It turns out that init containers do not work, as we
can't easily detect failures and access init log as they
restart constantly. So we use initialization jobs.
We take the opportunity to use cleanup jobs too, so
all knowledge of runtime content is in the kubefiles.
