The Kubernetes Cargo Cult: Why the CNCF Stack Isn’t the Only Way

For years, Kubernetes adoption has followed a predictable pattern. You spin up a cluster, then—almost instinctively—you start layering on third-party tools to make it "enterprise-grade." Not because you necessarily need them, but because that’s what the industry expects.

The standard playbook looks something like this:

• Authentication & Access Management: Dex, Keycloak, Pinniped
• Policy & Governance: OPA Gatekeeper, Kyverno
• GitOps & CI/CD: ArgoCD, Flux, Tekton, Argo Workflows
• Monitoring & Observability: Prometheus, Grafana, Loki, Jaeger, OpenTelemetry
• Networking & Ingress: Istio, Traefik
• Certificate Management: Cert-Manager
• Security & Compliance: Trivy, Falco
• Secrets Management: HashiCorp Vault, External Secrets Operator
• Multi-Tenancy & Namespace Control: Capsule, HNC
• Infrastructure as Code & Automation: Terraform
• Cluster Composition & Lifecycle Management: Cluster API, Crossplane
• Container Registry & App Management: Harbor, Kubeapps
• Log Management & Search: Kibana, ElasticSearch
• Management Interface: k9s, Lens, Headlamp

This CNCF-driven ecosystem has become the default Kubernetes journey for enterprises. Whether or not these tools are actually required, organizations feel compelled to install them just to be "production-ready." The industry has conditioned teams to believe that Kubernetes isn’t complete until it's wrapped in an ever-expanding ecosystem of open-source tools.

This playbook isn’t just theoretical but is widely recognized in the industry. The Cloud Native Computing Foundation (CNCF) Cloud Native Reference Architecture (architecture.cncf.io) provides a structured model that aligns with this stack, outlining the components enterprises typically deploy for security, observability, automation, and scalability. It validates the industry practice of assembling multiple CNCF projects to form a complete enterprise Kubernetes solution.

But what if that’s not actually necessary? What if the CNCF stack is a trap, locking teams into unnecessary complexity and preventing them from realizing Kubernetes' real value?

The Hidden Cost of the CNCF Stack

The CNCF ecosystem is built on the promise of composability—you choose the best tools for your environment. In theory, this makes sense. In practice, it creates massive inefficiencies:

1. Integration Overhead – Every tool has its own APIs, configurations, and quirks. Getting them to work together is an operational burden that never goes away.
2. Upkeep & Complexity – Each component adds another layer of maintenance, another potential failure point, and another set of security vulnerabilities to manage.
3. The "Best Practices" Trap – Teams adopt these tools not because they need them, but because "everyone else" is doing it. This leads to unnecessary complexity, higher costs, and slower time to production.
4. Support Costs Spiral – Open-source may seem free at first, but eventually, enterprises need support agreements or commercial versions to meet SLA, compliance, or operational requirements. Since each CNCF tool is a separate project with its own maintainers, organizations often find themselves paying for support many times over—once per discrete tool.

The result? You’re no longer just running Kubernetes—you’re managing a Kubernetes Frankenstein that requires an army of engineers and multiple commercial support contracts to keep afloat.

Portainer: A Saner Approach to Kubernetes Management

Portainer challenges this unnecessary complexity. Instead of forcing teams to assemble a Kubernetes management stack from scratch, Portainer provides a single, integrated control plane that simplifies cluster operations while retaining flexibility.

Portainer Doesn’t Ignore the CNCF Stack—It Leverages It Intelligently

Portainer isn’t anti-CNCF; in fact, it uses many CNCF projects under the hood, but it does so in a way that removes the operational burden from the user. Instead of forcing teams to manually install, configure, and maintain these tools, Portainer integrates them seamlessly so users can benefit without needing deep expertise.

For example:

• Policy & Governance: Instead of requiring users to install and configure OPA Gatekeeper, Portainer leverages OPA internally to enforce security policies and workload governance—without exposing the complexity to users.
• Authentication & RBAC: Portainer natively supports external authentication from almost all authentication providers. This authentication is linked to internal RBAC capability, which synchronizes with Kubernetes' internal RBAC.
• Networking & Ingress: Portainer natively supports managing ingress controllers and networking policies, but under the hood, it works with CNCF-standard networking components rather than reinventing the wheel.
• Monitoring & Visibility: Rather than forcing users to manually deploy a full Prometheus and Grafana stack, Portainer provides essential monitoring capabilities out of the box, leveraging Kubernetes-native metrics sources.
• Application Deployment & GitOps: Portainer simplifies application deployment and version control, reducing the need for ArgoCD or Flux in many environments.

Why This Matters for Enterprises

1. Faster Time to Value – Instead of spending weeks assembling and integrating a Kubernetes management stack, Portainer gives you an operational environment in minutes.
2. Lower Cost, Lower Risk – Fewer moving parts mean fewer failure points, fewer integration headaches, and lower long-term maintenance costs.
3. Reduced Support Overhead – Instead of paying for multiple commercial support agreements across different tools, enterprises can rely on a single vendor for a comprehensive solution.
4. No Unnecessary Complexity – You don’t need a team of Kubernetes specialists just to keep the lights on.

Why Aren’t More Companies Doing This?

If Portainer simplifies Kubernetes, why isn’t it the default approach instead of the sprawling CNCF stack?

Because complexity has become the status quo.

Many teams believe that “enterprise Kubernetes” must include dozens of external tools for security, policy enforcement, multi-tenancy, and automation—because that’s what everyone else is doing. There’s a perception that if you’re not using ArgoCD, OPA, or Prometheus, you’re somehow cutting corners.

This mindset needs to change. Kubernetes should be a tool, not a burden. The goal isn’t to build Kubernetes; it’s to run applications in a way that’s secure, scalable, and efficient with as little operational overhead as possible.

Challenge the Status Quo

Before blindly adopting the CNCF stack, ask yourself:

• Are you solving business problems through your Kubernetes stack, or are you adding unnecessary complexity?
• Do you actually need all these tools, or are you adding them because it’s the default recommendation?
• What’s the long-term cost of maintaining, integrating, and supporting all these tools separately?
• What if you could get 80% of the functionality you need with 20% of the effort? Wouldn’t that be a smarter choice?

The CNCF Cloud Native Reference Architecture (architecture.cncf.io) confirms that enterprises typically follow this playbook—but that doesn’t mean it’s the only way.

Portainer offers a way to get to production faster, with less friction and lower overhead. It’s time to rethink what "best practices" actually mean—and whether following the CNCF stack blindly is really in your organization’s best interest.

Because in the end, Kubernetes should serve your business. Not the other way around.

One platform, not twelve tools.

Govern Kubernetes across your whole fleet from a single control plane. Get 3 nodes free.

Get 3 nodes freeTalk to technical sales

Get 3 nodes free More from the blog