Someone deleted a RoleBinding used by human operators; apps keep running, but staff lose kubectl access. Why can workloads continue?
Select an answer to reveal the explanation.
Short Explanation
Apps and people wear different badges. Pods keep calling the API with their ServiceAccount token, so deleting a human RoleBinding does not stop those containers. Operators lose kubectl until their binding is restored—workloads do not need that human pass.
Full Explanation
Authorization is evaluated per request subject. Human users rely on RoleBindings or ClusterRoleBindings tied to their user or group; Pods use ServiceAccount credentials mounted or projected into the Pod. Removing a binding that only covered humans revokes their kubectl verbs without invalidating existing ServiceAccount tokens used by running workloads. RoleBindings are not copied into Pod sandboxes, and deletion does not put the API in a special Pod-only mode.