I agree, it's a start.
At its core, I'm having some difficulty wrapping my brain around the idea that any organization that's large and complex enough to demand to run their own compute platform (e.g. K8S) isn't also large and complex enough to demand a secure configuration system by default.