It’s for this reason I joined Defense Unicorns[1] last year - the team behind the airgap Kubernetes tool, Zarf[2] (which is OSS).
[1]: https://defenseunicorns.com
[2]: https://zarf.dev