diff --git a/stable/ambassador/CHANGELOG.md b/stable/ambassador/CHANGELOG.md
index f8e57d314b..778636a317 100644
--- a/stable/ambassador/CHANGELOG.md
+++ b/stable/ambassador/CHANGELOG.md
@@ -3,6 +3,21 @@
 This file documents all notable changes to Ambassador Helm Chart. The release
 numbering uses [semantic versioning](http://semver.org).
 
+## v3.0.0
+
+### Breaking Changes
+
+- The default annotation has been removed. The service port will be set dynamically to 8080 or 8443 for http and https respectively.
+- `service.http`, `service.https`, and `additionalTCPPort` has been replaced with `service.ports`.
+- `rbac.namespaced` has been removed. Use `scope.singleNamespace` instead.
+
+### Minor Changes
+
+- Ambassador Pro will pick up when `AMBASSADOR_ID` is set in `.Values.env` [[#15025]](https://github.com/helm/charts/issues/15025).
+- `{{release name}}-admins` has been renamed to `{{release name}}-admin` to match YAML install templates
+- RBAC configuration has been updated to allow for CRD use when `scope.singleNamespace: true`. [[ambassador/#1576]](https://github.com/datawire/ambassador/issues/1576)
+- RBAC configuration now allows for multiple Ambassadors to use CRDs. Set `crds.enabled` in releases that expect CRDs [[ambassador/#1679]](https://github.com/datawire/ambassador/issues/1679)
+
 ## v2.6.0
 
 ### Minor Changes
diff --git a/stable/ambassador/Chart.yaml b/stable/ambassador/Chart.yaml
index d0e7c1f94c..55bbac9333 100644
--- a/stable/ambassador/Chart.yaml
+++ b/stable/ambassador/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 appVersion: 0.73.0
 description: A Helm chart for Datawire Ambassador
 name: ambassador
-version: 2.12.5
+version: 3.0.0
 icon: https://www.getambassador.io/images/logo.png
 home: https://www.getambassador.io/
 sources:
diff --git a/stable/ambassador/README.md b/stable/ambassador/README.md
index f33eb12890..0acf67d58a 100755
--- a/stable/ambassador/README.md
+++ b/stable/ambassador/README.md
@@ -38,6 +38,10 @@ $ helm delete --purge my-release
 
 The command removes all the Kubernetes components associated with the chart and deletes the release.
 
+## Changelog
+
+Notable chart changes are listed in the [CHANGELOG](https://github.com/helm/charts/blob/master/stable/ambassador/CHANGELOG.md)
+
 ## Configuration
 
 The following tables lists the configurable parameters of the Ambassador chart and their default values.
@@ -48,6 +52,7 @@ The following tables lists the configurable parameters of the Ambassador chart a
 | `adminService.nodePort`            | If explicit NodePort for admin service is required                              | `true`                            |
 | `adminService.type`                | Ambassador's admin service type to be used                                      | `ClusterIP`                       |
 | `ambassadorConfig`                 | Config thats mounted to `/ambassador/ambassador-config`                         | `""`                              |
+| `crds.enabled`                     | If `true`, enables CRD resources for the installation.                          | `true`                            |
 | `crds.create`                      | If `true`, Creates CRD resources                                                | `true`                            |
 | `crds.keep`                        | If `true`, if the ambassador CRDs should be kept when the chart is deleted      | `true`                            |
 | `daemonSet`                        | If `true`, Create a DaemonSet. By default Deployment controller will be created | `false`                           |
@@ -59,7 +64,7 @@ The following tables lists the configurable parameters of the Ambassador chart a
 | `image.tag`                        | Ambassador image tag                                                            | `0.72.0`                          |
 | `imagePullSecrets`                 | Image pull secrets                                                              | `[]`                              |
 | `namespace.name`                   | Set the `AMBASSADOR_NAMESPACE` environment variable                             | `metadata.namespace`              |
-| `scope.singleNamespace`            | Set the `AMBASSADOR_SINGLE_NAMESPACE` environment variable                      | `false`                           |
+| `scope.singleNamespace`            | Set the `AMBASSADOR_SINGLE_NAMESPACE` environment variable and create namespaced RBAC if `rbac.enabled: true` | `false`                           |
 | `podAnnotations`                   | Additional annotations for ambassador pods                                      | `{}`                              |
 | `deploymentAnnotations`            | Additional annotations for ambassador DaemonSet/Deployment                      | `{}`                              |
 | `podLabels`                        | Additional labels for ambassador pods                                           |                                   |
@@ -70,22 +75,14 @@ The following tables lists the configurable parameters of the Ambassador chart a
 | `prometheusExporter.tag`           | Prometheus exporter image                                                       | `v0.8.1`                          |
 | `prometheusExporter.resources`  | CPU/memory resource requests/limits                                                       | `{}`                          |
 | `rbac.create`                      | If `true`, create and use RBAC resources                                        | `true`                            |
-| `rbac.namespaced`                  | If `true`, permissions are namespace-scoped rather than cluster-scoped          | `false`                           |
 | `rbac.podSecurityPolicies`         | pod security polices to bind to                                                 |                                   |
 | `replicaCount`                     | Number of Ambassador replicas                                                   | `3`                               |
 | `resources`                        | CPU/memory resource requests/limits                                             | `{}`                              |
 | `securityContext`                  | Set security context for pod                                                    | `{ "runAsUser": "8888" }`         |
 | `initContainers`                   | Containers used to initialize context for pods                                  | `[]`                              |
-| `service.annotations`              | Annotations to apply to Ambassador service                                      | See "Annotations" below           |
+| `service.annotations`              | Annotations to apply to Ambassador service                                      | `""`                              |
 | `service.externalTrafficPolicy`    | Sets the external traffic policy for the service                                | `""`                              |
-| `service.http.enabled`             | if port 80 should be opened for service                                         | `true`                            |
-| `service.http.nodePort`            | If explicit NodePort is required                                                | None                              |
-| `service.http.port`                | if port 443 should be opened for service                                        | `true`                            |
-| `service.http.targetPort`          | Sets the targetPort that maps to the service's cleartext port                   | `8080`                            |
-| `service.https.enabled`            | if port 443 should be opened for service                                        | `true`                            |
-| `service.https.nodePort`           | If explicit NodePort is required                                                | None                              |
-| `service.https.port`               | if port 443 should be opened for service                                        | `true`                            |
-| `service.https.targetPort`         | Sets the targetPort that maps to the service's TLS port                         | `8443`                            |
+| `service.ports`                    | List of ports Ambassador is listening on                                        |  `[{"name": "http","port": 80,"targetPort": 8080},{"name": "https","port": 443,"targetPort": 8443}]` |
 | `service.loadBalancerIP`           | IP address to assign (if cloud provider supports it)                            | `""`                              |
 | `service.loadBalancerSourceRanges` | Passed to cloud provider load balancer if created (e.g: AWS ELB)                | None                              |
 | `service.type`                     | Service type to be used                                                         | `LoadBalancer`                    |
@@ -105,23 +102,12 @@ The following tables lists the configurable parameters of the Ambassador chart a
 | `autoscaling.minReplica`           | If autoscaling enabled, this field sets minimum replica count                   | `2`                               |
 | `autoscaling.maxReplica`           | If autoscaling enabled, this field sets maximum replica count                   | `5`                               |
 | `autoscaling.metrics`              | If autoscaling enabled, configure hpa metrics                                   |                                   |
-| `additionalTCPPorts`               | List of additional TCP ports to be exposed by the container and service         | `[]`                              |
 
 **NOTE:** Make sure the configured `service.http.targetPort` and `service.https.targetPort` ports match your [Ambassador Module's](https://www.getambassador.io/reference/modules/#the-ambassador-module) `service_port` and `redirect_cleartext_from` configurations.
 
 ### Annotations
 
-The default annotation applied to the Ambassador service is
-
-```
-getambassador.io/config: |
-  ---
-  apiVersion: ambassador/v1
-  kind: Module
-  name: ambassador
-  config:
-    service_port: 8080
-```
+Ambassador configuration is done through annotations on Kubernetes services or Custom Resource Definitions (CRDs). The `service.annotations` section of the values file contains commented out examples of [Ambassador Module](https://www.getambassador.io/reference/core/ambassador) and a global [TLSContext](https://www.getambassador.io/reference/core/tls) configurations which are typically created in the Ambassador service.
 
 If you intend to use `service.annotations`, remember to include the `getambassador.io/config` annotation key as above,
 and remember that you'll have to escape newlines. For example, the annotation above could be defined as
@@ -158,6 +144,66 @@ $ helm upgrade --install --wait my-release -f values.yaml stable/ambassador
 
 # Upgrading
 
+## To 3.0.0
+
+### Service Ports
+
+The way ports are assigned has been changed for a more dynamic method.
+
+Now, instead of setting the port assignments for only the http and https, any port can be open on the load balancer using a list like you would in a standard Kubernetes YAML manifest.
+
+`pre-3.0.0`
+```yaml
+service:
+  http:
+    enabled: true
+    port: 80
+    targetPort: 8080
+  https:
+    enabled: true
+    port: 443
+    targetPort: 8443
+```
+
+`3.0.0`
+```yaml
+service:
+  ports:
+  - name: http
+    port: 80
+    targetPort: 8080
+  - name: https
+    port: 443
+    targetPort: 8443
+```
+
+This change has also replaced the `.additionalTCPPorts` configuration. Additional TCP ports can be created the same as the http and https ports above.
+
+### Annotations and `service_port` 
+
+The below Ambassador `Module` annotation is no longer being applied by default. 
+
+```yaml
+getambassador.io/config: |
+  ---
+  apiVersion: ambassador/v1
+  kind: Module
+  name: ambassador
+  config:
+    service_port: 8080
+```
+This was causing confusion with the `service_port` being hard-coded when enabling TLS termination in Ambassador.
+
+Ambassador has been listening on port 8080 for HTTP and 8443 for HTTPS by default since version `0.60.0` (chart version 2.2.0). 
+
+### RBAC and CRDs
+
+A `ClusterRole` and `ClusterRoleBinding` named `{{release name}}-crd` will be created to watch for the Ambassador Custom Resource Definitions. This will be created regardless of the value of `scope.singleNamespace` since CRDs are created the cluster scope.
+
+`rbac.namespaced` has been removed. For namespaced RBAC, set `scope.singleNamespace: true` and `rbac.enabled: true`.
+
+`crds.enabled` will indicate that you are using CRDs and will create the rbac resources regardless of the value of `crds.create`. This allows for multiple deployments to use the CRDs.
+
 ## To 2.0.0
 
 ### Ambassador ID
diff --git a/stable/ambassador/templates/_helpers.tpl b/stable/ambassador/templates/_helpers.tpl
index 6540f582fb..ac6380dc57 100644
--- a/stable/ambassador/templates/_helpers.tpl
+++ b/stable/ambassador/templates/_helpers.tpl
@@ -41,3 +41,14 @@ Create the name of the service account to use
     {{ default "default" .Values.serviceAccount.name }}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Define the http port of the Ambassador service
+*/}}
+{{- define "ambassador.servicePort" -}}
+{{- range .Values.service.ports -}}
+{{- if (eq .name "http") -}}
+{{ default .port }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
diff --git a/stable/ambassador/templates/admin-service.yaml b/stable/ambassador/templates/admin-service.yaml
index 1c788e2d9a..4f9515fa3f 100644
--- a/stable/ambassador/templates/admin-service.yaml
+++ b/stable/ambassador/templates/admin-service.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "ambassador.fullname" . }}-admins
+  name: {{ include "ambassador.fullname" . }}-admin
   labels:
     app.kubernetes.io/name: {{ include "ambassador.name" . }}
     helm.sh/chart: {{ include "ambassador.chart" . }}
diff --git a/stable/ambassador/templates/crds-rbac.yaml b/stable/ambassador/templates/crds-rbac.yaml
new file mode 100644
index 0000000000..23d1731644
--- /dev/null
+++ b/stable/ambassador/templates/crds-rbac.yaml
@@ -0,0 +1,48 @@
+{{- if .Values.crds.enabled }}
+{{- if .Values.rbac.create }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ include "ambassador.fullname" . }}-crds
+  labels:
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}
+    helm.sh/chart: {{ include "ambassador.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+  - apiGroups: [ "apiextensions.k8s.io" ]
+    resources:
+    - customresourcedefinitions
+    resourceNames:
+    - authservices.getambassador.io
+    - mappings.getambassador.io
+    - modules.getambassador.io
+    - ratelimitservices.getambassador.io
+    - tcpmappings.getambassador.io
+    - tlscontexts.getambassador.io
+    - tracingservices.getambassador.io
+    - kubernetesendpointresolvers.getambassador.io
+    - kubernetesserviceresolvers.getambassador.io
+    - consulresolvers.getambassador.io
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "ambassador.fullname" . }}-crds
+  labels:
+    app.kubernetes.io/name: {{ include "ambassador.name" . }}
+    helm.sh/chart: {{ include "ambassador.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "ambassador.fullname" . }}-crds
+subjects:
+  - name: {{ include "ambassador.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace | quote }}
+    kind: ServiceAccount
+{{- end }}
+{{- end }}
diff --git a/stable/ambassador/templates/crds.yaml b/stable/ambassador/templates/crds.yaml
index 4611fc7d14..23fa8a5652 100644
--- a/stable/ambassador/templates/crds.yaml
+++ b/stable/ambassador/templates/crds.yaml
@@ -145,6 +145,10 @@ metadata:
     helm.sh/chart: {{ include "ambassador.chart" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{ if .Values.crds.keep }}
+  annotations:
+    "helm.sh/resource-policy": keep
+  {{ end }}
 spec:
   group: getambassador.io
   version: v1
diff --git a/stable/ambassador/templates/deployment.yaml b/stable/ambassador/templates/deployment.yaml
index 31aec39009..f48cb0d8ed 100644
--- a/stable/ambassador/templates/deployment.yaml
+++ b/stable/ambassador/templates/deployment.yaml
@@ -96,21 +96,15 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
-            {{- if .Values.service.http.enabled }}
-            - name: http
-              containerPort: {{ .Values.service.http.targetPort }}
-            {{- end }}
-            {{- if .Values.service.https.enabled }}
-            - name: https
-              containerPort: {{ .Values.service.https.targetPort }}
-            {{- end }}
+            {{- range .Values.service.ports }}
+            - name: {{ .name }}
+              containerPort: {{ .targetPort }}
+              {{- if .protocol }}
+              protocol: {{ .protocol }}
+              {{- end }}
+            {{- end}}
             - name: admin
               containerPort: 8877
-          {{- range $key := .Values.additionalTCPPorts }}
-            - name: "{{ $key }}-tcp"
-              containerPort: {{ $key }}
-              protocol: TCP
-          {{- end }}
           env:
             - name: HOST_IP
               valueFrom:
@@ -177,7 +171,7 @@ spec:
           - name: REDIS_SOCKET_TYPE
             value: tcp
           - name: REDIS_URL
-            value: ambassador-pro-redis:6379
+            value: {{ include "ambassador.fullname" . }}-pro-redis:6379
           - name: APRO_AUTH_PORT
             value: "{{ .Values.pro.ports.auth }}"
           - name: GRPC_PORT
@@ -194,6 +188,14 @@ spec:
               fieldRef:
                 fieldPath: metadata.namespace
           {{- end }}
+          {{- if .Values.env }}
+          {{- range $key,$value := .Values.env }}
+          {{- if eq $key "AMBASSADOR_ID"}}
+          - name: {{ $key | upper | quote}}
+            value: {{ $value | quote}}
+          {{- end }}
+          {{- end }}
+          {{- end }}
           - name: AMBASSADOR_LICENSE_KEY
           {{- if .Values.pro.licenseKey.secret }}
             valueFrom:
diff --git a/stable/ambassador/templates/rbac.yaml b/stable/ambassador/templates/rbac.yaml
index b475f640e7..b2d65159f0 100644
--- a/stable/ambassador/templates/rbac.yaml
+++ b/stable/ambassador/templates/rbac.yaml
@@ -1,6 +1,6 @@
 {{- if .Values.rbac.create -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
-{{- if .Values.rbac.namespaced }}
+{{- if .Values.scope.singleNamespace }}
 kind: Role
 {{- else }}
 kind: ClusterRole
@@ -16,7 +16,7 @@ metadata:
 rules:
   - apiGroups: [""]
     resources:
-    {{- if not .Values.rbac.namespaced }}
+    {{- if not .Values.scope.singleNamespace }}
     - namespaces
     {{- end }}
     - services
@@ -46,7 +46,7 @@ rules:
   {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
-{{- if .Values.rbac.namespaced }}
+{{- if .Values.scope.singleNamespace }}
 kind: RoleBinding
 {{- else }}
 kind: ClusterRoleBinding
@@ -61,7 +61,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  {{- if .Values.rbac.namespaced }}
+  {{- if .Values.scope.singleNamespace }}
   kind: Role
   {{- else }}
   kind: ClusterRole
diff --git a/stable/ambassador/templates/service.yaml b/stable/ambassador/templates/service.yaml
index 5ed13ec112..d988e5010e 100644
--- a/stable/ambassador/templates/service.yaml
+++ b/stable/ambassador/templates/service.yaml
@@ -21,30 +21,7 @@ spec:
   externalTrafficPolicy: "{{ .Values.service.externalTrafficPolicy }}"
   {{- end }}
   ports:
-    {{- if .Values.service.http.enabled }}
-    - port: {{ .Values.service.http.port }}
-      targetPort: {{ .Values.service.http.targetPort }}
-      protocol: TCP
-      name: http
-      {{- with .Values.service.http.nodePort }}
-      nodePort: {{ toYaml . }}
-      {{- end }}
-    {{- end }}
-    {{- if .Values.service.https.enabled }}
-    - port: {{ .Values.service.https.port }}
-      targetPort: {{ .Values.service.https.targetPort }}
-      protocol: TCP
-      name: https
-      {{- with .Values.service.https.nodePort }}
-      nodePort: {{ toYaml . }}
-      {{- end }}
-    {{- end }}
-    {{- range $key := .Values.additionalTCPPorts }}
-    - name: "{{ $key }}-tcp"
-      port: {{ $key }}
-      protocol: TCP
-      targetPort: "{{ $key }}-tcp"
-    {{- end }}
+    {{- toYaml .Values.service.ports | nindent 4 }}
   selector:
     app.kubernetes.io/name: {{ include "ambassador.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
diff --git a/stable/ambassador/templates/tests/test-ready.yaml b/stable/ambassador/templates/tests/test-ready.yaml
index 73f4bbb94e..62aca21737 100644
--- a/stable/ambassador/templates/tests/test-ready.yaml
+++ b/stable/ambassador/templates/tests/test-ready.yaml
@@ -15,6 +15,6 @@ spec:
     - name: wget
       image: busybox
       command: ['wget']
-      args:  ['{{ include "ambassador.fullname" . }}:{{ .Values.service.http.port }}/ambassador/v0/check_ready']
+      args:  ['{{ include "ambassador.fullname" . }}:{{ include "ambassador.servicePort" . }}/ambassador/v0/check_ready']
   restartPolicy: Never
 {{- end }}
diff --git a/stable/ambassador/values.yaml b/stable/ambassador/values.yaml
index cb5dbc2dc9..e7697709b7 100644
--- a/stable/ambassador/values.yaml
+++ b/stable/ambassador/values.yaml
@@ -27,7 +27,6 @@ autoscaling:
 
 # Additional container environment variable
 env:
-  {}
   # Exposing statistics via StatsD
   # STATSD_ENABLED: true
   # STATSD_HOST: statsd-sink
@@ -60,32 +59,66 @@ service:
 
   # Note that target http ports need to match your ambassador configurations service_port
   # https://www.getambassador.io/reference/modules/#the-ambassador-module
-  http:
-    enabled: true
-    port: 80
-    targetPort: 8080
-    # nodePort: 30080
-
-  https:
-    enabled: true
-    port: 443
-    targetPort: 8443
-    # nodePort: 30443
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8080
+      # protocol: TCP
+      # nodePort: 30080
+    - name: https
+      port: 443
+      targetPort: 8443
+      # protocol: TCP
+      # nodePort: 30443
+    # TCPMapping_Port
+      # port: 2222
+      # targetPort: 2222
+      # protocol: TCP
+      # nodePort: 30222
 
   annotations:
-    getambassador.io/config: |
-      ---
-      apiVersion: ambassador/v1
-      kind: Module
-      name: ambassador
-      config:
-        service_port: 8080
-  #       diagnostics:
-  #         enabled: false
-
-  # externalTrafficPolicy:
-  # loadBalancerSourceRanges:
-  #   - YOUR_IP_RANGE
+  #  Uncomment out fields you want to use.
+  #  See https://www.getambassador.io/reference/core/ambassador and
+  #  https://www.getambassador.io/reference/core/tls for more info
+  #  getambassador.io/config: |
+  #    ---
+  #    apiVersion: ambassador/v1
+  #    kind: TLSContext
+  #    name: ambassador
+  #    secret: ambassador-certs
+  #    hosts: ["*"]
+  #    ---
+  #    apiVersion: ambassador/v1
+  #    kind: Module
+  #    name: ambassador
+  #    config:
+  #      admin_port: 8001
+  #      diag_port: 8877
+  #      diagnostics:
+  #        enabled: true
+  #      enable_grpc_http11_bridge: false
+  #      enable_grpc_web: false
+  #      enable_http10: false
+  #      enable_ipv4: true
+  #      enable_ipv6: false
+  #      liveness_probe:
+  #        enabled: true
+  #      lua_scripts:
+  #      readiness_probe:
+  #        enabled: true
+  #      server_name: envoy
+  #      service_port: 8080
+  #      use_proxy_proto: false
+  #      use_remote_address: true
+  #      xff_num_trusted_hops: 0
+  #      x_forwarded_proto_redirect: false
+  #      load_balancer:
+  #        policy: round_robin
+  #      circuit_breakers:
+  #        max_connections: 2048
+  #      retry_policy:
+  #        retry_on: "5xx"
+  #      cors:
 
 adminService:
   create: true
@@ -97,7 +130,6 @@ adminService:
 rbac:
   # Specifies whether RBAC resources should be created
   create: true
-  namespaced: false
   podSecurityPolicies:
     {}
 
@@ -112,8 +144,6 @@ serviceAccount:
   # If not set and create is true, a name is generated using the fullname template
   name:
 
-additionalTCPPorts: []
-
 initContainers: []
 
 volumes: []
@@ -184,7 +214,7 @@ pro:
   enabled: false
   image:
     repository: quay.io/datawire/ambassador_pro
-    tag: amb-sidecar-0.4.0
+    tag: amb-sidecar-0.5.0
   ports:
     auth: 8500
     ratelimit: 8501
@@ -195,5 +225,6 @@ pro:
     secret: false
 
 crds:
+  enabled: true
   create: true
   keep: true