Right, I think we're saying the same thing. If the node is properly configured an end-user pod should not be able to take down the kubelet.