For explicit example - we use Crossplane and FluxCD to perform provisioning of our entire on-prem set of resources (VM, k8s, S3, etc). At the moment all git resources live on public Github which has a range of benefits and guarantees survivability outside of our own infrastructure. The most painful bit of this is the instability of the platform. Github down means all provisioning is down. We also use on-prem Github Enterprise and it has its use-cases but we're also multi-region across the world which means the latency of GHES hurts compared to Github.com. Enough to have the trade-off of relying on Github.com's availability.

The other issue is permissions management. Git is great for auditability but it doesn't have the fine-grained permissions management you'd typically require from a "cloud" provider.

The end result is that we've created a "private cloud console" which has AWS-like IAM with fine-grained permissions and RBAC. All of the actions in the console talk to Github.com and open pull requests to repositories which once merged will publish a new OCI artifact. FluxCD pulls the latest artifact and Crossplane does the logic of updating the state of resources. Some (external/non-k8s) resources don't fit into this model very well if they don't have a Crossplane provider like our NetApp arrays where S3 is hosted.