K8s supports encryption at rest, ACLs and audit logs.

What it actually lacks is versioning, and a dynamic secrets engine, though you could build that with an operator, and things like the postgres-operator do.

You also don't get the whole sealing thing, but I'd argue that's more annoying than useful.