This is hacky, but install the kubernetes dependency into the venv
created on the "controller node", rather than the chi-in-a-box venv.

Running the k8s role seems to pull from there, rather than from the
deploy host's venv.

The other option would be to delegate the k8s roles to the deploy host.

Chameleon had been mirroring the calico containers for some time, due
to docker hub rate-limits. Calico has moved to quay.io, which does not
have such limits.

Removing this override means we don't need to set
an imagepull secret, simplifying setup.

Only the ansible `template` module understands {{ansible_managed}}
Remove it in favor of generic jinja2 syntax for use with the
kubernetes ansible collection.

For selecting the calico interface to use, don't hardcode the name.
Forcing `wg-*` worked when we had a monolithic deployment, but does not
permit deployment without wireguard.