Glossary
User impersonation (Kubernetes)
Kubernetes feature letting a caller with the impersonate verb act as another user, group or service account through Impersonate-* headers.
Impersonation lets a caller that holds the impersonate permission send Impersonate-User, Impersonate-Group and related headers (kubectl --as, --as-group). The request is then authorised as the impersonated identity.
The audit event keeps both identities: user is the real caller, impersonatedUser the assumed one. Always report both. Because it lets a caller borrow permissions it does not hold, the impersonate verb should be granted to very few identities. See RBAC privilege escalation and the authentication documentation.