It's not rocket science, but like any complex computing tool it requires dedicated attention especially if you are going to run more than a handful of clusters. A lot of the tooling in the ecosystem falls flat here, it all solves the Day One: Getting Started problem but often punts on Day 2: Operations and then once it realizes it is actually a problem hamfistedly engineers a bolt-on solution.
So back to my point: Provisioning and setup easy... maintenance moderately more complex.
It gets a bit more complicated when you automate it and support adding/replacing nodes - the uploaded certs are valid only for 2h for example. (IMO the easiest solution to that is manual cert distribution - i.e. just scping them to the joining nodes.)