What is missing?
The gateway currently strips all Kubernetes user impersonation headers (Impersonate-User, Impersonate-Group, Impersonate-Extra-*) from incoming requests. This prevents users from using kubectl --as and kubectl --as-group commands, even when they have the necessary RBAC permissions to perform impersonation in the Kubernetes cluster.
Why do we need it?
Users with legitimate impersonation permissions cannot utilize this functionality when accessing the cluster through the gateway. This is a common workflow for cluster administrators testing permissions, service account debugging, and multi-tenant operations.
Anything else we need to know?:
The gateway could use SubjectAccessReview to check if the authenticated user has permission to perform impersonation before deciding whether to allow or reject the request.
What is missing?
The gateway currently strips all Kubernetes user impersonation headers (
Impersonate-User,Impersonate-Group,Impersonate-Extra-*) from incoming requests. This prevents users from usingkubectl --asandkubectl --as-groupcommands, even when they have the necessary RBAC permissions to perform impersonation in the Kubernetes cluster.Why do we need it?
Users with legitimate impersonation permissions cannot utilize this functionality when accessing the cluster through the gateway. This is a common workflow for cluster administrators testing permissions, service account debugging, and multi-tenant operations.
Anything else we need to know?:
The gateway could use
SubjectAccessReviewto check if the authenticated user has permission to perform impersonation before deciding whether to allow or reject the request.