> going to be Kubernetes as the IaC stack

Not unless its heavily modified to scale past 10k nodes sensibly. its security/secrets model also needs a boatload of work before you can think about hosting untrusted parties on your kit.