<p>Why does using <code>kubectl</code> with impersonation <code>--as=</code> result in "The connection to the server localhost:8080 was refused" on a host with only the <code>default</code> service account configured?</p>

<p>I have downloaded <code>kubectl</code> to a host with only the <code>default</code> service account configured. If I try to impersonate any user, e.g. <code>system:anonymous</code>, the following error message is returned: "The connection to the server localhost:8080 was refused".</p>

<p>I can resolve the issue by starting a local proxy using <code>kubectl proxy --port=8080</code>, however, I would like to avoid this.</p>

<p>Why does <code>kubectl</code> try to connect to <code>localhost:8080</code>, when using impersonation (<code>--as=</code>)?</p>

<pre><code>kube@ctf1-k8s-deploy1-545977f47-g9dpl:~$ kubectl config view
apiVersion: v1
clusters: null
contexts: null
current-context: ""
kind: Config
preferences: {}
users: null
kube@ctf1-k8s-deploy1-545977f47-g9dpl:~$ ls /var/run/secrets/kubernetes.io/serviceaccount/
ca.crt  namespace  token
kube@ctf1-k8s-deploy1-545977f47-g9dpl:~$ kubectl auth can-i --list --as=system:anonymous
The connection to the server localhost:8080 was refused - did you specify the right host or port?
</code></pre>

Shuzheng
<p>At the moment the <code>kubectl</code> has an issue where any client configuration override flag (eg. --as, --request-timeout,...) disables the automatic fallback to in-cluster configuration.</p>
<p>See Kubernetes <a href="https://github.com/kubernetes/kubernetes/issues/93474" rel="nofollow noreferrer">Github issue</a></p>
