For most of the history of Kubernetes in government, agencies had options. They could build their environment piece by piece, download free open-source tools, make tradeoffs, and figure out the security and compliance layer as they went. That flexibility made sense when deployments were more protracted, missions were contained, and the consequences of a security breach were easier to absorb.