These weren't necessarily being changed after an Endpoints update.

The Ingress update may have followed an update for Endpoints.

XXX: re-use this code wherever we wait for port-forward.

For that, the Secret must be named as the TLS Secret by an Ingress
in the same namespace that identifies out ingress.class.

This means that the controller doesn't need to try delete an element
from any PEM Secret (to remove the certificate from the haproxy
Secret volume).

For the Unix domain socket over which haproxy and varnish communicate,
we have chmod 660 and chgrp varnish. haproxy belongs to group varnish
and thus has write permissions on the socket, which is required in
Linux to be able to connect.

For that, both containers must have the same group name and GID.
We've been using 998, since that results from the RPM install for
Varnish from the official packagecloud repos.