how to disable user impersonation in kubernetes?

Question

Is there a way to disable impersonation in Kubernetes for all admin/non Admin users?

kubectl get pod --as user1

The above command should not provide answer due to security concerns. Thank you in advance.

Answer 1

Unless all your users are already admins they should not be able to impersonate users. As cluster-admin you can do "anything" and pre-installed roles/rb should not be edited under normal circumstances.

The necessary Role to enable impersonation is:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: impersonator
rules:
- apiGroups: [""]
  resources: ["users", "groups", "serviceaccounts"]
  verbs: ["impersonate"]

As long as normal users don't have those permissions, they should not be allowed to perform --as.