TODO

1. Not crazy about the hostname/config situation with internal LBs
2. Force oauth2 proxy on all ingresses (via istio)
3. Create volumes for all services that can pre-populate a dev env
4. Variable wrangling is pretty convoluted right now
5. Fix the ingress firewall rule generation
6. Garden bug with injected env (eg: podIP)
7. proxy-lbs FW to ingress
8. readiness probe is wonky