This will be done incrementally for all templates, making the
controller executable wholly self-contained.

Closes #38

Service spec.ports maps to the public TLS port. First just for
kubectl/yaml deployments.

Addresses #38

Addresses #38

Addresses #38

Initially for kubectl/yaml deployments.

While here, ensure that /etc/varnish is world-readable, since it's
been reported that it might not be. Evidently not always, but setting
the permissions is never wrong.

Addresses #38

in vcl_backend_response {} and vcl_backend_error {} we test if
`bereq.backend == vk8s_cluster.backend(resolve=LAZY)`. With the
current code, this condition will never evaluate true, because
`resolve=NOW` will make the shard director return the "real" (VBE)
backend.

With this patch, the net effect, the chosen cluster varnish backend,
should still be the same, except for the rare race event that the
backend becomes unhealthy between the time the vcl code executes and
when the backend connection is made. We already account for this race
by setting `req.hash_ignore_busy` in vcl_revc {}.

The test should run correctly without them, and leaving them
deployed may conceal potential bugs.

To avoiding hiding potential bugs.

That is, if they are neither viking services, nor an IngressBackend
for any Ingress with the viking Ingress class.

This reduces the Event noise for Services that have nothing to do
with viking.