The one fact that makes Kubernetes authentication click - there is no user object. The API server never stores users. It only verifies a credential from outside and reads a name off it. Once you know that, the whole model stops being confusing.
At some point JWTs became the default answer to "how do I keep a user logged in." For most applications it was the wrong choice. A JWT's headline feature is that the server does not remember it, which is the same sentence as "the server cannot forget it" — so you cannot revoke a session when you need to. Add the algorithm confusion attacks the format invites, and the boring opaque session cookie turns out to be safer, simpler, and revocable for anything that does not need stateless cross-boundary verification.