Impersonation uses a reverse proxy to inject a user's identifying information (username, groups and extra scopes) as headers in each request to the API server. The Dashboard can pass these headers to the API server if your reverse proxy will inject them in the requests.
Impersonation is useful in situations where using a user's token isn't available, such as cloud-hosted Kubernetes services. To use impersonation a reverse proxy must:
- Have a Kubernetes service account that has RBAC permissions to impersonate other users
- Generate the
Impersonate-Userheader with a unique name identifying the user - Optional Generate the
Impersonate-Groupheader(s) with the impersonated user's group data - Optional Generate the
Impersonate-Extraheader(s) with additional authorization data
Impersonation will only work when the reverse proxy provides the Authorization header with a valid service account. It will not work with any other method of authenticating to the dashboard.
Copyright 2019 The Kubernetes Dashboard Authors