Skip to content

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.

Glossary

User impersonation (Kubernetes)

Kubernetes feature letting a caller with the impersonate verb act as another user, group or service account through Impersonate-* headers.

Impersonation lets a caller that holds the impersonate permission send Impersonate-User, Impersonate-Group and related headers (kubectl --as, --as-group). The request is then authorised as the impersonated identity.

The audit event keeps both identities: user is the real caller, impersonatedUser the assumed one. Always report both. Because it lets a caller borrow permissions it does not hold, the impersonate verb should be granted to very few identities. See RBAC privilege escalation and the authentication documentation.

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.