diff --git a/.github/actions/setup-deps/action.yml b/.github/actions/setup-deps/action.yml
index 9326a19831..960def637b 100644
--- a/.github/actions/setup-deps/action.yml
+++ b/.github/actions/setup-deps/action.yml
@@ -34,4 +34,9 @@ runs:
     - name: "Install Python requirements with pip"
       shell: bash
       run: python -m pip install awscli packaging
-
+    # Helm Deps
+    - name: "Install Helm Dependencies"
+      shell: bash
+      run: |
+        helm repo add agent https://s3.amazonaws.com/datawire-static-files/charts
+        helm repo update
diff --git a/Makefile b/Makefile
index 18b45ca1e3..5421464752 100644
--- a/Makefile
+++ b/Makefile
@@ -74,6 +74,27 @@ $(call module,ambassador,$(OSS_HOME))
 include $(OSS_HOME)/build-aux/generate.mk
 include $(OSS_HOME)/build-aux/lint.mk
 
+HELM_TEST_IMAGE = quay.io/helmpack/chart-testing:v3.0.0-rc.1
+CHART_DIR := $(OSS_HOME)/build-output/chart-$(patsubst v%,%,$(VERSION))_$(patsubst v%,%,$(CHART_VERSION)).d
+CT_EXEC = docker run --rm -v $(KIND_KUBECONFIG):/root/.kube/config -v $(CHART_DIR) --network host $(HELM_TEST_IMAGE) $(CHART_DIR)/ci.in/ct.sh
+
+chart/lint: preflight-dev-kubeconfig
+	$(CT_EXEC) lint --config /ct.yaml
+.PHONY: chart/lint
+
+chart/k3d-test: preflight-dev-kubeconfig
+	# check if k3d is installed
+	@if ! command -v k3d 2> /dev/null ; then \
+		printf 'k3d not installed, please do that'; \
+	    false; \
+	fi
+.PHONY: chart/k3d-test
+
+chart/test: chart/lint chart/k3d-test ci/setup-k3d
+	$(CT_EXEC) install --config /ct.yaml && \
+		$(MAKE) chart/delete-cluster
+.PHONY: chart/test
+
 .git/hooks/prepare-commit-msg:
 	ln -s $(OSS_HOME)/tools/hooks/prepare-commit-msg $(OSS_HOME)/.git/hooks/prepare-commit-msg
 
@@ -90,9 +111,10 @@ deploy: push preflight-cluster
 	$(MAKE) deploy-only
 .PHONY: deploy
 
-deploy-only: preflight-dev-kubeconfig $(tools/kubectl) build-output/yaml-$(patsubst v%,%,$(VERSION)) $(boguschart_dir)
+deploy-only: preflight-dev-kubeconfig chart/test $(tools/kubectl) build-output/yaml-$(patsubst v%,%,$(VERSION)) $(boguschart_dir)
 	mkdir -p $(OSS_HOME)/build/helm/ && \
 	($(tools/kubectl) --kubeconfig $(DEV_KUBECONFIG) create ns ambassador || true) && \
+	helm dependency build && \
 	helm template ambassador --output-dir $(OSS_HOME)/build/helm -n ambassador $(boguschart_dir) \
 		--set createNamespace=true \
 		--set service.selector.service=ambassador \
diff --git a/build-aux/generate.mk b/build-aux/generate.mk
index df48b5be1d..d4fc3e03df 100644
--- a/build-aux/generate.mk
+++ b/build-aux/generate.mk
@@ -207,7 +207,11 @@ helm.namespace.emissary-defaultns-migration = default
 
 # IF YOU'RE LOOKING FOR *.yaml: recipes, look in main.mk.
 
-$(OSS_HOME)/k8s-config/%/helm-expanded.yaml: \
+helm-dependency: $(boguschart_dir)
+	cd $(boguschart_dir) && helm dependency build
+.PHONY: helm-dependency
+
+$(OSS_HOME)/k8s-config/%/helm-expanded.yaml: helm-dependency \
   $(OSS_HOME)/k8s-config/%/values.yaml \
   $(boguschart_dir)
 	helm template --namespace=$(helm.namespace.$*) --values=$(@D)/values.yaml $(or $(helm.name.$*),$*) $(boguschart_dir) >$@
diff --git a/build-aux/main.mk b/build-aux/main.mk
index aa27fe4fcf..cc04f9a0f7 100644
--- a/build-aux/main.mk
+++ b/build-aux/main.mk
@@ -130,6 +130,7 @@ endif
 	}
 	$(tools/chart-doc-gen) -d $</doc.yaml -t $</readme.tpl -v $@/values.yaml >$@/README.md
 build-output/chart-%.tgz: build-output/chart-%.d
+	cd $< && helm dependency build
 	helm package --destination=$< $<
 	mv $</emissary-ingress-$(word 2,$(subst _, ,$*)).tgz $@
 
diff --git a/charts/emissary-ingress/Chart.lock b/charts/emissary-ingress/Chart.lock
new file mode 100644
index 0000000000..1489418366
--- /dev/null
+++ b/charts/emissary-ingress/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: ambassador-agent
+  repository: https://s3.amazonaws.com/datawire-static-files/charts
+  version: 1.0.18
+digest: sha256:e3e849f13219638d9f10874165c6026bea1598cb487b77cc309cb60d82fed00b
+generated: "2023-11-03T12:55:18.614119-04:00"
diff --git a/charts/emissary-ingress/Chart.yaml.in b/charts/emissary-ingress/Chart.yaml.in
index b974e51986..7f661a7f9b 100644
--- a/charts/emissary-ingress/Chart.yaml.in
+++ b/charts/emissary-ingress/Chart.yaml.in
@@ -1,4 +1,4 @@
-apiVersion: v1
+apiVersion: v2
 appVersion: @version@
 description: A Helm chart for Emissary Ingress
 name: emissary-ingress
@@ -16,12 +16,19 @@ keywords:
 - emissary
 - emissary ingress
 maintainers:
-- name: flydiverny
-  email: markus@maga.se
-- name: kflynn
-  email: flynn@datawire.io
-- name: nbkrause
-  email: nkrause@datawire.io
-- name: lukeshu
-  email: lukeshu@datawire.io
-engine: gotpl
+  - name: Alice Wasko
+    email: alicewasko@datawire.io
+  - name: Hamzah Qudsi
+    email: hqudsi@datawire.io
+  - name: Lance Austin
+    email: laustin@datawire.io
+  - name: Rick Lane
+    email: rlane@datawire.io
+  - name: Tenshin Higashi
+    email: thigashi@datawire.io
+dependencies:
+  - name: ambassador-agent
+    version: 1.0.18
+    repository: https://s3.amazonaws.com/datawire-static-files/charts
+    condition: agent.enabled
+    alias: agent
diff --git a/charts/emissary-ingress/ci.in/ct.sh b/charts/emissary-ingress/ci.in/ct.sh
new file mode 100644
index 0000000000..1b256e4dc2
--- /dev/null
+++ b/charts/emissary-ingress/ci.in/ct.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -ex
+
+helm repo add ambassador-agent https://s3.amazonaws.com/datawire-static-files/charts || helm repo update
+
+ct "$@"
diff --git a/charts/emissary-ingress/ct.yaml b/charts/emissary-ingress/ct.yaml
index 941cd63155..ec1fb3ebed 100644
--- a/charts/emissary-ingress/ct.yaml
+++ b/charts/emissary-ingress/ct.yaml
@@ -19,6 +19,9 @@ charts:
   - ./
 chart-dirs:
   - ./
+chart-repos:
+  - datawire=https://s3.amazonaws.com/datawire-static-files/charts/
+  - datawiredev=https://s3.amazonaws.com/datawire-static-files/charts-dev/
 
 
 # namespace: ambassador
diff --git a/charts/emissary-ingress/templates/ambassador-agent.yaml b/charts/emissary-ingress/templates/ambassador-agent.yaml
deleted file mode 100644
index 1eb4dc96c8..0000000000
--- a/charts/emissary-ingress/templates/ambassador-agent.yaml
+++ /dev/null
@@ -1,284 +0,0 @@
-{{- if .Values.agent.enabled }}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent
-  namespace: {{ include "ambassador.namespace" . }}
-  labels:
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-{{- if .Values.docker.useImagePullSecret }}
-imagePullSecrets:
-- name: {{ .Values.docker.imagePullSecretName }}
-{{- end }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent-config
-  namespace: {{ include "ambassador.namespace" . }}
-  labels:
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "ambassador.fullname" . }}-agent-config
-subjects:
-- kind: ServiceAccount
-  name: {{ include "ambassador.fullname" . }}-agent
-  namespace: {{ include "ambassador.namespace" . }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent-config
-  namespace: {{ include "ambassador.namespace" . }}
-  labels:
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-rules:
-- apiGroups: [""]
-  resources: [ "configmaps" ]
-  verbs: [ "get", "list", "watch" ]
-- apiGroups: [""]
-  resources: [ "secrets"]
-  verbs: [ "get", "list", "watch", "create", "delete", "patch" ]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent
-  labels:
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "ambassador.fullname" . }}-agent
-subjects:
-- kind: ServiceAccount
-  name: {{ include "ambassador.fullname" . }}-agent
-  namespace: {{ include "ambassador.namespace" . }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent
-  labels:
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-aggregationRule:
-  clusterRoleSelectors:
-  - matchLabels:
-      rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
-rules: []
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent-pods
-  labels:
-    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-rules:
-- apiGroups: [""]
-  resources: [ "pods"]
-  verbs: [ "get", "list", "watch" ]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent-deployments
-  labels:
-    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-rules:
-- apiGroups: ["apps", "extensions"]
-  resources: [ "deployments" ]
-  verbs: [ "get", "list", "watch" ]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent-endpoints
-  labels:
-    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-rules:
-- apiGroups: [""]
-  resources: [ "endpoints" ]
-  verbs: [ "get", "list", "watch" ]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent-configmaps
-  labels:
-    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-rules:
-- apiGroups: [""]
-  resources: [ "configmaps" ]
-  verbs: [ "get", "list", "watch" ]
----
-{{- if .Values.agent.createArgoRBAC }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent-rollouts
-  labels:
-    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-rules:
-- apiGroups: ["argoproj.io"]
-  resources: [ "rollouts", "rollouts/status" ]
-  verbs: [ "get", "list", "watch", "patch" ]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent-applications
-  labels:
-    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-rules:
-- apiGroups: ["argoproj.io"]
-  resources: [ "applications" ]
-  verbs: [ "get", "list", "watch" ]
-{{- end }}
-{{ if ne .Values.agent.cloudConnectToken "" }}
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent-cloud-token
-  namespace: {{ include "ambassador.namespace" . }}
-  labels:
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent-cloud-token
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-data:
-  CLOUD_CONNECT_TOKEN: {{ .Values.agent.cloudConnectToken }}
-{{ end }}
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent
-  namespace: {{ include "ambassador.namespace" . }}
-  labels:
-    app.kubernetes.io/name: {{ include "ambassador.fullname" . }}-agent
-    {{- include "ambassador.labels" . | nindent 4 }}
-    product: aes
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: {{ include "ambassador.fullname" . }}-agent
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: {{ include "ambassador.fullname" . }}-agent
-        {{- include "ambassador.labels" . | nindent 8 }}
-        product: aes
-    spec:
-      {{- with .Values.agent.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "ambassador.fullname" . }}-agent
-      containers:
-      - name: agent
-        image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}"
-        imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
-        ports:
-          - containerPort: 8080
-            name: http
-        {{- with .Values.agent.containerSecurityContext }}
-        securityContext:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        env:
-        - name: AGENT_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: AGENT_CONFIG_RESOURCE_NAME
-          value: {{ include "ambassador.fullname" . }}-agent-cloud-token
-        - name: RPC_CONNECTION_ADDRESS
-          value: {{ .Values.agent.rpcAddress }}
-        - name: AES_SNAPSHOT_URL
-          value: "http://{{ include "ambassador.fullname" . }}-admin.{{ include "ambassador.namespace" . }}:{{ .Values.adminService.snapshotPort }}/snapshot-external"
-        - name: AES_REPORT_DIAGNOSTICS_TO_CLOUD
-          value: {{ .Values.agent.reportDiagnostics | quote }}
-        - name: AES_DIAGNOSTICS_URL
-          value: "http://{{ include "ambassador.fullname" . }}-admin.{{ include "ambassador.namespace" . }}:{{ .Values.adminService.port }}/ambassador/v0/diag/?json=true"
-
-      {{- with .Values.agent.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.agent.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.agent.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-
-  {{ if .Values.progressDeadlines }}
-  {{ if hasKey .Values.progressDeadlines "agent" }}
-  progressDeadlineSeconds: {{ .Values.progressDeadlines.agent }}
-  {{- end }}
-  {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "ambassador.fullname" . }}-agent
-  namespace: {{ include "ambassador.namespace" . }}
-  labels:
-    {{- if ne .Values.deploymentTool "getambassador.io" }}
-    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-    helm.sh/chart: {{ include "ambassador.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    {{- if .Values.deploymentTool }}
-    app.kubernetes.io/managed-by: {{ .Values.deploymentTool }}
-    {{- else }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-    {{- end }}
-    {{- end }}
-    product: aes
-spec:
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/name: {{ include "ambassador.fullname" . }}-agent
-    app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
diff --git a/charts/emissary-ingress/values.yaml.in b/charts/emissary-ingress/values.yaml.in
index abe1dcaa24..d81f13e4ac 100644
--- a/charts/emissary-ingress/values.yaml.in
+++ b/charts/emissary-ingress/values.yaml.in
@@ -405,39 +405,13 @@ prometheusExporter: # +doc-gen:break
 # securityContext:
 #   runAsUser: 8888
 
-
-# Configure the ambassador agent
+# ambassador-agent Values.
+# all values under agent key are passed to [the ambassador-agent chart](https://github.com/datawire/ambassador-agent/tree/master/helm/ambassador-agent)
 agent:
-  # If `true`, installs the ambassador-agent Deployment, ServiceAccount and ClusterRole in the ambassador namespace, enabling the Ambassador Cloud connectivity.
+  # If `true`, installs the ambassador-agent Deployment enabling the Ambassador Cloud connectivity.
   enabled: true
-  # API token for reporting snapshots to [Ambassador Cloud](https://app.getambassador.io/cloud/);
-  # If empty, agent will not report snapshots
-  cloudConnectToken: ''
-  # Address of the Ambassador Cloud rpc server.
-  rpcAddress: https://app.getambassador.io/
-
-  # If `true`, Ambassador Agent will report diagnostics to Ambassador Cloud
-  reportDiagnostics: true
-
-  createArgoRBAC: true
-  image:
-    # Leave blank to use image.repository and image.tag
-    tag: 1.0.14
-    repository: docker.io/ambassador/ambassador-agent
-    pullPolicy: IfNotPresent
-
-  podSecurityContext: {}
-  # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#podsecuritycontext-v1-core
-  #  runAsUser: 8888
-
-  containerSecurityContext: {}
-  # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#securitycontext-v1-core
-  # allowPrivilegeEscalation: false
-
-  nodeSelector: {}
-  tolerations: []
-  affinity: {}
 
+  rpcAddress: "https://app.getambassador.io/"
 
 deploymentTool: ''
 
diff --git a/k8s-config/emissary-defaultns/require.yaml b/k8s-config/emissary-defaultns/require.yaml
index 445425d58e..06f1817bf1 100644
--- a/k8s-config/emissary-defaultns/require.yaml
+++ b/k8s-config/emissary-defaultns/require.yaml
@@ -3,7 +3,6 @@ _anchors:
 resources:
   - { kind: Service,            name: emissary-ingress-admin,              namespace: *namespace }
   - { kind: Service,            name: emissary-ingress,                    namespace: *namespace }
-  - { kind: Service,            name: emissary-ingress-agent,              namespace: *namespace }
   - { kind: ClusterRole,        name: emissary-ingress                                           }
   - { kind: ServiceAccount,     name: emissary-ingress,                    namespace: *namespace }
   - { kind: ClusterRoleBinding, name: emissary-ingress                                           }
@@ -11,17 +10,21 @@ resources:
   - { kind: ClusterRole,        name: emissary-ingress-watch                                     }
   - { kind: Deployment,         name: emissary-ingress,                    namespace: *namespace }
   - { kind: Module,             name: ambassador,                          namespace: *namespace }
-  - { kind: ServiceAccount,     name: emissary-ingress-agent,              namespace: *namespace }
-  - { kind: ClusterRoleBinding, name: emissary-ingress-agent                                     }
-  - { kind: ClusterRole,        name: emissary-ingress-agent                                     }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-pods                                }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-rollouts                            }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-applications                        }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-deployments                         }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-endpoints                           }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-configmaps                          }
-  - { kind: Role,               name: emissary-ingress-agent-config,       namespace: *namespace }
-  - { kind: RoleBinding,        name: emissary-ingress-agent-config,       namespace: *namespace }
-  - { kind: Role,               name: emissary-ingress-apiext,             namespace: emissary-system}
-  - { kind: RoleBinding,        name: emissary-ingress-apiext,             namespace: emissary-system}
-  - { kind: Deployment,         name: emissary-ingress-agent,              namespace: *namespace }
+  - { kind: Role,               name: emissary-ingress-apiext,             namespace: emissary-system }
+  - { kind: RoleBinding,        name: emissary-ingress-apiext,             namespace: emissary-system }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-applications                            }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-default-ns                              }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-deployments                             }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-endpoints                               }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-ingresses                               }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-pods                                    }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-rollouts                                }
+  - { kind: ClusterRole,        name: emissary-ingress-agent                                         }
+  - { kind: ClusterRoleBinding, name: emissary-ingress-agent                                         }
+  - { kind: Deployment,         name: emissary-ingress-agent,                  namespace: *namespace }
+  - { kind: Role,               name: emissary-ingress-agent-config,           namespace: *namespace }
+  - { kind: Role,               name: emissary-ingress-agent-leaderelection,   namespace: *namespace }
+  - { kind: RoleBinding,        name: emissary-ingress-agent-config,           namespace: *namespace }
+  - { kind: RoleBinding,        name: emissary-ingress-agent-leaderelection,   namespace: *namespace }
+  - { kind: Service,            name: emissary-ingress-agent,                  namespace: *namespace }
+  - { kind: ServiceAccount,     name: emissary-ingress-agent,                  namespace: *namespace }
diff --git a/k8s-config/emissary-defaultns/values.yaml b/k8s-config/emissary-defaultns/values.yaml
index 8ba3e0d574..8c65d585fc 100644
--- a/k8s-config/emissary-defaultns/values.yaml
+++ b/k8s-config/emissary-defaultns/values.yaml
@@ -32,3 +32,7 @@ image:
 waitForApiext:
   enabled: true
   createRoles: true
+
+agent:
+  enabled: true
+
diff --git a/k8s-config/emissary-emissaryns/require.yaml b/k8s-config/emissary-emissaryns/require.yaml
index 42146be22d..33ee997a80 100644
--- a/k8s-config/emissary-emissaryns/require.yaml
+++ b/k8s-config/emissary-emissaryns/require.yaml
@@ -3,7 +3,6 @@ _anchors:
 resources:
   - { kind: Service,            name: emissary-ingress-admin,              namespace: *namespace }
   - { kind: Service,            name: emissary-ingress,                    namespace: *namespace }
-  - { kind: Service,            name: emissary-ingress-agent,              namespace: *namespace }
   - { kind: ClusterRole,        name: emissary-ingress                                           }
   - { kind: ServiceAccount,     name: emissary-ingress,                    namespace: *namespace }
   - { kind: ClusterRoleBinding, name: emissary-ingress                                           }
@@ -11,17 +10,22 @@ resources:
   - { kind: ClusterRole,        name: emissary-ingress-watch                                     }
   - { kind: Deployment,         name: emissary-ingress,                    namespace: *namespace }
   - { kind: Module,             name: ambassador,                          namespace: *namespace }
-  - { kind: ServiceAccount,     name: emissary-ingress-agent,              namespace: *namespace }
-  - { kind: ClusterRoleBinding, name: emissary-ingress-agent                                     }
-  - { kind: ClusterRole,        name: emissary-ingress-agent                                     }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-pods                                }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-rollouts                            }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-applications                        }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-deployments                         }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-endpoints                           }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-configmaps                          }
-  - { kind: Role,               name: emissary-ingress-agent-config,       namespace: *namespace }
-  - { kind: RoleBinding,        name: emissary-ingress-agent-config,       namespace: *namespace }
   - { kind: Role,               name: emissary-ingress-apiext,             namespace: emissary-system}
   - { kind: RoleBinding,        name: emissary-ingress-apiext,             namespace: emissary-system}
-  - { kind: Deployment,         name: emissary-ingress-agent,              namespace: *namespace }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-applications                            }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-default-ns                              }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-deployments                             }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-endpoints                               }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-ingresses                               }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-pods                                    }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-rollouts                                }
+  - { kind: ClusterRole,        name: emissary-ingress-agent                                         }
+  - { kind: ClusterRoleBinding, name: emissary-ingress-agent                                         }
+  - { kind: Deployment,         name: emissary-ingress-agent,                  namespace: *namespace }
+  - { kind: Role,               name: emissary-ingress-agent-config,           namespace: *namespace }
+  - { kind: Role,               name: emissary-ingress-agent-leaderelection,   namespace: *namespace }
+  - { kind: RoleBinding,        name: emissary-ingress-agent-config,           namespace: *namespace }
+  - { kind: RoleBinding,        name: emissary-ingress-agent-leaderelection,   namespace: *namespace }
+  - { kind: Service,            name: emissary-ingress-agent,                  namespace: *namespace }
+  - { kind: ServiceAccount,     name: emissary-ingress-agent,                  namespace: *namespace }
+
diff --git a/k8s-config/emissary-emissaryns/values.yaml b/k8s-config/emissary-emissaryns/values.yaml
index db88da0250..c0bc7fce38 100644
--- a/k8s-config/emissary-emissaryns/values.yaml
+++ b/k8s-config/emissary-emissaryns/values.yaml
@@ -33,3 +33,6 @@ image:
 waitForApiext:
   enabled: true
   createRoles: true
+
+agent:
+  enabled: true
diff --git a/manifests/emissary/emissary-defaultns.yaml.in b/manifests/emissary/emissary-defaultns.yaml.in
index cd7e87ac4b..bfd91d5051 100644
--- a/manifests/emissary/emissary-defaultns.yaml.in
+++ b/manifests/emissary/emissary-defaultns.yaml.in
@@ -74,23 +74,6 @@ spec:
     profile: main
   type: LoadBalancer
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    product: aes
-  name: emissary-ingress-agent
-  namespace: default
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: http
-  selector:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/name: emissary-ingress-agent
----
 aggregationRule:
   clusterRoleSelectors:
   - matchLabels:
@@ -407,113 +390,129 @@ spec:
       allow_non_local: true
       enabled: false
 ---
-apiVersion: v1
-kind: ServiceAccount
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/name: emissary-ingress
     app.kubernetes.io/part-of: emissary-ingress
     product: aes
-  name: emissary-ingress-agent
-  namespace: default
+    rbac.getambassador.io/role-group: emissary-ingress
+  name: emissary-ingress-apiext
+  namespace: emissary-system
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/name: emissary-ingress
     app.kubernetes.io/part-of: emissary-ingress
     product: aes
-  name: emissary-ingress-agent
+  name: emissary-ingress-apiext
+  namespace: emissary-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: emissary-ingress-agent
+  kind: Role
+  name: emissary-ingress-apiext
 subjects:
 - kind: ServiceAccount
-  name: emissary-ingress-agent
+  name: emissary-ingress
   namespace: default
 ---
-aggregationRule:
-  clusterRoleSelectors:
-  - matchLabels:
-      rbac.getambassador.io/role-group: emissary-ingress-agent
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
-  name: emissary-ingress-agent
-rules: []
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+    rbac.getambassador.io/role-group: emissary-ingress-agent
+  name: emissary-ingress-agent-applications
+rules:
+- apiGroups:
+  - argoproj.io
+  resources:
+  - applications
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-pods
+  name: emissary-ingress-agent-default-ns
 rules:
 - apiGroups:
   - ""
+  resourceNames:
+  - default
   resources:
-  - pods
+  - namespaces
   verbs:
   - get
-  - list
-  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-rollouts
+  name: emissary-ingress-agent-deployments
 rules:
 - apiGroups:
-  - argoproj.io
+  - apps
+  - extensions
   resources:
-  - rollouts
-  - rollouts/status
+  - deployments
   verbs:
   - get
   - list
   - watch
-  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-applications
+  name: emissary-ingress-agent-endpoints
 rules:
 - apiGroups:
-  - argoproj.io
+  - ""
   resources:
-  - applications
+  - endpoints
+  - services
   verbs:
   - get
   - list
@@ -524,18 +523,18 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-deployments
+  name: emissary-ingress-agent-ingresses
 rules:
 - apiGroups:
-  - apps
+  - networking.k8s.io
   - extensions
   resources:
-  - deployments
+  - ingresses
   verbs:
   - get
   - list
@@ -546,17 +545,17 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-endpoints
+  name: emissary-ingress-agent-pods
 rules:
 - apiGroups:
   - ""
   resources:
-  - endpoints
+  - pods
   verbs:
   - get
   - list
@@ -567,31 +566,114 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-configmaps
+  name: emissary-ingress-agent-rollouts
 rules:
 - apiGroups:
-  - ""
+  - argoproj.io
   resources:
-  - configmaps
+  - rollouts
+  - rollouts/status
   verbs:
   - get
   - list
   - watch
+  - patch
+---
+aggregationRule:
+  clusterRoleSelectors:
+  - matchLabels:
+      rbac.getambassador.io/role-group: emissary-ingress-agent
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent
+rules: []
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: emissary-ingress-agent
+subjects:
+- kind: ServiceAccount
+  name: emissary-ingress-agent
+  namespace: default
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent
+  namespace: default
+spec:
+  replicas: null
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: emissary-ingress
+      app.kubernetes.io/name: agent
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: emissary-ingress
+        app.kubernetes.io/name: agent
+    spec:
+      containers:
+      - env:
+        - name: LOG_LEVEL
+          value: info
+        - name: AGENT_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: AGENT_CONFIG_RESOURCE_NAME
+          value: emissary-ingress-agent-cloud-token
+        - name: RPC_CONNECTION_ADDRESS
+          value: https://app.getambassador.io/
+        image: docker.io/ambassador/ambassador-agent:1.0.18
+        imagePullPolicy: IfNotPresent
+        name: agent
+        ports:
+        - containerPort: 8080
+          name: http
+        resources: {}
+        securityContext: {}
+      securityContext: {}
+      serviceAccountName: emissary-ingress-agent
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-config
   namespace: default
 rules:
@@ -610,20 +692,39 @@ rules:
   verbs:
   - get
   - list
-  - watch
   - create
   - delete
   - patch
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent-leaderelection
+  namespace: default
+rules:
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-config
   namespace: default
 roleRef:
@@ -636,94 +737,54 @@ subjects:
   namespace: default
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
-    rbac.getambassador.io/role-group: emissary-ingress
-  name: emissary-ingress-apiext
-  namespace: emissary-system
-rules:
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
-  name: emissary-ingress-apiext
-  namespace: emissary-system
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent-leaderelection
+  namespace: default
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: emissary-ingress-apiext
+  name: emissary-ingress-agent-leaderelection
 subjects:
 - kind: ServiceAccount
-  name: emissary-ingress
+  name: emissary-ingress-agent
   namespace: default
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: v1
+kind: Service
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
   namespace: default
 spec:
-  progressDeadlineSeconds: 600
-  replicas: 1
+  ports:
+  - name: http
+    port: 80
+    targetPort: http
   selector:
-    matchLabels:
-      app.kubernetes.io/instance: emissary-ingress
-      app.kubernetes.io/name: emissary-ingress-agent
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: emissary-ingress
-        app.kubernetes.io/managed-by: getambassador.io
-        app.kubernetes.io/name: emissary-ingress-agent
-        app.kubernetes.io/part-of: emissary-ingress
-        product: aes
-    spec:
-      containers:
-      - env:
-        - name: AGENT_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: AGENT_CONFIG_RESOURCE_NAME
-          value: emissary-ingress-agent-cloud-token
-        - name: RPC_CONNECTION_ADDRESS
-          value: https://app.getambassador.io/
-        - name: AES_SNAPSHOT_URL
-          value: http://emissary-ingress-admin.default:8005/snapshot-external
-        - name: AES_REPORT_DIAGNOSTICS_TO_CLOUD
-          value: "true"
-        - name: AES_DIAGNOSTICS_URL
-          value: http://emissary-ingress-admin.default:8877/ambassador/v0/diag/?json=true
-        image: docker.io/ambassador/ambassador-agent:1.0.14
-        imagePullPolicy: IfNotPresent
-        name: agent
-        ports:
-        - containerPort: 8080
-          name: http
-      serviceAccountName: emissary-ingress-agent
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/name: agent
+  type: ClusterIP
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent
+  namespace: default
diff --git a/manifests/emissary/emissary-emissaryns.yaml.in b/manifests/emissary/emissary-emissaryns.yaml.in
index f4159f11d1..2baef4f715 100644
--- a/manifests/emissary/emissary-emissaryns.yaml.in
+++ b/manifests/emissary/emissary-emissaryns.yaml.in
@@ -74,23 +74,6 @@ spec:
     profile: main
   type: LoadBalancer
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    product: aes
-  name: emissary-ingress-agent
-  namespace: emissary
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: http
-  selector:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/name: emissary-ingress-agent
----
 aggregationRule:
   clusterRoleSelectors:
   - matchLabels:
@@ -407,113 +390,129 @@ spec:
       allow_non_local: true
       enabled: false
 ---
-apiVersion: v1
-kind: ServiceAccount
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/name: emissary-ingress
     app.kubernetes.io/part-of: emissary-ingress
     product: aes
-  name: emissary-ingress-agent
-  namespace: emissary
+    rbac.getambassador.io/role-group: emissary-ingress
+  name: emissary-ingress-apiext
+  namespace: emissary-system
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/name: emissary-ingress
     app.kubernetes.io/part-of: emissary-ingress
     product: aes
-  name: emissary-ingress-agent
+  name: emissary-ingress-apiext
+  namespace: emissary-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: emissary-ingress-agent
+  kind: Role
+  name: emissary-ingress-apiext
 subjects:
 - kind: ServiceAccount
-  name: emissary-ingress-agent
+  name: emissary-ingress
   namespace: emissary
 ---
-aggregationRule:
-  clusterRoleSelectors:
-  - matchLabels:
-      rbac.getambassador.io/role-group: emissary-ingress-agent
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
-  name: emissary-ingress-agent
-rules: []
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+    rbac.getambassador.io/role-group: emissary-ingress-agent
+  name: emissary-ingress-agent-applications
+rules:
+- apiGroups:
+  - argoproj.io
+  resources:
+  - applications
+  verbs:
+  - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-pods
+  name: emissary-ingress-agent-default-ns
 rules:
 - apiGroups:
   - ""
+  resourceNames:
+  - default
   resources:
-  - pods
+  - namespaces
   verbs:
   - get
-  - list
-  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-rollouts
+  name: emissary-ingress-agent-deployments
 rules:
 - apiGroups:
-  - argoproj.io
+  - apps
+  - extensions
   resources:
-  - rollouts
-  - rollouts/status
+  - deployments
   verbs:
   - get
   - list
   - watch
-  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-applications
+  name: emissary-ingress-agent-endpoints
 rules:
 - apiGroups:
-  - argoproj.io
+  - ""
   resources:
-  - applications
+  - endpoints
+  - services
   verbs:
   - get
   - list
@@ -524,18 +523,18 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-deployments
+  name: emissary-ingress-agent-ingresses
 rules:
 - apiGroups:
-  - apps
+  - networking.k8s.io
   - extensions
   resources:
-  - deployments
+  - ingresses
   verbs:
   - get
   - list
@@ -546,17 +545,17 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-endpoints
+  name: emissary-ingress-agent-pods
 rules:
 - apiGroups:
   - ""
   resources:
-  - endpoints
+  - pods
   verbs:
   - get
   - list
@@ -567,31 +566,114 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-configmaps
+  name: emissary-ingress-agent-rollouts
 rules:
 - apiGroups:
-  - ""
+  - argoproj.io
   resources:
-  - configmaps
+  - rollouts
+  - rollouts/status
   verbs:
   - get
   - list
   - watch
+  - patch
+---
+aggregationRule:
+  clusterRoleSelectors:
+  - matchLabels:
+      rbac.getambassador.io/role-group: emissary-ingress-agent
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent
+rules: []
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: emissary-ingress-agent
+subjects:
+- kind: ServiceAccount
+  name: emissary-ingress-agent
+  namespace: emissary
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent
+  namespace: emissary
+spec:
+  replicas: null
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: emissary-ingress
+      app.kubernetes.io/name: agent
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: emissary-ingress
+        app.kubernetes.io/name: agent
+    spec:
+      containers:
+      - env:
+        - name: LOG_LEVEL
+          value: info
+        - name: AGENT_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: AGENT_CONFIG_RESOURCE_NAME
+          value: emissary-ingress-agent-cloud-token
+        - name: RPC_CONNECTION_ADDRESS
+          value: https://app.getambassador.io/
+        image: docker.io/ambassador/ambassador-agent:1.0.18
+        imagePullPolicy: IfNotPresent
+        name: agent
+        ports:
+        - containerPort: 8080
+          name: http
+        resources: {}
+        securityContext: {}
+      securityContext: {}
+      serviceAccountName: emissary-ingress-agent
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-config
   namespace: emissary
 rules:
@@ -610,20 +692,39 @@ rules:
   verbs:
   - get
   - list
-  - watch
   - create
   - delete
   - patch
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent-leaderelection
+  namespace: emissary
+rules:
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-config
   namespace: emissary
 roleRef:
@@ -636,94 +737,54 @@ subjects:
   namespace: emissary
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
-    rbac.getambassador.io/role-group: emissary-ingress
-  name: emissary-ingress-apiext
-  namespace: emissary-system
-rules:
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
-  name: emissary-ingress-apiext
-  namespace: emissary-system
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent-leaderelection
+  namespace: emissary
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: emissary-ingress-apiext
+  name: emissary-ingress-agent-leaderelection
 subjects:
 - kind: ServiceAccount
-  name: emissary-ingress
+  name: emissary-ingress-agent
   namespace: emissary
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: v1
+kind: Service
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress-agent
-    app.kubernetes.io/part-of: emissary-ingress
-    product: aes
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
   namespace: emissary
 spec:
-  progressDeadlineSeconds: 600
-  replicas: 1
+  ports:
+  - name: http
+    port: 80
+    targetPort: http
   selector:
-    matchLabels:
-      app.kubernetes.io/instance: emissary-ingress
-      app.kubernetes.io/name: emissary-ingress-agent
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: emissary-ingress
-        app.kubernetes.io/managed-by: getambassador.io
-        app.kubernetes.io/name: emissary-ingress-agent
-        app.kubernetes.io/part-of: emissary-ingress
-        product: aes
-    spec:
-      containers:
-      - env:
-        - name: AGENT_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: AGENT_CONFIG_RESOURCE_NAME
-          value: emissary-ingress-agent-cloud-token
-        - name: RPC_CONNECTION_ADDRESS
-          value: https://app.getambassador.io/
-        - name: AES_SNAPSHOT_URL
-          value: http://emissary-ingress-admin.emissary:8005/snapshot-external
-        - name: AES_REPORT_DIAGNOSTICS_TO_CLOUD
-          value: "true"
-        - name: AES_DIAGNOSTICS_URL
-          value: http://emissary-ingress-admin.emissary:8877/ambassador/v0/diag/?json=true
-        image: docker.io/ambassador/ambassador-agent:1.0.14
-        imagePullPolicy: IfNotPresent
-        name: agent
-        ports:
-        - containerPort: 8080
-          name: http
-      serviceAccountName: emissary-ingress-agent
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/name: agent
+  type: ClusterIP
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: agent
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
+  name: emissary-ingress-agent
+  namespace: emissary