k8s uses re2, which does not support lookaround, so this rather
complicated pattern is what I came up with to forbid vcl and
vk8s prefixes.