From a5a4c688b1b0329b2aea71f2e6c49a48b3e757b1 Mon Sep 17 00:00:00 2001
From: Tenshin Higashi <thigashi@datawire.io>
Date: Wed, 8 Nov 2023 11:04:15 -0500
Subject: [PATCH 1/2] Revert "Updating Agent"

This reverts commit 81de0a26fc57b23587ccdce33ce321a05e8d6e07.

Signed-off-by: Tenshin Higashi <thigashi@datawire.io>
---
 charts/emissary-ingress/Chart.lock            |  6 +-
 charts/emissary-ingress/Chart.yaml.in         |  2 +-
 manifests/emissary/emissary-defaultns.yaml.in | 68 +++++++++----------
 .../emissary/emissary-emissaryns.yaml.in      | 68 +++++++++----------
 4 files changed, 72 insertions(+), 72 deletions(-)

diff --git a/charts/emissary-ingress/Chart.lock b/charts/emissary-ingress/Chart.lock
index 4bd81d9233..1489418366 100644
--- a/charts/emissary-ingress/Chart.lock
+++ b/charts/emissary-ingress/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: ambassador-agent
   repository: https://s3.amazonaws.com/datawire-static-files/charts
-  version: 1.0.20
-digest: sha256:456db1b8c5478e0a373231fa3284fc181b146dd4e88abc19fd11916cb667a1f4
-generated: "2023-11-07T01:18:03.271677-05:00"
+  version: 1.0.18
+digest: sha256:e3e849f13219638d9f10874165c6026bea1598cb487b77cc309cb60d82fed00b
+generated: "2023-11-03T12:55:18.614119-04:00"
diff --git a/charts/emissary-ingress/Chart.yaml.in b/charts/emissary-ingress/Chart.yaml.in
index b420db0014..7f661a7f9b 100644
--- a/charts/emissary-ingress/Chart.yaml.in
+++ b/charts/emissary-ingress/Chart.yaml.in
@@ -28,7 +28,7 @@ maintainers:
     email: thigashi@datawire.io
 dependencies:
   - name: ambassador-agent
-    version: 1.0.20
+    version: 1.0.18
     repository: https://s3.amazonaws.com/datawire-static-files/charts
     condition: agent.enabled
     alias: agent
diff --git a/manifests/emissary/emissary-defaultns.yaml.in b/manifests/emissary/emissary-defaultns.yaml.in
index 50d989dc2f..bfd91d5051 100644
--- a/manifests/emissary/emissary-defaultns.yaml.in
+++ b/manifests/emissary/emissary-defaultns.yaml.in
@@ -439,8 +439,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-applications
 rules:
@@ -460,8 +460,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-default-ns
 rules:
@@ -481,8 +481,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-deployments
 rules:
@@ -503,8 +503,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-endpoints
 rules:
@@ -525,8 +525,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-ingresses
 rules:
@@ -547,8 +547,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-pods
 rules:
@@ -568,8 +568,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-rollouts
 rules:
@@ -595,8 +595,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
 rules: []
 ---
@@ -607,8 +607,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -626,12 +626,12 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
   namespace: default
 spec:
-  replicas: 1
+  replicas: null
   selector:
     matchLabels:
       app.kubernetes.io/instance: emissary-ingress
@@ -654,7 +654,7 @@ spec:
           value: emissary-ingress-agent-cloud-token
         - name: RPC_CONNECTION_ADDRESS
           value: https://app.getambassador.io/
-        image: docker.io/ambassador/ambassador-agent:1.0.20
+        image: docker.io/ambassador/ambassador-agent:1.0.18
         imagePullPolicy: IfNotPresent
         name: agent
         ports:
@@ -672,8 +672,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-config
   namespace: default
 rules:
@@ -704,8 +704,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-leaderelection
   namespace: default
 rules:
@@ -723,8 +723,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-config
   namespace: default
 roleRef:
@@ -743,8 +743,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-leaderelection
   namespace: default
 roleRef:
@@ -763,8 +763,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
   namespace: default
 spec:
@@ -784,7 +784,7 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
   namespace: default
diff --git a/manifests/emissary/emissary-emissaryns.yaml.in b/manifests/emissary/emissary-emissaryns.yaml.in
index ef5c1611d9..2baef4f715 100644
--- a/manifests/emissary/emissary-emissaryns.yaml.in
+++ b/manifests/emissary/emissary-emissaryns.yaml.in
@@ -439,8 +439,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-applications
 rules:
@@ -460,8 +460,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-default-ns
 rules:
@@ -481,8 +481,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-deployments
 rules:
@@ -503,8 +503,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-endpoints
 rules:
@@ -525,8 +525,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-ingresses
 rules:
@@ -547,8 +547,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-pods
 rules:
@@ -568,8 +568,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
     rbac.getambassador.io/role-group: emissary-ingress-agent
   name: emissary-ingress-agent-rollouts
 rules:
@@ -595,8 +595,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
 rules: []
 ---
@@ -607,8 +607,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -626,12 +626,12 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
   namespace: emissary
 spec:
-  replicas: 1
+  replicas: null
   selector:
     matchLabels:
       app.kubernetes.io/instance: emissary-ingress
@@ -654,7 +654,7 @@ spec:
           value: emissary-ingress-agent-cloud-token
         - name: RPC_CONNECTION_ADDRESS
           value: https://app.getambassador.io/
-        image: docker.io/ambassador/ambassador-agent:1.0.20
+        image: docker.io/ambassador/ambassador-agent:1.0.18
         imagePullPolicy: IfNotPresent
         name: agent
         ports:
@@ -672,8 +672,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-config
   namespace: emissary
 rules:
@@ -704,8 +704,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-leaderelection
   namespace: emissary
 rules:
@@ -723,8 +723,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-config
   namespace: emissary
 roleRef:
@@ -743,8 +743,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent-leaderelection
   namespace: emissary
 roleRef:
@@ -763,8 +763,8 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
   namespace: emissary
 spec:
@@ -784,7 +784,7 @@ metadata:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.20
-    helm.sh/chart: agent-1.0.20
+    app.kubernetes.io/version: 1.0.18
+    helm.sh/chart: agent-1.0.18
   name: emissary-ingress-agent
   namespace: emissary

From cf7ad46a89a5c92f4b2606aa35cd7143787420d5 Mon Sep 17 00:00:00 2001
From: Tenshin Higashi <thigashi@datawire.io>
Date: Wed, 8 Nov 2023 11:04:59 -0500
Subject: [PATCH 2/2] Revert "Moving agent helm chart to dependency (#5328)"

This reverts commit c5fc4a7ce46627b69a1a5659a8d85f8d0519a471.

Signed-off-by: Tenshin Higashi <thigashi@datawire.io>
---
 .github/actions/setup-deps/action.yml         |   7 +-
 Makefile                                      |  24 +-
 build-aux/generate.mk                         |   6 +-
 build-aux/main.mk                             |   1 -
 charts/emissary-ingress/Chart.lock            |   6 -
 charts/emissary-ingress/Chart.yaml.in         |  27 +-
 charts/emissary-ingress/ci.in/ct.sh           |   7 -
 charts/emissary-ingress/ct.yaml               |   3 -
 .../templates/ambassador-agent.yaml           | 284 +++++++++++++
 charts/emissary-ingress/values.yaml.in        |  34 +-
 k8s-config/emissary-defaultns/require.yaml    |  33 +-
 k8s-config/emissary-defaultns/values.yaml     |   4 -
 k8s-config/emissary-emissaryns/require.yaml   |  30 +-
 k8s-config/emissary-emissaryns/values.yaml    |   3 -
 manifests/emissary/emissary-defaultns.yaml.in | 389 ++++++++----------
 .../emissary/emissary-emissaryns.yaml.in      | 389 ++++++++----------
 16 files changed, 683 insertions(+), 564 deletions(-)
 delete mode 100644 charts/emissary-ingress/Chart.lock
 delete mode 100644 charts/emissary-ingress/ci.in/ct.sh
 create mode 100644 charts/emissary-ingress/templates/ambassador-agent.yaml

diff --git a/.github/actions/setup-deps/action.yml b/.github/actions/setup-deps/action.yml
index 960def637b..9326a19831 100644
--- a/.github/actions/setup-deps/action.yml
+++ b/.github/actions/setup-deps/action.yml
@@ -34,9 +34,4 @@ runs:
     - name: "Install Python requirements with pip"
       shell: bash
       run: python -m pip install awscli packaging
-    # Helm Deps
-    - name: "Install Helm Dependencies"
-      shell: bash
-      run: |
-        helm repo add agent https://s3.amazonaws.com/datawire-static-files/charts
-        helm repo update
+
diff --git a/Makefile b/Makefile
index 57cdd50570..18b45ca1e3 100644
--- a/Makefile
+++ b/Makefile
@@ -74,27 +74,6 @@ $(call module,ambassador,$(OSS_HOME))
 include $(OSS_HOME)/build-aux/generate.mk
 include $(OSS_HOME)/build-aux/lint.mk
 
-HELM_TEST_IMAGE = quay.io/helmpack/chart-testing:v3.10.1
-CHART_DIR := $(OSS_HOME)/build-output/chart-$(patsubst v%,%,$(VERSION))_$(patsubst v%,%,$(CHART_VERSION)).d
-CT_EXEC = docker run --rm -v $(KIND_KUBECONFIG):/root/.kube/config -v $(CHART_DIR) --network host $(HELM_TEST_IMAGE) $(CHART_DIR)/ci.in/ct.sh
-
-chart/lint: preflight-dev-kubeconfig
-	$(CT_EXEC) lint --config /ct.yaml
-.PHONY: chart/lint
-
-chart/k3d-test: preflight-dev-kubeconfig
-	# check if k3d is installed
-	@if ! command -v k3d 2> /dev/null ; then \
-		printf 'k3d not installed, please do that'; \
-	    false; \
-	fi
-.PHONY: chart/k3d-test
-
-chart/test: chart/lint chart/k3d-test ci/setup-k3d
-	$(CT_EXEC) install --config /ct.yaml && \
-		$(MAKE) chart/delete-cluster
-.PHONY: chart/test
-
 .git/hooks/prepare-commit-msg:
 	ln -s $(OSS_HOME)/tools/hooks/prepare-commit-msg $(OSS_HOME)/.git/hooks/prepare-commit-msg
 
@@ -111,10 +90,9 @@ deploy: push preflight-cluster
 	$(MAKE) deploy-only
 .PHONY: deploy
 
-deploy-only: preflight-dev-kubeconfig chart/test $(tools/kubectl) build-output/yaml-$(patsubst v%,%,$(VERSION)) $(boguschart_dir)
+deploy-only: preflight-dev-kubeconfig $(tools/kubectl) build-output/yaml-$(patsubst v%,%,$(VERSION)) $(boguschart_dir)
 	mkdir -p $(OSS_HOME)/build/helm/ && \
 	($(tools/kubectl) --kubeconfig $(DEV_KUBECONFIG) create ns ambassador || true) && \
-	helm dependency build && \
 	helm template ambassador --output-dir $(OSS_HOME)/build/helm -n ambassador $(boguschart_dir) \
 		--set createNamespace=true \
 		--set service.selector.service=ambassador \
diff --git a/build-aux/generate.mk b/build-aux/generate.mk
index d4fc3e03df..df48b5be1d 100644
--- a/build-aux/generate.mk
+++ b/build-aux/generate.mk
@@ -207,11 +207,7 @@ helm.namespace.emissary-defaultns-migration = default
 
 # IF YOU'RE LOOKING FOR *.yaml: recipes, look in main.mk.
 
-helm-dependency: $(boguschart_dir)
-	cd $(boguschart_dir) && helm dependency build
-.PHONY: helm-dependency
-
-$(OSS_HOME)/k8s-config/%/helm-expanded.yaml: helm-dependency \
+$(OSS_HOME)/k8s-config/%/helm-expanded.yaml: \
   $(OSS_HOME)/k8s-config/%/values.yaml \
   $(boguschart_dir)
 	helm template --namespace=$(helm.namespace.$*) --values=$(@D)/values.yaml $(or $(helm.name.$*),$*) $(boguschart_dir) >$@
diff --git a/build-aux/main.mk b/build-aux/main.mk
index cc04f9a0f7..aa27fe4fcf 100644
--- a/build-aux/main.mk
+++ b/build-aux/main.mk
@@ -130,7 +130,6 @@ endif
 	}
 	$(tools/chart-doc-gen) -d $</doc.yaml -t $</readme.tpl -v $@/values.yaml >$@/README.md
 build-output/chart-%.tgz: build-output/chart-%.d
-	cd $< && helm dependency build
 	helm package --destination=$< $<
 	mv $</emissary-ingress-$(word 2,$(subst _, ,$*)).tgz $@
 
diff --git a/charts/emissary-ingress/Chart.lock b/charts/emissary-ingress/Chart.lock
deleted file mode 100644
index 1489418366..0000000000
--- a/charts/emissary-ingress/Chart.lock
+++ /dev/null
@@ -1,6 +0,0 @@
-dependencies:
-- name: ambassador-agent
-  repository: https://s3.amazonaws.com/datawire-static-files/charts
-  version: 1.0.18
-digest: sha256:e3e849f13219638d9f10874165c6026bea1598cb487b77cc309cb60d82fed00b
-generated: "2023-11-03T12:55:18.614119-04:00"
diff --git a/charts/emissary-ingress/Chart.yaml.in b/charts/emissary-ingress/Chart.yaml.in
index 7f661a7f9b..b974e51986 100644
--- a/charts/emissary-ingress/Chart.yaml.in
+++ b/charts/emissary-ingress/Chart.yaml.in
@@ -1,4 +1,4 @@
-apiVersion: v2
+apiVersion: v1
 appVersion: @version@
 description: A Helm chart for Emissary Ingress
 name: emissary-ingress
@@ -16,19 +16,12 @@ keywords:
 - emissary
 - emissary ingress
 maintainers:
-  - name: Alice Wasko
-    email: alicewasko@datawire.io
-  - name: Hamzah Qudsi
-    email: hqudsi@datawire.io
-  - name: Lance Austin
-    email: laustin@datawire.io
-  - name: Rick Lane
-    email: rlane@datawire.io
-  - name: Tenshin Higashi
-    email: thigashi@datawire.io
-dependencies:
-  - name: ambassador-agent
-    version: 1.0.18
-    repository: https://s3.amazonaws.com/datawire-static-files/charts
-    condition: agent.enabled
-    alias: agent
+- name: flydiverny
+  email: markus@maga.se
+- name: kflynn
+  email: flynn@datawire.io
+- name: nbkrause
+  email: nkrause@datawire.io
+- name: lukeshu
+  email: lukeshu@datawire.io
+engine: gotpl
diff --git a/charts/emissary-ingress/ci.in/ct.sh b/charts/emissary-ingress/ci.in/ct.sh
deleted file mode 100644
index 1b256e4dc2..0000000000
--- a/charts/emissary-ingress/ci.in/ct.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/sh
-
-set -ex
-
-helm repo add ambassador-agent https://s3.amazonaws.com/datawire-static-files/charts || helm repo update
-
-ct "$@"
diff --git a/charts/emissary-ingress/ct.yaml b/charts/emissary-ingress/ct.yaml
index ec1fb3ebed..941cd63155 100644
--- a/charts/emissary-ingress/ct.yaml
+++ b/charts/emissary-ingress/ct.yaml
@@ -19,9 +19,6 @@ charts:
   - ./
 chart-dirs:
   - ./
-chart-repos:
-  - datawire=https://s3.amazonaws.com/datawire-static-files/charts/
-  - datawiredev=https://s3.amazonaws.com/datawire-static-files/charts-dev/
 
 
 # namespace: ambassador
diff --git a/charts/emissary-ingress/templates/ambassador-agent.yaml b/charts/emissary-ingress/templates/ambassador-agent.yaml
new file mode 100644
index 0000000000..1eb4dc96c8
--- /dev/null
+++ b/charts/emissary-ingress/templates/ambassador-agent.yaml
@@ -0,0 +1,284 @@
+{{- if .Values.agent.enabled }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent
+  namespace: {{ include "ambassador.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+{{- if .Values.docker.useImagePullSecret }}
+imagePullSecrets:
+- name: {{ .Values.docker.imagePullSecretName }}
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent-config
+  namespace: {{ include "ambassador.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "ambassador.fullname" . }}-agent-config
+subjects:
+- kind: ServiceAccount
+  name: {{ include "ambassador.fullname" . }}-agent
+  namespace: {{ include "ambassador.namespace" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent-config
+  namespace: {{ include "ambassador.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+rules:
+- apiGroups: [""]
+  resources: [ "configmaps" ]
+  verbs: [ "get", "list", "watch" ]
+- apiGroups: [""]
+  resources: [ "secrets"]
+  verbs: [ "get", "list", "watch", "create", "delete", "patch" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent
+  labels:
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "ambassador.fullname" . }}-agent
+subjects:
+- kind: ServiceAccount
+  name: {{ include "ambassador.fullname" . }}-agent
+  namespace: {{ include "ambassador.namespace" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent
+  labels:
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+aggregationRule:
+  clusterRoleSelectors:
+  - matchLabels:
+      rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
+rules: []
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent-pods
+  labels:
+    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+rules:
+- apiGroups: [""]
+  resources: [ "pods"]
+  verbs: [ "get", "list", "watch" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent-deployments
+  labels:
+    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+rules:
+- apiGroups: ["apps", "extensions"]
+  resources: [ "deployments" ]
+  verbs: [ "get", "list", "watch" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent-endpoints
+  labels:
+    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+rules:
+- apiGroups: [""]
+  resources: [ "endpoints" ]
+  verbs: [ "get", "list", "watch" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent-configmaps
+  labels:
+    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+rules:
+- apiGroups: [""]
+  resources: [ "configmaps" ]
+  verbs: [ "get", "list", "watch" ]
+---
+{{- if .Values.agent.createArgoRBAC }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent-rollouts
+  labels:
+    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+rules:
+- apiGroups: ["argoproj.io"]
+  resources: [ "rollouts", "rollouts/status" ]
+  verbs: [ "get", "list", "watch", "patch" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent-applications
+  labels:
+    rbac.getambassador.io/role-group: {{ include "ambassador.rbacName" . }}-agent
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+rules:
+- apiGroups: ["argoproj.io"]
+  resources: [ "applications" ]
+  verbs: [ "get", "list", "watch" ]
+{{- end }}
+{{ if ne .Values.agent.cloudConnectToken "" }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent-cloud-token
+  namespace: {{ include "ambassador.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent-cloud-token
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+data:
+  CLOUD_CONNECT_TOKEN: {{ .Values.agent.cloudConnectToken }}
+{{ end }}
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent
+  namespace: {{ include "ambassador.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "ambassador.fullname" . }}-agent
+    {{- include "ambassador.labels" . | nindent 4 }}
+    product: aes
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "ambassador.fullname" . }}-agent
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "ambassador.fullname" . }}-agent
+        {{- include "ambassador.labels" . | nindent 8 }}
+        product: aes
+    spec:
+      {{- with .Values.agent.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "ambassador.fullname" . }}-agent
+      containers:
+      - name: agent
+        image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}"
+        imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
+        ports:
+          - containerPort: 8080
+            name: http
+        {{- with .Values.agent.containerSecurityContext }}
+        securityContext:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        env:
+        - name: AGENT_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: AGENT_CONFIG_RESOURCE_NAME
+          value: {{ include "ambassador.fullname" . }}-agent-cloud-token
+        - name: RPC_CONNECTION_ADDRESS
+          value: {{ .Values.agent.rpcAddress }}
+        - name: AES_SNAPSHOT_URL
+          value: "http://{{ include "ambassador.fullname" . }}-admin.{{ include "ambassador.namespace" . }}:{{ .Values.adminService.snapshotPort }}/snapshot-external"
+        - name: AES_REPORT_DIAGNOSTICS_TO_CLOUD
+          value: {{ .Values.agent.reportDiagnostics | quote }}
+        - name: AES_DIAGNOSTICS_URL
+          value: "http://{{ include "ambassador.fullname" . }}-admin.{{ include "ambassador.namespace" . }}:{{ .Values.adminService.port }}/ambassador/v0/diag/?json=true"
+
+      {{- with .Values.agent.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.agent.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+
+  {{ if .Values.progressDeadlines }}
+  {{ if hasKey .Values.progressDeadlines "agent" }}
+  progressDeadlineSeconds: {{ .Values.progressDeadlines.agent }}
+  {{- end }}
+  {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "ambassador.fullname" . }}-agent
+  namespace: {{ include "ambassador.namespace" . }}
+  labels:
+    {{- if ne .Values.deploymentTool "getambassador.io" }}
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}-agent
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    helm.sh/chart: {{ include "ambassador.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- if .Values.deploymentTool }}
+    app.kubernetes.io/managed-by: {{ .Values.deploymentTool }}
+    {{- else }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- end }}
+    {{- end }}
+    product: aes
+spec:
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: {{ include "ambassador.fullname" . }}-agent
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
diff --git a/charts/emissary-ingress/values.yaml.in b/charts/emissary-ingress/values.yaml.in
index d81f13e4ac..abe1dcaa24 100644
--- a/charts/emissary-ingress/values.yaml.in
+++ b/charts/emissary-ingress/values.yaml.in
@@ -405,13 +405,39 @@ prometheusExporter: # +doc-gen:break
 # securityContext:
 #   runAsUser: 8888
 
-# ambassador-agent Values.
-# all values under agent key are passed to [the ambassador-agent chart](https://github.com/datawire/ambassador-agent/tree/master/helm/ambassador-agent)
+
+# Configure the ambassador agent
 agent:
-  # If `true`, installs the ambassador-agent Deployment enabling the Ambassador Cloud connectivity.
+  # If `true`, installs the ambassador-agent Deployment, ServiceAccount and ClusterRole in the ambassador namespace, enabling the Ambassador Cloud connectivity.
   enabled: true
+  # API token for reporting snapshots to [Ambassador Cloud](https://app.getambassador.io/cloud/);
+  # If empty, agent will not report snapshots
+  cloudConnectToken: ''
+  # Address of the Ambassador Cloud rpc server.
+  rpcAddress: https://app.getambassador.io/
+
+  # If `true`, Ambassador Agent will report diagnostics to Ambassador Cloud
+  reportDiagnostics: true
+
+  createArgoRBAC: true
+  image:
+    # Leave blank to use image.repository and image.tag
+    tag: 1.0.14
+    repository: docker.io/ambassador/ambassador-agent
+    pullPolicy: IfNotPresent
+
+  podSecurityContext: {}
+  # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#podsecuritycontext-v1-core
+  #  runAsUser: 8888
+
+  containerSecurityContext: {}
+  # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#securitycontext-v1-core
+  # allowPrivilegeEscalation: false
+
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
 
-  rpcAddress: "https://app.getambassador.io/"
 
 deploymentTool: ''
 
diff --git a/k8s-config/emissary-defaultns/require.yaml b/k8s-config/emissary-defaultns/require.yaml
index 06f1817bf1..445425d58e 100644
--- a/k8s-config/emissary-defaultns/require.yaml
+++ b/k8s-config/emissary-defaultns/require.yaml
@@ -3,6 +3,7 @@ _anchors:
 resources:
   - { kind: Service,            name: emissary-ingress-admin,              namespace: *namespace }
   - { kind: Service,            name: emissary-ingress,                    namespace: *namespace }
+  - { kind: Service,            name: emissary-ingress-agent,              namespace: *namespace }
   - { kind: ClusterRole,        name: emissary-ingress                                           }
   - { kind: ServiceAccount,     name: emissary-ingress,                    namespace: *namespace }
   - { kind: ClusterRoleBinding, name: emissary-ingress                                           }
@@ -10,21 +11,17 @@ resources:
   - { kind: ClusterRole,        name: emissary-ingress-watch                                     }
   - { kind: Deployment,         name: emissary-ingress,                    namespace: *namespace }
   - { kind: Module,             name: ambassador,                          namespace: *namespace }
-  - { kind: Role,               name: emissary-ingress-apiext,             namespace: emissary-system }
-  - { kind: RoleBinding,        name: emissary-ingress-apiext,             namespace: emissary-system }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-applications                            }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-default-ns                              }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-deployments                             }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-endpoints                               }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-ingresses                               }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-pods                                    }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-rollouts                                }
-  - { kind: ClusterRole,        name: emissary-ingress-agent                                         }
-  - { kind: ClusterRoleBinding, name: emissary-ingress-agent                                         }
-  - { kind: Deployment,         name: emissary-ingress-agent,                  namespace: *namespace }
-  - { kind: Role,               name: emissary-ingress-agent-config,           namespace: *namespace }
-  - { kind: Role,               name: emissary-ingress-agent-leaderelection,   namespace: *namespace }
-  - { kind: RoleBinding,        name: emissary-ingress-agent-config,           namespace: *namespace }
-  - { kind: RoleBinding,        name: emissary-ingress-agent-leaderelection,   namespace: *namespace }
-  - { kind: Service,            name: emissary-ingress-agent,                  namespace: *namespace }
-  - { kind: ServiceAccount,     name: emissary-ingress-agent,                  namespace: *namespace }
+  - { kind: ServiceAccount,     name: emissary-ingress-agent,              namespace: *namespace }
+  - { kind: ClusterRoleBinding, name: emissary-ingress-agent                                     }
+  - { kind: ClusterRole,        name: emissary-ingress-agent                                     }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-pods                                }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-rollouts                            }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-applications                        }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-deployments                         }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-endpoints                           }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-configmaps                          }
+  - { kind: Role,               name: emissary-ingress-agent-config,       namespace: *namespace }
+  - { kind: RoleBinding,        name: emissary-ingress-agent-config,       namespace: *namespace }
+  - { kind: Role,               name: emissary-ingress-apiext,             namespace: emissary-system}
+  - { kind: RoleBinding,        name: emissary-ingress-apiext,             namespace: emissary-system}
+  - { kind: Deployment,         name: emissary-ingress-agent,              namespace: *namespace }
diff --git a/k8s-config/emissary-defaultns/values.yaml b/k8s-config/emissary-defaultns/values.yaml
index 8c65d585fc..8ba3e0d574 100644
--- a/k8s-config/emissary-defaultns/values.yaml
+++ b/k8s-config/emissary-defaultns/values.yaml
@@ -32,7 +32,3 @@ image:
 waitForApiext:
   enabled: true
   createRoles: true
-
-agent:
-  enabled: true
-
diff --git a/k8s-config/emissary-emissaryns/require.yaml b/k8s-config/emissary-emissaryns/require.yaml
index 33ee997a80..42146be22d 100644
--- a/k8s-config/emissary-emissaryns/require.yaml
+++ b/k8s-config/emissary-emissaryns/require.yaml
@@ -3,6 +3,7 @@ _anchors:
 resources:
   - { kind: Service,            name: emissary-ingress-admin,              namespace: *namespace }
   - { kind: Service,            name: emissary-ingress,                    namespace: *namespace }
+  - { kind: Service,            name: emissary-ingress-agent,              namespace: *namespace }
   - { kind: ClusterRole,        name: emissary-ingress                                           }
   - { kind: ServiceAccount,     name: emissary-ingress,                    namespace: *namespace }
   - { kind: ClusterRoleBinding, name: emissary-ingress                                           }
@@ -10,22 +11,17 @@ resources:
   - { kind: ClusterRole,        name: emissary-ingress-watch                                     }
   - { kind: Deployment,         name: emissary-ingress,                    namespace: *namespace }
   - { kind: Module,             name: ambassador,                          namespace: *namespace }
+  - { kind: ServiceAccount,     name: emissary-ingress-agent,              namespace: *namespace }
+  - { kind: ClusterRoleBinding, name: emissary-ingress-agent                                     }
+  - { kind: ClusterRole,        name: emissary-ingress-agent                                     }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-pods                                }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-rollouts                            }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-applications                        }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-deployments                         }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-endpoints                           }
+  - { kind: ClusterRole,        name: emissary-ingress-agent-configmaps                          }
+  - { kind: Role,               name: emissary-ingress-agent-config,       namespace: *namespace }
+  - { kind: RoleBinding,        name: emissary-ingress-agent-config,       namespace: *namespace }
   - { kind: Role,               name: emissary-ingress-apiext,             namespace: emissary-system}
   - { kind: RoleBinding,        name: emissary-ingress-apiext,             namespace: emissary-system}
-  - { kind: ClusterRole,        name: emissary-ingress-agent-applications                            }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-default-ns                              }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-deployments                             }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-endpoints                               }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-ingresses                               }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-pods                                    }
-  - { kind: ClusterRole,        name: emissary-ingress-agent-rollouts                                }
-  - { kind: ClusterRole,        name: emissary-ingress-agent                                         }
-  - { kind: ClusterRoleBinding, name: emissary-ingress-agent                                         }
-  - { kind: Deployment,         name: emissary-ingress-agent,                  namespace: *namespace }
-  - { kind: Role,               name: emissary-ingress-agent-config,           namespace: *namespace }
-  - { kind: Role,               name: emissary-ingress-agent-leaderelection,   namespace: *namespace }
-  - { kind: RoleBinding,        name: emissary-ingress-agent-config,           namespace: *namespace }
-  - { kind: RoleBinding,        name: emissary-ingress-agent-leaderelection,   namespace: *namespace }
-  - { kind: Service,            name: emissary-ingress-agent,                  namespace: *namespace }
-  - { kind: ServiceAccount,     name: emissary-ingress-agent,                  namespace: *namespace }
-
+  - { kind: Deployment,         name: emissary-ingress-agent,              namespace: *namespace }
diff --git a/k8s-config/emissary-emissaryns/values.yaml b/k8s-config/emissary-emissaryns/values.yaml
index c0bc7fce38..db88da0250 100644
--- a/k8s-config/emissary-emissaryns/values.yaml
+++ b/k8s-config/emissary-emissaryns/values.yaml
@@ -33,6 +33,3 @@ image:
 waitForApiext:
   enabled: true
   createRoles: true
-
-agent:
-  enabled: true
diff --git a/manifests/emissary/emissary-defaultns.yaml.in b/manifests/emissary/emissary-defaultns.yaml.in
index bfd91d5051..cd7e87ac4b 100644
--- a/manifests/emissary/emissary-defaultns.yaml.in
+++ b/manifests/emissary/emissary-defaultns.yaml.in
@@ -74,6 +74,23 @@ spec:
     profile: main
   type: LoadBalancer
 ---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    product: aes
+  name: emissary-ingress-agent
+  namespace: default
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: http
+  selector:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/name: emissary-ingress-agent
+---
 aggregationRule:
   clusterRoleSelectors:
   - matchLabels:
@@ -390,129 +407,113 @@ spec:
       allow_non_local: true
       enabled: false
 ---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
+apiVersion: v1
+kind: ServiceAccount
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress
+    app.kubernetes.io/name: emissary-ingress-agent
     app.kubernetes.io/part-of: emissary-ingress
     product: aes
-    rbac.getambassador.io/role-group: emissary-ingress
-  name: emissary-ingress-apiext
-  namespace: emissary-system
-rules:
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  verbs:
-  - get
-  - list
-  - watch
+  name: emissary-ingress-agent
+  namespace: default
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
+kind: ClusterRoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress
+    app.kubernetes.io/name: emissary-ingress-agent
     app.kubernetes.io/part-of: emissary-ingress
     product: aes
-  name: emissary-ingress-apiext
-  namespace: emissary-system
+  name: emissary-ingress-agent
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: emissary-ingress-apiext
+  kind: ClusterRole
+  name: emissary-ingress-agent
 subjects:
 - kind: ServiceAccount
-  name: emissary-ingress
+  name: emissary-ingress-agent
   namespace: default
 ---
+aggregationRule:
+  clusterRoleSelectors:
+  - matchLabels:
+      rbac.getambassador.io/role-group: emissary-ingress-agent
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-    rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-applications
-rules:
-- apiGroups:
-  - argoproj.io
-  resources:
-  - applications
-  verbs:
-  - get
-  - list
-  - watch
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
+  name: emissary-ingress-agent
+rules: []
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-default-ns
+  name: emissary-ingress-agent-pods
 rules:
 - apiGroups:
   - ""
-  resourceNames:
-  - default
   resources:
-  - namespaces
+  - pods
   verbs:
   - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-deployments
+  name: emissary-ingress-agent-rollouts
 rules:
 - apiGroups:
-  - apps
-  - extensions
+  - argoproj.io
   resources:
-  - deployments
+  - rollouts
+  - rollouts/status
   verbs:
   - get
   - list
   - watch
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-endpoints
+  name: emissary-ingress-agent-applications
 rules:
 - apiGroups:
-  - ""
+  - argoproj.io
   resources:
-  - endpoints
-  - services
+  - applications
   verbs:
   - get
   - list
@@ -523,18 +524,18 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-ingresses
+  name: emissary-ingress-agent-deployments
 rules:
 - apiGroups:
-  - networking.k8s.io
+  - apps
   - extensions
   resources:
-  - ingresses
+  - deployments
   verbs:
   - get
   - list
@@ -545,17 +546,17 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-pods
+  name: emissary-ingress-agent-endpoints
 rules:
 - apiGroups:
   - ""
   resources:
-  - pods
+  - endpoints
   verbs:
   - get
   - list
@@ -566,114 +567,31 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-rollouts
+  name: emissary-ingress-agent-configmaps
 rules:
 - apiGroups:
-  - argoproj.io
+  - ""
   resources:
-  - rollouts
-  - rollouts/status
+  - configmaps
   verbs:
   - get
   - list
   - watch
-  - patch
----
-aggregationRule:
-  clusterRoleSelectors:
-  - matchLabels:
-      rbac.getambassador.io/role-group: emissary-ingress-agent
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent
-rules: []
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: emissary-ingress-agent
-subjects:
-- kind: ServiceAccount
-  name: emissary-ingress-agent
-  namespace: default
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent
-  namespace: default
-spec:
-  replicas: null
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: emissary-ingress
-      app.kubernetes.io/name: agent
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: emissary-ingress
-        app.kubernetes.io/name: agent
-    spec:
-      containers:
-      - env:
-        - name: LOG_LEVEL
-          value: info
-        - name: AGENT_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: AGENT_CONFIG_RESOURCE_NAME
-          value: emissary-ingress-agent-cloud-token
-        - name: RPC_CONNECTION_ADDRESS
-          value: https://app.getambassador.io/
-        image: docker.io/ambassador/ambassador-agent:1.0.18
-        imagePullPolicy: IfNotPresent
-        name: agent
-        ports:
-        - containerPort: 8080
-          name: http
-        resources: {}
-        securityContext: {}
-      securityContext: {}
-      serviceAccountName: emissary-ingress-agent
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
   name: emissary-ingress-agent-config
   namespace: default
 rules:
@@ -692,39 +610,20 @@ rules:
   verbs:
   - get
   - list
+  - watch
   - create
   - delete
   - patch
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent-leaderelection
-  namespace: default
-rules:
-- apiGroups:
-  - coordination.k8s.io
-  resources:
-  - leases
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
   name: emissary-ingress-agent-config
   namespace: default
 roleRef:
@@ -737,54 +636,94 @@ subjects:
   namespace: default
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
+    rbac.getambassador.io/role-group: emissary-ingress
+  name: emissary-ingress-apiext
+  namespace: emissary-system
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent-leaderelection
-  namespace: default
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
+  name: emissary-ingress-apiext
+  namespace: emissary-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: emissary-ingress-agent-leaderelection
+  name: emissary-ingress-apiext
 subjects:
 - kind: ServiceAccount
-  name: emissary-ingress-agent
+  name: emissary-ingress
   namespace: default
 ---
-apiVersion: v1
-kind: Service
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
   name: emissary-ingress-agent
   namespace: default
 spec:
-  ports:
-  - name: http
-    port: 80
-    targetPort: http
+  progressDeadlineSeconds: 600
+  replicas: 1
   selector:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/name: agent
-  type: ClusterIP
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent
-  namespace: default
+    matchLabels:
+      app.kubernetes.io/instance: emissary-ingress
+      app.kubernetes.io/name: emissary-ingress-agent
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: emissary-ingress
+        app.kubernetes.io/managed-by: getambassador.io
+        app.kubernetes.io/name: emissary-ingress-agent
+        app.kubernetes.io/part-of: emissary-ingress
+        product: aes
+    spec:
+      containers:
+      - env:
+        - name: AGENT_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: AGENT_CONFIG_RESOURCE_NAME
+          value: emissary-ingress-agent-cloud-token
+        - name: RPC_CONNECTION_ADDRESS
+          value: https://app.getambassador.io/
+        - name: AES_SNAPSHOT_URL
+          value: http://emissary-ingress-admin.default:8005/snapshot-external
+        - name: AES_REPORT_DIAGNOSTICS_TO_CLOUD
+          value: "true"
+        - name: AES_DIAGNOSTICS_URL
+          value: http://emissary-ingress-admin.default:8877/ambassador/v0/diag/?json=true
+        image: docker.io/ambassador/ambassador-agent:1.0.14
+        imagePullPolicy: IfNotPresent
+        name: agent
+        ports:
+        - containerPort: 8080
+          name: http
+      serviceAccountName: emissary-ingress-agent
diff --git a/manifests/emissary/emissary-emissaryns.yaml.in b/manifests/emissary/emissary-emissaryns.yaml.in
index 2baef4f715..f4159f11d1 100644
--- a/manifests/emissary/emissary-emissaryns.yaml.in
+++ b/manifests/emissary/emissary-emissaryns.yaml.in
@@ -74,6 +74,23 @@ spec:
     profile: main
   type: LoadBalancer
 ---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    product: aes
+  name: emissary-ingress-agent
+  namespace: emissary
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: http
+  selector:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/name: emissary-ingress-agent
+---
 aggregationRule:
   clusterRoleSelectors:
   - matchLabels:
@@ -390,129 +407,113 @@ spec:
       allow_non_local: true
       enabled: false
 ---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
+apiVersion: v1
+kind: ServiceAccount
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress
+    app.kubernetes.io/name: emissary-ingress-agent
     app.kubernetes.io/part-of: emissary-ingress
     product: aes
-    rbac.getambassador.io/role-group: emissary-ingress
-  name: emissary-ingress-apiext
-  namespace: emissary-system
-rules:
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  verbs:
-  - get
-  - list
-  - watch
+  name: emissary-ingress-agent
+  namespace: emissary
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
+kind: ClusterRoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
     app.kubernetes.io/managed-by: getambassador.io
-    app.kubernetes.io/name: emissary-ingress
+    app.kubernetes.io/name: emissary-ingress-agent
     app.kubernetes.io/part-of: emissary-ingress
     product: aes
-  name: emissary-ingress-apiext
-  namespace: emissary-system
+  name: emissary-ingress-agent
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: emissary-ingress-apiext
+  kind: ClusterRole
+  name: emissary-ingress-agent
 subjects:
 - kind: ServiceAccount
-  name: emissary-ingress
+  name: emissary-ingress-agent
   namespace: emissary
 ---
+aggregationRule:
+  clusterRoleSelectors:
+  - matchLabels:
+      rbac.getambassador.io/role-group: emissary-ingress-agent
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-    rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-applications
-rules:
-- apiGroups:
-  - argoproj.io
-  resources:
-  - applications
-  verbs:
-  - get
-  - list
-  - watch
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
+  name: emissary-ingress-agent
+rules: []
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-default-ns
+  name: emissary-ingress-agent-pods
 rules:
 - apiGroups:
   - ""
-  resourceNames:
-  - default
   resources:
-  - namespaces
+  - pods
   verbs:
   - get
+  - list
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-deployments
+  name: emissary-ingress-agent-rollouts
 rules:
 - apiGroups:
-  - apps
-  - extensions
+  - argoproj.io
   resources:
-  - deployments
+  - rollouts
+  - rollouts/status
   verbs:
   - get
   - list
   - watch
+  - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-endpoints
+  name: emissary-ingress-agent-applications
 rules:
 - apiGroups:
-  - ""
+  - argoproj.io
   resources:
-  - endpoints
-  - services
+  - applications
   verbs:
   - get
   - list
@@ -523,18 +524,18 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-ingresses
+  name: emissary-ingress-agent-deployments
 rules:
 - apiGroups:
-  - networking.k8s.io
+  - apps
   - extensions
   resources:
-  - ingresses
+  - deployments
   verbs:
   - get
   - list
@@ -545,17 +546,17 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-pods
+  name: emissary-ingress-agent-endpoints
 rules:
 - apiGroups:
   - ""
   resources:
-  - pods
+  - endpoints
   verbs:
   - get
   - list
@@ -566,114 +567,31 @@ kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
     rbac.getambassador.io/role-group: emissary-ingress-agent
-  name: emissary-ingress-agent-rollouts
+  name: emissary-ingress-agent-configmaps
 rules:
 - apiGroups:
-  - argoproj.io
+  - ""
   resources:
-  - rollouts
-  - rollouts/status
+  - configmaps
   verbs:
   - get
   - list
   - watch
-  - patch
----
-aggregationRule:
-  clusterRoleSelectors:
-  - matchLabels:
-      rbac.getambassador.io/role-group: emissary-ingress-agent
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent
-rules: []
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: emissary-ingress-agent
-subjects:
-- kind: ServiceAccount
-  name: emissary-ingress-agent
-  namespace: emissary
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent
-  namespace: emissary
-spec:
-  replicas: null
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: emissary-ingress
-      app.kubernetes.io/name: agent
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: emissary-ingress
-        app.kubernetes.io/name: agent
-    spec:
-      containers:
-      - env:
-        - name: LOG_LEVEL
-          value: info
-        - name: AGENT_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: AGENT_CONFIG_RESOURCE_NAME
-          value: emissary-ingress-agent-cloud-token
-        - name: RPC_CONNECTION_ADDRESS
-          value: https://app.getambassador.io/
-        image: docker.io/ambassador/ambassador-agent:1.0.18
-        imagePullPolicy: IfNotPresent
-        name: agent
-        ports:
-        - containerPort: 8080
-          name: http
-        resources: {}
-        securityContext: {}
-      securityContext: {}
-      serviceAccountName: emissary-ingress-agent
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
   name: emissary-ingress-agent-config
   namespace: emissary
 rules:
@@ -692,39 +610,20 @@ rules:
   verbs:
   - get
   - list
+  - watch
   - create
   - delete
   - patch
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent-leaderelection
-  namespace: emissary
-rules:
-- apiGroups:
-  - coordination.k8s.io
-  resources:
-  - leases
-  verbs:
-  - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
   name: emissary-ingress-agent-config
   namespace: emissary
 roleRef:
@@ -737,54 +636,94 @@ subjects:
   namespace: emissary
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/instance: emissary-ingress
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
+    rbac.getambassador.io/role-group: emissary-ingress
+  name: emissary-ingress-apiext
+  namespace: emissary-system
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent-leaderelection
-  namespace: emissary
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
+  name: emissary-ingress-apiext
+  namespace: emissary-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: emissary-ingress-agent-leaderelection
+  name: emissary-ingress-apiext
 subjects:
 - kind: ServiceAccount
-  name: emissary-ingress-agent
+  name: emissary-ingress
   namespace: emissary
 ---
-apiVersion: v1
-kind: Service
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   labels:
     app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
+    app.kubernetes.io/managed-by: getambassador.io
+    app.kubernetes.io/name: emissary-ingress-agent
+    app.kubernetes.io/part-of: emissary-ingress
+    product: aes
   name: emissary-ingress-agent
   namespace: emissary
 spec:
-  ports:
-  - name: http
-    port: 80
-    targetPort: http
+  progressDeadlineSeconds: 600
+  replicas: 1
   selector:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/name: agent
-  type: ClusterIP
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app.kubernetes.io/instance: emissary-ingress
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: agent
-    app.kubernetes.io/version: 1.0.18
-    helm.sh/chart: agent-1.0.18
-  name: emissary-ingress-agent
-  namespace: emissary
+    matchLabels:
+      app.kubernetes.io/instance: emissary-ingress
+      app.kubernetes.io/name: emissary-ingress-agent
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: emissary-ingress
+        app.kubernetes.io/managed-by: getambassador.io
+        app.kubernetes.io/name: emissary-ingress-agent
+        app.kubernetes.io/part-of: emissary-ingress
+        product: aes
+    spec:
+      containers:
+      - env:
+        - name: AGENT_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: AGENT_CONFIG_RESOURCE_NAME
+          value: emissary-ingress-agent-cloud-token
+        - name: RPC_CONNECTION_ADDRESS
+          value: https://app.getambassador.io/
+        - name: AES_SNAPSHOT_URL
+          value: http://emissary-ingress-admin.emissary:8005/snapshot-external
+        - name: AES_REPORT_DIAGNOSTICS_TO_CLOUD
+          value: "true"
+        - name: AES_DIAGNOSTICS_URL
+          value: http://emissary-ingress-admin.emissary:8877/ambassador/v0/diag/?json=true
+        image: docker.io/ambassador/ambassador-agent:1.0.14
+        imagePullPolicy: IfNotPresent
+        name: agent
+        ports:
+        - containerPort: 8080
+          name: http
+      serviceAccountName: emissary-ingress-agent