diff --git a/stable/kong/Chart.yaml b/stable/kong/Chart.yaml
index 6764d9acbd..fa3d6570b1 100644
--- a/stable/kong/Chart.yaml
+++ b/stable/kong/Chart.yaml
@@ -12,5 +12,5 @@ maintainers:
 name: kong
 sources:
 - https://github.com/Kong/kong
-version: 0.32.1
+version: 0.33.0
 appVersion: 1.4
diff --git a/stable/kong/FAQs.md b/stable/kong/FAQs.md
index 2a0efb5e15..1bac262748 100644
--- a/stable/kong/FAQs.md
+++ b/stable/kong/FAQs.md
@@ -1,2 +1,32 @@
 # Frequently Asked Questions (FAQs)
 
+#### Kong fails to start after `helm upgrade` when Postgres is used. What do I do?
+
+You may be running into this issue: https://github.com/helm/charts/issues/12575.
+This issue is caused due to: https://github.com/helm/helm/issues/3053.
+
+The problem that happens is that Postgres database has the old password but
+the new secret has a different password, which is used by Kong, and password
+based authentication fails.
+
+The solution to the problem is to specify a password to the `postgresql` chart.
+This is to ensure that the password is not generated randomly but is set to
+the same one that is user-provided on each upgrade.
+
+#### Kong fails to start on a fresh installation with Postgres. What do I do?
+
+Please make sure that there is no `PersistentVolumes` present from a previous
+release. If there are, it can lead to data or passwords being out of sync
+and result in connection issues.
+
+A simple way to find out is to use the following command:
+
+```
+kubectl get pv -n <your-namespace>
+```
+
+And then based on the `AGE` column, determine if you have an old volume.
+If you do, then please delete the release, delete the volume, and then
+do a fresh installation. PersistentVolumes can remain in the cluster even if
+you delete the namespace itself (the namespace in which they were present).
+
diff --git a/stable/kong/README.md b/stable/kong/README.md
index af017dcdc8..30fa3549cf 100644
--- a/stable/kong/README.md
+++ b/stable/kong/README.md
@@ -242,23 +242,16 @@ section of `values.yaml` file:
 | Parameter                          | Description                                                                           | Default                                                                      |
 | ---------------------------------- | ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
 | enabled                            | Deploy the ingress controller, rbac and crd                                           | true                                                                         |
+| replicaCount                       | Number of desired ingress controllers                                                 | 1                                                                            |
 | image.repository                   | Docker image with the ingress controller                                              | kong-docker-kubernetes-ingress-controller.bintray.io/kong-ingress-controller |
-| image.tag                          | Version of the ingress controller                                                     | 0.6.2                                                                        |
+| image.tag                          | Version of the ingress controller                                                     | 0.6.0                                                                        |
+| readinessProbe                     | Kong ingress controllers readiness probe                                              |                                                                              |
+| livenessProbe                      | Kong ingress controllers liveness probe                                               |                                                                              |
 | env                                | Specify Kong Ingress Controller configuration via environment variables               |                                                                              |
+| ingressClass                       | The ingress-class value for controller                                                | kong                                                                         |
 | admissionWebhook.enabled           | Whether to enable the validating admission webhook                                    | false                                                                        |
 | admissionWebhook.failurePolicy     | How unrecognized errors from the admission endpoint are handled (Ignore or Fail)      | Fail                                                                         |
 | admissionWebhook.port              | The port the ingress controller will listen on for admission webhooks                 | 8080                                                                         |
-| admissionWebhook.port              | The port the ingress controller will listen on for admission webhooks                 | 8080                                                                         |
-| ingressClass                       | The ingress-class value for controller                                                | kong                                                                         |
-| installCRDs                        | Install the Custom Resource definitions along-with Kong                               | `true`                                                                       |
-| rbac.create                        | Install and setup RBAC resources for the Controller authorization policies            | `true`                                                                       |
-| serviceAccount.create              | Install and setup ServiceAccount resources for the Controller authentication          | `true`                                                                       |
-| serviceAccount.name                | Name of ServiceAccount to use if serviceAccount.create is set to `false`              | `true`                                                                       |
-| livenessProbe                      | Kong ingress controllers liveness probe                                               |                                                                              |
-| readinessProbe                     | Kong ingress controllers readiness probe                                              |                                                                              |
-| podDisruptionBudget.enabled        | Enable PodDisruptionBudget for ingress controller                                     | `false`                                                                      |
-| podDisruptionBudget.maxUnavailable | Represents the minimum number of Pods that can be unavailable (integer or percentage) | `50%`                                                                        |
-| podDisruptionBudget.minAvailable   | Represents the number of Pods that must be available (integer or percentage)          |                                                                              |
 
 For a complete list of all configuration values you can set in the 
 `env` section, please read the Kong Ingress Controller's
@@ -457,6 +450,37 @@ value is your SMTP password.
 
 ## Changelog
 
+
+### 0.33.0
+
+> PR [#19840](https://github.com/helm/charts/pull/19840)
+
+#### Dependencies
+
+- Postgre sub-chart has been bumped up to 8.1.2
+
+#### Fixed
+
+- Removed podDisruption budge for Ingress Controller. Ingress Controller and
+  Kong run in the same pod so this was no longer applicable
+- Migration job now receives the same environment variable and configuration
+  as that of the Kong pod.
+- If Kong is configured to run with Postgres, the Kong pods now always wait
+  for Postgres to start. Previously this was done only when the sub-chart
+  postgres was deployed.
+- A hard-coded container name is used for kong: `proxy`. Previously this
+  was auto-generated by Helm. This deterministic naming allows for simpler
+  scripts and documentation.
+
+#### Under the hood
+
+Following changes have no end user visible effects:
+
+- All Custom Resource Definitions have been consolidated into a single
+  template file
+- All RBAC resources have been consolidated into a single template file
+- `wait-for-postgres` container has been refactored and de-duplicated
+
 ### 0.32.1
 
 #### Improvements
diff --git a/stable/kong/requirements.lock b/stable/kong/requirements.lock
index c890977ff2..58b39937c3 100644
--- a/stable/kong/requirements.lock
+++ b/stable/kong/requirements.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: postgresql
   repository: https://kubernetes-charts.storage.googleapis.com/
-  version: 6.3.15
-digest: sha256:1110c0b8497a990af34f196753420ab9b1b00fed77c540bce43542bdedd74b9b
-generated: "2019-10-31T09:56:30.102440266-07:00"
+  version: 8.1.2
+digest: sha256:c4bf54db60c2c5953ba7b79ce4814f8b8225d04e932868bcfab23b93c05b0f7f
+generated: "2019-12-31T13:58:27.104134475-08:00"
diff --git a/stable/kong/requirements.yaml b/stable/kong/requirements.yaml
index b25cd96411..98315ed99e 100644
--- a/stable/kong/requirements.yaml
+++ b/stable/kong/requirements.yaml
@@ -1,5 +1,5 @@
 dependencies:
 - name: postgresql
-  version: ~6.3.0
+  version: ~8.1.0
   repository: https://kubernetes-charts.storage.googleapis.com/
   condition: postgresql.enabled
diff --git a/stable/kong/templates/_helpers.tpl b/stable/kong/templates/_helpers.tpl
index bc75020ed9..470a8ce399 100644
--- a/stable/kong/templates/_helpers.tpl
+++ b/stable/kong/templates/_helpers.tpl
@@ -335,3 +335,157 @@ Use the Pod security context defined in Values or set the UID by default
 {{- define "kong.podsecuritycontext" -}}
 {{ .Values.securityContext | toYaml }}
 {{- end -}}
+
+{{/*
+The environment values passed to Kong; this should come after all
+the template that it itself is using form the above sections.
+*/}}
+{{- define "kong.final_env" -}}
+- name: KONG_LUA_PACKAGE_PATH
+  value: "/opt/?.lua;;"
+{{- if not .Values.env.admin_listen }}
+{{- if .Values.admin.useTLS }}
+- name: KONG_ADMIN_LISTEN
+  value: "0.0.0.0:{{ .Values.admin.containerPort }} ssl"
+{{- else }}
+- name: KONG_ADMIN_LISTEN
+  value: 0.0.0.0:{{ .Values.admin.containerPort }}
+{{- end }}
+{{- end }}
+{{- if .Values.admin.ingress.enabled }}
+- name: KONG_ADMIN_API_URI
+  value: {{ include "kong.ingress.serviceUrl" .Values.admin.ingress }}
+{{- end }}
+{{- if not .Values.env.proxy_listen }}
+- name: KONG_PROXY_LISTEN
+  value: {{ template "kong.kongProxyListenValue" . }}
+{{- end }}
+{{- if and (not .Values.env.admin_gui_listen) (.Values.enterprise.enabled) }}
+- name: KONG_ADMIN_GUI_LISTEN
+  value: {{ template "kong.kongManagerListenValue" . }}
+{{- end }}
+{{- if and (.Values.manager.ingress.enabled) (.Values.enterprise.enabled) }}
+- name: KONG_ADMIN_GUI_URL
+  value: {{ include "kong.ingress.serviceUrl" .Values.manager.ingress }}
+{{- end }}
+{{- if and (not .Values.env.portal_gui_listen) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
+- name: KONG_PORTAL_GUI_LISTEN
+  value: {{ template "kong.kongPortalListenValue" . }}
+{{- end }}
+{{- if and (.Values.portal.ingress.enabled) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
+- name: KONG_PORTAL_GUI_HOST
+  value: {{ .Values.portal.ingress.hostname }}
+{{- if .Values.portal.ingress.tls }}
+- name: KONG_PORTAL_GUI_PROTOCOL
+  value: https
+{{- else }}
+- name: KONG_PORTAL_GUI_PROTOCOL
+  value: http
+{{- end }}
+{{- end }}
+{{- if and (not .Values.env.portal_api_listen) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
+- name: KONG_PORTAL_API_LISTEN
+  value: {{ template "kong.kongPortalApiListenValue" . }}
+{{- end }}
+{{- if and (.Values.portalapi.ingress.enabled) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
+- name: KONG_PORTAL_API_URL
+  value: {{ include "kong.ingress.serviceUrl" .Values.portalapi.ingress }}
+{{- end }}
+- name: KONG_NGINX_DAEMON
+  value: "off"
+{{- if .Values.enterprise.enabled }}
+{{- if not .Values.enterprise.vitals.enabled }}
+- name: KONG_VITALS
+  value: "off"
+{{- end }}
+{{- if .Values.enterprise.portal.enabled }}
+- name: KONG_PORTAL
+  value: "on"
+{{- if .Values.enterprise.portal.portal_auth }}
+- name: KONG_PORTAL_AUTH
+  value: {{ .Values.enterprise.portal.portal_auth }}
+- name: KONG_PORTAL_SESSION_CONF
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.enterprise.portal.session_conf_secret }}
+      key: portal_session_conf
+{{- end }}
+{{- end }}
+{{- if .Values.enterprise.rbac.enabled }}
+- name: KONG_ENFORCE_RBAC
+  value: "on"
+- name: KONG_ADMIN_GUI_AUTH
+  value: {{ .Values.enterprise.rbac.admin_gui_auth | default "basic-auth" }}
+{{- if not (eq .Values.enterprise.rbac.admin_gui_auth "basic-auth") }}
+- name: KONG_ADMIN_GUI_AUTH_CONF
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.enterprise.rbac.admin_gui_auth_conf_secret }}
+      key: admin_gui_auth_conf
+{{- end }}
+- name: KONG_ADMIN_GUI_SESSION_CONF
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.enterprise.rbac.session_conf_secret }}
+      key: admin_gui_session_conf
+{{- end }}
+{{- if .Values.enterprise.smtp.enabled }}
+- name: KONG_PORTAL_EMAILS_FROM
+  value: {{ .Values.enterprise.smtp.portal_emails_from }}
+- name: KONG_PORTAL_EMAILS_REPLY_TO
+  value: {{ .Values.enterprise.smtp.portal_emails_reply_to }}
+- name: KONG_ADMIN_EMAILS_FROM
+  value: {{ .Values.enterprise.smtp.admin_emails_from }}
+- name: KONG_ADMIN_EMAILS_REPLY_TO
+  value: {{ .Values.enterprise.smtp.admin_emails_reply_to }}
+- name: KONG_SMTP_HOST
+  value: {{ .Values.enterprise.smtp.smtp_host }}
+- name: KONG_SMTP_PORT
+  value: {{ .Values.enterprise.smtp.smtp_port | quote }}
+- name: KONG_SMTP_STARTTLS
+  value: {{ .Values.enterprise.smtp.smtp_starttls | quote }}
+{{- if .Values.enterprise.smtp.auth.smtp_username }}
+- name: KONG_SMTP_USERNAME
+  value: {{ .Values.enterprise.smtp.auth.smtp_username }}
+- name: KONG_SMTP_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.enterprise.smtp.auth.smtp_password_secret }}
+      key: smtp_password
+{{- end }}
+{{- else }}
+- name: KONG_SMTP_MOCK
+  value: "on"
+{{- end }}
+{{- include "kong.license" . }}
+{{- end }}
+- name: KONG_NGINX_HTTP_INCLUDE
+  value: /kong/servers.conf
+{{- if .Values.postgresql.enabled }}
+- name: KONG_PG_HOST
+  value: {{ template "kong.postgresql.fullname" . }}
+- name: KONG_PG_PORT
+  value: "{{ .Values.postgresql.service.port }}"
+- name: KONG_PG_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: {{ template "kong.postgresql.fullname" . }}
+      key: postgresql-password
+{{- end }}
+{{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off")) }}
+- name: KONG_DECLARATIVE_CONFIG
+  value: "/kong_dbless/kong.yml"
+{{- end }}
+- name: KONG_PLUGINS
+  value: {{ template "kong.plugins" . }}
+{{- include "kong.env" . }}
+{{- end -}}
+
+{{- define "kong.wait-for-postgres" -}}
+- name: wait-for-postgres
+  image: "{{ .Values.waitImage.repository }}:{{ .Values.waitImage.tag }}"
+  imagePullPolicy: {{ .Values.waitImage.pullPolicy }}
+  env:
+  {{- include "kong.final_env" . | nindent 2 }}
+  command: [ "/bin/sh", "-c", "until nc -zv $KONG_PG_HOST $KONG_PG_PORT -w1; do echo 'waiting for db'; sleep 1; done" ]
+{{- end -}}
diff --git a/stable/kong/templates/controller-cluster-role.yaml b/stable/kong/templates/controller-cluster-role.yaml
deleted file mode 100644
index 9e256b5c3d..0000000000
--- a/stable/kong/templates/controller-cluster-role.yaml
+++ /dev/null
@@ -1,70 +0,0 @@
-{{- if and .Values.ingressController.rbac.create .Values.ingressController.enabled -}}
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  labels:
-    app: {{ template "kong.name" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-  name:  {{ template "kong.fullname" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - endpoints
-      - nodes
-      - pods
-      - secrets
-    verbs:
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-    verbs:
-      - get
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - "extensions"
-      - "networking.k8s.io"
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-        - events
-    verbs:
-        - create
-        - patch
-  - apiGroups:
-      - "extensions"
-      - "networking.k8s.io"
-    resources:
-      - ingresses/status
-    verbs:
-      - update
-  - apiGroups:
-      - "configuration.konghq.com"
-    resources:
-      - kongplugins
-      - kongcredentials
-      - kongconsumers
-      - kongingresses
-    verbs:
-      - get
-      - list
-      - watch
-{{- end -}}
diff --git a/stable/kong/templates/controller-pdb.yaml b/stable/kong/templates/controller-pdb.yaml
deleted file mode 100644
index d03278195f..0000000000
--- a/stable/kong/templates/controller-pdb.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-{{- if and .Values.ingressController.enabled .Values.ingressController.podDisruptionBudget.enabled }}
-apiVersion: policy/v1beta1
-kind: PodDisruptionBudget
-metadata:
-  name: "{{ template "kong.fullname" . }}-controller"
-  labels:
-    app: "{{ template "kong.name" . }}"
-spec:
-  {{- if .Values.ingressController.podDisruptionBudget.minAvailable }}
-  minAvailable: {{ .Values.ingressController.podDisruptionBudget.minAvailable }}
-  {{- end  }}
-  {{- if .Values.ingressController.podDisruptionBudget.maxUnavailable }}
-  maxUnavailable: {{ .Values.ingressController.podDisruptionBudget.maxUnavailable }}
-  {{- end  }}
-  selector:
-    matchLabels:
-      app: {{ template "kong.name" . }}
-      release: {{ .Release.Name }}
-      component: controller
-{{- end }}
\ No newline at end of file
diff --git a/stable/kong/templates/controller-rbac-cluster-role-binding.yaml b/stable/kong/templates/controller-rbac-cluster-role-binding.yaml
deleted file mode 100644
index 2e4e7526f0..0000000000
--- a/stable/kong/templates/controller-rbac-cluster-role-binding.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if and .Values.ingressController.rbac.create .Values.ingressController.enabled -}}
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  name:  {{ template "kong.fullname" . }}
-  labels:
-    app: {{ template "kong.name" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name:  {{ template "kong.fullname" . }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "kong.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
-{{- end -}}
diff --git a/stable/kong/templates/controller-rbac-resources.yaml b/stable/kong/templates/controller-rbac-resources.yaml
new file mode 100644
index 0000000000..bbc4ad1215
--- /dev/null
+++ b/stable/kong/templates/controller-rbac-resources.yaml
@@ -0,0 +1,152 @@
+{{- if and .Values.ingressController.rbac.create .Values.ingressController.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  name:  {{ template "kong.fullname" . }}
+  namespace: {{ .Release.namespace }}
+  labels:
+    app: {{ template "kong.name" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - pods
+      - secrets
+      - namespaces
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    resourceNames:
+      # Defaults to "<election-id>-<ingress-class>"
+      # Here: "<kong-ingress-controller-leader-nginx>-<nginx>"
+      # This has to be adapted if you change either parameter
+      # when launching the nginx-ingress-controller.
+      - "kong-ingress-controller-leader-{{ .Values.ingressController.ingressClass }}-{{ .Values.ingressController.ingressClass }}"
+    verbs:
+      - get
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - create
+  - apiGroups:
+      - ""
+    resources:
+      - endpoints
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name:  {{ template "kong.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "kong.name" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "kong.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "kong.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  labels:
+    app: {{ template "kong.name" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+  name:  {{ template "kong.fullname" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - endpoints
+      - nodes
+      - pods
+      - secrets
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "extensions"
+      - "networking.k8s.io"
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+        - events
+    verbs:
+        - create
+        - patch
+  - apiGroups:
+      - "extensions"
+      - "networking.k8s.io"
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+  - apiGroups:
+      - "configuration.konghq.com"
+    resources:
+      - kongplugins
+      - kongcredentials
+      - kongconsumers
+      - kongingresses
+    verbs:
+      - get
+      - list
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name:  {{ template "kong.fullname" . }}
+  labels:
+    app: {{ template "kong.name" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name:  {{ template "kong.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "kong.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
diff --git a/stable/kong/templates/controller-rbac-role-binding.yaml b/stable/kong/templates/controller-rbac-role-binding.yaml
deleted file mode 100644
index 6dad01956c..0000000000
--- a/stable/kong/templates/controller-rbac-role-binding.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-{{- if and .Values.ingressController.rbac.create .Values.ingressController.enabled -}}
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: RoleBinding
-metadata:
-  name:  {{ template "kong.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "kong.name" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ template "kong.fullname" . }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "kong.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
-{{- end -}}
diff --git a/stable/kong/templates/controller-rbac-role.yaml b/stable/kong/templates/controller-rbac-role.yaml
deleted file mode 100644
index 90e076730d..0000000000
--- a/stable/kong/templates/controller-rbac-role.yaml
+++ /dev/null
@@ -1,47 +0,0 @@
-{{- if and .Values.ingressController.rbac.create .Values.ingressController.enabled -}}
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: Role
-metadata:
-  name:  {{ template "kong.fullname" . }}
-  namespace: {{ .Release.namespace }}
-  labels:
-    app: {{ template "kong.name" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - pods
-      - secrets
-      - namespaces
-    verbs:
-      - get
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    resourceNames:
-      # Defaults to "<election-id>-<ingress-class>"
-      # Here: "<kong-ingress-controller-leader-nginx>-<nginx>"
-      # This has to be adapted if you change either parameter
-      # when launching the nginx-ingress-controller.
-      - "kong-ingress-controller-leader-{{ .Values.ingressController.ingressClass }}-{{ .Values.ingressController.ingressClass }}"
-    verbs:
-      - get
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - create
-  - apiGroups:
-      - ""
-    resources:
-      - endpoints
-    verbs:
-      - get
-{{- end -}}
diff --git a/stable/kong/templates/crd-kongconsumer.yaml b/stable/kong/templates/crd-kongconsumer.yaml
deleted file mode 100644
index a25eff50b0..0000000000
--- a/stable/kong/templates/crd-kongconsumer.yaml
+++ /dev/null
@@ -1,36 +0,0 @@
-{{- if and .Values.ingressController.enabled .Values.ingressController.installCRDs -}}
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: kongconsumers.configuration.konghq.com
-  labels:
-    app: {{ template "kong.name" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-spec:
-  group: configuration.konghq.com
-  version: v1
-  scope: Namespaced
-  names:
-    kind: KongConsumer
-    plural: kongconsumers
-    shortNames:
-    - kc
-  additionalPrinterColumns:
-  - name: Username
-    type: string
-    description: Username of a Kong Consumer
-    JSONPath: .username
-  - name: Age
-    type: date
-    description: Age
-    JSONPath: .metadata.creationTimestamp
-  validation:
-    openAPIV3Schema:
-      properties:
-        username:
-          type: string
-        custom_id:
-          type: string
-{{- end -}}
diff --git a/stable/kong/templates/crd-kongcredential.yaml b/stable/kong/templates/crd-kongcredential.yaml
deleted file mode 100644
index d442157877..0000000000
--- a/stable/kong/templates/crd-kongcredential.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
-{{- if and .Values.ingressController.enabled .Values.ingressController.installCRDs -}}
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: kongcredentials.configuration.konghq.com
-  labels:
-    app: {{ template "kong.name" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-spec:
-  group: configuration.konghq.com
-  version: v1
-  scope: Namespaced
-  names:
-    kind: KongCredential
-    plural: kongcredentials
-  additionalPrinterColumns:
-  - name: Credential-type
-    type: string
-    description: Type of credential
-    JSONPath: .type
-  - name: Age
-    type: date
-    description: Age
-    JSONPath: .metadata.creationTimestamp
-  - name: Consumer-Ref
-    type: string
-    description: Owner of the credential
-    JSONPath: .consumerRef
-  validation:
-    openAPIV3Schema:
-      required:
-      - consumerRef
-      - type
-      properties:
-        consumerRef:
-          type: string
-        type:
-          type: string
-{{- end -}}
diff --git a/stable/kong/templates/crd-kongplugins.yaml b/stable/kong/templates/crd-kongplugins.yaml
deleted file mode 100644
index d8fff8e91a..0000000000
--- a/stable/kong/templates/crd-kongplugins.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-{{- if and .Values.ingressController.enabled .Values.ingressController.installCRDs -}}
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: kongplugins.configuration.konghq.com
-  labels:
-    app: {{ template "kong.name" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
-spec:
-  group: configuration.konghq.com
-  version: v1
-  scope: Namespaced
-  names:
-    kind: KongPlugin
-    plural: kongplugins
-    shortNames:
-    - kp
-  additionalPrinterColumns:
-  - name: Plugin-Type
-    type: string
-    description: Name of the plugin
-    JSONPath: .plugin
-  - name: Age
-    type: date
-    description: Age
-    JSONPath: .metadata.creationTimestamp
-  - name: Disabled
-    type: boolean
-    description: Indicates if the plugin is disabled
-    JSONPath: .disabled
-    priority: 1
-  - name: Config
-    type: string
-    description: Configuration of the plugin
-    JSONPath: .config
-    priority: 1
-  validation:
-    openAPIV3Schema:
-      required:
-      - plugin
-      properties:
-        plugin:
-          type: string
-        disabled:
-          type: boolean
-        config:
-          type: object
-        run_on:
-          type: string
-          enum:
-          - first
-          - second
-          - all
-        protocols:
-          type: array
-          items:
-            type: string
-            enum:
-            - http
-            - https
-            - tcp
-            - tls
-{{- end -}}
diff --git a/stable/kong/templates/crd-kongingress.yaml b/stable/kong/templates/custom-resource-definitions.yaml
similarity index 57%
rename from stable/kong/templates/crd-kongingress.yaml
rename to stable/kong/templates/custom-resource-definitions.yaml
index 1f6eaf9b82..4e0c0346bc 100644
--- a/stable/kong/templates/crd-kongingress.yaml
+++ b/stable/kong/templates/custom-resource-definitions.yaml
@@ -1,6 +1,145 @@
 {{- if and .Values.ingressController.enabled .Values.ingressController.installCRDs -}}
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
+metadata:
+  name: kongconsumers.configuration.konghq.com
+  labels:
+    app: {{ template "kong.name" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+spec:
+  group: configuration.konghq.com
+  version: v1
+  scope: Namespaced
+  names:
+    kind: KongConsumer
+    plural: kongconsumers
+    shortNames:
+    - kc
+  additionalPrinterColumns:
+  - name: Username
+    type: string
+    description: Username of a Kong Consumer
+    JSONPath: .username
+  - name: Age
+    type: date
+    description: Age
+    JSONPath: .metadata.creationTimestamp
+  validation:
+    openAPIV3Schema:
+      properties:
+        username:
+          type: string
+        custom_id:
+          type: string
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: kongcredentials.configuration.konghq.com
+  labels:
+    app: {{ template "kong.name" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+spec:
+  group: configuration.konghq.com
+  version: v1
+  scope: Namespaced
+  names:
+    kind: KongCredential
+    plural: kongcredentials
+  additionalPrinterColumns:
+  - name: Credential-type
+    type: string
+    description: Type of credential
+    JSONPath: .type
+  - name: Age
+    type: date
+    description: Age
+    JSONPath: .metadata.creationTimestamp
+  - name: Consumer-Ref
+    type: string
+    description: Owner of the credential
+    JSONPath: .consumerRef
+  validation:
+    openAPIV3Schema:
+      required:
+      - consumerRef
+      - type
+      properties:
+        consumerRef:
+          type: string
+        type:
+          type: string
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: kongplugins.configuration.konghq.com
+  labels:
+    app: {{ template "kong.name" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+spec:
+  group: configuration.konghq.com
+  version: v1
+  scope: Namespaced
+  names:
+    kind: KongPlugin
+    plural: kongplugins
+    shortNames:
+    - kp
+  additionalPrinterColumns:
+  - name: Plugin-Type
+    type: string
+    description: Name of the plugin
+    JSONPath: .plugin
+  - name: Age
+    type: date
+    description: Age
+    JSONPath: .metadata.creationTimestamp
+  - name: Disabled
+    type: boolean
+    description: Indicates if the plugin is disabled
+    JSONPath: .disabled
+    priority: 1
+  - name: Config
+    type: string
+    description: Configuration of the plugin
+    JSONPath: .config
+    priority: 1
+  validation:
+    openAPIV3Schema:
+      required:
+      - plugin
+      properties:
+        plugin:
+          type: string
+        disabled:
+          type: boolean
+        config:
+          type: object
+        run_on:
+          type: string
+          enum:
+          - first
+          - second
+          - all
+        protocols:
+          type: array
+          items:
+            type: string
+            enum:
+            - http
+            - https
+            - tcp
+            - tls
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
 metadata:
   name: kongingresses.configuration.konghq.com
   labels:
diff --git a/stable/kong/templates/deployment.yaml b/stable/kong/templates/deployment.yaml
index 53a9a7d053..cde83fe099 100644
--- a/stable/kong/templates/deployment.yaml
+++ b/stable/kong/templates/deployment.yaml
@@ -53,148 +53,11 @@ spec:
       {{- if .Values.ingressController.enabled }}
       {{- include "kong.controller-container" . | nindent 6 }}
       {{ end }}
-      - name: {{ template "kong.name" . }}
+      - name: "proxy"
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         env:
-        - name: KONG_LUA_PACKAGE_PATH
-          value: "/opt/?.lua;;"
-        {{- if not .Values.env.admin_listen }}
-        {{- if .Values.admin.useTLS }}
-        - name: KONG_ADMIN_LISTEN
-          value: "0.0.0.0:{{ .Values.admin.containerPort }} ssl"
-        {{- else }}
-        - name: KONG_ADMIN_LISTEN
-          value: 0.0.0.0:{{ .Values.admin.containerPort }}
-        {{- end }}
-        {{- end }}
-        {{- if .Values.admin.ingress.enabled }}
-        - name: KONG_ADMIN_API_URI
-          value: {{ include "kong.ingress.serviceUrl" .Values.admin.ingress }}
-        {{- end }}
-        {{- if not .Values.env.proxy_listen }}
-        - name: KONG_PROXY_LISTEN
-          value: {{ template "kong.kongProxyListenValue" . }}
-        {{- end }}
-        {{- if and (not .Values.env.admin_gui_listen) (.Values.enterprise.enabled) }}
-        - name: KONG_ADMIN_GUI_LISTEN
-          value: {{ template "kong.kongManagerListenValue" . }}
-        {{- end }}
-        {{- if and (.Values.manager.ingress.enabled) (.Values.enterprise.enabled) }}
-        - name: KONG_ADMIN_GUI_URL
-          value: {{ include "kong.ingress.serviceUrl" .Values.manager.ingress }}
-        {{- end }}
-        {{- if and (not .Values.env.portal_gui_listen) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
-        - name: KONG_PORTAL_GUI_LISTEN
-          value: {{ template "kong.kongPortalListenValue" . }}
-        {{- end }}
-        {{- if and (.Values.portal.ingress.enabled) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
-        - name: KONG_PORTAL_GUI_HOST
-          value: {{ .Values.portal.ingress.hostname }}
-        {{- if .Values.portal.ingress.tls }}
-        - name: KONG_PORTAL_GUI_PROTOCOL
-          value: https
-        {{- else }}
-        - name: KONG_PORTAL_GUI_PROTOCOL
-          value: http
-        {{- end }}
-        {{- end }}
-        {{- if and (not .Values.env.portal_api_listen) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
-        - name: KONG_PORTAL_API_LISTEN
-          value: {{ template "kong.kongPortalApiListenValue" . }}
-        {{- end }}
-        {{- if and (.Values.portalapi.ingress.enabled) (.Values.enterprise.enabled) (.Values.enterprise.portal.enabled) }}
-        - name: KONG_PORTAL_API_URL
-          value: {{ include "kong.ingress.serviceUrl" .Values.portalapi.ingress }}
-        {{- end }}
-        - name: KONG_NGINX_DAEMON
-          value: "off"
-        {{- if .Values.enterprise.enabled }}
-        {{- if not .Values.enterprise.vitals.enabled }}
-        - name: KONG_VITALS
-          value: "off"
-        {{- end }}
-        {{- if .Values.enterprise.portal.enabled }}
-        - name: KONG_PORTAL
-          value: "on"
-        {{- if .Values.enterprise.portal.portal_auth }}
-        - name: KONG_PORTAL_AUTH
-          value: {{ .Values.enterprise.portal.portal_auth }}
-        - name: KONG_PORTAL_SESSION_CONF
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.enterprise.portal.session_conf_secret }}
-              key: portal_session_conf
-        {{- end }}
-        {{- end }}
-        {{- if .Values.enterprise.rbac.enabled }}
-        - name: KONG_ENFORCE_RBAC
-          value: "on"
-        - name: KONG_ADMIN_GUI_AUTH
-          value: {{ .Values.enterprise.rbac.admin_gui_auth | default "basic-auth" }}
-        {{- if not (eq .Values.enterprise.rbac.admin_gui_auth "basic-auth") }}
-        - name: KONG_ADMIN_GUI_AUTH_CONF
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.enterprise.rbac.admin_gui_auth_conf_secret }}
-              key: admin_gui_auth_conf
-        {{- end }}
-        - name: KONG_ADMIN_GUI_SESSION_CONF
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.enterprise.rbac.session_conf_secret }}
-              key: admin_gui_session_conf
-        {{- end }}
-        {{- if .Values.enterprise.smtp.enabled }}
-        - name: KONG_PORTAL_EMAILS_FROM
-          value: {{ .Values.enterprise.smtp.portal_emails_from }}
-        - name: KONG_PORTAL_EMAILS_REPLY_TO
-          value: {{ .Values.enterprise.smtp.portal_emails_reply_to }}
-        - name: KONG_ADMIN_EMAILS_FROM
-          value: {{ .Values.enterprise.smtp.admin_emails_from }}
-        - name: KONG_ADMIN_EMAILS_REPLY_TO
-          value: {{ .Values.enterprise.smtp.admin_emails_reply_to }}
-        - name: KONG_SMTP_HOST
-          value: {{ .Values.enterprise.smtp.smtp_host }}
-        - name: KONG_SMTP_PORT
-          value: {{ .Values.enterprise.smtp.smtp_port | quote }}
-        - name: KONG_SMTP_STARTTLS
-          value: {{ .Values.enterprise.smtp.smtp_starttls | quote }}
-        {{- if .Values.enterprise.smtp.auth.smtp_username }}
-        - name: KONG_SMTP_USERNAME
-          value: {{ .Values.enterprise.smtp.auth.smtp_username }}
-        - name: KONG_SMTP_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.enterprise.smtp.auth.smtp_password_secret }}
-              key: smtp_password
-        {{- end }}
-        {{- else }}
-        - name: KONG_SMTP_MOCK
-          value: "on"
-        {{- end }}
-        {{- include "kong.license" . | nindent 8 }}
-        {{- end }}
-        - name: KONG_NGINX_HTTP_INCLUDE
-          value: /kong/servers.conf
-        {{- if .Values.postgresql.enabled }}
-        - name: KONG_PG_HOST
-          value: {{ template "kong.postgresql.fullname" . }}
-        - name: KONG_PG_PORT
-          value: "{{ .Values.postgresql.service.port }}"
-        - name: KONG_PG_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "kong.postgresql.fullname" . }}
-              key: postgresql-password
-        {{- end }}
-        {{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off")) }}
-        - name: KONG_DECLARATIVE_CONFIG
-          value: "/kong_dbless/kong.yml"
-        {{- end }}
-        - name: KONG_PLUGINS
-          value: {{ template "kong.plugins" . }}
-        {{- include "kong.env" .  | indent 8 }}
+        {{- include "kong.final_env" . | nindent 8 }}
         lifecycle:
           preStop:
             exec:
diff --git a/stable/kong/templates/migrations-post-upgrade.yaml b/stable/kong/templates/migrations-post-upgrade.yaml
index 26d2cf2f02..ff231bf6c5 100644
--- a/stable/kong/templates/migrations-post-upgrade.yaml
+++ b/stable/kong/templates/migrations-post-upgrade.yaml
@@ -32,49 +32,16 @@ spec:
         - name: {{ . }}
       {{- end }}
       {{- end }}
-      {{- if .Values.postgresql.enabled }}
       initContainers:
-      - name: wait-for-postgres
-        image: "{{ .Values.waitImage.repository }}:{{ .Values.waitImage.tag }}"
-        imagePullPolicy: {{ .Values.waitImage.pullPolicy }}
-        env:
-        - name: KONG_PG_HOST
-          value: {{ template "kong.postgresql.fullname" . }}
-        - name: KONG_PG_PORT
-          value: "{{ .Values.postgresql.service.port }}"
-        - name: KONG_PG_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "kong.postgresql.fullname" . }}
-              key: postgresql-password
-        command: [ "/bin/sh", "-c", "until nc -zv $KONG_PG_HOST $KONG_PG_PORT -w1; do echo 'waiting for db'; sleep 1; done" ]
+      {{- if (eq .Values.env.database "postgres") }}
+      {{- include "kong.wait-for-postgres" . | nindent 6 }}
       {{- end }}
       containers:
       - name: {{ template "kong.name" . }}-post-upgrade-migrations
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         env:
-        - name: KONG_LUA_PACKAGE_PATH
-          value: "/opt/?.lua;;"
-        - name: KONG_PLUGINS
-          value: {{ template "kong.plugins" . }}
-        - name: KONG_NGINX_DAEMON
-          value: "off"
-        {{- if .Values.enterprise.enabled }}
-        {{- include "kong.license" . | nindent 8 }}
-        {{- end }}
-        {{- if .Values.postgresql.enabled }}
-        - name: KONG_PG_HOST
-          value: {{ template "kong.postgresql.fullname" . }}
-        - name: KONG_PG_PORT
-          value: "{{ .Values.postgresql.service.port }}"
-        - name: KONG_PG_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "kong.postgresql.fullname" . }}
-              key: postgresql-password
-        {{- end }}
-        {{- include "kong.env" .  | indent 8 }}
+        {{- include "kong.final_env" . | nindent 8 }}
         command: [ "/bin/sh", "-c", "kong migrations finish" ]
         volumeMounts:
         {{- include "kong.volumeMounts" . | nindent 8 }}
diff --git a/stable/kong/templates/migrations-pre-upgrade.yaml b/stable/kong/templates/migrations-pre-upgrade.yaml
index 2055aa206a..090e0b81ba 100644
--- a/stable/kong/templates/migrations-pre-upgrade.yaml
+++ b/stable/kong/templates/migrations-pre-upgrade.yaml
@@ -32,49 +32,16 @@ spec:
         - name: {{ . }}
       {{- end }}
       {{- end }}
-      {{- if .Values.postgresql.enabled }}
       initContainers:
-      - name: wait-for-postgres
-        image: "{{ .Values.waitImage.repository }}:{{ .Values.waitImage.tag }}"
-        imagePullPolicy: {{ .Values.waitImage.pullPolicy }}
-        env:
-        - name: KONG_PG_HOST
-          value: {{ template "kong.postgresql.fullname" . }}
-        - name: KONG_PG_PORT
-          value: "{{ .Values.postgresql.service.port }}"
-        - name: KONG_PG_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "kong.postgresql.fullname" . }}
-              key: postgresql-password
-        command: [ "/bin/sh", "-c", "until nc -zv $KONG_PG_HOST $KONG_PG_PORT -w1; do echo 'waiting for db'; sleep 1; done" ]
+      {{- if (eq .Values.env.database "postgres") }}
+      {{- include "kong.wait-for-postgres" . | nindent 6 }}
       {{- end }}
       containers:
       - name: {{ template "kong.name" . }}-upgrade-migrations
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         env:
-        - name: KONG_LUA_PACKAGE_PATH
-          value: "/opt/?.lua;;"
-        - name: KONG_PLUGINS
-          value: {{ template "kong.plugins" . }}
-        - name: KONG_NGINX_DAEMON
-          value: "off"
-        {{- if .Values.enterprise.enabled }}
-        {{- include "kong.license" . | nindent 8 }}
-        {{- end }}
-        {{- if .Values.postgresql.enabled }}
-        - name: KONG_PG_HOST
-          value: {{ template "kong.postgresql.fullname" . }}
-        - name: KONG_PG_PORT
-          value: "{{ .Values.postgresql.service.port }}"
-        - name: KONG_PG_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "kong.postgresql.fullname" . }}
-              key: postgresql-password
-        {{- end }}
-        {{- include "kong.env" .  | indent 8 }}
+        {{- include "kong.final_env" . | nindent 8 }}
         command: [ "/bin/sh", "-c", "kong migrations up" ]
         volumeMounts:
         {{- include "kong.volumeMounts" . | nindent 8 }}
diff --git a/stable/kong/templates/migrations.yaml b/stable/kong/templates/migrations.yaml
index bfec1f2c4d..18626cd1ef 100644
--- a/stable/kong/templates/migrations.yaml
+++ b/stable/kong/templates/migrations.yaml
@@ -27,49 +27,16 @@ spec:
         - name: {{ . }}
       {{- end }}
       {{- end }}
-      {{- if .Values.postgresql.enabled }}
       initContainers:
-      - name: wait-for-postgres
-        image: "{{ .Values.waitImage.repository }}:{{ .Values.waitImage.tag }}"
-        imagePullPolicy: {{ .Values.waitImage.pullPolicy }}
-        env:
-        - name: KONG_PG_HOST
-          value: {{ template "kong.postgresql.fullname" . }}
-        - name: KONG_PG_PORT
-          value: "{{ .Values.postgresql.service.port }}"
-        - name: KONG_PG_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "kong.postgresql.fullname" . }}
-              key: postgresql-password
-        command: [ "/bin/sh", "-c", "until nc -zv $KONG_PG_HOST $KONG_PG_PORT -w1; do echo 'waiting for db'; sleep 1; done" ]
+      {{- if (eq .Values.env.database "postgres") }}
+      {{- include "kong.wait-for-postgres" . | nindent 6 }}
       {{- end }}
       containers:
       - name: {{ template "kong.name" . }}-migrations
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         env:
-        - name: KONG_PLUGINS
-          value: {{ template "kong.plugins" . }}
-        - name: KONG_LUA_PACKAGE_PATH
-          value: "/opt/?.lua;;"
-        - name: KONG_NGINX_DAEMON
-          value: "off"
-        {{- if .Values.enterprise.enabled }}
-        {{- include "kong.license" . | nindent 8 }}
-        {{- end }}
-        {{- if .Values.postgresql.enabled }}
-        - name: KONG_PG_HOST
-          value: {{ template "kong.postgresql.fullname" . }}
-        - name: KONG_PG_PORT
-          value: "{{ .Values.postgresql.service.port }}"
-        - name: KONG_PG_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ template "kong.postgresql.fullname" . }}
-              key: postgresql-password
-        {{- end }}
-        {{- include "kong.env" .  | indent 8 }}
+        {{- include "kong.final_env" . | nindent 8 }}
         command: [ "/bin/sh", "-c", "kong migrations bootstrap" ]
         volumeMounts:
         {{- include "kong.volumeMounts" . | nindent 8 }}
diff --git a/stable/kong/values.yaml b/stable/kong/values.yaml
index bf65bfcabe..f33d28f97e 100644
--- a/stable/kong/values.yaml
+++ b/stable/kong/values.yaml
@@ -1,8 +1,39 @@
-# Default values for kong.
+# Default values for Kong's Helm Chart.
 # Declare variables to be passed into your templates.
+#
+# Sections:
+# - Kong parameters
+# - Ingress Controller parameters
+# - Postgres sub-chart parameters
+# - Miscellaneous parameters
+# - Kong Enterprise parameters
 
+# -----------------------------------------------------------------------------
+# Kong parameters
+# -----------------------------------------------------------------------------
+
+# Specify Kong configurations
+# Kong configurations guide https://docs.konghq.com/latest/configuration
+# Values here take precedence over values from other sections of values.yaml,
+# e.g. setting pg_user here will override the value normally set when postgresql.enabled
+# is set below. In general, you should not set values here if they are set elsewhere.
+env:
+  database: "off"
+  nginx_worker_processes: "1"
+  proxy_access_log: /dev/stdout
+  admin_access_log: /dev/stdout
+  admin_gui_access_log: /dev/stdout
+  portal_api_access_log: /dev/stdout
+  proxy_error_log: /dev/stderr
+  admin_error_log: /dev/stderr
+  admin_gui_error_log: /dev/stderr
+  portal_api_error_log: /dev/stderr
+  prefix: /kong_prefix/
+
+# Specify Kong's Docker image and repository details here
 image:
   repository: kong
+  # repository: kong-docker-kong-enterprise-k8s.bintray.io/kong-enterprise-k8s
   # repository: kong-docker-kong-enterprise-edition-docker.bintray.io/kong-enterprise-edition
   tag: 1.4
   pullPolicy: IfNotPresent
@@ -14,12 +45,9 @@ image:
   # pullSecrets:
   #   - myRegistrKeySecretName
 
-waitImage:
-  repository: busybox
-  tag: latest
-  pullPolicy: IfNotPresent
-
 # Specify Kong admin service configuration
+# Note: It is recommended to not use the Admin API to configure Kong
+# when using Kong as an Ingress Controller.
 admin:
   enabled: false
   # If you want to specify annotations for the admin service, uncomment the following
@@ -36,7 +64,8 @@ admin:
   type: NodePort
   # Set a nodePort which is available
   # nodePort: 32444
-  # Kong admin ingress settings.
+  # Kong admin ingress settings. Useful if you want to expose the Admin
+  # API of Kong outside the k8s cluster.
   ingress:
     # Enable/disable exposure using ingress.
     enabled: false
@@ -77,6 +106,8 @@ proxy:
   type: LoadBalancer
 
   # Kong proxy ingress settings.
+  # Note: You need this only if you are using another Ingress Controller
+  # to expose Kong outside the k8s cluster.
   ingress:
     # Enable/disable exposure using ingress.
     enabled: false
@@ -96,6 +127,281 @@ proxy:
 
   externalIPs: []
 
+# Custom Kong plugins can be loaded into Kong by mounting the plugin code
+# into the file-system of Kong container.
+# The plugin code should be present in ConfigMap or Secret inside the same
+# namespace as Kong is being installed.
+# The `name` property refers to the name of the ConfigMap or Secret
+# itself, while the pluginName refers to the name of the plugin as it appears
+# in Kong.
+plugins: {}
+  # configMaps:
+  # - pluginName: rewriter
+  #   name: kong-plugin-rewriter
+  # secrets:
+  # - pluginName: rewriter
+  #   name: kong-plugin-rewriter
+# Inject specified secrets as a volume in Kong Container at path /etc/secrets/{secret-name}/
+# This can be used to override default SSL certificates
+# Example configuration
+# secretVolumes:
+# - kong-proxy-tls
+# - kong-admin-tls
+secretVolumes: []
+
+# Set runMigrations to run Kong migrations
+runMigrations: true
+
+# Kong's configuration for DB-less mode
+# Note: Use this section only if you are deploying Kong in DB-less mode
+# and not as an Ingress Controller.
+dblessConfig:
+  # Either Kong's configuration is managed from an existing ConfigMap (with Key: kong.yml)
+  configMap: ""
+  # Or the configuration is passed in full-text below
+  config:
+    _format_version: "1.1"
+    services:
+      # Example configuration
+      # - name: example.com
+      #   url: http://example.com
+      #   routes:
+      #   - name: example
+      #     paths:
+      #     - "/example"
+
+# -----------------------------------------------------------------------------
+# Ingress Controller parameters
+# -----------------------------------------------------------------------------
+
+# Kong Ingress Controller's primary purpose is to satisfy Ingress resources
+# created in k8s.  It uses CRDs for more fine grained control over routing and
+# for Kong specific configuration.
+ingressController:
+  enabled: true
+  image:
+    repository: kong-docker-kubernetes-ingress-controller.bintray.io/kong-ingress-controller
+    tag: 0.6.2
+
+  # Specify Kong Ingress Controller configuration via environment variables
+  env: {}
+
+  admissionWebhook:
+    enabled: false
+    failurePolicy: Fail
+    port: 8080
+
+  ingressClass: kong
+
+  rbac:
+    # Specifies whether RBAC resources should be created
+    create: true
+
+  serviceAccount:
+    # Specifies whether a ServiceAccount should be created
+    create: true
+    # The name of the ServiceAccount to use.
+    # If not set and create is true, a name is generated using the fullname template
+    name:
+
+  installCRDs: true
+
+  # general properties
+  livenessProbe:
+    failureThreshold: 3
+    httpGet:
+      path: "/healthz"
+      port: 10254
+      scheme: HTTP
+    initialDelaySeconds: 10
+    periodSeconds: 10
+    successThreshold: 1
+    timeoutSeconds: 5
+  readinessProbe:
+    failureThreshold: 3
+    httpGet:
+      path: "/healthz"
+      port: 10254
+      scheme: HTTP
+    initialDelaySeconds: 10
+    periodSeconds: 10
+    successThreshold: 1
+    timeoutSeconds: 5
+  resources: {}
+
+# -----------------------------------------------------------------------------
+# Postgres sub-chart parameters
+# -----------------------------------------------------------------------------
+
+# Kong can run without a database or use either Postgres or Cassandra
+# as a backend datatstore for it's configuration.
+# By default, this chart installs Kong without a database.
+
+# If you would like to use a database, there are two options:
+# - (recommended) Deploy and maintain a database and pass the connection
+#   details to Kong via the `env` section.
+# - You can use the below `postgresql` sub-chart to deploy a database
+#   along-with Kong as part of a single Helm release.
+
+# PostgreSQL chart documentation:
+# https://github.com/helm/charts/blob/master/stable/postgresql/README.md
+
+postgresql:
+  enabled: false
+  # postgresqlUsername: kong
+  # postgresqlDatabase: kong
+  # service:
+  #   port: 5432
+
+# -----------------------------------------------------------------------------
+# Miscellaneous parameters
+# -----------------------------------------------------------------------------
+
+waitImage:
+  repository: busybox
+  tag: latest
+  pullPolicy: IfNotPresent
+
+# update strategy
+updateStrategy: {}
+  # type: RollingUpdate
+  # rollingUpdate:
+  #   maxSurge: "100%"
+  #   maxUnavailable: "0%"
+
+# If you want to specify resources, uncomment the following
+# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+resources: {}
+  # limits:
+  #  cpu: 100m
+  #  memory: 128Mi
+  # requests:
+  #  cpu: 100m
+  #  memory: 128Mi
+
+# readinessProbe for Kong pods
+# If using Kong Enterprise with RBAC, you must add a Kong-Admin-Token header
+readinessProbe:
+  httpGet:
+    path: "/status"
+    port: metrics
+    scheme: HTTP
+  initialDelaySeconds: 10
+  timeoutSeconds: 1
+  periodSeconds: 10
+  successThreshold: 1
+  failureThreshold: 5
+
+# livenessProbe for Kong pods
+livenessProbe:
+  httpGet:
+    path: "/status"
+    port: metrics
+    scheme: HTTP
+  initialDelaySeconds: 10
+  timeoutSeconds: 5
+  periodSeconds: 30
+  successThreshold: 1
+  failureThreshold: 5
+
+# Affinity for pod assignment
+# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+# affinity: {}
+
+# Tolerations for pod assignment
+# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+tolerations: []
+
+# Node labels for pod assignment
+# Ref: https://kubernetes.io/docs/user-guide/node-selection/
+nodeSelector: {}
+
+# Annotation to be added to Kong pods
+podAnnotations: {}
+
+# Kong pod count
+replicaCount: 1
+
+# Kong Pod Disruption Budget
+podDisruptionBudget:
+  enabled: false
+  maxUnavailable: "50%"
+
+podSecurityPolicy:
+  enabled: false
+
+# securityContext for Kong pods.
+securityContext:
+  runAsUser: 1000
+
+serviceMonitor:
+  # Specifies whether ServiceMonitor for Prometheus operator should be created
+  enabled: false
+  # interval: 10s
+  # Specifies namespace, where ServiceMonitor should be installed
+  # namespace: monitoring
+  # labels:
+  #   foo: bar
+
+# -----------------------------------------------------------------------------
+# Kong Enterprise parameters
+# -----------------------------------------------------------------------------
+
+# Toggle Kong Enterprise features on or off
+# RBAC and SMTP configuration have additional options that must all be set together
+# Other settings should be added to the "env" settings below
+enterprise:
+  enabled: false
+  # Kong Enterprise license secret name
+  # This secret must contain a single 'license' key, containing your base64-encoded license data
+  # The license secret is required for all Kong Enterprise deployments
+  license_secret: you-must-create-a-kong-license-secret
+  # Session configuration secret
+  # The session conf secret is required if using RBAC or the Portal
+  vitals:
+    enabled: true
+  portal:
+    enabled: false
+    # portal_auth here sets the default authentication mechanism for the Portal
+    # FIXME This can be changed per-workspace, but must currently default to
+    # basic-auth to work around limitations with session configuration
+    portal_auth: basic-auth
+    # If the Portal is enabled and any workspace's Portal uses authentication,
+    # this Secret must contain an portal_session_conf key
+    # The key value must be a secret configuration, following the example at
+    # https://docs.konghq.com/enterprise/latest/developer-portal/configuration/authentication/sessions
+    session_conf_secret: you-must-create-a-portal-session-conf-secret
+  rbac:
+    enabled: false
+    admin_gui_auth: basic-auth
+    # If RBAC is enabled, this Secret must contain an admin_gui_session_conf key
+    # The key value must be a secret configuration, following the example at
+    # https://docs.konghq.com/enterprise/latest/kong-manager/authentication/sessions
+    session_conf_secret: you-must-create-an-rbac-session-conf-secret
+    # If admin_gui_auth is not set to basic-auth, provide a secret name which
+    # has an admin_gui_auth_conf key containing the plugin config JSON
+    admin_gui_auth_conf_secret: you-must-create-an-admin-gui-auth-conf-secret
+  # For configuring emails and SMTP, please read through:
+  # https://docs.konghq.com/enterprise/latest/developer-portal/configuration/smtp
+  # https://docs.konghq.com/enterprise/latest/kong-manager/networking/email
+  smtp:
+    enabled: false
+    portal_emails_from: none@example.com
+    portal_emails_reply_to: none@example.com
+    admin_emails_from: none@example.com
+    admin_emails_reply_to: none@example.com
+    smtp_admin_emails: none@example.com
+    smtp_host: smtp.example.com
+    smtp_port: 587
+    smtp_starttls: true
+    auth:
+      # If your SMTP server does not require authentication, this section can
+      # be left as-is. If smtp_username is set to anything other than an empty
+      # string, you must create a Secret with an smtp_password key containing
+      # your SMTP password and specify its name here.
+      smtp_username: ''  # e.g. postmaster@example.com
+      smtp_password_secret: you-must-create-an-smtp-password
+
 manager:
   # If you want to specify annotations for the Manager service, uncomment the following
   # line, add additional or adjust as needed, and remove the curly braces after 'annotations:'.
@@ -209,275 +515,3 @@ portalapi:
     path: /
 
   externalIPs: []
-
-# Toggle Kong Enterprise features on or off
-# RBAC and SMTP configuration have additional options that must all be set together
-# Other settings should be added to the "env" settings below
-enterprise:
-  enabled: false
-  # Kong Enterprise license secret name
-  # This secret must contain a single 'license' key, containing your base64-encoded license data
-  # The license secret is required for all Kong Enterprise deployments
-  license_secret: you-must-create-a-kong-license-secret
-  # Session configuration secret
-  # The session conf secret is required if using RBAC or the Portal
-  vitals:
-    enabled: true
-  portal:
-    enabled: false
-    # portal_auth here sets the default authentication mechanism for the Portal
-    # FIXME This can be changed per-workspace, but must currently default to
-    # basic-auth to work around limitations with session configuration
-    portal_auth: basic-auth
-    # If the Portal is enabled and any workspace's Portal uses authentication,
-    # this Secret must contain an portal_session_conf key
-    # The key value must be a secret configuration, following the example at
-    # https://docs.konghq.com/enterprise/latest/developer-portal/configuration/authentication/sessions
-    session_conf_secret: you-must-create-a-portal-session-conf-secret
-  rbac:
-    enabled: false
-    admin_gui_auth: basic-auth
-    # If RBAC is enabled, this Secret must contain an admin_gui_session_conf key
-    # The key value must be a secret configuration, following the example at
-    # https://docs.konghq.com/enterprise/latest/kong-manager/authentication/sessions
-    session_conf_secret: you-must-create-an-rbac-session-conf-secret
-    # If admin_gui_auth is not set to basic-auth, provide a secret name which
-    # has an admin_gui_auth_conf key containing the plugin config JSON
-    admin_gui_auth_conf_secret: you-must-create-an-admin-gui-auth-conf-secret
-  # For configuring emails and SMTP, please read through:
-  # https://docs.konghq.com/enterprise/latest/developer-portal/configuration/smtp
-  # https://docs.konghq.com/enterprise/latest/kong-manager/networking/email
-  smtp:
-    enabled: false
-    portal_emails_from: none@example.com
-    portal_emails_reply_to: none@example.com
-    admin_emails_from: none@example.com
-    admin_emails_reply_to: none@example.com
-    smtp_admin_emails: none@example.com
-    smtp_host: smtp.example.com
-    smtp_port: 587
-    smtp_starttls: true
-    auth:
-      # If your SMTP server does not require authentication, this section can
-      # be left as-is. If smtp_username is set to anything other than an empty
-      # string, you must create a Secret with an smtp_password key containing
-      # your SMTP password and specify its name here.
-      smtp_username: ''  # e.g. postmaster@example.com
-      smtp_password_secret: you-must-create-an-smtp-password
-
-# Set runMigrations to run Kong migrations
-runMigrations: true
-
-# update strategy
-updateStrategy: {}
-  # type: RollingUpdate
-  # rollingUpdate:
-  #   maxSurge: "100%"
-  #   maxUnavailable: "0%"
-
-# Specify Kong configurations
-# Kong configurations guide https://getkong.org/docs/latest/configuration/
-# Values here take precedence over values from other sections of values.yaml,
-# e.g. setting pg_user here will override the value normally set when postgresql.enabled
-# is set below. In general, you should not set values here if they are set elsewhere.
-env:
-  database: "off"
-  nginx_worker_processes: "1"
-  proxy_access_log: /dev/stdout
-  admin_access_log: /dev/stdout
-  admin_gui_access_log: /dev/stdout
-  portal_api_access_log: /dev/stdout
-  proxy_error_log: /dev/stderr
-  admin_error_log: /dev/stderr
-  admin_gui_error_log: /dev/stderr
-  portal_api_error_log: /dev/stderr
-  prefix: /kong_prefix/
-
-# If you want to specify resources, uncomment the following
-# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-resources: {}
-  # limits:
-  #  cpu: 100m
-  #  memory: 128Mi
-  # requests:
-  #  cpu: 100m
-  #  memory: 128Mi
-
-# readinessProbe for Kong pods
-# If using Kong Enterprise with RBAC, you must add a Kong-Admin-Token header
-readinessProbe:
-  httpGet:
-    path: "/status"
-    port: metrics
-    scheme: HTTP
-  initialDelaySeconds: 10
-  timeoutSeconds: 1
-  periodSeconds: 10
-  successThreshold: 1
-  failureThreshold: 5
-
-# livenessProbe for Kong pods
-# If using Kong Enterprise with RBAC, you must add a Kong-Admin-Token header
-livenessProbe:
-  httpGet:
-    path: "/status"
-    port: metrics
-    scheme: HTTP
-  initialDelaySeconds: 10
-  timeoutSeconds: 5
-  periodSeconds: 30
-  successThreshold: 1
-  failureThreshold: 5
-
-# Affinity for pod assignment
-# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-# affinity: {}
-
-# Tolerations for pod assignment
-# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-tolerations: []
-
-# Node labels for pod assignment
-# Ref: https://kubernetes.io/docs/user-guide/node-selection/
-nodeSelector: {}
-
-# Annotation to be added to Kong pods
-podAnnotations: {}
-
-# Kong pod count
-replicaCount: 1
-
-# Kong Pod Disruption Budget
-podDisruptionBudget:
-  enabled: false
-  maxUnavailable: "50%"
-
-podSecurityPolicy:
-  enabled: false
-
-# securityContext for Kong pods.
-securityContext:
-  runAsUser: 1000
-
-# Kong has a choice of either Postgres or Cassandra as a backend datatstore.
-# This chart allows you to choose either of them with the `database.type`
-# parameter.  Postgres is chosen by default.
-
-# Additionally, this chart allows you to use your own database or spin up a new
-# instance by using the `postgres.enabled` or `cassandra.enabled` parameters.
-# Enabling both will create both databases in your cluster, but only one
-# will be used by Kong based on the `env.database` parameter.
-# Postgres is enabled by default.
-
-
-# PostgreSQL chart configs
-postgresql:
-  enabled: false
-  # postgresqlUsername: kong
-  # postgresqlDatabase: kong
-  # service:
-  #   port: 5432
-
-# Custom Kong plugins can be loaded into Kong by mounting the plugin code
-# into the file-system of Kong container.
-# The plugin code should be present in ConfigMap or Secret inside the same
-# namespace as Kong is being installed.
-# The `name` property refers to the name of the ConfigMap or Secret
-# itself, while the pluginName refers to the name of the plugin as it appears
-# in Kong.
-plugins: {}
-  # configMaps:
-  # - pluginName: rewriter
-  #   name: kong-plugin-rewriter
-  # secrets:
-  # - pluginName: rewriter
-  #   name: kong-plugin-rewriter
-# Kong Ingress Controller's primary purpose is to satisfy Ingress resources
-# created in k8s.  It uses CRDs for more fine grained control over routing and
-# for Kong specific configuration.
-ingressController:
-  enabled: true
-  image:
-    repository: kong-docker-kubernetes-ingress-controller.bintray.io/kong-ingress-controller
-    tag: 0.6.2
-
-  # Specify Kong Ingress Controller configuration via environment variables
-  env: {}
-
-  admissionWebhook:
-    enabled: false
-    failurePolicy: Fail
-    port: 8080
-
-  installCRDs: true
-  ingressClass: kong
-
-  rbac:
-    # Specifies whether RBAC resources should be created
-    create: true
-
-  serviceAccount:
-    # Specifies whether a ServiceAccount should be created
-    create: true
-    # The name of the ServiceAccount to use.
-    # If not set and create is true, a name is generated using the fullname template
-    name:
-
-  # general properties
-  livenessProbe:
-    failureThreshold: 3
-    httpGet:
-      path: "/healthz"
-      port: 10254
-      scheme: HTTP
-    initialDelaySeconds: 10
-    periodSeconds: 10
-    successThreshold: 1
-    timeoutSeconds: 5
-  readinessProbe:
-    failureThreshold: 3
-    httpGet:
-      path: "/healthz"
-      port: 10254
-      scheme: HTTP
-    initialDelaySeconds: 10
-    periodSeconds: 10
-    successThreshold: 1
-    timeoutSeconds: 5
-  resources: {}
-  podDisruptionBudget:
-    enabled: false
-    maxUnavailable: "50%"
-
-# We pass the dbless (declarative) config over here.
-dblessConfig:
-  # Either Kong's configuration is managed from an existing ConfigMap (with Key: kong.yml)
-  configMap: ""
-  # Or the configuration is passed in full-text below
-  config:
-    _format_version: "1.1"
-    services:
-      # Example configuration
-      # - name: example.com
-      #   url: http://example.com
-      #   routes:
-      #   - name: example
-      #     paths:
-      #     - "/example"
-
-# Inject specified secrets as a volume in Kong Container at path /etc/secrets/{secret-name}/
-# This can be used to override default SSL certificates
-# Example configuration
-# secretVolumes:
-# - kong-proxy-tls
-# - kong-admin-tls
-secretVolumes: []
-
-serviceMonitor:
-  # Specifies whether ServiceMonitor for Prometheus operator should be created
-  enabled: false
-  # interval: 10s
-  # Specifies namespace, where ServiceMonitor should be installed
-  # namespace: monitoring
-  # labels:
-  #   foo: bar