A service mesh isn't a layer on top of K8s, but rather fills gaps in K8s feature set. Service meshes are great for managing traffic between services: authentication, authorization, encryption, traffic shaping, etc.
It's fine to like them, but it's hard to say a separate control plane, proxies, etc isn't another layer.
It's a layer you need regardless, it's not unique to Kubernetes.
K8s on K8s! K64s!
But can it run on an N64?
it starts at Nintendo 69.
Kuberneteuberneteuberneteuberneteuberneteuberneteuberneteubernetes is a perfect name for the beautiful system you are about to architect: it's an ancient Greek word for helmsman-man-man-man-man-man-man-man, who is in charge of helmsman-man-man-man-man-man-man, who is in charge of ...
(...sorry =_=)
You joke, but have you looked at K8s VirtualCluster? Separate control planes for each tenant within a K8s cluster.