I happened to stumble upon maintain-kubeusers being in CrashLoopBackOff due to T282725 by accident, ideally that would have been caught by automatic monitoring instead. This likely applies to any pod not in a tool-* namespace.