The cert-gen job has always used an image tag of :latest to get around the issue of applying the same manifest on top of an existing installation, however, tagged releases use a unique name for each certgen job for that release so there's no need to use latest for releases and can cause issues for users in air-gapped environments.

We should remove the :latest tag and use a specific versio

CI should report an error if a commit changes the base manifests but doesn't update the single manifests ./hack/build-single-manifests.sh.

https://medium.com/free-code-camp/how-to-set-up-a-serious-kubernetes-terminal-dd07cab51cd4

Is there an updated ARM template that uses VMSS for nodePool creations, add them to app gateway backend pool and I would like to know how we can egress the traffic through APP Gateway as it would be the only public IP for the cluster and I still get a random IP address when I try to access a web page from a pod.

https://raw.githubusercontent.com/Azure/application-gateway-kubernetes-ingress/ma

Kubernetes v1.18 introduced a dedicated resource + field for defining IngressClass. See the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class

It would make sense for the ingress-controller to support ingress class in this way going forward.

Related issue for skipper: zalando/skipper#1478

Change the templates to run all the Tyk containers as non-root user by default, but keep an option to change the user for the gateway since there might be a legitimate use case with a host network (and privileged port).

The images should mostly work fine with this, known issues are:

• tyk-gateway container will need a pid file path configured for a non-root user accessible path
• tyk-k8s co