<p>Is there a way to disable impersonation in Kubernetes for all admin/non Admin users?</p>
<pre><code>kubectl get pod --as user1
</code></pre>
<p>The above command should not provide answer due to security concerns.
Thank you in advance.</p>

farhad kazemipour
<p>Unless all your users are already admins they should not be able to impersonate users. As <code>cluster-admin</code> you can do &quot;anything&quot; and pre-installed roles/rb should not be edited under normal circumstances.</p>
<p>The necessary Role to <strong>enable</strong> impersonation is:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: impersonator
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;users&quot;, &quot;groups&quot;, &quot;serviceaccounts&quot;]
  verbs: [&quot;impersonate&quot;]
</code></pre>
<p>As long as normal users don't have those permissions, they should not be allowed to perform <code>--as</code>.</p>
