status[@]}" spire-system daemonset spire-agent)" |
-EOF
-
-if [ $1 -ne 0 ]; then
+if [[ "$1" -ne 0 ]]; then
   get_namespace_details spire-server
-  get_namespace_details spire-systen
+  get_namespace_details spire-system
 fi
diff --git a/.github/tests/production-external-mysql/install.sh b/.github/tests/production-external-mysql/install.sh
new file mode 100755
index 0000000..fc979cd
--- /dev/null
+++ b/.github/tests/production-external-mysql/install.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+set -xe
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+DB=spire
+DBUSER=spire
+DBPW=$(uuidgen)
+DBROOTPW=$(uuidgen)
+
+# Generate random settings to make sure things come up with random settings.
+cat <<EOF > /tmp/$$-db-values.yaml
+auth:
+  database: ${DB}
+  username: ${DBUSER}
+  password: ${DBPW}
+  rootPassword: ${DBROOTPW}
+EOF
+
+cat <<EOF > /tmp/$$-spire-values.yaml
+spire-server:
+  dataStore:
+    sql:
+      databaseType: mysql
+      databaseName: ${DB}
+      username: ${DBUSER}
+      password: ${DBPW}
+      host: mysql
+      port: 3306
+      options:
+      - parseTime: true
+EOF
+
+helm install mysql mysql --namespace "spire-server" --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
+  --values "${SCRIPTPATH}/mysql-values.yaml" \
+  --values /tmp/$$-db-values.yaml --wait
+
+helm install \
+  --namespace "spire-server" \
+  --values /tmp/$$-spire-values.yaml \
+  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
+  spire charts/spire --wait
+
+helm test spire --namespace "spire-server"
diff --git a/.github/tests/production-external-mysql/mysql-values.yaml b/.github/tests/production-external-mysql/mysql-values.yaml
new file mode 100644
index 0000000..62f27e2
--- /dev/null
+++ b/.github/tests/production-external-mysql/mysql-values.yaml
@@ -0,0 +1,7 @@
+primary:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
diff --git a/.github/tests/production-external-mysql/post-install.sh b/.github/tests/production-external-mysql/post-install.sh
new file mode 100755
index 0000000..29335e6
--- /dev/null
+++ b/.github/tests/production-external-mysql/post-install.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status spire-server spire-system
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details spire-server
+  get_namespace_details spire-system
+fi
diff --git a/.github/tests/production-external-mysql/pre-install.sh b/.github/tests/production-external-mysql/pre-install.sh
new file mode 100755
index 0000000..b33d1ed
--- /dev/null
+++ b/.github/tests/production-external-mysql/pre-install.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+kubectl create namespace spire-system
+kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace spire-server
+kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
diff --git a/.github/tests/production-external-postgresql/install.sh b/.github/tests/production-external-postgresql/install.sh
new file mode 100755
index 0000000..38b56c4
--- /dev/null
+++ b/.github/tests/production-external-postgresql/install.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+set -xe
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+DB=$(uuidgen)
+DBUSER=$(uuidgen)
+DBPW=$(uuidgen)
+DBPGPW=$(uuidgen)
+
+# Generate random settings to make sure things come up with random settings.
+cat > /tmp/$$-db-values.yaml <<EOF
+auth:
+  database: ${DB}
+  username: ${DBUSER}
+  password: ${DBPW}
+  postgresPassword: ${DBPGPW}
+EOF
+
+cat > /tmp/$$-spire-values.yaml <<EOF
+spire-server:
+  dataStore:
+    sql:
+      databaseType: postgres
+      databaseName: ${DB}
+      username: ${DBUSER}
+      password: ${DBPW}
+      host: postgresql
+      port: 5432
+      options:
+      - sslmode: disable
+EOF
+
+helm install postgresql postgresql --namespace "spire-server" --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
+  --values "${SCRIPTPATH}/postgresql-values.yaml" \
+  --values /tmp/$$-db-values.yaml --wait
+
+helm install \
+  --namespace "spire-server" \
+  --values /tmp/$$-spire-values.yaml \
+  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
+  spire charts/spire --wait
+
+helm test spire --namespace "spire-server"
diff --git a/.github/tests/production-external-postgresql/post-install.sh b/.github/tests/production-external-postgresql/post-install.sh
new file mode 100755
index 0000000..29335e6
--- /dev/null
+++ b/.github/tests/production-external-postgresql/post-install.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status spire-server spire-system
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details spire-server
+  get_namespace_details spire-system
+fi
diff --git a/.github/tests/production-external-postgresql/postgresql-values.yaml b/.github/tests/production-external-postgresql/postgresql-values.yaml
new file mode 100644
index 0000000..ea34425
--- /dev/null
+++ b/.github/tests/production-external-postgresql/postgresql-values.yaml
@@ -0,0 +1,8 @@
+primary:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
diff --git a/.github/tests/production-external-postgresql/pre-install.sh b/.github/tests/production-external-postgresql/pre-install.sh
new file mode 100755
index 0000000..b33d1ed
--- /dev/null
+++ b/.github/tests/production-external-postgresql/pre-install.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+kubectl create namespace spire-system
+kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace spire-server
+kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
diff --git a/.github/tests/prometheus/post-install.sh b/.github/tests/prometheus/post-install.sh
new file mode 100644
index 0000000..1278f29
--- /dev/null
+++ b/.github/tests/prometheus/post-install.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status "${scenario}"
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details "${scenario}"
+fi
diff --git a/.github/tests/prometheus/pre-install.sh b/.github/tests/prometheus/pre-install.sh
index 5959a16..e63cb46 100755
--- a/.github/tests/prometheus/pre-install.sh
+++ b/.github/tests/prometheus/pre-install.sh
@@ -1,3 +1,11 @@
 #!/usr/bin/env bash
 
-helm install kube-prometheus-stack kube-prometheus-stack --version 45.7.1 --repo https://prometheus-community.github.io/helm-charts -n "$scenario" --wait
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+helm install kube-prometheus-stack kube-prometheus-stack \
+  --version "${VERSION_KUBE_PROMETHEUS_STACK}" \
+  --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \
+  -n "${scenario}" \
+  --wait
diff --git a/.github/tests/spire-oidc-insecure/post-install.sh b/.github/tests/spire-oidc-insecure/post-install.sh
new file mode 100644
index 0000000..1278f29
--- /dev/null
+++ b/.github/tests/spire-oidc-insecure/post-install.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status "${scenario}"
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details "${scenario}"
+fi
diff --git a/.github/tests/spire-oidc-insecure/pre-install.sh b/.github/tests/spire-oidc-insecure/pre-install.sh
index 939b1d8..d27cc96 100755
--- a/.github/tests/spire-oidc-insecure/pre-install.sh
+++ b/.github/tests/spire-oidc-insecure/pre-install.sh
@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
 
-helm install ingress-nginx ingress-nginx --version 4.5.2 --repo https://kubernetes.github.io/ingress-nginx -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough=
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+helm install ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough=
 kubectl wait --namespace ingress-nginx   --for=condition=ready pod   --selector=app.kubernetes.io/component=controller -n "$scenario"
diff --git a/.github/tests/upstream-authority-cert-manager/post-install.sh b/.github/tests/upstream-authority-cert-manager/post-install.sh
new file mode 100755
index 0000000..9ef78ac
--- /dev/null
+++ b/.github/tests/upstream-authority-cert-manager/post-install.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status "${scenario}"
+
+if [ "$1" != '0' ]; then
+  get_namespace_details "${scenario}"
+fi
diff --git a/.github/tests/upstream-authority-cert-manager/pre-install.sh b/.github/tests/upstream-authority-cert-manager/pre-install.sh
index 8b5733f..9508f5d 100755
--- a/.github/tests/upstream-authority-cert-manager/pre-install.sh
+++ b/.github/tests/upstream-authority-cert-manager/pre-install.sh
@@ -1,5 +1,9 @@
 #!/usr/bin/env bash
 
-helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version v1.11.0 --set installCRDs=true --repo https://charts.jetstack.io --wait
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-kubectl apply -f $SCRIPT_DIR/cert-manager-ca.yaml -n "$scenario"
+kubectl apply -f "${SCRIPT_DIR}/cert-manager-ca.yaml" -n "$scenario"
diff --git a/.github/tests/upstream-authority-disk/post-install.sh b/.github/tests/upstream-authority-disk/post-install.sh
new file mode 100755
index 0000000..9ef78ac
--- /dev/null
+++ b/.github/tests/upstream-authority-disk/post-install.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status "${scenario}"
+
+if [ "$1" != '0' ]; then
+  get_namespace_details "${scenario}"
+fi
diff --git a/.github/workflows/check-versions.yaml b/.github/workflows/check-versions.yaml
new file mode 100644
index 0000000..e129967
--- /dev/null
+++ b/.github/workflows/check-versions.yaml
@@ -0,0 +1,49 @@
+name: Check versions
+
+on:
+  schedule:
+    - cron: '0 8 * * 1'
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+env:
+  HELM_VERSION: v3.11.1
+
+jobs:
+  check-helm-chart-versions:
+    runs-on: ubuntu-22.04
+
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3.5.0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v3.5
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Update test chart versions
+        run: |
+          ./.github/scripts/update-versions.sh
+          git diff
+
+      - name: Create Pull Request
+        id: cpr
+        uses: peter-evans/create-pull-request@v5.0.1
+        with:
+          title: Bump test chart dependencies
+          branch: bump-test-chart-deps
+          commit-message: Bump test chart dependencies
+          body: Bump the Helm charts used in test scenarios to latest available versions.
+          signoff: true
+          add-paths: |
+            .github/tests
+
+      - name: Check outputs
+        if: ${{ steps.cpr.outputs.pull-request-number }}
+        run: 'echo "::notice title=PR #${{ steps.cpr.outputs.pull-request-number }}::${{ steps.cpr.outputs.pull-request-url }}"'
diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
index 179df3a..4ac7bb0 100644
--- a/.github/workflows/helm-chart-ci.yaml
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -147,11 +147,12 @@ jobs:
         # Kubernetes, but can go back farther as long as we don't need heroics
         # to pull it off (i.e. kubectl version juggling).
         k8s:
-          - v1.26.0
-          - v1.25.3
-          - v1.24.7
-          - v1.23.13
-          - v1.22.15
+          - v1.27.0
+          - v1.26.3
+          - v1.25.8
+          - v1.24.12
+          - v1.23.17
+          - v1.22.17
           - v1.21.14
         values:
           - ${{ fromJson(needs.build-matrix.outputs.tests) }}
@@ -181,7 +182,7 @@ jobs:
         uses: helm/kind-action@v1.5.0
         # Only build a kind cluster if there are chart changes to test.
         with:
-          version: v0.17.0
+          version: v0.18.0
           node_image: kindest/node:${{ matrix.k8s }}
           config: .github/kind/conf/kind-config.yaml
           verbosity: 1
@@ -198,6 +199,8 @@ jobs:
           export scenario="$(basename "${TEST_DIR}")"
           export EXTRA_HELM_ARGS=""
 
+          source .github/tests/charts.sh
+
           [ "${scenario}" != "default" ] && kubectl create namespace "${scenario}"
           [ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh"
           [ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env"
diff --git a/.github/workflows/helm-release.yaml b/.github/workflows/helm-release.yaml
index 5f0300c..357d965 100644
--- a/.github/workflows/helm-release.yaml
+++ b/.github/workflows/helm-release.yaml
@@ -29,9 +29,9 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Setup cosign
-        uses: sigstore/cosign-installer@v3.0.2
+        uses: sigstore/cosign-installer@v3.0.3
         with:
-          cosign-release: v2.0.1
+          cosign-release: v2.0.2
 
       - name: Set up Helm
         uses: azure/setup-helm@v3.5
diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml
new file mode 100644
index 0000000..1bed14c
--- /dev/null
+++ b/.github/workflows/shellcheck.yaml
@@ -0,0 +1,30 @@
+name: Shellcheck
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [synchronize, opened, reopened, edited]
+    paths:
+      - .github/workflows/shellcheck.yaml
+      - '**/*.sh'
+
+concurrency:
+  group: ${{ github.ref }}-shellcheck
+  cancel-in-progress: true
+
+env:
+  SHELLCHECK_VERSION: v0.9.0
+
+jobs:
+  checks:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3.5.2
+
+      - name: Run Shellcheck
+        uses: ludeeus/action-shellcheck@2.0.0
+        with:
+          format: gcc
+          version: ${{ env.SHELLCHECK_VERSION }}
diff --git a/CODEOWNERS b/CODEOWNERS
index 97468c2..54b1269 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -2,6 +2,6 @@
 # the repo. Unless a later match takes precedence,
 # they will be requested for review when someone opens a 
 # pull request.
-*       @marcofranssen @Kfox1111 @developer-guy @dfeldman @faisal-memon @mrsabath
+*       @marcofranssen @Kfox1111 @developer-guy @dfeldman @faisal-memon @mrsabath @edwbuck
 
 # See CODEOWNERS syntax here: https://help.github.com/articles/about-codeowners/#codeowners-syntax
diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml
index 2c37c3f..62af05f 100644
--- a/charts/spire/Chart.yaml
+++ b/charts/spire/Chart.yaml
@@ -3,7 +3,7 @@ name: spire
 description: >
   A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
 type: application
-version: 0.6.3
+version: 0.7.0
 appVersion: "1.6.3"
 keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
 home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
@@ -18,6 +18,8 @@ maintainers:
     email: Kevin.Fox@pnnl.gov
   - name: faisal-memon
     email: fymemon@yahoo.com
+  - name: edwbuck
+    email: edwbuck@gmail.com
 kubeVersion: ">=1.21.0-0"
 dependencies:
   - name: spire-server
diff --git a/charts/spire/README.md b/charts/spire/README.md
index b842370..e77bf5c 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.6.3](https://img.shields.io/badge/Version-0.6.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square)
+![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square)
 [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
 
 A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -17,7 +17,7 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi
 
 | Dependency | Supported Versions |
 |:-----------|:-------------------|
-| SPIRE      | `1.5.3+`, `1.6.x`  |
+| SPIRE      | `1.5.3+`, `1.6.3+` |
 | Helm       | `3.x`              |
 | Kubernetes | `1.21+`            |
 
@@ -88,6 +88,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
 | kfox1111 | <Kevin.Fox@pnnl.gov> |  |
 | faisal-memon | <fymemon@yahoo.com> |  |
+| edwbuck | <edwbuck@gmail.com> |  |
 
 ## Source Code
 
@@ -108,12 +109,11 @@ Kubernetes: `>=1.21.0-0`
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| fullnameOverride | string | `""` |  |
 | global.k8s.clusterDomain | string | `"cluster.local"` |  |
 | global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap |
-| global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster |
-| global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers |
-| nameOverride | string | `""` |  |
+| global.spire.clusterName | string | `"example-cluster"` |  |
+| global.spire.image.registry | string | `""` | Override all Spire image registries at once |
+| global.spire.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers |
 | spiffe-csi-driver.enabled | bool | `true` |  |
 | spiffe-oidc-discovery-provider.enabled | bool | `false` |  |
 | spire-agent.enabled | bool | `true` |  |
@@ -121,5 +121,239 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.controllerManager.enabled | bool | `true` |  |
 | spire-server.enabled | bool | `true` |  |
 | spire-server.nameOverride | string | `"server"` |  |
+| spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
+| spiffe-csi-driver.fullnameOverride | string | `""` |  |
+| spiffe-csi-driver.healthChecks.port | int | `9809` |  |
+| spiffe-csi-driver.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| spiffe-csi-driver.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
+| spiffe-csi-driver.image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry |
+| spiffe-csi-driver.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
+| spiffe-csi-driver.imagePullSecrets | list | `[]` |  |
+| spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` |  |
+| spiffe-csi-driver.nameOverride | string | `""` |  |
+| spiffe-csi-driver.namespaceOverride | string | `""` |  |
+| spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| spiffe-csi-driver.nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from |
+| spiffe-csi-driver.nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry |
+| spiffe-csi-driver.nodeDriverRegistrar.image.version | string | `"v2.6.2"` |  |
+| spiffe-csi-driver.nodeDriverRegistrar.resources | object | `{}` |  |
+| spiffe-csi-driver.nodeSelector | object | `{}` |  |
+| spiffe-csi-driver.pluginName | string | `"csi.spiffe.io"` | Set the csi driver name deployed to Kubernetes. |
+| spiffe-csi-driver.podAnnotations | object | `{}` |  |
+| spiffe-csi-driver.podSecurityContext | object | `{}` |  |
+| spiffe-csi-driver.priorityClassName | string | `""` | Priority class assigned to daemonset pods |
+| spiffe-csi-driver.resources | object | `{}` |  |
+| spiffe-csi-driver.securityContext.privileged | bool | `true` |  |
+| spiffe-csi-driver.securityContext.readOnlyRootFilesystem | bool | `true` |  |
+| spiffe-csi-driver.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| spiffe-csi-driver.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| spiffe-csi-driver.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+| spiffe-oidc-discovery-provider.affinity | object | `{}` |  |
+| spiffe-oidc-discovery-provider.agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket |
+| spiffe-oidc-discovery-provider.autoscaling.enabled | bool | `false` |  |
+| spiffe-oidc-discovery-provider.autoscaling.maxReplicas | int | `5` |  |
+| spiffe-oidc-discovery-provider.autoscaling.minReplicas | int | `1` |  |
+| spiffe-oidc-discovery-provider.autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
+| spiffe-oidc-discovery-provider.autoscaling.targetMemoryUtilizationPercentage | int | `80` |  |
+| spiffe-oidc-discovery-provider.clusterDomain | string | `"cluster.local"` |  |
+| spiffe-oidc-discovery-provider.config.acme.cacheDir | string | `"/run/spire"` |  |
+| spiffe-oidc-discovery-provider.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` |  |
+| spiffe-oidc-discovery-provider.config.acme.emailAddress | string | `"letsencrypt@example.org"` |  |
+| spiffe-oidc-discovery-provider.config.acme.tosAccepted | bool | `false` |  |
+| spiffe-oidc-discovery-provider.config.domains[0] | string | `"localhost"` |  |
+| spiffe-oidc-discovery-provider.config.domains[1] | string | `"oidc-discovery.example.org"` |  |
+| spiffe-oidc-discovery-provider.config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
+| spiffe-oidc-discovery-provider.configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap |
+| spiffe-oidc-discovery-provider.fullnameOverride | string | `""` |  |
+| spiffe-oidc-discovery-provider.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| spiffe-oidc-discovery-provider.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
+| spiffe-oidc-discovery-provider.image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry |
+| spiffe-oidc-discovery-provider.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
+| spiffe-oidc-discovery-provider.imagePullSecrets | list | `[]` |  |
+| spiffe-oidc-discovery-provider.ingress.annotations | object | `{}` |  |
+| spiffe-oidc-discovery-provider.ingress.className | string | `""` |  |
+| spiffe-oidc-discovery-provider.ingress.enabled | bool | `false` |  |
+| spiffe-oidc-discovery-provider.ingress.hosts[0].host | string | `"oidc-discovery.example.org"` |  |
+| spiffe-oidc-discovery-provider.ingress.hosts[0].paths[0].path | string | `"/"` |  |
+| spiffe-oidc-discovery-provider.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` |  |
+| spiffe-oidc-discovery-provider.ingress.tls | list | `[]` |  |
+| spiffe-oidc-discovery-provider.insecureScheme.enabled | bool | `false` |  |
+| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
+| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry |
+| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` |  |
+| spiffe-oidc-discovery-provider.insecureScheme.nginx.resources | object | `{}` |  |
+| spiffe-oidc-discovery-provider.nameOverride | string | `""` |  |
+| spiffe-oidc-discovery-provider.namespaceOverride | string | `""` |  |
+| spiffe-oidc-discovery-provider.nodeSelector | object | `{}` |  |
+| spiffe-oidc-discovery-provider.podAnnotations | object | `{}` |  |
+| spiffe-oidc-discovery-provider.podSecurityContext | object | `{}` |  |
+| spiffe-oidc-discovery-provider.replicaCount | int | `1` |  |
+| spiffe-oidc-discovery-provider.resources | object | `{}` |  |
+| spiffe-oidc-discovery-provider.securityContext | object | `{}` |  |
+| spiffe-oidc-discovery-provider.service.annotations | object | `{}` |  |
+| spiffe-oidc-discovery-provider.service.port | int | `80` |  |
+| spiffe-oidc-discovery-provider.service.type | string | `"ClusterIP"` |  |
+| spiffe-oidc-discovery-provider.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| spiffe-oidc-discovery-provider.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| spiffe-oidc-discovery-provider.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.enabled | bool | `false` |  |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` |  |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.nginxExporter.resources | object | `{}` |  |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.labels | object | `{}` |  |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider |
+| spiffe-oidc-discovery-provider.telemetry.prometheus.port | int | `9988` |  |
+| spiffe-oidc-discovery-provider.tolerations | list | `[]` |  |
+| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
+| spire-agent.bundleConfigMap | string | `"spire-bundle"` |  |
+| spire-agent.clusterName | string | `"example-cluster"` |  |
+| spire-agent.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap |
+| spire-agent.extraContainers | list | `[]` |  |
+| spire-agent.extraVolumeMounts | list | `[]` |  |
+| spire-agent.extraVolumes | list | `[]` |  |
+| spire-agent.fullnameOverride | string | `""` |  |
+| spire-agent.healthChecks.port | int | `9980` | override the host port used for health checking |
+| spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
+| spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
+| spire-agent.image.version | string | `""` |  |
+| spire-agent.imagePullSecrets | list | `[]` |  |
+| spire-agent.initContainers | list | `[]` |  |
+| spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
+| spire-agent.nameOverride | string | `""` |  |
+| spire-agent.namespaceOverride | string | `""` |  |
+| spire-agent.nodeSelector | object | `{}` |  |
+| spire-agent.podAnnotations | object | `{}` |  |
+| spire-agent.podSecurityContext | object | `{}` |  |
+| spire-agent.priorityClassName | string | `""` | Priority class assigned to daemonset pods |
+| spire-agent.resources | object | `{}` |  |
+| spire-agent.securityContext | object | `{}` |  |
+| spire-agent.server.address | string | `""` |  |
+| spire-agent.server.namespaceOverride | string | `""` |  |
+| spire-agent.server.port | int | `8081` |  |
+| spire-agent.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| spire-agent.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| spire-agent.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+| spire-agent.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
+| spire-agent.telemetry.prometheus.enabled | bool | `false` |  |
+| spire-agent.telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
+| spire-agent.telemetry.prometheus.podMonitor.labels | object | `{}` |  |
+| spire-agent.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent |
+| spire-agent.telemetry.prometheus.port | int | `9988` |  |
+| spire-agent.trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" |
+| spire-agent.trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap |
+| spire-agent.trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers |
+| spire-agent.waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| spire-agent.waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
+| spire-agent.waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry |
+| spire-agent.waitForIt.image.version | string | `"latest-20230113"` |  |
+| spire-agent.waitForIt.resources | object | `{}` |  |
+| spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
+| spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
+| spire-server.affinity | object | `{}` |  |
+| spire-server.autoscaling.enabled | bool | `false` |  |
+| spire-server.autoscaling.maxReplicas | int | `100` |  |
+| spire-server.autoscaling.minReplicas | int | `1` |  |
+| spire-server.autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
+| spire-server.bundleConfigMap | string | `"spire-bundle"` |  |
+| spire-server.caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA.  EC cryptography is not supported) |
+| spire-server.caTTL | string | `"24h"` |  |
+| spire-server.ca_subject.common_name | string | `"example.org"` |  |
+| spire-server.ca_subject.country | string | `"NL"` |  |
+| spire-server.ca_subject.organization | string | `"Example"` |  |
+| spire-server.clusterDomain | string | `"cluster.local"` |  |
+| spire-server.clusterName | string | `"example-cluster"` |  |
+| spire-server.configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap |
+| spire-server.controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap |
+| spire-server.controllerManager.enabled | bool | `false` |  |
+| spire-server.controllerManager.identities.dnsNameTemplates | list | `[]` |  |
+| spire-server.controllerManager.identities.enabled | bool | `true` |  |
+| spire-server.controllerManager.identities.namespaceSelector | object | `{}` |  |
+| spire-server.controllerManager.identities.podSelector | object | `{}` |  |
+| spire-server.controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` |  |
+| spire-server.controllerManager.ignoreNamespaces[0] | string | `"kube-system"` |  |
+| spire-server.controllerManager.ignoreNamespaces[1] | string | `"kube-public"` |  |
+| spire-server.controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` |  |
+| spire-server.controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| spire-server.controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
+| spire-server.controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
+| spire-server.controllerManager.image.version | string | `"0.2.2"` |  |
+| spire-server.controllerManager.resources | object | `{}` |  |
+| spire-server.controllerManager.securityContext | object | `{}` |  |
+| spire-server.controllerManager.service.annotations | object | `{}` |  |
+| spire-server.controllerManager.service.port | int | `443` |  |
+| spire-server.controllerManager.service.type | string | `"ClusterIP"` |  |
+| spire-server.controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` |  |
+| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
+| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry |
+| spire-server.controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` |  |
+| spire-server.dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
+| spire-server.dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
+| spire-server.dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
+| spire-server.dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" |
+| spire-server.dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" |
+| spire-server.dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section |
+| spire-server.dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. |
+| spire-server.dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" |
+| spire-server.defaultJwtSvidTTL | string | `"1h"` |  |
+| spire-server.defaultX509SvidTTL | string | `"4h"` |  |
+| spire-server.extraContainers | list | `[]` |  |
+| spire-server.extraVolumeMounts | list | `[]` |  |
+| spire-server.extraVolumes | list | `[]` |  |
+| spire-server.federation.bundleEndpoint.address | string | `"0.0.0.0"` |  |
+| spire-server.federation.bundleEndpoint.port | int | `8443` |  |
+| spire-server.federation.enabled | bool | `false` |  |
+| spire-server.fullnameOverride | string | `""` |  |
+| spire-server.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| spire-server.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
+| spire-server.image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
+| spire-server.image.version | string | `""` |  |
+| spire-server.imagePullSecrets | list | `[]` |  |
+| spire-server.initContainers | list | `[]` |  |
+| spire-server.jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
+| spire-server.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
+| spire-server.nameOverride | string | `""` |  |
+| spire-server.namespaceOverride | string | `""` |  |
+| spire-server.nodeAttestor.k8sPsat.enabled | bool | `true` |  |
+| spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` |  |
+| spire-server.nodeSelector | object | `{}` |  |
+| spire-server.notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
+| spire-server.persistence.accessMode | string | `"ReadWriteOnce"` |  |
+| spire-server.persistence.size | string | `"1Gi"` |  |
+| spire-server.persistence.storageClass | string | `nil` |  |
+| spire-server.podAnnotations | object | `{}` |  |
+| spire-server.podSecurityContext | object | `{}` |  |
+| spire-server.replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
+| spire-server.resources | object | `{}` |  |
+| spire-server.securityContext | object | `{}` |  |
+| spire-server.service.annotations | object | `{}` |  |
+| spire-server.service.port | int | `8081` |  |
+| spire-server.service.type | string | `"ClusterIP"` |  |
+| spire-server.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| spire-server.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| spire-server.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+| spire-server.telemetry.prometheus.enabled | bool | `false` |  |
+| spire-server.telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
+| spire-server.telemetry.prometheus.podMonitor.labels | object | `{}` |  |
+| spire-server.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
+| spire-server.tolerations | list | `[]` |  |
+| spire-server.topologySpreadConstraints | list | `[]` |  |
+| spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
+| spire-server.upstreamAuthority.certManager.enabled | bool | `false` |  |
+| spire-server.upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
+| spire-server.upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` |  |
+| spire-server.upstreamAuthority.certManager.issuer_name | string | `"spire-ca"` |  |
+| spire-server.upstreamAuthority.certManager.kube_config_file | string | `""` |  |
+| spire-server.upstreamAuthority.certManager.namespace | string | `""` | Specify to use a namespace other then the one the chart is installed into |
+| spire-server.upstreamAuthority.certManager.rbac.create | bool | `true` |  |
+| spire-server.upstreamAuthority.disk.enabled | bool | `false` |  |
+| spire-server.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
+| spire-server.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
+| spire-server.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
 
 ----------------------------------------------
diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl
index 70823d0..f2dd15d 100644
--- a/charts/spire/README.md.gotmpl
+++ b/charts/spire/README.md.gotmpl
@@ -19,7 +19,7 @@
 
 | Dependency | Supported Versions |
 |:-----------|:-------------------|
-| SPIRE      | `1.5.3+`, `1.6.x`  |
+| SPIRE      | `1.5.3+`, `1.6.3+` |
 | Helm       | `3.x`              |
 | Kubernetes | `1.21+`            |
 
diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md
index ee8e044..0eb23d9 100644
--- a/charts/spire/charts/spiffe-csi-driver/README.md
+++ b/charts/spire/charts/spiffe-csi-driver/README.md
@@ -13,20 +13,20 @@ A Helm chart to install the SPIFFE CSI driver.
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` |  |
+| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
 | fullnameOverride | string | `""` |  |
 | healthChecks.port | int | `9809` |  |
-| image.pullPolicy | string | `"IfNotPresent"` |  |
-| image.registry | string | `"ghcr.io"` |  |
-| image.repository | string | `"spiffe/spiffe-csi-driver"` |  |
-| image.version | string | `""` |  |
+| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
+| image.repository | string | `"spiffe/spiffe-csi-driver"` | The repository within the registry |
+| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
 | imagePullSecrets | list | `[]` |  |
 | kubeletPath | string | `"/var/lib/kubelet"` |  |
 | nameOverride | string | `""` |  |
 | namespaceOverride | string | `""` |  |
-| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` |  |
-| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` |  |
-| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` |  |
+| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | The OCI registry to pull the image from |
+| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | The repository within the registry |
 | nodeDriverRegistrar.image.version | string | `"v2.6.2"` |  |
 | nodeDriverRegistrar.resources | object | `{}` |  |
 | nodeSelector | object | `{}` |  |
@@ -37,8 +37,8 @@ A Helm chart to install the SPIFFE CSI driver.
 | resources | object | `{}` |  |
 | securityContext.privileged | bool | `true` |  |
 | securityContext.readOnlyRootFilesystem | bool | `true` |  |
-| serviceAccount.annotations | object | `{}` |  |
-| serviceAccount.create | bool | `true` |  |
-| serviceAccount.name | string | `""` |  |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
 
 ----------------------------------------------
diff --git a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl
index 0680b9e..3df9f55 100644
--- a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl
+++ b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl
@@ -72,19 +72,6 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-
-{{- define "spiffe-csi-driver.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spiffe-csi-driver.agent-socket-path" -}}
 {{- print .Values.agentSocketPath }}
 {{- end }}
diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
index 59d1239..c926a0e 100644
--- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
@@ -31,7 +31,7 @@ spec:
       containers:
         # This is the container which runs the SPIFFE CSI driver.
         - name: {{ .Chart.Name }}
-          image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args: [
             "-workload-api-socket-dir", "/spire-agent-socket",
@@ -71,7 +71,7 @@ spec:
         # of all the little details required to register a CSI driver with
         # the kubelet.
         - name: node-driver-registrar
-          image: {{ template "spiffe-csi-driver.image" .Values.nodeDriverRegistrar }}
+          image: {{ template "spire-lib.image" (dict "image" .Values.nodeDriverRegistrar.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
           args: [
             "-csi-address", "/spiffe-csi/csi.sock",
diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml
index b1e9d93..5169312 100644
--- a/charts/spire/charts/spiffe-csi-driver/values.yaml
+++ b/charts/spire/charts/spiffe-csi-driver/values.yaml
@@ -2,9 +2,13 @@
 pluginName: csi.spiffe.io
 
 image:
+  # -- The OCI registry to pull the image from
   registry: ghcr.io
+  # -- The repository within the registry
   repository: spiffe/spiffe-csi-driver
+  # -- The image pull policy
   pullPolicy: IfNotPresent
+  # -- Overrides the image tag whose default is the chart appVersion
   version: ""
 resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious
@@ -27,11 +31,11 @@ namespaceOverride: ""
 fullnameOverride: ""
 
 serviceAccount:
-  # Specifies whether a service account should be created
+  # -- Specifies whether a service account should be created
   create: true
-  # Annotations to add to the service account
+  # -- Annotations to add to the service account
   annotations: {}
-  # The name of the service account to use.
+  # -- The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template
   name: ""
 
@@ -53,8 +57,11 @@ nodeSelector: {}
 
 nodeDriverRegistrar:
   image:
+    # -- The OCI registry to pull the image from
     registry: registry.k8s.io
+    # -- The repository within the registry
     repository: sig-storage/csi-node-driver-registrar
+    # -- The image pull policy
     pullPolicy: IfNotPresent
     version: v2.6.2
   resources: {}
@@ -69,6 +76,7 @@ nodeDriverRegistrar:
     #   cpu: 100m
     #   memory: 64Mi
 
+# -- The unix socket path to the spire-agent
 agentSocketPath: /run/spire/agent-sockets/spire-agent.sock
 
 kubeletPath: /var/lib/kubelet
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
index 14aacab..ea7627d 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md
@@ -15,7 +15,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | affinity | object | `{}` |  |
-| agentSocketName | string | `"spire-agent.sock"` |  |
+| agentSocketName | string | `"spire-agent.sock"` | The name of the spire-agent unix socket |
 | autoscaling.enabled | bool | `false` |  |
 | autoscaling.maxReplicas | int | `5` |  |
 | autoscaling.minReplicas | int | `1` |  |
@@ -28,12 +28,13 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | config.acme.tosAccepted | bool | `false` |  |
 | config.domains[0] | string | `"localhost"` |  |
 | config.domains[1] | string | `"oidc-discovery.example.org"` |  |
-| config.logLevel | string | `"info"` |  |
+| config.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
+| configMap.annotations | object | `{}` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap |
 | fullnameOverride | string | `""` |  |
-| image.pullPolicy | string | `"IfNotPresent"` |  |
-| image.registry | string | `"ghcr.io"` |  |
-| image.repository | string | `"spiffe/oidc-discovery-provider"` |  |
-| image.version | string | `""` |  |
+| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
+| image.repository | string | `"spiffe/oidc-discovery-provider"` | The repository within the registry |
+| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion |
 | imagePullSecrets | list | `[]` |  |
 | ingress.annotations | object | `{}` |  |
 | ingress.className | string | `""` |  |
@@ -43,9 +44,9 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | ingress.hosts[0].paths[0].pathType | string | `"Prefix"` |  |
 | ingress.tls | list | `[]` |  |
 | insecureScheme.enabled | bool | `false` |  |
-| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` |  |
-| insecureScheme.nginx.image.registry | string | `"docker.io"` |  |
-| insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` |  |
+| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| insecureScheme.nginx.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
+| insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` | The repository within the registry |
 | insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` |  |
 | insecureScheme.nginx.resources | object | `{}` |  |
 | nameOverride | string | `""` |  |
@@ -59,13 +60,13 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | service.annotations | object | `{}` |  |
 | service.port | int | `80` |  |
 | service.type | string | `"ClusterIP"` |  |
-| serviceAccount.annotations | object | `{}` |  |
-| serviceAccount.create | bool | `true` |  |
-| serviceAccount.name | string | `""` |  |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
 | telemetry.prometheus.enabled | bool | `false` |  |
-| telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` |  |
-| telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` |  |
-| telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` |  |
+| telemetry.prometheus.nginxExporter.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| telemetry.prometheus.nginxExporter.image.registry | string | `"docker.io"` | The OCI registry to pull the image from |
+| telemetry.prometheus.nginxExporter.image.repository | string | `"nginx/nginx-prometheus-exporter"` | The repository within the registry |
 | telemetry.prometheus.nginxExporter.image.version | string | `"0.11.0"` |  |
 | telemetry.prometheus.nginxExporter.resources | object | `{}` |  |
 | telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
@@ -73,6 +74,6 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spiffe-oidc-discovery-provider |
 | telemetry.prometheus.port | int | `9988` |  |
 | tolerations | list | `[]` |  |
-| trustDomain | string | `"example.org"` |  |
+| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
 
 ----------------------------------------------
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
index 139e151..72b9077 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
@@ -82,42 +82,7 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spiffe-oidc-discovery-provider.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
 {{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
 {{- end }}
 
-{{- define "spiffe-oidc-discovery-provider.cluster-name" }}
-{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
-{{- .Values.global.spire.clusterName }}
-{{- else }}
-{{- .Values.clusterName }}
-{{- end }}
-{{- end }}
-
-{{- define "spiffe-oidc-discovery-provider.trust-domain" }}
-{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
-{{- .Values.global.spire.trustDomain }}
-{{- else }}
-{{- .Values.trustDomain }}
-{{- end }}
-{{- end }}
-
-{{- define "spiffe-oidc-discovery-provider.cluster-domain" }}
-{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
-{{- .Values.global.k8s.clusterDomain }}
-{{- else }}
-{{- .Values.clusterDomain }}
-{{- end }}
-{{- end }}
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
index 1078b33..eb39513 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
@@ -1,44 +1,50 @@
 {{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
+{{- define "spiffe-oidc-discovery-provider.yaml-config" -}}
+{{- $oidcSocket := .oidcSocket }}
+{{- with .root }}
+log_level: {{ .Values.config.logLevel | quote }}
+
+domains:
+  - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}"
+  - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}"
+  - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}"
+  {{- if gt (len .Values.config.domains) 0 }}
+  {{- .Values.config.domains | toYaml | nindent 2 }}
+  {{- end }}
+
+{{- if .Values.insecureScheme.enabled }}
+allow_insecure_scheme: {{ .Values.insecureScheme.enabled }}
+listen_socket_path: {{ $oidcSocket | quote }}
+{{- else }}
+acme:
+  directory_url: {{ .Values.config.acme.directoryUrl | quote }}
+  cache_dir: {{ .Values.config.acme.cacheDir | quote }}
+  tos_accepted: {{ .Values.config.acme.tosAccepted }}
+  email: {{ .Values.config.acme.emailAddress | quote }}
+{{- end }}
+
+workload_api:
+  socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
+  trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
+
+health_checks:
+  bind_port: "8008"
+  ready_path: "/ready"
+  live_path: "/live"
+{{- end }}
+{{- end }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
   namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
+  {{- with .Values.configMap.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   oidc-discovery-provider.conf: |
-    log_level = "{{ .Values.config.logLevel }}"
-
-    domains = [
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}",
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}",
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}",
-    {{- if gt (len .Values.config.domains) 0 }}
-      "{{- join "\",\n      \"" .Values.config.domains }}"
-    {{- end }}
-    ]
-
-    {{- if .Values.insecureScheme.enabled }}
-    allow_insecure_scheme = {{ .Values.insecureScheme.enabled }}
-    listen_socket_path = {{ $oidcSocket | quote }}
-    {{- else }}
-    acme {
-      directory_url = "{{ .Values.config.acme.directoryUrl }}"
-      cache_dir = "{{ .Values.config.acme.cacheDir }}"
-      tos_accepted = {{ .Values.config.acme.tosAccepted }}
-      email = "{{ .Values.config.acme.emailAddress }}"
-    }
-    {{- end }}
-
-    workload_api {
-      socket_path = {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
-      trust_domain = {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }}
-    }
-
-    health_checks {
-      bind_port = "8008"
-      ready_path = "/ready"
-      live_path = "/live"
-    }
+    {{- include "spiffe-oidc-discovery-provider.yaml-config" (dict "oidcSocket" $oidcSocket "root" .) | fromYaml | toPrettyJson | nindent 4 }}
   {{- if .Values.insecureScheme.enabled }}
   default.conf: |
     upstream oidc {
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
index 7516df6..d180466 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
@@ -34,7 +34,7 @@ spec:
         - name: {{ .Chart.Name }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spiffe-oidc-discovery-provider.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
             - -config
@@ -75,7 +75,7 @@ spec:
         - name: nginx
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spiffe-oidc-discovery-provider.image" .Values.insecureScheme.nginx }}
+          image: {{ template "spire-lib.image" (dict "image" .Values.insecureScheme.nginx.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }}
           ports:
             - containerPort: 8080
@@ -97,7 +97,7 @@ spec:
         - name: nginx-exporter
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spiffe-oidc-discovery-provider.image" .Values.telemetry.prometheus.nginxExporter }}
+          image: {{ template "spire-lib.image" (dict "image" .Values.telemetry.prometheus.nginxExporter.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }}
           args:
           - -nginx.scrape-uri=http://127.0.0.1:8080/stub_status
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
index e687868..3f11d11 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
@@ -26,7 +26,7 @@ spec:
     - name: curl-service-name-namespace-svc-cluster-local
       image: cgr.dev/chainguard/bash:latest
       command: ['curl']
-      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
+      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- if .Values.ingress.enabled }}
diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
index 1424301..bf829bc 100644
--- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
@@ -2,6 +2,7 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
+# -- The name of the spire-agent unix socket
 agentSocketName: spire-agent.sock
 
 replicaCount: 1
@@ -9,11 +10,13 @@ replicaCount: 1
 namespaceOverride: ""
 
 image:
-  # registry: gcr.io
-  # repository: spiffe-io/oidc-discovery-provider
+  # -- The OCI registry to pull the image from
   registry: ghcr.io
+  # -- The repository within the registry
   repository: spiffe/oidc-discovery-provider
+  # -- The image pull policy
   pullPolicy: IfNotPresent
+  # -- Overrides the image tag whose default is the chart appVersion
   version: ""
 
 resources: {}
@@ -34,6 +37,10 @@ service:
   annotations: {}
     # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
 
+configMap:
+  # -- Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap
+  annotations: {}
+
 podSecurityContext: {}
   # fsGroup: 2000
 
@@ -52,8 +59,11 @@ insecureScheme:
 
   nginx:
     image:
+      # -- The OCI registry to pull the image from
       registry: docker.io
+      # -- The repository within the registry
       repository: nginxinc/nginx-unprivileged
+      # -- The image pull policy
       pullPolicy: IfNotPresent
       version: 1.23.2-alpine
       # chainguard image does not support the templates feature
@@ -75,6 +85,7 @@ insecureScheme:
       #   memory: 64Mi
 
 config:
+  # -- The log level, valid values are "debug", "info", "warn", and "error"
   logLevel: info
   domains:
     - localhost
@@ -91,11 +102,11 @@ nameOverride: ""
 fullnameOverride: ""
 
 serviceAccount:
-  # Specifies whether a service account should be created
+  # -- Specifies whether a service account should be created
   create: true
-  # Annotations to add to the service account
+  # -- Annotations to add to the service account
   annotations: {}
-  # The name of the service account to use.
+  # -- The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template
   name: ""
 
@@ -112,8 +123,9 @@ tolerations: []
 
 affinity: {}
 
+# -- Set the trust domain to be used for the SPIFFE identifiers
 trustDomain: example.org
-# -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
+# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
 clusterDomain: cluster.local
 
 telemetry:
@@ -128,8 +140,11 @@ telemetry:
 
     nginxExporter:
       image:
+        # -- The OCI registry to pull the image from
         registry: docker.io
+        # -- The repository within the registry
         repository: nginx/nginx-prometheus-exporter
+        # -- The image pull policy
         pullPolicy: IfNotPresent
         version: "0.11.0"
 
diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md
index 744e311..a0a5b4d 100644
--- a/charts/spire/charts/spire-agent/README.md
+++ b/charts/spire/charts/spire-agent/README.md
@@ -16,18 +16,19 @@ A Helm chart to install the SPIRE agent.
 |-----|------|---------|-------------|
 | bundleConfigMap | string | `"spire-bundle"` |  |
 | clusterName | string | `"example-cluster"` |  |
+| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Agent ConfigMap |
 | extraContainers | list | `[]` |  |
 | extraVolumeMounts | list | `[]` |  |
 | extraVolumes | list | `[]` |  |
 | fullnameOverride | string | `""` |  |
 | healthChecks.port | int | `9980` | override the host port used for health checking |
-| image.pullPolicy | string | `"IfNotPresent"` |  |
-| image.registry | string | `"ghcr.io"` |  |
-| image.repository | string | `"spiffe/spire-agent"` |  |
+| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
+| image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
 | image.version | string | `""` |  |
 | imagePullSecrets | list | `[]` |  |
 | initContainers | list | `[]` |  |
-| logLevel | string | `"info"` |  |
+| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
 | nameOverride | string | `""` |  |
 | namespaceOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
@@ -39,21 +40,24 @@ A Helm chart to install the SPIRE agent.
 | server.address | string | `""` |  |
 | server.namespaceOverride | string | `""` |  |
 | server.port | int | `8081` |  |
-| serviceAccount.annotations | object | `{}` |  |
-| serviceAccount.create | bool | `true` |  |
-| serviceAccount.name | string | `""` |  |
-| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` |  |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
 | telemetry.prometheus.enabled | bool | `false` |  |
 | telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
 | telemetry.prometheus.podMonitor.labels | object | `{}` |  |
 | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent |
 | telemetry.prometheus.port | int | `9988` |  |
-| trustDomain | string | `"example.org"` |  |
-| waitForIt.image.pullPolicy | string | `"IfNotPresent"` |  |
-| waitForIt.image.registry | string | `"cgr.dev"` |  |
-| waitForIt.image.repository | string | `"chainguard/wait-for-it"` |  |
+| trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" |
+| trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap |
+| trustDomain | string | `"example.org"` | The trust domain to be used for the SPIFFE identifiers |
+| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| waitForIt.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
+| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | The repository within the registry |
 | waitForIt.image.version | string | `"latest-20230113"` |  |
 | waitForIt.resources | object | `{}` |  |
+| workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
 | workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
 
 ----------------------------------------------
diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl
index ff43724..4fa7ee7 100644
--- a/charts/spire/charts/spire-agent/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl
@@ -90,18 +90,6 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spire-agent.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spire-agent.server-address" }}
 {{- if .Values.server.address }}
 {{- .Values.server.address }}
@@ -114,26 +102,3 @@ Create the name of the service account to use
 {{- print .Values.socketPath }}
 {{- end }}
 
-{{- define "spire-agent.cluster-name" }}
-{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
-{{- .Values.global.spire.clusterName }}
-{{- else }}
-{{- .Values.clusterName }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-agent.trust-domain" }}
-{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
-{{- .Values.global.spire.trustDomain }}
-{{- else }}
-{{- .Values.trustDomain }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-agent.bundle-configmap" }}
-{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
-{{- .Values.global.spire.bundleConfigMap }}
-{{- else }}
-{{- .Values.bundleConfigMap }}
-{{- end }}
-{{- end }}
diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml
index 900f526..aa545fc 100644
--- a/charts/spire/charts/spire-agent/templates/configmap.yaml
+++ b/charts/spire/charts/spire-agent/templates/configmap.yaml
@@ -1,62 +1,64 @@
+{{- define "spire-agent.yaml-config" -}}
+agent:
+  data_dir: "/run/spire"
+  log_level: {{ .Values.logLevel | quote }}
+  server_address: {{ include "spire-agent.server-address" . | trim | quote }}
+  server_port: {{ .Values.server.port | quote }}
+  socket_path: {{ include "spire-agent.socket-path" . | quote }}
+  {{- if ne (len .Values.trustBundleURL) 0 }}
+  trust_bundle_url: {{ .Values.trustBundleURL | quote }}
+  trust_bundle_format: {{ .Values.trustBundleFormat | quote }}
+  {{- else }}
+  trust_bundle_path: "/run/spire/bundle/bundle.crt"
+  {{- end }}
+  trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
+
+plugins:
+  NodeAttestor:
+    - k8s_psat:
+        plugin_data:
+          cluster: {{ include "spire-lib.cluster-name" . | quote }}
+
+  KeyManager:
+    - memory:
+        plugin_data:
+
+  WorkloadAttestor:
+    - k8s:
+        plugin_data:
+          # Defaults to the secure kubelet port by default.
+          # Minikube does not have a cert in the cluster CA bundle that
+          # can authenticate the kubelet cert, so skip validation.
+          skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
+
+  {{- if .Values.workloadAttestors.unix.enabled }}
+    - unix:
+        plugin_data:
+  {{- end }}
+
+health_checks:
+  listener_enabled: true
+  bind_address: "0.0.0.0"
+  bind_port: {{ .Values.healthChecks.port | quote }}
+  live_path: "/live"
+  ready_path: "/ready"
+
+{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
+telemetry:
+  - Prometheus:
+      - host: "0.0.0.0"
+        port: {{ .Values.telemetry.prometheus.port }}
+{{- end }}
+{{- end }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "spire-agent.fullname" . }}
   namespace: {{ include "spire-agent.namespace" . }}
+  {{- with .Values.configMap.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   agent.conf: |
-    agent {
-      data_dir = "/run/spire"
-      log_level = {{ .Values.logLevel | quote }}
-      server_address = {{ include "spire-agent.server-address" . | trim | quote }}
-      server_port = {{ .Values.server.port | quote }}
-      socket_path = {{ include "spire-agent.socket-path" . | quote }}
-      trust_bundle_path = "/run/spire/bundle/bundle.crt"
-      trust_domain = {{ include "spire-agent.trust-domain" . | quote }}
-    }
-
-    plugins {
-      NodeAttestor "k8s_psat" {
-        plugin_data {
-          cluster = {{ include "spire-agent.cluster-name" . | quote }}
-        }
-      }
-
-      KeyManager "memory" {
-        plugin_data {
-        }
-      }
-
-      WorkloadAttestor "k8s" {
-        plugin_data {
-          # Defaults to the secure kubelet port by default.
-          # Minikube does not have a cert in the cluster CA bundle that
-          # can authenticate the kubelet cert, so skip validation.
-          skip_kubelet_verification = true
-        }
-      }
-
-      {{- if .Values.workloadAttestors.unix.enabled }}
-      WorkloadAttestor "unix" {
-          plugin_data {
-          }
-      }
-      {{- end }}
-    }
-
-    health_checks {
-      listener_enabled = true
-      bind_address = "0.0.0.0"
-      bind_port = {{ .Values.healthChecks.port | quote }}
-      live_path = "/live"
-      ready_path = "/ready"
-    }
-
-    {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
-    telemetry {
-      Prometheus {
-        host = "0.0.0.0"
-        port = {{ .Values.telemetry.prometheus.port }}
-      }
-    }
-    {{- end }}
+    {{- include "spire-agent.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}
diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml
index 10c2603..eafbad1 100644
--- a/charts/spire/charts/spire-agent/templates/daemonset.yaml
+++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml
@@ -38,7 +38,7 @@ spec:
           # This is a small image with wait-for-it, choose whatever image
           # you prefer that waits for a service to be up. This image is built
           # from https://github.com/vishnubob/wait-for-it
-          image: {{ template "spire-agent.image" .Values.waitForIt }}
+          image: {{ template "spire-lib.image" (dict "image" .Values.waitForIt.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
           args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}]
           resources:
@@ -48,7 +48,7 @@ spec:
         {{- end }}
       containers:
         - name: {{ .Chart.Name }}
-          image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args: ["-config", "/run/spire/config/agent.conf"]
           ports:
@@ -62,9 +62,11 @@ spec:
             - name: spire-config
               mountPath: /run/spire/config
               readOnly: true
+            {{- if eq (len .Values.trustBundleURL) 0 }}
             - name: spire-bundle
               mountPath: /run/spire/bundle
               readOnly: true
+            {{- end }}
             - name: spire-agent-socket-dir
               mountPath: {{ include "spire-agent.socket-path" . | dir }}
               readOnly: false
@@ -98,9 +100,11 @@ spec:
         - name: spire-config
           configMap:
             name: {{ include "spire-agent.fullname" . }}
+        {{- if eq (len .Values.trustBundleURL) 0 }}
         - name: spire-bundle
           configMap:
-            name: {{ include "spire-agent.bundle-configmap" . }}
+            name: {{ include "spire-lib.bundle-configmap" . }}
+        {{- end }}
         - name: spire-token
           projected:
             sources:
diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml
index e5bca41..2a1f9d1 100644
--- a/charts/spire/charts/spire-agent/values.yaml
+++ b/charts/spire/charts/spire-agent/values.yaml
@@ -3,10 +3,11 @@
 # Declare variables to be passed into your templates.
 
 image:
-  # registry: gcr.io
-  # repository: spiffe-io/spire-agent
+  # -- The OCI registry to pull the image from
   registry: ghcr.io
+  # -- The repository within the registry
   repository: spiffe/spire-agent
+  # -- The image pull policy
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
   version: ""
@@ -17,14 +18,18 @@ namespaceOverride: ""
 fullnameOverride: ""
 
 serviceAccount:
-  # Specifies whether a service account should be created
+  # -- Specifies whether a service account should be created
   create: true
-  # Annotations to add to the service account
+  # -- Annotations to add to the service account
   annotations: {}
-  # The name of the service account to use.
+  # -- The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template
   name: ""
 
+configMap:
+  # -- Annotations to add to the SPIRE Agent ConfigMap
+  annotations: {}
+
 podAnnotations: {}
 
 podSecurityContext: {}
@@ -52,10 +57,16 @@ resources: {}
 
 nodeSelector: {}
 
+# -- The log level, valid values are "debug", "info", "warn", and "error"
 logLevel: info
+# -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
 clusterName: example-cluster
+# -- The trust domain to be used for the SPIFFE identifiers
 trustDomain: example.org
-
+# -- If set, obtain trust bundle from url instead of Kubernetes ConfigMap
+trustBundleURL: ""
+# -- If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"
+trustBundleFormat: pem
 bundleConfigMap: spire-bundle
 
 server:
@@ -69,8 +80,11 @@ healthChecks:
 
 waitForIt:
   image:
+    # -- The OCI registry to pull the image from
     registry: cgr.dev
+    # -- The repository within the registry
     repository: chainguard/wait-for-it
+    # -- The image pull policy
     pullPolicy: IfNotPresent
     version: latest-20230113
   resources: {}
@@ -81,6 +95,9 @@ workloadAttestors:
   unix:
     # -- enables the Unix workload attestor
     enabled: false
+  k8s:
+    # -- If true, kubelet certificate verification is skipped
+    skipKubeletVerification: true
 
 telemetry:
   prometheus:
@@ -92,6 +109,7 @@ telemetry:
       namespace: ""
       labels: {}
 
+# -- The unix socket path to the spire-agent
 socketPath: /run/spire/agent-sockets/spire-agent.sock
 
 # -- Priority class assigned to daemonset pods
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 9d8e2f1..efc2ba5 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -30,6 +30,8 @@ A Helm chart to install the SPIRE server.
 | ca_subject.organization | string | `"Example"` |  |
 | clusterDomain | string | `"cluster.local"` |  |
 | clusterName | string | `"example-cluster"` |  |
+| configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap |
+| controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap |
 | controllerManager.enabled | bool | `false` |  |
 | controllerManager.identities.dnsNameTemplates | list | `[]` |  |
 | controllerManager.identities.enabled | bool | `true` |  |
@@ -39,9 +41,9 @@ A Helm chart to install the SPIRE server.
 | controllerManager.ignoreNamespaces[0] | string | `"kube-system"` |  |
 | controllerManager.ignoreNamespaces[1] | string | `"kube-public"` |  |
 | controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` |  |
-| controllerManager.image.pullPolicy | string | `"IfNotPresent"` |  |
-| controllerManager.image.registry | string | `"ghcr.io"` |  |
-| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` |  |
+| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| controllerManager.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
+| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
 | controllerManager.image.version | string | `"0.2.2"` |  |
 | controllerManager.resources | object | `{}` |  |
 | controllerManager.securityContext | object | `{}` |  |
@@ -49,14 +51,18 @@ A Helm chart to install the SPIRE server.
 | controllerManager.service.port | int | `443` |  |
 | controllerManager.service.type | string | `"ClusterIP"` |  |
 | controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` |  |
-| controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` |  |
-| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` |  |
-| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` |  |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | The OCI registry to pull the image from |
+| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | The repository within the registry |
 | controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` |  |
-| dataStorage.accessMode | string | `"ReadWriteOnce"` |  |
-| dataStorage.enabled | bool | `true` |  |
-| dataStorage.size | string | `"1Gi"` |  |
-| dataStorage.storageClass | string | `nil` |  |
+| dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
+| dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
+| dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
+| dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" |
+| dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" |
+| dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section |
+| dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. |
+| dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" |
 | defaultJwtSvidTTL | string | `"1h"` |  |
 | defaultX509SvidTTL | string | `"4h"` |  |
 | extraContainers | list | `[]` |  |
@@ -66,20 +72,23 @@ A Helm chart to install the SPIRE server.
 | federation.bundleEndpoint.port | int | `8443` |  |
 | federation.enabled | bool | `false` |  |
 | fullnameOverride | string | `""` |  |
-| image.pullPolicy | string | `"IfNotPresent"` |  |
-| image.registry | string | `"ghcr.io"` |  |
-| image.repository | string | `"spiffe/spire-server"` |  |
+| image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
+| image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
+| image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
 | image.version | string | `""` |  |
 | imagePullSecrets | list | `[]` |  |
 | initContainers | list | `[]` |  |
-| jwtIssuer | string | `"oidc-discovery.example.org"` |  |
-| logLevel | string | `"info"` |  |
+| jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
+| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
 | nameOverride | string | `""` |  |
 | namespaceOverride | string | `""` |  |
 | nodeAttestor.k8sPsat.enabled | bool | `true` |  |
 | nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` |  |
 | nodeSelector | object | `{}` |  |
 | notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
+| persistence.accessMode | string | `"ReadWriteOnce"` |  |
+| persistence.size | string | `"1Gi"` |  |
+| persistence.storageClass | string | `nil` |  |
 | podAnnotations | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |
 | replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
@@ -88,16 +97,16 @@ A Helm chart to install the SPIRE server.
 | service.annotations | object | `{}` |  |
 | service.port | int | `8081` |  |
 | service.type | string | `"ClusterIP"` |  |
-| serviceAccount.annotations | object | `{}` |  |
-| serviceAccount.create | bool | `true` |  |
-| serviceAccount.name | string | `""` |  |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
 | telemetry.prometheus.enabled | bool | `false` |  |
 | telemetry.prometheus.podMonitor.enabled | bool | `false` |  |
 | telemetry.prometheus.podMonitor.labels | object | `{}` |  |
 | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
-| trustDomain | string | `"example.org"` |  |
+| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
 | upstreamAuthority.certManager.enabled | bool | `false` |  |
 | upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
 | upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` |  |
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 809aeb3..3fcff92 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -82,18 +82,6 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spire-server.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spire-server.upstream-ca-secret" -}}
 {{- $root := . }}
 {{- with .Values.upstreamAuthority.disk -}}
@@ -117,34 +105,51 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spire-server.cluster-name" }}
-{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
-{{- .Values.global.spire.clusterName }}
-{{- else }}
-{{- .Values.clusterName }}
+{{- define "spire-server.config-mysql-query" }}
+{{- $lst := list }}
+{{- range . }}
+{{- range $key, $value := . }}
+{{- $eValue := toString $value }}
+{{- $entry := printf "%s=%s" (urlquery $key) (urlquery $eValue) }}
+{{- $lst = append $lst $entry }}
+{{- end }}
+{{- end }}
+{{- if gt (len $lst) 0 }}
+{{- printf "?%s" (join "&" $lst) }}
 {{- end }}
 {{- end }}
 
-{{- define "spire-server.trust-domain" }}
-{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
-{{- .Values.global.spire.trustDomain }}
-{{- else }}
-{{- .Values.trustDomain }}
+{{- define "spire-server.config-postgresql-options" }}
+{{- $lst := list }}
+{{- range . }}
+{{- range $key, $value := . }}
+{{- $eValue := toString $value }}
+{{- $entry := printf "%s=%s" $key $eValue }}
+{{- $lst = append $lst $entry }}
+{{- end }}
+{{- end }}
+{{- if gt (len $lst) 0 }}
+{{- printf " %s" (join " " $lst) }}
 {{- end }}
 {{- end }}
 
-{{- define "spire-server.bundle-configmap" }}
-{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
-{{- .Values.global.spire.bundleConfigMap }}
+{{- define "spire-server.datastore-config" }}
+{{- $config := deepCopy .Values.dataStore.sql.plugin_data }}
+{{- if eq .Values.dataStore.sql.databaseType "sqlite3" }}
+  {{- $_ := set $config "database_type" "sqlite3" }}
+  {{- $_ := set $config "connection_string" "/run/spire/data/datastore.sqlite3" }}
+{{- else if eq .Values.dataStore.sql.databaseType "mysql" }}
+  {{- $_ := set $config "database_type" "mysql" }}
+  {{- $port := int .Values.dataStore.sql.port | default 3306 }}
+  {{- $query := include "spire-server.config-mysql-query" .Values.dataStore.sql.options }}
+  {{- $_ := set $config "connection_string" (printf "%s:${DBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.username .Values.dataStore.sql.host $port .Values.dataStore.sql.databaseName $query) }}
+{{- else if eq .Values.dataStore.sql.databaseType "postgres" }}
+  {{- $_ := set $config "database_type" "postgres" }}
+  {{- $port := int .Values.dataStore.sql.port | default 5432 }}
+  {{- $options:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.options }}
+  {{- $_ := set $config "connection_string" (printf "dbname=%s user=%s password=${DBPW} host=%s port=%d%s" .Values.dataStore.sql.databaseName .Values.dataStore.sql.username .Values.dataStore.sql.host $port $options) }}
 {{- else }}
-{{- .Values.bundleConfigMap }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-server.cluster-domain" -}}
-{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
-{{- .Values.global.k8s.clusterDomain }}
-{{- else }}
-{{- .Values.clusterDomain }}
+  {{- fail "Unsupported database type" }}
 {{- end }}
+{{- $config | toYaml }}
 {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml
index bbc2fb5..ea4224e 100644
--- a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml
@@ -2,5 +2,5 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "spire-server.bundle-configmap" . }}
+  name: {{ include "spire-lib.bundle-configmap" . }}
   namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index d1143f5..6b2ff71 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -1,126 +1,113 @@
+{{- define "spire-server.yaml-config" -}}
 {{- $root := . }}
-{{- $namespace := include "spire-server.namespace" . }}
+server:
+  bind_address: "0.0.0.0"
+  bind_port: "8081"
+  trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
+  data_dir: "/run/spire/data"
+  log_level: {{ .Values.logLevel | quote }}
+  jwt_issuer: {{ .Values.jwtIssuer | quote }}
+
+  ca_key_type: {{ .Values.caKeyType | quote }}
+  ca_ttl: {{ .Values.caTTL | quote }}
+
+  default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }}
+  default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}
+
+  ca_subject:
+    {{- with .Values.ca_subject }}
+    - country: [{{ .country | quote }}]
+      organization: [{{ .organization | quote }}]
+      common_name: {{ .common_name | quote }}
+    {{- end }}
+
+  {{- with .Values.federation }}
+  {{- if eq (.enabled | toString) "true" }}
+  federation:
+    bundle_endpoint:
+      - {{ .bundleEndpoint | toYaml | nindent 8 }}
+  {{- end }}
+  {{- end }}
+
+plugins:
+  DataStore:
+    - sql:
+        plugin_data:
+          {{ include "spire-server.datastore-config" . | nindent 10 }}
+
+  {{- with .Values.nodeAttestor.k8sPsat }}
+  {{- if eq (.enabled | toString) "true" }}
+  NodeAttestor:
+    - k8s_psat:
+        plugin_data:
+          clusters:
+            {{ include "spire-lib.cluster-name" $root }}:
+              service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
+  {{- end }}
+  {{- end }}
+
+  KeyManager:
+    - disk:
+        plugin_data:
+          keys_path: "/run/spire/data/keys.json"
+
+  Notifier:
+    - k8sbundle:
+        plugin_data:
+          namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
+          config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
+
+  {{- with .Values.upstreamAuthority.disk }}
+  {{- if eq (.enabled | toString) "true" }}
+  UpstreamAuthority:
+    - disk:
+        plugin_data:
+          cert_file_path: "/run/spire/upstream_ca/tls.crt"
+          key_file_path: "/run/spire/upstream_ca/tls.key"
+          {{- if ne .secret.data.bundle "" }}
+          bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
+          {{- end }}
+  {{- end }}
+  {{- end }}
+
+  {{- with .Values.upstreamAuthority.certManager }}
+  {{- if eq (.enabled | toString) "true" }}
+  UpstreamAuthority:
+    - cert-manager:
+        plugin_data:
+          issuer_name: {{ .issuer_name | quote }}
+          issuer_kind: {{ .issuer_kind | quote }}
+          issuer_group: {{ .issuer_group | quote }}
+          namespace: {{ default $root.Release.Namespace .namespace | quote }}
+          {{- if ne .kube_config_file "" }}
+          kube_config_file: {{ .kube_config_file | quote }}
+          {{- end }}
+  {{- end }}
+  {{- end }}
+
+health_checks:
+  listener_enabled: true
+  bind_address: "0.0.0.0"
+  bind_port: "8080"
+  live_path: "/live"
+  ready_path: "/ready"
+
+{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
+telemetry:
+  - Prometheus:
+      - host: "0.0.0.0"
+        port: 9988
+{{- end }}
+{{- end }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "spire-server.fullname" . }}
   namespace: {{ include "spire-server.namespace" . }}
+  {{- with .Values.configMap.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   server.conf: |
-    server {
-      bind_address = "0.0.0.0"
-      bind_port = "8081"
-      trust_domain = {{ include "spire-server.trust-domain" . | quote }}
-      data_dir = "/run/spire/data"
-      log_level = {{ .Values.logLevel | quote }}
-
-      jwt_issuer = {{ .Values.jwtIssuer | quote }}
-
-      ca_key_type = {{ .Values.caKeyType | quote }}
-      ca_ttl = {{ .Values.caTTL | quote }}
-
-      default_x509_svid_ttl = {{ .Values.defaultX509SvidTTL | quote }}
-      default_jwt_svid_ttl = {{ .Values.defaultJwtSvidTTL | quote }}
-
-      ca_subject = {
-        {{- with .Values.ca_subject }}
-        country = [{{ .country | quote }}],
-        organization = [{{ .organization | quote }}],
-        common_name = {{ .common_name | quote }},
-        {{- end }}
-      }
-
-      {{- with .Values.federation }}
-      {{- if eq (.enabled | toString) "true" }}
-      federation {
-        bundle_endpoint {
-          address = "{{ .bundleEndpoint.address }}"
-          port = {{ .bundleEndpoint.port }}
-        }
-      }
-      {{- end }}
-      {{- end }}
-    }
-
-    plugins {
-      DataStore "sql" {
-        plugin_data {
-          database_type = "sqlite3"
-          connection_string = "/run/spire/data/datastore.sqlite3"
-        }
-      }
-
-      {{- with .Values.nodeAttestor.k8sPsat }}
-      {{- if eq (.enabled | toString) "true" }}
-      NodeAttestor "k8s_psat" {
-        plugin_data {
-          clusters = {
-            {{ include "spire-server.cluster-name" $root | quote }} = {
-              service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
-            }
-          }
-        }
-      }
-      {{- end }}
-      {{- end }}
-
-      KeyManager "disk" {
-        plugin_data {
-          keys_path = "/run/spire/data/keys.json"
-        }
-      }
-
-      Notifier "k8sbundle" {
-        plugin_data {
-          namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
-          config_map = {{ include "spire-server.bundle-configmap" . | quote }}
-        }
-      }
-
-      {{- with .Values.upstreamAuthority.disk }}
-      {{- if eq (.enabled | toString) "true" }}
-      UpstreamAuthority "disk" {
-        plugin_data {
-          cert_file_path = "/run/spire/upstream_ca/tls.crt"
-          key_file_path = "/run/spire/upstream_ca/tls.key"
-          {{- if ne .secret.data.bundle "" }}
-          bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
-          {{- end }}
-        }
-      }
-      {{- end }}
-      {{- end }}
-
-      {{- with .Values.upstreamAuthority.certManager }}
-      {{- if eq (.enabled | toString) "true" }}
-      UpstreamAuthority "cert-manager" {
-        plugin_data {
-          issuer_name = {{ .issuer_name | quote }}
-          issuer_kind = {{ .issuer_kind | quote }}
-          issuer_group = {{ .issuer_group | quote }}
-          namespace = {{ default $root.Release.Namespace .namespace | quote }}
-          {{- if ne .kube_config_file "" }}
-          kube_config_file = {{ .kube_config_file | quote }}
-          {{- end }}
-        }
-      }
-      {{- end }}
-      {{- end }}
-    }
-
-    health_checks {
-      listener_enabled = true
-      bind_address = "0.0.0.0"
-      bind_port = "8080"
-      live_path = "/live"
-      ready_path = "/ready"
-    }
-
-    {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
-    telemetry {
-      Prometheus {
-        host = "0.0.0.0"
-        port = 9988
-      }
-    }
-    {{- end }}
+    {{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}
diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
index 0509a56..7184ff0 100644
--- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
@@ -4,6 +4,10 @@ kind: ConfigMap
 metadata:
   name: {{ include "spire-controller-manager.fullname" . }}
   namespace: {{ include "spire-server.namespace" . }}
+  {{- with .Values.controllerManager.configMap.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   controller-manager-config.yaml: |
     apiVersion: spire.spiffe.io/v1alpha1
@@ -22,8 +26,8 @@ data:
       resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
       resourceNamespace: {{ include "spire-server.namespace" . }}
     validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
-    clusterName: {{ include "spire-server.cluster-name" . }}
-    trustDomain: {{ include "spire-server.trust-domain" . }}
+    clusterName: {{ include "spire-lib.cluster-name" . }}
+    trustDomain: {{ include "spire-lib.trust-domain" . }}
     ignoreNamespaces:
       {{- with .Values.controllerManager.ignoreNamespaces }}
       {{- toYaml . | nindent 6 }}
diff --git a/charts/spire/charts/spire-server/templates/hpa.yaml b/charts/spire/charts/spire-server/templates/hpa.yaml
index b68f878..921abf6 100644
--- a/charts/spire/charts/spire-server/templates/hpa.yaml
+++ b/charts/spire/charts/spire-server/templates/hpa.yaml
@@ -12,6 +12,9 @@ spec:
     kind: Deployment
     name: {{ include "spire-server.fullname" . }}
   minReplicas: {{ .Values.autoscaling.minReplicas }}
+  {{- if and (eq .Values.dataStore.sql.databaseType "sqlite3") .Values.autoscaling.enabled (gt (int .Values.autoscaling.maxReplicas) 1) }}
+  {{- fail "When running with sqlite3 database, you can't scale up to more then one instance. 'autoscaling.maxReplicas' MUST be 1" }}
+  {{- end }}
   maxReplicas: {{ .Values.autoscaling.maxReplicas }}
   metrics:
     {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
index 1279198..37fd2a8 100644
--- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
@@ -63,7 +63,7 @@ spec:
       - name: post-install-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
         command:
         - /bin/sh
         - -c
diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
index db0129a..f73e9f2 100644
--- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
@@ -63,7 +63,7 @@ spec:
       - name: post-upgrade-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
         command:
         - /bin/sh
         - -c
diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
index e07f9d9..d2445bc 100644
--- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
@@ -63,7 +63,7 @@ spec:
       - name: post-install-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
         command:
         - /bin/sh
         - -c
diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml
index 7bd8b1c..f1bf0fa 100644
--- a/charts/spire/charts/spire-server/templates/roles.yaml
+++ b/charts/spire/charts/spire-server/templates/roles.yaml
@@ -8,7 +8,7 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: [configmaps]
-    resourceNames: [{{ include "spire-server.bundle-configmap" . }}]
+    resourceNames: [{{ include "spire-lib.bundle-configmap" . }}]
     verbs:
       - get
       - patch
diff --git a/charts/spire/charts/spire-server/templates/secret.yaml b/charts/spire/charts/spire-server/templates/secret.yaml
new file mode 100644
index 0000000..fe06f7e
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/secret.yaml
@@ -0,0 +1,9 @@
+{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "spire-server.fullname" . }}-dbpw
+  namespace: {{ include "spire-server.namespace" . }}
+data:
+  DBPW: {{ .Values.dataStore.sql.password | b64enc }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml
index 5cdaf50..1e57a07 100644
--- a/charts/spire/charts/spire-server/templates/service.yaml
+++ b/charts/spire/charts/spire-server/templates/service.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: {{ include "spire-server.namespace" . }}
   {{- with .Values.service.annotations }}
   annotations:
-    {{- toYaml . | nindent 8 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
   labels:
     {{- include "spire-server.labels" . | nindent 4 }}
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index 2773bf6..f9e6262 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -1,5 +1,6 @@
 {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
-{{- $configSum2 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
+{{- $configSum2 := (include (print $.Template.BasePath "/secret.yaml") . | sha256sum) }}
+{{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
 {{- $fullname := include "spire-server.fullname" . }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -10,6 +11,9 @@ metadata:
     {{- include "spire-server.labels" . | nindent 4 }}
 spec:
   {{- if not .Values.autoscaling.enabled }}
+  {{- if and (eq .Values.dataStore.sql.databaseType "sqlite3") (gt (int .Values.replicaCount) 1) }}
+  {{- fail "When running with sqlite3 database, you can't scale up to more then one instance. 'replicaCount' MUST be 1" }}
+  {{- end }}
   replicas: {{ .Values.replicaCount }}
   {{- end }}
   serviceName: {{ include "spire-server.fullname" . }}
@@ -21,6 +25,7 @@ spec:
       annotations:
         checksum/config: {{ $configSum }}
         checksum/config2: {{ $configSum2 }}
+        checksum/config3: {{ $configSum3 }}
         {{- with .Values.podAnnotations }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
@@ -43,14 +48,22 @@ spec:
         - name: {{ .Chart.Name }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
+            - -expandEnv
             - -config
             - /run/spire/config/server.conf
           env:
           - name: PATH
             value: "/opt/spire/bin:/bin"
+          {{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
+          - name: DBPW
+            valueFrom:
+              secretKeyRef:
+                name: {{ $fullname }}-dbpw
+                key: DBPW
+          {{- end }}
           ports:
             - name: grpc
               containerPort: 8081
@@ -91,11 +104,9 @@ spec:
             - name: spire-config
               mountPath: /run/spire/config
               readOnly: true
-            {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
             - name: spire-data
               mountPath: /run/spire/data
               readOnly: false
-            {{- end }}
             {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
             - name: upstream-ca
               mountPath: /run/spire/upstream_ca
@@ -108,7 +119,7 @@ spec:
         - name: spire-controller-manager
           securityContext:
             {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
-          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
           args:
             - --config=controller-manager-config.yaml
@@ -185,16 +196,14 @@ spec:
         {{- toYaml .Values.extraVolumes | nindent 8 }}
         {{- end }}
   volumeClaimTemplates:
-    {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
     - metadata:
         name: spire-data
       spec:
         accessModes:
-          - {{ .Values.dataStorage.accessMode | default "ReadWriteOnce" }}
+          - {{ .Values.persistence.accessMode | default "ReadWriteOnce" }}
         resources:
           requests:
-            storage: {{ .Values.dataStorage.size }}
-        {{- if .Values.dataStorage.storageClass }}
-        storageClassName: {{ .Values.dataStorage.storageClass }}
+            storage: {{ .Values.persistence.size }}
+        {{- if .Values.persistence.storageClass }}
+        storageClassName: {{ .Values.persistence.storageClass }}
         {{- end }}
-    {{ end }}
diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
index ce49605..7674197 100644
--- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml
@@ -33,7 +33,7 @@ spec:
     - name: curl-federation-bundle-endpoint
       image: cgr.dev/chainguard/bash:latest
       command: ['curl']
-      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-server.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
+      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 4206c66..2d31c5c 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -6,10 +6,11 @@
 replicaCount: 1
 
 image:
-  # registry: gcr.io
-  # repository: spiffe-io/spire-server
+  # -- The OCI registry to pull the image from
   registry: ghcr.io
+  # -- The repository within the registry
   repository: spiffe/spire-server
+  # -- The image pull policy
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
   version: ""
@@ -20,11 +21,11 @@ namespaceOverride: ""
 fullnameOverride: ""
 
 serviceAccount:
-  # Specifies whether a service account should be created
+  # -- Specifies whether a service account should be created
   create: true
-  # Annotations to add to the service account
+  # -- Annotations to add to the service account
   annotations: {}
-  # The name of the service account to use.
+  # -- The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template
   name: ""
 
@@ -46,6 +47,10 @@ service:
   port: 8081
   annotations: {}
 
+configMap:
+  # -- Annotations to add to the SPIRE Server ConfigMap
+  annotations: {}
+
 resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious
   # choice for the user. This also increases chances charts run on environments with little
@@ -73,16 +78,39 @@ affinity: {}
 
 topologySpreadConstraints: []
 
-dataStorage:
-  enabled: true
+persistence:
   size: 1Gi
   accessMode: ReadWriteOnce
   storageClass: null
 
+dataStore:
+  sql:
+    # -- Other supported databases are "postgres" and "mysql"
+    databaseType: sqlite3
+    # -- Only used by "postgres" or "mysql"
+    databaseName: spire
+    # -- Only used by "postgres" or "mysql"
+    host: ""
+    # -- If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
+    port: 0
+    # -- Only used by "postgres" or "mysql"
+    username: spire
+    # -- Only used by "postgres" or "mysql"
+    password: ""
+    # -- Only used by "postgres" or "mysql"
+    options: []
+
+    # -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
+    plugin_data: {}
+
+# -- The log level, valid values are "debug", "info", "warn", and "error"
 logLevel: info
+# -- The JWT issuer domain
 jwtIssuer: oidc-discovery.example.org
 
+# -- Set the name of the Kubernetes cluster. (`kubeadm init --service-dns-domain`)
 clusterName: example-cluster
+# -- Set the trust domain to be used for the SPIFFE identifiers
 trustDomain: example.org
 
 bundleConfigMap: spire-bundle
@@ -134,8 +162,11 @@ controllerManager:
   enabled: false
 
   image:
+    # -- The OCI registry to pull the image from
     registry: ghcr.io
+    # -- The repository within the registry
     repository: spiffe/spire-controller-manager
+    # -- The image pull policy
     pullPolicy: IfNotPresent
     # Overrides the image tag whose default is the chart appVersion.
     version: "0.2.2"
@@ -165,6 +196,10 @@ controllerManager:
     port: 443
     annotations: {}
 
+  configMap:
+    # -- Annotations to add to the Controller Manager ConfigMap
+    annotations: {}
+
   ignoreNamespaces:
     - kube-system
     - kube-public
@@ -187,8 +222,11 @@ controllerManager:
     failurePolicy: Fail
     upgradeHook:
       image:
+        # -- The OCI registry to pull the image from
         registry: cgr.dev
+        # -- The repository within the registry
         repository: chainguard/kubectl
+        # -- The image pull policy
         pullPolicy: IfNotPresent
         version: latest
 
diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl
deleted file mode 100644
index 50fe6eb..0000000
--- a/charts/spire/templates/_helpers.tpl
+++ /dev/null
@@ -1,35 +0,0 @@
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "spire.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "spire.fullname" -}}
-{{- if .Values.fullnameOverride }}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride }}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "spire.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "spire.server-socket-path" -}}
-{{- print "/run/spire/server-sockets/spire-server.sock" }}
-{{- end }}
diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl
new file mode 100644
index 0000000..4c0c492
--- /dev/null
+++ b/charts/spire/templates/_spire-lib.tpl
@@ -0,0 +1,52 @@
+{{- define "spire-lib.cluster-name" }}
+{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
+{{- .Values.global.spire.clusterName }}
+{{- else }}
+{{- .Values.clusterName }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.trust-domain" }}
+{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
+{{- .Values.global.spire.trustDomain }}
+{{- else }}
+{{- .Values.trustDomain }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.bundle-configmap" }}
+{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
+{{- .Values.global.spire.bundleConfigMap }}
+{{- else }}
+{{- .Values.bundleConfigMap }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.cluster-domain" -}}
+{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
+{{- .Values.global.k8s.clusterDomain }}
+{{- else }}
+{{- .Values.clusterDomain }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.registry" }}
+{{- if ne (len (dig "spire" "image" "registry" "" .global)) 0 }}
+{{- .global.spire.image.registry }}
+{{- else }}
+{{- .image.registry }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.image" -}}
+{{- $registry := include "spire-lib.registry" . }}
+{{- if eq (substr 0 7 .image.version) "sha256:" -}}
+{{- printf "%s/%s@%s" $registry .image.repository .image.version -}}
+{{- else if .appVersion -}}
+{{- printf "%s/%s:%s" $registry .image.repository (default .appVersion .image.version) -}}
+{{- else if .image.version -}}
+{{- printf "%s/%s:%s" $registry .image.repository .image.version -}}
+{{- else -}}
+{{- printf "%s/%s" $registry .image.repository -}}
+{{- end -}}
+{{- end }}
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index 316741b..76ca445 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -4,13 +4,17 @@ global:
     # -- This is the value of your clusters `kubeadm init --service-dns-domain` flag
     clusterDomain: cluster.local
   spire:
-    # -- Set the name of the Kubernetes cluster
+    # -- The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
     clusterName: example-cluster
-    # -- Set the trust domain to use for the spiffe identifiers
+    # -- The trust domain to be used for the SPIFFE identifiers
     trustDomain: example.org
     # -- Override all instances of bundleConfigMap
     bundleConfigMap: ""
 
+    image:
+      # -- Override all Spire image registries at once
+      registry: ""
+
 #  telemetry:
 #    prometheus:
 #      enabled: true
@@ -20,9 +24,6 @@ global:
 #        namespace: "kube-prometheus-system"
 #        labels: {}
 
-nameOverride: ""
-fullnameOverride: ""
-
 # subcharts
 spire-server:
   enabled: true
diff --git a/examples/bin/readpw.sh b/examples/bin/readpw.sh
new file mode 100644
index 0000000..ac77d90
--- /dev/null
+++ b/examples/bin/readpw.sh
@@ -0,0 +1,3 @@
+# shellcheck shell=bash disable=SC2034
+read -s -r -p "Please enter your database password: " DBPW
+echo
diff --git a/examples/external-mysql/README.md b/examples/external-mysql/README.md
new file mode 100644
index 0000000..f9afb3e
--- /dev/null
+++ b/examples/external-mysql/README.md
@@ -0,0 +1,22 @@
+# Example external mysql
+
+We recommend you put your config into git, but never put a password directly into git. Generally the easiest way to do so is via
+environment variable. Your CI/CD system of choice usually allows you to set those. Please refer to your systems documentation for
+guidance.
+
+If manually deploying for testing, you can safely put the password into an environment variable by running:
+
+```bash
+source ../bin/readpw.sh
+```
+
+Next, edit values.yaml with your settings. Check it into your git repo if using one.
+
+Then, deploy the chart pointing at your mysql instance like so:
+
+```shell
+helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
+```
+
+See the [production example](../production) for production recommendations.
+See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
diff --git a/examples/external-mysql/values.yaml b/examples/external-mysql/values.yaml
new file mode 100644
index 0000000..b332156
--- /dev/null
+++ b/examples/external-mysql/values.yaml
@@ -0,0 +1,10 @@
+spire-server:
+  dataStore:
+    sql:
+      databaseType: mysql
+      databaseName: spire
+      host: mysql
+      port: 3306
+      username: spire
+      options:
+        - parseTime: true
diff --git a/examples/external-postgresql/README.md b/examples/external-postgresql/README.md
new file mode 100644
index 0000000..21fd1df
--- /dev/null
+++ b/examples/external-postgresql/README.md
@@ -0,0 +1,23 @@
+# Example external postgresql
+
+We recommend you put your config into git, but never put a password directly into git. Generally the easiest way to do so is via
+environment variable. Your CI/CD system of choice usually allows you to set those. Please refer to your systems documentation for
+guidance.
+
+If manually deploying for testing, you can safely put the password into an environment variable by running:
+
+```bash
+source ../bin/readpw.sh
+```
+
+Next, edit values.yaml with your settings. Check it into your git repo if using one.
+
+Then, deploy the chart pointing at your postgresql instance like so:
+
+```shell
+helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
+
+```
+
+See the [production example](../production) for production recommendations.
+See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
diff --git a/examples/external-postgresql/values.yaml b/examples/external-postgresql/values.yaml
new file mode 100644
index 0000000..5f1fcfa
--- /dev/null
+++ b/examples/external-postgresql/values.yaml
@@ -0,0 +1,10 @@
+spire-server:
+  dataStore:
+    sql:
+      databaseType: postgres
+      databaseName: spire
+      host: postgresql
+      port: 5432
+      username: spire
+      options:
+        - sslmode: disable
diff --git a/examples/production/README.md b/examples/production/README.md
index 4cf892c..0514ca4 100644
--- a/examples/production/README.md
+++ b/examples/production/README.md
@@ -1,6 +1,6 @@
 # Recommended production setup
 
-Too install Spire with the least privileges possible we deploy spire accross 2 namespaces.
+To install Spire with the least privileges possible we deploy spire across 2 namespaces.
 
 ```shell
 kubectl create namespace "spire-system"
diff --git a/helm-docs.sh b/helm-docs.sh
index d77d15c..6c264d7 100755
--- a/helm-docs.sh
+++ b/helm-docs.sh
@@ -6,31 +6,31 @@ SCRIPTPATH=$(dirname "$0")
 HELM_DOCS_VERSION="1.11.0"
 
 case "$(uname -s)" in
-    Linux*)
-      machine=Linux
-      shasum=sha256sum
-      exe=helm-docs
-      ;;
-    Darwin*)
-      machine=Darwin
-      shasum=shasum
-      exe=helm-docs
-      ;;
-    MINGW64*)
-      machine=Windows
-      shasum=sha256sum
-      exe=helm-docs.exe
-      ;;
+  Linux*)
+    machine=Linux
+    shasum=sha256sum
+    exe=helm-docs
+    ;;
+  Darwin*)
+    machine=Darwin
+    shasum=shasum
+    exe=helm-docs
+    ;;
+  MINGW64*)
+    machine=Windows
+    shasum=sha256sum
+    exe=helm-docs.exe
+    ;;
 esac
 
 function install_helm_docs {
-    curl -LO https://github.com/norwoodj/helm-docs/releases/download/v"${HELM_DOCS_VERSION}"/helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz
-    curl -L --output /tmp/checksums_helm-docs.txt https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt
-    grep helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz /tmp/checksums_helm-docs.txt | $shasum -c -
-    mkdir -p "$SCRIPTPATH/bin"
-    tar -xf helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz ${exe}
-    mv ${exe} "$SCRIPTPATH/bin/"
-    rm helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz
+  curl -LO "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz"
+  curl -L --output /tmp/checksums_helm-docs.txt "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt"
+  grep "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" /tmp/checksums_helm-docs.txt | $shasum -c -
+  mkdir -p "$SCRIPTPATH/bin"
+  tar -xf "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" "${exe}"
+  mv "${exe}" "$SCRIPTPATH/bin/"
+  rm "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz"
 }
 
 if [ ! -f "$SCRIPTPATH/bin/${exe}" ] ; then
@@ -42,5 +42,5 @@ else
 fi
 
 # validate docs
-"$SCRIPTPATH/bin/${exe}"
+"$SCRIPTPATH/bin/${exe}" --document-dependency-values
 git diff --exit-code
diff --git a/project/glossary.md b/project/glossary.md
new file mode 100644
index 0000000..5f54f47
--- /dev/null
+++ b/project/glossary.md
@@ -0,0 +1,46 @@
+<!-- vim: ft=markdown colorcolumn=72
+-->
+# Glossary
+
+This glossary is a dictionary of terms defined as they are used by the
+spire/helm-charts project.  Writing the definitions of terms here helps
+to keep other documents concise and precise.  Documenting terminology
+here helps prevent misundersandings, facilitating easy onboarding of new
+team members.
+
+**Deployment**
+: A use of the Helm Charts to describe a single SPIRE cluster.
+
+**Deployment Type**
+: One of three supported deployments of the charts: Standalone, 
+Primary, or Secondary.
+
+**Federation**
+: When one cluster is configured to trust elements of another cluster
+containing a different trust domain.
+
+**Federated Deployment**
+: A Primary Deployment or Standalone Deployment that is configured
+to federate with one or more Deployments.
+
+**Primary Deployment**
+: A deployment of the Helm Charts where the cluster's purpose is to
+provide certificates to Secondary Deployments.
+
+**Secondary Deployment**
+: A deployment of the Helm Charts where the cluster obtains an
+intermediate CA from a Primary Deployment and uses it to service
+Workload Identity requests.
+
+**Standalone Deployment**
+: A deployment of the Helm Charts where the cluster both manages the CA
+and services Workload Identity requests in the same cluster.
+
+**Tiered Deployment**
+: Use of the Helm Charts two or more times, such that one chart is
+configured as a Primary Deployment Type and the others are configured as
+Secondary Deployment Types.
+
+**Trust Domain**
+: The host field of a SPIFFE ID, naming a minimum footprint of a trust
+bundle's distribution.
diff --git a/project/overview.md b/project/overview.md
new file mode 100644
index 0000000..8e0e176
--- /dev/null
+++ b/project/overview.md
@@ -0,0 +1,51 @@
+<!-- vim: ft=markdown colorcolumn=72
+-->
+# Project Overview
+
+The spire/helm-chart effort intends to deliver a set of helm charts to
+support SPIRE deployments in Kubernetes to the widest possible audience of
+users.
+
+## Mission and Scope
+
+The mission of this effort is to provide a stable upstream repository
+of Helm Charts sufficient for any organization or individual to use.
+
+### What problem does this project address?
+
+Prior to this effort, no single authoritative repository for SPIRE Helm
+Charts existed, imposing an additional burden on SPIRE adoption as each
+organization or individual had to develop their own Kubernetes
+deployment packaging.
+
+### What is the goal of this project?
+
+The goal of this project is to be the primary means of deployment for
+SPIRE into Kubernetes clusters, providing a flexible solution that can
+be used in a wide number of different scenarios.
+
+### What is the scope of this project?
+
+The scope includes user documentation, chart creation, chart delivery,
+chart testing, and chart maintenance of a set of Helm Charts sufficient
+for deploying SPIRE in any SPIRE documented configuration, including
+direction on how to extend the Charts to integrate non-SPIRE plugins.
+
+### What development methodology is used?
+
+An Open Source Development methodology is used, where issues are tracked
+within the primary github repository.
+
+## Status
+
+The project is currently in a pre-release status.  While the standalone
+deployment is close to release quality, the tiered deployment is not.
+
+## Project Navigation
+
+Below are links to project documentation useful for the management and
+maintenance of the spire/helm project.
+
+### Coordination
+
+- [glossary](glossary.md)