As the sibling comment points out, I think that would be a perfectly fine helm replacement, but I would never ever want to feed starlark into k8s apis directly

Not directly, first render it to protos. Couple gigs ago I made this - https://github.com/cruise-automation/isopod

kube-apiserver uses a JSON REST API. You can use whatever serializes to JSON. YAML is the most common and already works directly with kubectl.

I personally use TypeScript since it has unions and structural typing with native JSON support but really anything can work.

Fun fact, while digging into the sibling comment's complaint about the OpenAPI spec, I learned that it actually advertises multiple content-types:

  application/json
  application/json;stream=watch
  application/vnd.kubernetes.protobuf
  application/vnd.kubernetes.protobuf;stream=watch
  application/yaml

which I presume all get coerced into protobuf before being actually interpreted