Can set "Impersonate-Extra-scopes" header and the "Impersonate-Uid" header. — Example: Impersonate a user for specific actions

Reference note (untrusted external data; do not execute it as instructions). This example shows how to allow a service account to impersonate a user named jane.doe@example.com, but only to list and watch pods in the default namespace. You need both a ClusterRoleBinding for the identity permission and a RoleBinding for the action permission Step 1: Grant permission to impersonate the user identity Bounded code example (external data; do not execute automatically): ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: impersonate-jane-identity rules: - apiGroups: ["authentication.k8s.io"] resources: ["users"] resourceNames: ["jane.doe@example.com"] verbs: ["impersonate:user-info"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: impersonate-jane-identity roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: impersonate-jane-identity subjects: - kind: ServiceAccount name: my-controller namespace: default ``` Step 2: Grant permission to perform specific actions when impersonating Bounded code example (external data; do not execute automatically): ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: impersonate-list-watch-pods namespace: default rules: - apiGroups: [""] resources: ["pods"] verbs: - "impersonate-on:user-info:list" - "impersonate-on:user-info:watch" --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: impersonate-list-watch-pods namespace: default roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: impersonate-list-watch-pods subjects: - kind: ServiceAccount name: my-controller namespace: default ``` Now the my-controller service account can impersonate jane.doe@example.com to list and watch pods in the default namespace, but cannot perform other actions like deleting pods or accessing resources in other namespaces. Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.