Second step in decoupling the service controller, use the apiserver for writes too.

Addresses #1436