Support some sort of instant go-live at CTF start

[cacama-valvata]

actually deploy, but additional boolean for whether ingress records are deployed. therefore way faster but privated before comp is ready

[detjensrobert]

From meeting:

Casey: BSides removed k8s services for quick toggle
IP restriction - only admins could connect - vpn?
Creating bastion out of scope, but can restrict to private network
Bastion in cluster? complicated