From 6d221263fbf2cd1d995e8d463f7897d1d97438b9 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Thu, 30 Mar 2023 14:08:59 +0200
Subject: [PATCH 01/16] Add Tornjak

This reverts commit 3210dfe49dfabc96437d1fe60a1b9a5eedb2312b.

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/charts/spire-server/README.md    | 10 +++-
 .../charts/spire-server/templates/NOTES.txt   | 18 ++++++
 .../spire-server/templates/_helpers.tpl       | 32 +++++++++++
 .../spire-server/templates/service.yaml       | 33 +++++++++++
 .../spire-server/templates/statefulset.yaml   | 55 +++++++++++++++++++
 .../tests/test-tornjak-connection.yaml        | 27 +++++++++
 .../templates/tornjak-config.yaml             | 23 ++++++++
 charts/spire/charts/spire-server/values.yaml  | 23 ++++++++
 8 files changed, 220 insertions(+), 1 deletion(-)
 create mode 100644 charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
 create mode 100644 charts/spire/charts/spire-server/templates/tornjak-config.yaml

diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index efc2ba5..8428259 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -106,7 +106,15 @@ A Helm chart to install the SPIRE server.
 | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
-| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
+| tornjak.config.backend.dataStore.driver | string | `"sqlite3"` |  |
+| tornjak.config.backend.dataStore.file | string | `"/run/spire/data/tornjak.sqlite3"` |  |
+| tornjak.config.frontend.apiServerURL | string | `"http://localhost:10000"` |  |
+| tornjak.enabled | bool | `false` |  |
+| tornjak.image.pullPolicy | string | `"IfNotPresent"` |  |
+| tornjak.image.registry | string | `"ghcr.io"` |  |
+| tornjak.image.repository | string | `"spiffe/tornjak"` |  |
+| tornjak.image.version | string | `"latest"` |  |
+| trustDomain | string | `"example.org"` |  |
 | upstreamAuthority.certManager.enabled | bool | `false` |  |
 | upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
 | upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` |  |
diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt
index b013798..7223e0f 100644
--- a/charts/spire/charts/spire-server/templates/NOTES.txt
+++ b/charts/spire/charts/spire-server/templates/NOTES.txt
@@ -4,3 +4,21 @@ Installed {{ .Chart.Name }}…
 
   kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \
     spire-server entry show
+
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+
+### WARNING ###
+This Tornjak is configured without authentication and it is intended for
+testing only. Please do not use this version in production.
+
+Tornjak APIs (Backend):
+      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 10000:10000
+
+Tornjak UI (Frontend):
+      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 3000:3000
+
+Tornjak API access:  {{ include "tornjak.apiURL" . }}
+Tornjak UI access:   {{ include "tornjak.frontendURL" . }}
+
+Installed {{ include "spire-tornjak.fullname" . }}…
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 3fcff92..d4ee16e 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -153,3 +153,35 @@ Create the name of the service account to use
 {{- end }}
 {{- $config | toYaml }}
 {{- end }}
+
+{{/*
+Tornjak specific section
+*/}}
+
+{{- define "spire-tornjak.fullname" -}}
+{{ include "spire-server.fullname" . | trimSuffix "-server" }}-tornjak
+{{- end }}
+{{- define "spire-tornjak.config" -}}
+{{ include "spire-tornjak.fullname" . }}-config
+{{- end }}
+{{- define "spire-tornjak.frontend" -}}
+{{ include "spire-tornjak.fullname" . }}-fe
+{{- end }}
+{{- define "spire-tornjak.backend" -}}
+{{ include "spire-tornjak.fullname" . }}-be
+{{- end }}
+
+{{/*
+Create URL for accessing Tornjak Backend
+*/}}
+{{- define "tornjak.apiURL" -}}
+{{- default .Values.tornjak.config.frontend.apiServerURL }}
+{{- end }}
+
+{{/*
+Create URL for accessing Tornjak Frontend
+*/}}
+{{- define "tornjak.frontendURL" -}}
+{{- $feurl := print "http://localhost:3000" }}
+{{- $feurl }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml
index 1e57a07..a9fb827 100644
--- a/charts/spire/charts/spire-server/templates/service.yaml
+++ b/charts/spire/charts/spire-server/templates/service.yaml
@@ -26,3 +26,36 @@ spec:
     {{- end }}
   selector:
     {{- include "spire-server.selectorLabels" . | nindent 4 }}
+
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ include "spire-server.namespace" . }}
+  name: {{ include "spire-tornjak.frontend" . }}
+spec:
+  type: {{ .Values.service.type }} # ClusterIP
+  selector:
+    {{- include "spire-server.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: {{ include "spire-tornjak.frontend" . }}
+      port: 3000
+      targetPort: 3000
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ include "spire-server.namespace" . }}
+  name: {{ include "spire-tornjak.backend" . }}
+spec:
+  type: {{ .Values.service.type }} # ClusterIP
+  selector:
+   {{- include "spire-server.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: {{ include "spire-tornjak.backend" . }}
+      port: 10000
+      targetPort: 10000
+      protocol: TCP
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index f9e6262..bea7d9e 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -1,6 +1,7 @@
 {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
 {{- $configSum2 := (include (print $.Template.BasePath "/secret.yaml") . | sha256sum) }}
 {{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
+{{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }}
 {{- $fullname := include "spire-server.fullname" . }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -26,6 +27,7 @@ spec:
         checksum/config: {{ $configSum }}
         checksum/config2: {{ $configSum2 }}
         checksum/config3: {{ $configSum3 }}
+        checksum/configTornjak: {{ $configSumTornjak }}
         {{- with .Values.podAnnotations }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
@@ -155,6 +157,51 @@ spec:
               mountPath: /tmp
               readOnly: false
         {{- end }}
+
+        {{- if eq (.Values.tornjak.enabled | toString) "true" }}
+        - name: tornjak
+          securityContext:
+            {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tornjak.image) }}
+          imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
+          startupProbe:
+            httpGet:
+              scheme: HTTP
+              port: 3000
+            failureThreshold: 6
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 10
+          env:
+          {{- if .Values.tornjak.config.frontend }}
+          - name: REACT_APP_API_SERVER_URI
+            value: {{ include "tornjak.apiURL" . | required "Either .Values.tornjak.config.backend.ingress or .Values.tornjak.config.frontend.apiServerURL is required." }}
+          {{- end }}
+          args:
+          - -c
+          - /run/spire/config/server.conf
+          - -t
+          - /run/spire/tornjak-config/server.conf
+          ports:
+          - containerPort: 3000
+            protocol: TCP
+          volumeMounts:
+          - name: {{ include "spire-tornjak.config" . }}
+            mountPath: /run/spire/tornjak-config
+          - name: spire-server-socket
+            mountPath: /tmp/spire-server/private
+            readOnly: true
+          - name: spire-config
+            mountPath: /run/spire/config
+            readOnly: true
+          {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
+          - name: spire-data
+            mountPath: /run/spire/data
+            readOnly: false
+          {{- end }}
+        {{- end }}
+
         {{- if gt (len .Values.extraContainers) 0 }}
         {{- toYaml .Values.extraContainers | nindent 8 }}
         {{- end }}
@@ -192,6 +239,14 @@ spec:
           configMap:
             name: {{ include "spire-controller-manager.fullname" . }}
         {{- end }}
+        {{- if eq (.Values.tornjak.enabled | toString) "true" }}
+        {{- if .Values.tornjak.config }}
+        - name: {{ include "spire-tornjak.config" . }}
+          configMap:
+            defaultMode: 420
+            name: {{ include "spire-tornjak.config" . }}
+        {{- end }}
+        {{- end }}
         {{- if gt (len .Values.extraVolumes) 0 }}
         {{- toYaml .Values.extraVolumes | nindent 8 }}
         {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
new file mode 100644
index 0000000..9dd5ca7
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
@@ -0,0 +1,27 @@
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "spire-tornjak.fullname" . }}-test-connection"
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:  
+  annotations:
+    "helm.sh/hook": test
+spec:
+  securityContext:
+    {{- toYaml .Values.podSecurityContext | nindent 4 }}
+  containers:
+    - name: wget-tornjak-backend
+      image: busybox
+      command: ['wget']
+      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.backend" . }}:10000/api/tornjak/serverinfo']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+    - name: wget-tornjak-frontend
+      image: busybox
+      command: ['wget']
+      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.frontend" . }}:3000']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+  restartPolicy: Never
+{{- end }}
\ No newline at end of file
diff --git a/charts/spire/charts/spire-server/templates/tornjak-config.yaml b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
new file mode 100644
index 0000000..f1bd3ce
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
@@ -0,0 +1,23 @@
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire-tornjak.config" . }}
+  namespace: {{ include "spire-server.namespace" . }}
+data:
+  server.conf: |
+    server {
+      metadata = "insert metadata"
+    }
+
+    plugins {
+    {{- if .Values.tornjak.config.backend.dataStore }}
+      DataStore "sql" {
+        plugin_data {
+          drivername = "{{ .Values.tornjak.config.backend.dataStore.driver }}"
+          filename = "{{ .Values.tornjak.config.backend.dataStore.file }}"
+        }
+      }
+    {{- end }}
+    }
+    {{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 2d31c5c..4a3267f 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -255,3 +255,26 @@ nodeAttestor:
   k8sPsat:
     enabled: true
     serviceAccountAllowList: []
+
+# tornjak - Tornjak specific configuration
+tornjak:
+  enabled: false
+  # image - Tornjak image (frontend + backend) if not separated above
+  image: # ghcr.io/spiffe/tornjak
+    registry: ghcr.io
+    repository: spiffe/tornjak
+    pullPolicy: IfNotPresent
+    # Overrides the image tag whose default is the chart appVersion.
+    # TODO we should use a specific Tornjak version instead of 'latest'
+    version: "latest"
+  config:
+    # Front-end specific configuration:
+    frontend:
+      # apiServerURL - URL of the Tornjak back-end
+      apiServerURL: "http://localhost:10000"  # 👈 Use it for minikube or kind
+     # Back-end specific configuration
+    backend:
+      # dataStore - persistent DB for storing Tornjak specific information
+      dataStore:
+        driver: "sqlite3"
+        file: "/run/spire/data/tornjak.sqlite3"

From da186c5f5349cb6a4a1087b098d8be5bc281a61e Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Thu, 13 Apr 2023 14:57:15 -0400
Subject: [PATCH 02/16] Split Tornjak Frontend into separate subchart (#179)

Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/Chart.yaml                       |   4 +
 charts/spire/README.md                        |   2 +
 charts/spire/charts/spire-server/README.md    |  15 ++-
 .../charts/spire-server/templates/NOTES.txt   |   9 +-
 .../spire-server/templates/_helpers.tpl       |   3 -
 .../spire-server/templates/service.yaml       |  27 ++---
 .../spire-server/templates/statefulset.yaml   |  54 ++++-----
 .../tests/test-tornjak-connection.yaml        |  17 +--
 .../templates/tornjak-config.yaml             |   6 +-
 charts/spire/charts/spire-server/values.yaml  |  32 +++--
 .../spire/charts/tornjak-frontend/Chart.yaml  |  10 ++
 .../spire/charts/tornjak-frontend/README.md   |  64 ++++++++++
 .../charts/tornjak-frontend/README.md.gotmpl  |  47 ++++++++
 .../tornjak-frontend/templates/NOTES.txt      |  25 ++++
 .../tornjak-frontend/templates/_helpers.tpl   | 109 ++++++++++++++++++
 .../templates/deployment.yaml                 |  46 ++++++++
 .../tornjak-frontend/templates/service.yaml   |  19 +++
 .../templates/serviceaccount.yaml             |  13 +++
 .../tests/test-tornjak-connection.yaml        |  21 ++++
 .../spire/charts/tornjak-frontend/values.yaml |  47 ++++++++
 charts/spire/values.yaml                      |   3 +
 21 files changed, 478 insertions(+), 95 deletions(-)
 create mode 100644 charts/spire/charts/tornjak-frontend/Chart.yaml
 create mode 100644 charts/spire/charts/tornjak-frontend/README.md
 create mode 100644 charts/spire/charts/tornjak-frontend/README.md.gotmpl
 create mode 100644 charts/spire/charts/tornjak-frontend/templates/NOTES.txt
 create mode 100644 charts/spire/charts/tornjak-frontend/templates/_helpers.tpl
 create mode 100644 charts/spire/charts/tornjak-frontend/templates/deployment.yaml
 create mode 100644 charts/spire/charts/tornjak-frontend/templates/service.yaml
 create mode 100644 charts/spire/charts/tornjak-frontend/templates/serviceaccount.yaml
 create mode 100644 charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml
 create mode 100644 charts/spire/charts/tornjak-frontend/values.yaml

diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml
index 62af05f..12af3d9 100644
--- a/charts/spire/Chart.yaml
+++ b/charts/spire/Chart.yaml
@@ -38,6 +38,10 @@ dependencies:
     condition: spiffe-oidc-discovery-provider.enabled
     repository: file://./charts/spiffe-oidc-discovery-provider
     version: 0.1.0
+  - name: tornjak-frontend
+    condition: tornjak-frontend.enabled
+    repository: file://./charts/tornjak-frontend
+    version: 0.1.0
 annotations:
   artifacthub.io/category: security
   artifacthub.io/license: Apache-2.0
diff --git a/charts/spire/README.md b/charts/spire/README.md
index e77bf5c..7054fe5 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -104,6 +104,7 @@ Kubernetes: `>=1.21.0-0`
 | file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 |
 | file://./charts/spire-agent | spire-agent | 0.1.0 |
 | file://./charts/spire-server | spire-server | 0.1.0 |
+| file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 |
 
 ## Values
 
@@ -355,5 +356,6 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
 | spire-server.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
 | spire-server.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
+| tornjak-frontend.enabled | bool | `false` |  |
 
 ----------------------------------------------
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 8428259..0eef5fb 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -106,14 +106,13 @@ A Helm chart to install the SPIRE server.
 | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
-| tornjak.config.backend.dataStore.driver | string | `"sqlite3"` |  |
-| tornjak.config.backend.dataStore.file | string | `"/run/spire/data/tornjak.sqlite3"` |  |
-| tornjak.config.frontend.apiServerURL | string | `"http://localhost:10000"` |  |
-| tornjak.enabled | bool | `false` |  |
-| tornjak.image.pullPolicy | string | `"IfNotPresent"` |  |
-| tornjak.image.registry | string | `"ghcr.io"` |  |
-| tornjak.image.repository | string | `"spiffe/tornjak"` |  |
-| tornjak.image.version | string | `"latest"` |  |
+| tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | persistent DB for storing Tornjak specific information |
+| tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) |
+| tornjak.image | object | `{"pullPolicy":"IfNotPresent","registry":"ghcr.io","repository":"spiffe/tornjak-be","version":"v1.0.2"}` | Tornjak API image |
+| tornjak.image.version | string | `"v1.0.2"` | Overrides the image tag whose default is the chart appVersion. |
+| tornjak.service.annotations | object | `{}` |  |
+| tornjak.service.port | int | `10000` |  |
+| tornjak.service.type | string | `"ClusterIP"` |  |
 | trustDomain | string | `"example.org"` |  |
 | upstreamAuthority.certManager.enabled | bool | `false` |  |
 | upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt
index 7223e0f..580244e 100644
--- a/charts/spire/charts/spire-server/templates/NOTES.txt
+++ b/charts/spire/charts/spire-server/templates/NOTES.txt
@@ -8,17 +8,14 @@ Installed {{ .Chart.Name }}…
 {{- if eq (.Values.tornjak.enabled | toString) "true" }}
 
 ### WARNING ###
+
 This Tornjak is configured without authentication and it is intended for
 testing only. Please do not use this version in production.
 
 Tornjak APIs (Backend):
-      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 10000:10000
+      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 {{ .Values.tornjak.service.port }}:10000
 
-Tornjak UI (Frontend):
-      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 3000:3000
-
-Tornjak API access:  {{ include "tornjak.apiURL" . }}
-Tornjak UI access:   {{ include "tornjak.frontendURL" . }}
+Open browser to: http://localhost:{{ .Values.tornjak.service.port }}
 
 Installed {{ include "spire-tornjak.fullname" . }}…
 {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index d4ee16e..864b9f7 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -164,9 +164,6 @@ Tornjak specific section
 {{- define "spire-tornjak.config" -}}
 {{ include "spire-tornjak.fullname" . }}-config
 {{- end }}
-{{- define "spire-tornjak.frontend" -}}
-{{ include "spire-tornjak.fullname" . }}-fe
-{{- end }}
 {{- define "spire-tornjak.backend" -}}
 {{ include "spire-tornjak.fullname" . }}-be
 {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml
index a9fb827..bfa354a 100644
--- a/charts/spire/charts/spire-server/templates/service.yaml
+++ b/charts/spire/charts/spire-server/templates/service.yaml
@@ -31,31 +31,22 @@ spec:
 ---
 apiVersion: v1
 kind: Service
-metadata:
-  namespace: {{ include "spire-server.namespace" . }}
-  name: {{ include "spire-tornjak.frontend" . }}
-spec:
-  type: {{ .Values.service.type }} # ClusterIP
-  selector:
-    {{- include "spire-server.selectorLabels" . | nindent 4 }}
-  ports:
-    - name: {{ include "spire-tornjak.frontend" . }}
-      port: 3000
-      targetPort: 3000
-      protocol: TCP
----
-apiVersion: v1
-kind: Service
 metadata:
   namespace: {{ include "spire-server.namespace" . }}
   name: {{ include "spire-tornjak.backend" . }}
+  {{- with .Values.tornjak.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
 spec:
-  type: {{ .Values.service.type }} # ClusterIP
+  type: {{ .Values.tornjak.service.type }}
   selector:
    {{- include "spire-server.selectorLabels" . | nindent 4 }}
   ports:
     - name: {{ include "spire-tornjak.backend" . }}
-      port: 10000
-      targetPort: 10000
+      port: {{ .Values.tornjak.service.port }}
+      targetPort: tornjak
       protocol: TCP
 {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index bea7d9e..6e93b91 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -167,39 +167,35 @@ spec:
           startupProbe:
             httpGet:
               scheme: HTTP
-              port: 3000
-            failureThreshold: 6
-            initialDelaySeconds: 60
-            periodSeconds: 30
+              port: 10000
+            failureThreshold: 3
+            initialDelaySeconds: 5
+            periodSeconds: 10
             successThreshold: 1
-            timeoutSeconds: 10
-          env:
-          {{- if .Values.tornjak.config.frontend }}
-          - name: REACT_APP_API_SERVER_URI
-            value: {{ include "tornjak.apiURL" . | required "Either .Values.tornjak.config.backend.ingress or .Values.tornjak.config.frontend.apiServerURL is required." }}
-          {{- end }}
+            timeoutSeconds: 5
           args:
-          - -c
-          - /run/spire/config/server.conf
-          - -t
-          - /run/spire/tornjak-config/server.conf
+            - -c
+            - /run/spire/config/server.conf
+            - -t
+            - /run/spire/tornjak-config/server.conf
           ports:
-          - containerPort: 3000
-            protocol: TCP
+            - name: tornjak
+              containerPort: 10000
+              protocol: TCP
           volumeMounts:
-          - name: {{ include "spire-tornjak.config" . }}
-            mountPath: /run/spire/tornjak-config
-          - name: spire-server-socket
-            mountPath: /tmp/spire-server/private
-            readOnly: true
-          - name: spire-config
-            mountPath: /run/spire/config
-            readOnly: true
-          {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
-          - name: spire-data
-            mountPath: /run/spire/data
-            readOnly: false
-          {{- end }}
+            - name: {{ include "spire-tornjak.config" . }}
+              mountPath: /run/spire/tornjak-config
+            - name: spire-server-socket
+              mountPath: /tmp/spire-server/private
+              readOnly: true
+            - name: spire-config
+              mountPath: /run/spire/config
+              readOnly: true
+            {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
+            - name: spire-data
+              mountPath: /run/spire/data
+              readOnly: false
+            {{- end }}
         {{- end }}
 
         {{- if gt (len .Values.extraContainers) 0 }}
diff --git a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
index 9dd5ca7..a804109 100644
--- a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
+++ b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
@@ -4,7 +4,8 @@ kind: Pod
 metadata:
   name: "{{ include "spire-tornjak.fullname" . }}-test-connection"
   namespace: {{ include "spire-server.namespace" . }}
-  labels:  
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
   annotations:
     "helm.sh/hook": test
 spec:
@@ -12,16 +13,10 @@ spec:
     {{- toYaml .Values.podSecurityContext | nindent 4 }}
   containers:
     - name: wget-tornjak-backend
-      image: busybox
-      command: ['wget']
-      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.backend" . }}:10000/api/tornjak/serverinfo']
-      securityContext:
-        {{- toYaml .Values.securityContext | nindent 8 }}
-    - name: wget-tornjak-frontend
-      image: busybox
-      command: ['wget']
-      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.frontend" . }}:3000']
+      image: cgr.dev/chainguard/bash:latest
+      command: ['curl']
+      args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.backend" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.port }}']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
   restartPolicy: Never
-{{- end }}
\ No newline at end of file
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/tornjak-config.yaml b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
index f1bd3ce..5410356 100644
--- a/charts/spire/charts/spire-server/templates/tornjak-config.yaml
+++ b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
@@ -11,11 +11,11 @@ data:
     }
 
     plugins {
-    {{- if .Values.tornjak.config.backend.dataStore }}
+    {{- if .Values.tornjak.config.dataStore }}
       DataStore "sql" {
         plugin_data {
-          drivername = "{{ .Values.tornjak.config.backend.dataStore.driver }}"
-          filename = "{{ .Values.tornjak.config.backend.dataStore.file }}"
+          drivername = "{{ .Values.tornjak.config.dataStore.driver }}"
+          filename = "{{ .Values.tornjak.config.dataStore.file }}"
         }
       }
     {{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 4a3267f..2ff322b 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -12,7 +12,7 @@ image:
   repository: spiffe/spire-server
   # -- The image pull policy
   pullPolicy: IfNotPresent
-  # Overrides the image tag whose default is the chart appVersion.
+  # -- Overrides the image tag whose default is the chart appVersion.
   version: ""
 
 imagePullSecrets: []
@@ -258,23 +258,21 @@ nodeAttestor:
 
 # tornjak - Tornjak specific configuration
 tornjak:
+  # -- Deploys Tornjak API (backend)
   enabled: false
-  # image - Tornjak image (frontend + backend) if not separated above
-  image: # ghcr.io/spiffe/tornjak
+  # -- Tornjak API image
+  image:
     registry: ghcr.io
-    repository: spiffe/tornjak
+    repository: spiffe/tornjak-be
     pullPolicy: IfNotPresent
-    # Overrides the image tag whose default is the chart appVersion.
-    # TODO we should use a specific Tornjak version instead of 'latest'
-    version: "latest"
+    # -- Overrides the image tag whose default is the chart appVersion.
+    version: "v1.0.2"
+  service:
+    type: ClusterIP
+    port: 10000
+    annotations: {}
   config:
-    # Front-end specific configuration:
-    frontend:
-      # apiServerURL - URL of the Tornjak back-end
-      apiServerURL: "http://localhost:10000"  # 👈 Use it for minikube or kind
-     # Back-end specific configuration
-    backend:
-      # dataStore - persistent DB for storing Tornjak specific information
-      dataStore:
-        driver: "sqlite3"
-        file: "/run/spire/data/tornjak.sqlite3"
+    # -- persistent DB for storing Tornjak specific information
+    dataStore:
+      driver: "sqlite3"
+      file: "/run/spire/data/tornjak.sqlite3"
diff --git a/charts/spire/charts/tornjak-frontend/Chart.yaml b/charts/spire/charts/tornjak-frontend/Chart.yaml
new file mode 100644
index 0000000..790d5c8
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+name: tornjak-frontend
+description: A Helm chart to deploy Tornjak frontend
+type: application
+version: 0.1.0
+appVersion: "v1.0.2"
+maintainers:
+  - name: mrsabath
+    email: mrsabath@gmail.com
+    url: https://mrsabath.github.io
diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md
new file mode 100644
index 0000000..126d2de
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/README.md
@@ -0,0 +1,64 @@
+# tornjak-frontend
+
+<!-- This README.md is generated. Please edit README.md.gotmpl -->
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.0.2](https://img.shields.io/badge/AppVersion-v1.0.2-informational?style=flat-square)
+[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
+
+A Helm chart to deploy Tornjak frontend
+
+## Version support
+
+> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
+> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
+> we do aim for as much stability as possible.
+
+| Dependency | Supported Versions |
+|:-----------|:-------------------|
+| SPIRE      | `1.5.3+`, `1.6.x`  |
+| Tornjak    | `1.0.x`            |
+| Helm       | `3.x`              |
+
+## Prerequisites
+
+This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`).
+This URL needs to be reachable from your webbrowser and can therefore not be a cluster internal URL.
+
+Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally,
+Tornjak APIs are typically available at `http://localhost:10000`.
+Review Tornjak documentation for more details.
+
+## Usage
+
+Since this is just a demo version, to access Tornjak APIs you can use
+port forwarding. See the chart NOTES output for more details.
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| mrsabath | <mrsabath@gmail.com> | <https://mrsabath.github.io> |
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| apiServerURL | string | `"http://localhost:10000/"` | URL of the Tornjak APIs (backend) Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. |
+| fullnameOverride | string | `""` |  |
+| image.pullPolicy | string | `"IfNotPresent"` |  |
+| image.registry | string | `"ghcr.io"` |  |
+| image.repository | string | `"spiffe/tornjak-fe"` |  |
+| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion. |
+| imagePullSecrets | list | `[]` |  |
+| labels | object | `{}` |  |
+| nameOverride | string | `""` |  |
+| namespaceOverride | string | `""` |  |
+| podSecurityContext | object | `{}` |  |
+| securityContext | object | `{}` |  |
+| service.annotations | object | `{}` |  |
+| service.port | int | `3000` |  |
+| service.type | string | `"ClusterIP"` |  |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+----------------------------------------------
diff --git a/charts/spire/charts/tornjak-frontend/README.md.gotmpl b/charts/spire/charts/tornjak-frontend/README.md.gotmpl
new file mode 100644
index 0000000..eaf51ce
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/README.md.gotmpl
@@ -0,0 +1,47 @@
+{{ template "chart.header" . }}
+
+<!-- This README.md is generated. Please edit README.md.gotmpl -->
+
+{{ template "chart.deprecationWarning" . }}
+
+{{ template "chart.badgesSection" . }}
+[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
+
+{{ template "chart.description" . }}
+
+{{ template "chart.homepageLine" . }}
+
+## Version support
+
+> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
+> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
+> we do aim for as much stability as possible.
+
+| Dependency | Supported Versions |
+|:-----------|:-------------------|
+| SPIRE      | `1.5.3+`, `1.6.x`  |
+| Tornjak    | `1.0.x`            |
+| Helm       | `3.x`              |
+
+## Prerequisites
+
+This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`).
+This URL needs to be reachable from your webbrowser and can therefore not be a cluster internal URL.
+
+Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally,
+Tornjak APIs are typically available at `http://localhost:10000`.
+Review Tornjak documentation for more details.
+
+## Usage
+
+Since this is just a demo version, to access Tornjak APIs you can use
+port forwarding. See the chart NOTES output for more details.
+
+{{ template "chart.maintainersSection" . }}
+
+{{ template "chart.sourcesSection" . }}
+
+{{ template "chart.requirementsSection" . }}
+
+{{ template "chart.valuesSection" . }}
+----------------------------------------------
diff --git a/charts/spire/charts/tornjak-frontend/templates/NOTES.txt b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
new file mode 100644
index 0000000..50d8fe4
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
@@ -0,0 +1,25 @@
+Installed {{ .Chart.Name }}…
+
+Name: {{ include "tornjak-frontend.name" . }}
+Fullname: {{ include "tornjak-frontend.fullname" . }}
+Your release is named: {{ .Release.Name }}
+Namespace: {{ include "tornjak-frontend.namespace" . }}
+
+Tornjak UI (Frontend)
+  image: {{ template "tornjak-frontend.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+  pull policy: {{ .Values.image.pullPolicy }}
+Configured with Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }}
+
+### WARNING ###
+This Tornjak is configured without authentication and it is intended for
+testing only. Please do not use this version in production.
+
+You can use port forwarding to access UI:
+  kubectl -n {{ include "tornjak-frontend.namespace" . }} port-forward service/{{ include "tornjak-frontend.fullname" . }} {{ .Values.service.port }}:3000
+
+Open browser to: http://localhost:{{ .Values.service.port }}
+
+To learn more about the release, try:
+
+  $ helm status {{ .Release.Name }}
+  $ helm get all {{ .Release.Name }}
diff --git a/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl
new file mode 100644
index 0000000..77f7c12
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl
@@ -0,0 +1,109 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "tornjak-frontend.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "tornjak-frontend.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "tornjak-frontend.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "tornjak-frontend.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "tornjak-frontend.cluster-domain" -}}
+{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
+{{- .Values.global.k8s.clusterDomain }}
+{{- else }}
+{{- .Values.clusterDomain }}
+{{- end }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "tornjak-frontend.labels" -}}
+helm.sh/chart: {{ include "tornjak-frontend.chart" . }}
+{{ include "tornjak-frontend.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "tornjak-frontend.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "tornjak-frontend.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "tornjak-frontend.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "tornjak-frontend.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create an image name
+*/}}
+{{- define "tornjak-frontend.image" -}}
+{{- if eq (substr 0 7 .image.version) "sha256:" -}}
+{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
+{{- else if .appVersion -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
+{{- else if
+    .Values.tornjakFrontend.image.version -}}
+{{- printf "%s/%s:%s" .Values.tornjakFrontend.image.registry .Values.tornjakFrontend.image.repository .Values.tornjakFrontend.image.version -}}
+{{- else -}}
+{{- printf "%s/%s" .Values.tornjakFrontend.image.registry .Values.tornjakFrontend.image.repository -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Create URL for accessing Tornjak APIs
+*/}}
+{{- define "tornjak-frontend.apiURL" -}}
+{{- if .Values.apiServerURL -}}
+{{- .Values.apiServerURL -}}
+{{- else }}
+{{- $feurl := print "http://localhost:" .Values.service.port }}
+{{- $feurl }}
+{{- end }}
+{{- end }}
diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
new file mode 100644
index 0000000..e383594
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "tornjak-frontend.fullname" . }}
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "tornjak-frontend.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "tornjak-frontend.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "tornjak-frontend.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name:  {{ include "tornjak-frontend.fullname" . }}
+          image: {{ template "tornjak-frontend.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          env:
+            - name: REACT_APP_API_SERVER_URI
+              value: {{ include "tornjak-frontend.apiURL" . }}
+          startupProbe:
+            httpGet:
+              scheme: HTTP
+              port: {{ .Values.service.port }}
+            failureThreshold: 6
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 10
diff --git a/charts/spire/charts/tornjak-frontend/templates/service.yaml b/charts/spire/charts/tornjak-frontend/templates/service.yaml
new file mode 100644
index 0000000..5a49fca
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/service.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  name: {{ include "tornjak-frontend.fullname" . }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  selector:
+    {{- include "tornjak-frontend.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: {{ include "tornjak-frontend.fullname" . }}
+      port: {{ .Values.service.port }}
+      targetPort: http
diff --git a/charts/spire/charts/tornjak-frontend/templates/serviceaccount.yaml b/charts/spire/charts/tornjak-frontend/templates/serviceaccount.yaml
new file mode 100644
index 0000000..15640ac
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/serviceaccount.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "tornjak-frontend.serviceAccountName" . }}
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml
new file mode 100644
index 0000000..af4aea4
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "tornjak-frontend.fullname" . }}-test-connection"
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  securityContext:
+    {{- toYaml .Values.podSecurityContext | nindent 4 }}
+  containers:
+    - name: curl-tornjak-frontend
+      image: cgr.dev/chainguard/bash:latest
+      command: ['curl']
+      args: ['-k', '-s', '-f', 'http://{{ include "tornjak-frontend.fullname" . }}.{{ include "tornjak-frontend.namespace" . }}.svc.{{ include "tornjak-frontend.cluster-domain" . }}:{{ .Values.service.port }}']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+  restartPolicy: Never
+
diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml
new file mode 100644
index 0000000..a27ef48
--- /dev/null
+++ b/charts/spire/charts/tornjak-frontend/values.yaml
@@ -0,0 +1,47 @@
+# Default values for Tornjak UI (Frontend).
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+image:
+  registry: ghcr.io
+  repository: spiffe/tornjak-fe
+  pullPolicy: IfNotPresent
+  # -- Overrides the image tag whose default is the chart appVersion.
+  version: ""
+
+imagePullSecrets: []
+nameOverride: ""
+namespaceOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  # -- Specifies whether a service account should be created
+  create: true
+  # -- Annotations to add to the service account
+  annotations: {}
+  # -- The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+labels: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+service:
+  type: ClusterIP
+  port: 3000
+  annotations: {}
+
+# -- URL of the Tornjak APIs (backend)
+# Since Tornjak Frontend runs in the browser, this URL must be accessible from
+# the machine running a browser.
+apiServerURL: "http://localhost:10000/"  # 👈 Use it for minikube or kind
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index 76ca445..3f0a7a4 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -41,3 +41,6 @@ spiffe-csi-driver:
 
 spiffe-oidc-discovery-provider:
   enabled: false
+
+tornjak-frontend:
+  enabled: false

From bdba97b62902ac1592a5a863ce93f7ef560e5d5e Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Tue, 18 Apr 2023 22:19:09 -0400
Subject: [PATCH 03/16] Add empty directory to Tornjak to support npm cache
 (#224)

Resolves issue #223

Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
---
 .../spire/charts/tornjak-frontend/templates/deployment.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
index e383594..eb2fe4d 100644
--- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
+++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
@@ -44,3 +44,9 @@ spec:
             periodSeconds: 30
             successThreshold: 1
             timeoutSeconds: 10
+          volumeMounts:
+            - name: cache
+              mountPath: /usr/src/app/node_modules/.cache
+      volumes:
+        - name: cache
+          emptyDir: {}

From 5e827ee45e0a29ec0d8181190ee92f31d044ff99 Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Fri, 21 Apr 2023 11:45:39 -0400
Subject: [PATCH 04/16] Add Tornjak Tests (#220)

Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: kfox1111 <Kevin.Fox@pnnl.gov>
Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Co-authored-by: kfox1111 <Kevin.Fox@pnnl.gov>
---
 .github/tests/tornjak/install.sh              | 13 +++++
 .github/tests/tornjak/post-install.sh         | 54 +++++++++++++++++++
 .github/tests/tornjak/pre-install.sh          |  6 +++
 .../spire/charts/tornjak-frontend/Chart.yaml  |  4 ++
 .../spire/charts/tornjak-frontend/README.md   |  6 +++
 examples/production/values.yaml               | 15 ++++++
 examples/tornjak/README.md                    | 19 +++++++
 examples/tornjak/values.yaml                  | 10 ++++
 8 files changed, 127 insertions(+)
 create mode 100755 .github/tests/tornjak/install.sh
 create mode 100755 .github/tests/tornjak/post-install.sh
 create mode 100755 .github/tests/tornjak/pre-install.sh
 create mode 100644 examples/tornjak/README.md
 create mode 100644 examples/tornjak/values.yaml

diff --git a/.github/tests/tornjak/install.sh b/.github/tests/tornjak/install.sh
new file mode 100755
index 0000000..bfb0139
--- /dev/null
+++ b/.github/tests/tornjak/install.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+helm install \
+  --namespace spire-server \
+  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
+  --values "${SCRIPTPATH}/../../../examples/tornjak/values.yaml" \
+  spire charts/spire --wait
+helm test spire -n spire-server
diff --git a/.github/tests/tornjak/post-install.sh b/.github/tests/tornjak/post-install.sh
new file mode 100755
index 0000000..50b34af
--- /dev/null
+++ b/.github/tests/tornjak/post-install.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
+k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
+
+function get_namespace_details {
+cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### Namespace $1
+
+#### Events
+
+\`\`\`shell
+$(kubectl --request-timeout=30s get events --output wide --namespace "$1")
+\`\`\`
+
+#### Pods
+
+\`\`\`shell
+$(kubectl --request-timeout=30s describe pods --namespace "$1")
+\`\`\`
+
+#### Logs
+
+\`\`\`shell
+$(kubectl get pods -o name -n "$1" | while read -r line; do echo logs for "${line}"; kubectl logs -n "$1" "${line}" --all-containers=true --ignore-errors=true; done)
+\`\`\`
+
+EOF
+}
+
+cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### spire
+
+| workload                             | Status |
+| ------------------------------------ | ------ |
+| spire-server                         | "$("${k_rollout_status[@]}" spire-server statefulset spire-server)" |
+| spire-controller-manager             | "$("${k_rollout_status[@]}" spire-server statefulset spire-controller-manager)" |
+| spire-spiffe-oidc-discovery-provider | "$("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" |
+| spire-spiffe-csi-driver              | "$("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver)" |
+| spire-agent                          | "$("${k_rollout_status[@]}" spire-system daemonset spire-agent)" |
+| tornjak-frontend                     | "$("${k_wait[@]}" spire-server deployments.apps spire-tornjak-frontend)" |
+EOF
+
+kubectl -n spire-server get service spire-tornjak-frontend
+
+if [ $1 -ne 0 ]; then
+  get_namespace_details spire-server
+  get_namespace_details spire-system
+fi
diff --git a/.github/tests/tornjak/pre-install.sh b/.github/tests/tornjak/pre-install.sh
new file mode 100755
index 0000000..b33d1ed
--- /dev/null
+++ b/.github/tests/tornjak/pre-install.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+kubectl create namespace spire-system
+kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace spire-server
+kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
diff --git a/charts/spire/charts/tornjak-frontend/Chart.yaml b/charts/spire/charts/tornjak-frontend/Chart.yaml
index 790d5c8..9b77c93 100644
--- a/charts/spire/charts/tornjak-frontend/Chart.yaml
+++ b/charts/spire/charts/tornjak-frontend/Chart.yaml
@@ -4,6 +4,10 @@ description: A Helm chart to deploy Tornjak frontend
 type: application
 version: 0.1.0
 appVersion: "v1.0.2"
+home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
+sources:
+  - https://github.com/spiffe/tornjak
+icon: https://raw.githubusercontent.com/spiffe/tornjak/main/logos/logo%2Btornjak.2132x1291.png
 maintainers:
   - name: mrsabath
     email: mrsabath@gmail.com
diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md
index 126d2de..c5255c1 100644
--- a/charts/spire/charts/tornjak-frontend/README.md
+++ b/charts/spire/charts/tornjak-frontend/README.md
@@ -7,6 +7,8 @@
 
 A Helm chart to deploy Tornjak frontend
 
+**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
+
 ## Version support
 
 > **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
@@ -39,6 +41,10 @@ port forwarding. See the chart NOTES output for more details.
 | ---- | ------ | --- |
 | mrsabath | <mrsabath@gmail.com> | <https://mrsabath.github.io> |
 
+## Source Code
+
+* <https://github.com/spiffe/tornjak>
+
 ## Values
 
 | Key | Type | Default | Description |
diff --git a/examples/production/values.yaml b/examples/production/values.yaml
index d81d285..fcbb883 100644
--- a/examples/production/values.yaml
+++ b/examples/production/values.yaml
@@ -77,3 +77,18 @@ spiffe-oidc-discovery-provider:
       drop: [ALL]
     seccompProfile:
       type: RuntimeDefault
+
+tornjak-frontend:
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: false
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault
diff --git a/examples/tornjak/README.md b/examples/tornjak/README.md
new file mode 100644
index 0000000..0863b05
--- /dev/null
+++ b/examples/tornjak/README.md
@@ -0,0 +1,19 @@
+# Recommended setup to deploy Tornjak
+
+To install Spire with the least privileges possible we deploy spire across 2 namespaces.
+
+```shell
+kubectl create namespace "spire-system"
+kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace "spire-server"
+kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
+
+# deploy SPIRE with Tornjak enabled
+helm upgrade --install --namespace spire-server --values ../production/values.yaml \
+ --values ./values.yaml spire charts/spire
+
+# test the Tornjak deployment
+helm test spire -n spire-server
+```
+
+See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
diff --git a/examples/tornjak/values.yaml b/examples/tornjak/values.yaml
new file mode 100644
index 0000000..c4ff6f2
--- /dev/null
+++ b/examples/tornjak/values.yaml
@@ -0,0 +1,10 @@
+spire-server:
+  tornjak:
+    enabled: true
+
+tornjak-frontend:
+  enabled: true
+  service:
+    type: ClusterIP
+    port: 3000
+  apiServerURL: "http://localhost:10000/"

From 1675997748f0c2d45bae3568f33dc9c9192e6f80 Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Fri, 21 Apr 2023 11:14:39 -0700
Subject: [PATCH 05/16] Tornjak global image fix (#228)

This pr updates the Tornjak branch to work with the merged global
registry configuration support.

Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
Signed-off-by: kfox1111 <Kevin.Fox@pnnl.gov>
---
 .../spire-server/templates/statefulset.yaml      |  2 +-
 .../charts/tornjak-frontend/templates/NOTES.txt  |  2 +-
 .../tornjak-frontend/templates/_helpers.tpl      | 16 ----------------
 .../tornjak-frontend/templates/deployment.yaml   |  2 +-
 4 files changed, 3 insertions(+), 19 deletions(-)

diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index 6e93b91..3a1322b 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -162,7 +162,7 @@ spec:
         - name: tornjak
           securityContext:
             {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
-          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tornjak.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tornjak.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
           startupProbe:
             httpGet:
diff --git a/charts/spire/charts/tornjak-frontend/templates/NOTES.txt b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
index 50d8fe4..ea06ed1 100644
--- a/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
+++ b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
@@ -6,7 +6,7 @@ Your release is named: {{ .Release.Name }}
 Namespace: {{ include "tornjak-frontend.namespace" . }}
 
 Tornjak UI (Frontend)
-  image: {{ template "tornjak-frontend.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+  image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
   pull policy: {{ .Values.image.pullPolicy }}
 Configured with Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }}
 
diff --git a/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl
index 77f7c12..1ad4567 100644
--- a/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl
+++ b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl
@@ -80,22 +80,6 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{/*
-Create an image name
-*/}}
-{{- define "tornjak-frontend.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if
-    .Values.tornjakFrontend.image.version -}}
-{{- printf "%s/%s:%s" .Values.tornjakFrontend.image.registry .Values.tornjakFrontend.image.repository .Values.tornjakFrontend.image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .Values.tornjakFrontend.image.registry .Values.tornjakFrontend.image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{/*
 Create URL for accessing Tornjak APIs
 */}}
diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
index eb2fe4d..116b9a1 100644
--- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
+++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
@@ -24,7 +24,7 @@ spec:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
         - name:  {{ include "tornjak-frontend.fullname" . }}
-          image: {{ template "tornjak-frontend.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}

From 91bdea2a1db8c8ec6239b9cbc1d13d1a23c95ab7 Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Mon, 24 Apr 2023 14:17:47 -0400
Subject: [PATCH 06/16] Provide minimal resources to prevent accidental crashes
 due to resource exhaustion

Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
---
 charts/spire/charts/tornjak-frontend/values.yaml | 9 +++++++++
 examples/tornjak/values.yaml                     | 7 +++++++
 2 files changed, 16 insertions(+)

diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml
index a27ef48..0d1d645 100644
--- a/charts/spire/charts/tornjak-frontend/values.yaml
+++ b/charts/spire/charts/tornjak-frontend/values.yaml
@@ -41,6 +41,15 @@ service:
   port: 3000
   annotations: {}
 
+# -- Provide minimal resources to prevent accidental crashes due to resource exhaustion
+# resources:
+#   requests:
+#     cpu: 50m
+#     memory: 128Mi
+#   limits:
+#     cpu: 100m
+#     memory: 512Mi
+
 # -- URL of the Tornjak APIs (backend)
 # Since Tornjak Frontend runs in the browser, this URL must be accessible from
 # the machine running a browser.
diff --git a/examples/tornjak/values.yaml b/examples/tornjak/values.yaml
index c4ff6f2..a407265 100644
--- a/examples/tornjak/values.yaml
+++ b/examples/tornjak/values.yaml
@@ -8,3 +8,10 @@ tornjak-frontend:
     type: ClusterIP
     port: 3000
   apiServerURL: "http://localhost:10000/"
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 100m
+      memory: 512Mi

From bd86518abce71ab5b688c3b67bdf30eae7548e66 Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Mon, 1 May 2023 16:32:58 -0400
Subject: [PATCH 07/16] Fixing shellcheck

Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
---
 .github/tests/tornjak/post-install.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/tests/tornjak/post-install.sh b/.github/tests/tornjak/post-install.sh
index 50b34af..d2b9a8d 100755
--- a/.github/tests/tornjak/post-install.sh
+++ b/.github/tests/tornjak/post-install.sh
@@ -5,6 +5,10 @@ set -x
 SCRIPT=$(readlink -f "$0")
 SCRIPTPATH=$(dirname "$SCRIPT")
 
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
 k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
 k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
 
@@ -48,7 +52,7 @@ EOF
 
 kubectl -n spire-server get service spire-tornjak-frontend
 
-if [ $1 -ne 0 ]; then
+if [ "$1" -ne 0 ]; then
   get_namespace_details spire-server
   get_namespace_details spire-system
 fi

From f5efa0cefd46462f6bd9798d80267ce97b929d3a Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Thu, 4 May 2023 10:29:25 -0400
Subject: [PATCH 08/16] Remove dead macros

Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
---
 .../charts/spire-server/templates/_helpers.tpl    | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 864b9f7..2851e4b 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -167,18 +167,3 @@ Tornjak specific section
 {{- define "spire-tornjak.backend" -}}
 {{ include "spire-tornjak.fullname" . }}-be
 {{- end }}
-
-{{/*
-Create URL for accessing Tornjak Backend
-*/}}
-{{- define "tornjak.apiURL" -}}
-{{- default .Values.tornjak.config.frontend.apiServerURL }}
-{{- end }}
-
-{{/*
-Create URL for accessing Tornjak Frontend
-*/}}
-{{- define "tornjak.frontendURL" -}}
-{{- $feurl := print "http://localhost:3000" }}
-{{- $feurl }}
-{{- end }}

From 80d34f0485f7c238cfe8dffd4e4390b04ecbfa76 Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Thu, 11 May 2023 22:58:23 -0400
Subject: [PATCH 09/16] Use common post-install scripts for testing

Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
---
 .github/tests/tornjak/post-install.sh | 53 +++++----------------------
 1 file changed, 9 insertions(+), 44 deletions(-)

diff --git a/.github/tests/tornjak/post-install.sh b/.github/tests/tornjak/post-install.sh
index d2b9a8d..69ca32e 100755
--- a/.github/tests/tornjak/post-install.sh
+++ b/.github/tests/tornjak/post-install.sh
@@ -2,57 +2,22 @@
 
 set -x
 
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH=$(dirname "$SCRIPT")
-
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
 
 # shellcheck source=/dev/null
 source "${SCRIPTPATH}/../common.sh"
 
-k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
-k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
-
-function get_namespace_details {
-cat <<EOF >>"$GITHUB_STEP_SUMMARY"
-### Namespace $1
-
-#### Events
-
-\`\`\`shell
-$(kubectl --request-timeout=30s get events --output wide --namespace "$1")
-\`\`\`
-
-#### Pods
-
-\`\`\`shell
-$(kubectl --request-timeout=30s describe pods --namespace "$1")
-\`\`\`
-
-#### Logs
-
-\`\`\`shell
-$(kubectl get pods -o name -n "$1" | while read -r line; do echo logs for "${line}"; kubectl logs -n "$1" "${line}" --all-containers=true --ignore-errors=true; done)
-\`\`\`
-
-EOF
-}
-
-cat <<EOF >>"$GITHUB_STEP_SUMMARY"
-### spire
-
-| workload                             | Status |
-| ------------------------------------ | ------ |
-| spire-server                         | "$("${k_rollout_status[@]}" spire-server statefulset spire-server)" |
-| spire-controller-manager             | "$("${k_rollout_status[@]}" spire-server statefulset spire-controller-manager)" |
-| spire-spiffe-oidc-discovery-provider | "$("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" |
-| spire-spiffe-csi-driver              | "$("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver)" |
-| spire-agent                          | "$("${k_rollout_status[@]}" spire-system daemonset spire-agent)" |
-| tornjak-frontend                     | "$("${k_wait[@]}" spire-server deployments.apps spire-tornjak-frontend)" |
-EOF
+print_helm_releases
+print_spire_workload_status spire-server spire-system
 
+kubectl rollout status --watch --timeout 30s --namespace spire-server deployments.apps spire-tornjak-frontend
+kubectl -n spire-server get deploy spire-tornjak-frontend
 kubectl -n spire-server get service spire-tornjak-frontend
 
-if [ "$1" -ne 0 ]; then
+
+if [[ "$1" -ne 0 ]]; then
   get_namespace_details spire-server
   get_namespace_details spire-system
 fi

From 6ddf6ab9fa99085100dc665a973f89b88c8ce472 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Fri, 12 May 2023 13:37:59 +0200
Subject: [PATCH 10/16] Improve tornjak docs (#276)

- Align tornjak backend naming with same convention as frontend
- Align Tornjak backend and frontend notes style
- Add disclaimer for Tornjak usage to example

---------

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 .../charts/spire-server/templates/NOTES.txt   | 12 ++++++----
 .../spire-server/templates/_helpers.tpl       |  4 +++-
 .../spire-server/templates/service.yaml       | 24 -------------------
 .../templates/tornjak-service.yaml            | 22 +++++++++++++++++
 .../tornjak-frontend/templates/NOTES.txt      | 12 ++++++----
 examples/tornjak/README.md                    | 22 +++++++++++++++--
 6 files changed, 60 insertions(+), 36 deletions(-)
 create mode 100644 charts/spire/charts/spire-server/templates/tornjak-service.yaml

diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt
index 580244e..1c00883 100644
--- a/charts/spire/charts/spire-server/templates/NOTES.txt
+++ b/charts/spire/charts/spire-server/templates/NOTES.txt
@@ -7,15 +7,17 @@ Installed {{ .Chart.Name }}…
 
 {{- if eq (.Values.tornjak.enabled | toString) "true" }}
 
+Installed {{ include "spire-tornjak.fullname" . }}…
+
 ### WARNING ###
 
-This Tornjak is configured without authentication and it is intended for
-testing only. Please do not use this version in production.
+Tornjak runs without authentication and is therefore NOT suitable to run in production environments.
+Only use in test environments!
 
-Tornjak APIs (Backend):
-      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 {{ .Values.tornjak.service.port }}:10000
+Access Tornjak:
+
+    kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.backend" . }} {{ .Values.tornjak.service.port }}:10000
 
 Open browser to: http://localhost:{{ .Values.tornjak.service.port }}
 
-Installed {{ include "spire-tornjak.fullname" . }}…
 {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index 2851e4b..7df3626 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -161,9 +161,11 @@ Tornjak specific section
 {{- define "spire-tornjak.fullname" -}}
 {{ include "spire-server.fullname" . | trimSuffix "-server" }}-tornjak
 {{- end }}
+
 {{- define "spire-tornjak.config" -}}
 {{ include "spire-tornjak.fullname" . }}-config
 {{- end }}
+
 {{- define "spire-tornjak.backend" -}}
-{{ include "spire-tornjak.fullname" . }}-be
+{{ include "spire-tornjak.fullname" . }}-backend
 {{- end }}
diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml
index bfa354a..1e57a07 100644
--- a/charts/spire/charts/spire-server/templates/service.yaml
+++ b/charts/spire/charts/spire-server/templates/service.yaml
@@ -26,27 +26,3 @@ spec:
     {{- end }}
   selector:
     {{- include "spire-server.selectorLabels" . | nindent 4 }}
-
-{{- if eq (.Values.tornjak.enabled | toString) "true" }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  namespace: {{ include "spire-server.namespace" . }}
-  name: {{ include "spire-tornjak.backend" . }}
-  {{- with .Values.tornjak.service.annotations }}
-  annotations:
-    {{- toYaml . | nindent 8 }}
-  {{- end }}
-  labels:
-    {{- include "spire-server.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.tornjak.service.type }}
-  selector:
-   {{- include "spire-server.selectorLabels" . | nindent 4 }}
-  ports:
-    - name: {{ include "spire-tornjak.backend" . }}
-      port: {{ .Values.tornjak.service.port }}
-      targetPort: tornjak
-      protocol: TCP
-{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/tornjak-service.yaml b/charts/spire/charts/spire-server/templates/tornjak-service.yaml
new file mode 100644
index 0000000..a4a95bd
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/tornjak-service.yaml
@@ -0,0 +1,22 @@
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ include "spire-server.namespace" . }}
+  name: {{ include "spire-tornjak.backend" . }}
+  {{- with .Values.tornjak.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.tornjak.service.type }}
+  selector:
+   {{- include "spire-server.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: {{ include "spire-tornjak.backend" . }}
+      port: {{ .Values.tornjak.service.port }}
+      targetPort: tornjak
+      protocol: TCP
+{{- end }}
diff --git a/charts/spire/charts/tornjak-frontend/templates/NOTES.txt b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
index ea06ed1..8e08f81 100644
--- a/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
+++ b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
@@ -8,15 +8,19 @@ Namespace: {{ include "tornjak-frontend.namespace" . }}
 Tornjak UI (Frontend)
   image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
   pull policy: {{ .Values.image.pullPolicy }}
-Configured with Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }}
+  Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }}
 
 ### WARNING ###
-This Tornjak is configured without authentication and it is intended for
-testing only. Please do not use this version in production.
 
-You can use port forwarding to access UI:
+Tornjak runs without authentication and is therefore NOT suitable to run in production environments.
+Only use in test environments!
+
+Access Tornjak:
+
   kubectl -n {{ include "tornjak-frontend.namespace" . }} port-forward service/{{ include "tornjak-frontend.fullname" . }} {{ .Values.service.port }}:3000
 
+Ensure you have port-forwarding for tornjak-backend as well.
+
 Open browser to: http://localhost:{{ .Values.service.port }}
 
 To learn more about the release, try:
diff --git a/examples/tornjak/README.md b/examples/tornjak/README.md
index 0863b05..4108c3b 100644
--- a/examples/tornjak/README.md
+++ b/examples/tornjak/README.md
@@ -1,5 +1,7 @@
 # Recommended setup to deploy Tornjak
 
+> **Warning**: The current version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production.
+
 To install Spire with the least privileges possible we deploy spire across 2 namespaces.
 
 ```shell
@@ -9,11 +11,27 @@ kubectl create namespace "spire-server"
 kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
 
 # deploy SPIRE with Tornjak enabled
-helm upgrade --install --namespace spire-server --values ../production/values.yaml \
- --values ./values.yaml spire charts/spire
+helm upgrade --install --namespace spire-server \
+  --values ../production/values.yaml \
+  --values ./values.yaml \
+  --render-subchart-notes \
+  spire charts/spire
 
 # test the Tornjak deployment
 helm test spire -n spire-server
 ```
 
+## Access tornjak
+
+To access Tornjak you will have to use port-forwarding for the time being *(until we add authentication and ingress)*.
+
+Run following commands from your shell, if you ran with different values your namespace might differ. Consult the install notes printed when running above `helm upgrade` command in that case.
+
+```shell
+kubectl -n spire-server port-forward service/spire-tornjak-backend 10000:10000
+kubectl -n spire-server port-forward service/spire-tornjak-frontend 3000:3000
+```
+
+You can now access Tornjak at [localhost:3000](http://localhost:3000).
+
 See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.

From b64c352b157601d5f7d0f2f769c41371bacfcf6f Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Fri, 12 May 2023 08:31:45 -0400
Subject: [PATCH 11/16] Update
 charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
---
 .../spire-server/templates/tests/test-tornjak-connection.yaml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
index a804109..5b38692 100644
--- a/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
+++ b/charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml
@@ -12,7 +12,7 @@ spec:
   securityContext:
     {{- toYaml .Values.podSecurityContext | nindent 4 }}
   containers:
-    - name: wget-tornjak-backend
+    - name: curl-tornjak-backend
       image: cgr.dev/chainguard/bash:latest
       command: ['curl']
       args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.backend" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.port }}']

From 7521cafcc6bfb3c8895401f344dab1af9f9987b2 Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Fri, 12 May 2023 08:31:58 -0400
Subject: [PATCH 12/16] Update
 charts/spire/charts/spire-server/templates/tornjak-config.yaml

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
---
 charts/spire/charts/spire-server/templates/tornjak-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/spire/charts/spire-server/templates/tornjak-config.yaml b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
index 5410356..a112051 100644
--- a/charts/spire/charts/spire-server/templates/tornjak-config.yaml
+++ b/charts/spire/charts/spire-server/templates/tornjak-config.yaml
@@ -20,4 +20,4 @@ data:
       }
     {{- end }}
     }
-    {{- end }}
+{{- end }}

From 657c460e67119315875e3b48868a03789aa8964b Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Fri, 12 May 2023 08:32:10 -0400
Subject: [PATCH 13/16] Update
 charts/spire/charts/tornjak-frontend/templates/service.yaml

Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
---
 charts/spire/charts/tornjak-frontend/templates/service.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/spire/charts/tornjak-frontend/templates/service.yaml b/charts/spire/charts/tornjak-frontend/templates/service.yaml
index 5a49fca..6208d9a 100644
--- a/charts/spire/charts/tornjak-frontend/templates/service.yaml
+++ b/charts/spire/charts/tornjak-frontend/templates/service.yaml
@@ -5,7 +5,7 @@ metadata:
   name: {{ include "tornjak-frontend.fullname" . }}
   {{- with .Values.service.annotations }}
   annotations:
-    {{- toYaml . | nindent 8 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
   labels:
     {{- include "tornjak-frontend.labels" . | nindent 4 }}

From 382e0d4a4711138161fdfc9f34b0256b108bcb55 Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Fri, 12 May 2023 13:10:25 -0400
Subject: [PATCH 14/16] Upgrade Tornjak image to version v1.2.0  (#259)

Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
---
 .github/tests/tornjak/post-install.sh                  |  2 +-
 charts/spire/charts/spire-server/README.md             |  4 ++--
 charts/spire/charts/spire-server/values.yaml           |  4 ++--
 charts/spire/charts/tornjak-frontend/Chart.yaml        |  2 +-
 charts/spire/charts/tornjak-frontend/README.md         |  5 +++--
 .../spire/charts/tornjak-frontend/templates/NOTES.txt  |  1 +
 .../charts/tornjak-frontend/templates/deployment.yaml  | 10 +++++++---
 charts/spire/charts/tornjak-frontend/values.yaml       |  8 +++++++-
 8 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/.github/tests/tornjak/post-install.sh b/.github/tests/tornjak/post-install.sh
index 69ca32e..c5040ec 100755
--- a/.github/tests/tornjak/post-install.sh
+++ b/.github/tests/tornjak/post-install.sh
@@ -12,7 +12,7 @@ source "${SCRIPTPATH}/../common.sh"
 print_helm_releases
 print_spire_workload_status spire-server spire-system
 
-kubectl rollout status --watch --timeout 30s --namespace spire-server deployments.apps spire-tornjak-frontend
+kubectl rollout status --watch --timeout 180s --namespace spire-server deployments.apps spire-tornjak-frontend
 kubectl -n spire-server get deploy spire-tornjak-frontend
 kubectl -n spire-server get service spire-tornjak-frontend
 
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 0eef5fb..7c051c3 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -108,8 +108,8 @@ A Helm chart to install the SPIRE server.
 | topologySpreadConstraints | list | `[]` |  |
 | tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | persistent DB for storing Tornjak specific information |
 | tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) |
-| tornjak.image | object | `{"pullPolicy":"IfNotPresent","registry":"ghcr.io","repository":"spiffe/tornjak-be","version":"v1.0.2"}` | Tornjak API image |
-| tornjak.image.version | string | `"v1.0.2"` | Overrides the image tag whose default is the chart appVersion. |
+| tornjak.image | object | `{"pullPolicy":"IfNotPresent","registry":"ghcr.io","repository":"spiffe/tornjak-backend","version":"v1.2.0"}` | Tornjak API image |
+| tornjak.image.version | string | `"v1.2.0"` | Overrides the image tag whose default is the chart appVersion. |
 | tornjak.service.annotations | object | `{}` |  |
 | tornjak.service.port | int | `10000` |  |
 | tornjak.service.type | string | `"ClusterIP"` |  |
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 2ff322b..904dcc1 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -263,10 +263,10 @@ tornjak:
   # -- Tornjak API image
   image:
     registry: ghcr.io
-    repository: spiffe/tornjak-be
+    repository: spiffe/tornjak-backend
     pullPolicy: IfNotPresent
     # -- Overrides the image tag whose default is the chart appVersion.
-    version: "v1.0.2"
+    version: "v1.2.0"
   service:
     type: ClusterIP
     port: 10000
diff --git a/charts/spire/charts/tornjak-frontend/Chart.yaml b/charts/spire/charts/tornjak-frontend/Chart.yaml
index 9b77c93..15167cf 100644
--- a/charts/spire/charts/tornjak-frontend/Chart.yaml
+++ b/charts/spire/charts/tornjak-frontend/Chart.yaml
@@ -3,7 +3,7 @@ name: tornjak-frontend
 description: A Helm chart to deploy Tornjak frontend
 type: application
 version: 0.1.0
-appVersion: "v1.0.2"
+appVersion: "v1.2.0"
 home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
 sources:
   - https://github.com/spiffe/tornjak
diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md
index c5255c1..fba5649 100644
--- a/charts/spire/charts/tornjak-frontend/README.md
+++ b/charts/spire/charts/tornjak-frontend/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.0.2](https://img.shields.io/badge/AppVersion-v1.0.2-informational?style=flat-square)
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.2.0](https://img.shields.io/badge/AppVersion-v1.2.0-informational?style=flat-square)
 [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
 
 A Helm chart to deploy Tornjak frontend
@@ -53,7 +53,7 @@ port forwarding. See the chart NOTES output for more details.
 | fullnameOverride | string | `""` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.registry | string | `"ghcr.io"` |  |
-| image.repository | string | `"spiffe/tornjak-fe"` |  |
+| image.repository | string | `"spiffe/tornjak-frontend"` |  |
 | image.version | string | `""` | Overrides the image tag whose default is the chart appVersion. |
 | imagePullSecrets | list | `[]` |  |
 | labels | object | `{}` |  |
@@ -67,4 +67,5 @@ port forwarding. See the chart NOTES output for more details.
 | serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
 | serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
 | serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+| spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator |
 ----------------------------------------------
diff --git a/charts/spire/charts/tornjak-frontend/templates/NOTES.txt b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
index 8e08f81..85a568e 100644
--- a/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
+++ b/charts/spire/charts/tornjak-frontend/templates/NOTES.txt
@@ -9,6 +9,7 @@ Tornjak UI (Frontend)
   image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
   pull policy: {{ .Values.image.pullPolicy }}
   Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }}
+  SPIRE health check enabled:  "{{ .Values.spireHealthCheck.enabled }}"
 
 ### WARNING ###
 
diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
index 116b9a1..141b771 100644
--- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
+++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml
@@ -35,15 +35,19 @@ spec:
           env:
             - name: REACT_APP_API_SERVER_URI
               value: {{ include "tornjak-frontend.apiURL" . }}
+            {{- if eq (.Values.spireHealthCheck.enabled | toString) "true" }}
+            - name: REACT_APP_SPIRE_HEALTH_CHECK_ENABLE
+              value: "{{ .Values.spireHealthCheck.enabled }}"
+            {{- end }}
           startupProbe:
             httpGet:
               scheme: HTTP
               port: {{ .Values.service.port }}
             failureThreshold: 6
-            initialDelaySeconds: 60
-            periodSeconds: 30
+            initialDelaySeconds: 120
+            periodSeconds: 45
             successThreshold: 1
-            timeoutSeconds: 10
+            timeoutSeconds: 20
           volumeMounts:
             - name: cache
               mountPath: /usr/src/app/node_modules/.cache
diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml
index 0d1d645..896769f 100644
--- a/charts/spire/charts/tornjak-frontend/values.yaml
+++ b/charts/spire/charts/tornjak-frontend/values.yaml
@@ -4,7 +4,7 @@
 
 image:
   registry: ghcr.io
-  repository: spiffe/tornjak-fe
+  repository: spiffe/tornjak-frontend
   pullPolicy: IfNotPresent
   # -- Overrides the image tag whose default is the chart appVersion.
   version: ""
@@ -54,3 +54,9 @@ service:
 # Since Tornjak Frontend runs in the browser, this URL must be accessible from
 # the machine running a browser.
 apiServerURL: "http://localhost:10000/"  # 👈 Use it for minikube or kind
+
+# SPIRE Healthchecker indicator
+spireHealthCheck:
+  # -- Enables the SPIRE Healthchecker indicator
+  enabled: true
+

From a11cfc99ac23854120f3815127e92e11a3561de3 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Fri, 12 May 2023 19:52:38 +0200
Subject: [PATCH 15/16] Allow to define the resources for tornjak backend

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/charts/spire-server/README.md            |  1 +
 .../charts/spire-server/templates/statefulset.yaml    |  2 ++
 charts/spire/charts/spire-server/values.yaml          | 11 +++++++++++
 3 files changed, 14 insertions(+)

diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 7c051c3..60f3158 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -110,6 +110,7 @@ A Helm chart to install the SPIRE server.
 | tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) |
 | tornjak.image | object | `{"pullPolicy":"IfNotPresent","registry":"ghcr.io","repository":"spiffe/tornjak-backend","version":"v1.2.0"}` | Tornjak API image |
 | tornjak.image.version | string | `"v1.2.0"` | Overrides the image tag whose default is the chart appVersion. |
+| tornjak.resources | object | `{}` |  |
 | tornjak.service.annotations | object | `{}` |  |
 | tornjak.service.port | int | `10000` |  |
 | tornjak.service.type | string | `"ClusterIP"` |  |
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index 3a1322b..dc67dab 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -182,6 +182,8 @@ spec:
             - name: tornjak
               containerPort: 10000
               protocol: TCP
+          resources:
+            {{- toYaml .Values.tornjak.resources | nindent 12 }}
           volumeMounts:
             - name: {{ include "spire-tornjak.config" . }}
               mountPath: /run/spire/tornjak-config
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 904dcc1..96fc425 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -276,3 +276,14 @@ tornjak:
     dataStore:
       driver: "sqlite3"
       file: "/run/spire/data/tornjak.sqlite3"
+  resources: {}
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    # limits:
+    #   cpu: 100m
+    #   memory: 128Mi
+    # requests:
+    #   cpu: 100m
+    #   memory: 128Mi

From ed472aa98bd6de9f2a3148690183aca7658737d8 Mon Sep 17 00:00:00 2001
From: Mariusz Sabath <mrsabath@gmail.com>
Date: Fri, 12 May 2023 18:46:59 -0400
Subject: [PATCH 16/16] Update documentation

Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
---
 charts/spire/README.md                     | 31 ++++++++++++++++++++--
 charts/spire/charts/spire-server/README.md |  4 +--
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/charts/spire/README.md b/charts/spire/README.md
index 7054fe5..582fdfe 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -122,6 +122,7 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.controllerManager.enabled | bool | `true` |  |
 | spire-server.enabled | bool | `true` |  |
 | spire-server.nameOverride | string | `"server"` |  |
+| tornjak-frontend.enabled | bool | `false` |  |
 | spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | The unix socket path to the spire-agent |
 | spiffe-csi-driver.fullnameOverride | string | `""` |  |
 | spiffe-csi-driver.healthChecks.port | int | `9809` |  |
@@ -313,7 +314,7 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | spire-server.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | spire-server.image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
-| spire-server.image.version | string | `""` |  |
+| spire-server.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion. |
 | spire-server.imagePullSecrets | list | `[]` |  |
 | spire-server.initContainers | list | `[]` |  |
 | spire-server.jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
@@ -344,6 +345,14 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
 | spire-server.tolerations | list | `[]` |  |
 | spire-server.topologySpreadConstraints | list | `[]` |  |
+| spire-server.tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | persistent DB for storing Tornjak specific information |
+| spire-server.tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) |
+| spire-server.tornjak.image | object | `{"pullPolicy":"IfNotPresent","registry":"ghcr.io","repository":"spiffe/tornjak-backend","version":"v1.2.0"}` | Tornjak API image |
+| spire-server.tornjak.image.version | string | `"v1.2.0"` | Overrides the image tag whose default is the chart appVersion. |
+| spire-server.tornjak.resources | object | `{}` |  |
+| spire-server.tornjak.service.annotations | object | `{}` |  |
+| spire-server.tornjak.service.port | int | `10000` |  |
+| spire-server.tornjak.service.type | string | `"ClusterIP"` |  |
 | spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
 | spire-server.upstreamAuthority.certManager.enabled | bool | `false` |  |
 | spire-server.upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
@@ -356,6 +365,24 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
 | spire-server.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
 | spire-server.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
-| tornjak-frontend.enabled | bool | `false` |  |
+| tornjak-frontend.apiServerURL | string | `"http://localhost:10000/"` | URL of the Tornjak APIs (backend) Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. |
+| tornjak-frontend.fullnameOverride | string | `""` |  |
+| tornjak-frontend.image.pullPolicy | string | `"IfNotPresent"` |  |
+| tornjak-frontend.image.registry | string | `"ghcr.io"` |  |
+| tornjak-frontend.image.repository | string | `"spiffe/tornjak-frontend"` |  |
+| tornjak-frontend.image.version | string | `""` | Overrides the image tag whose default is the chart appVersion. |
+| tornjak-frontend.imagePullSecrets | list | `[]` |  |
+| tornjak-frontend.labels | object | `{}` |  |
+| tornjak-frontend.nameOverride | string | `""` |  |
+| tornjak-frontend.namespaceOverride | string | `""` |  |
+| tornjak-frontend.podSecurityContext | object | `{}` |  |
+| tornjak-frontend.securityContext | object | `{}` |  |
+| tornjak-frontend.service.annotations | object | `{}` |  |
+| tornjak-frontend.service.port | int | `3000` |  |
+| tornjak-frontend.service.type | string | `"ClusterIP"` |  |
+| tornjak-frontend.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| tornjak-frontend.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| tornjak-frontend.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+| tornjak-frontend.spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator |
 
 ----------------------------------------------
diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 60f3158..d6ac190 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -75,7 +75,7 @@ A Helm chart to install the SPIRE server.
 | image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | image.repository | string | `"spiffe/spire-server"` | The repository within the registry |
-| image.version | string | `""` |  |
+| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion. |
 | imagePullSecrets | list | `[]` |  |
 | initContainers | list | `[]` |  |
 | jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
@@ -114,7 +114,7 @@ A Helm chart to install the SPIRE server.
 | tornjak.service.annotations | object | `{}` |  |
 | tornjak.service.port | int | `10000` |  |
 | tornjak.service.type | string | `"ClusterIP"` |  |
-| trustDomain | string | `"example.org"` |  |
+| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
 | upstreamAuthority.certManager.enabled | bool | `false` |  |
 | upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
 | upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` |  |