<p>Why does using <code>kubectl</code> with impersonation <code>--as=</code> result in "The connection to the server localhost:8080 was refused" on a host with only the <code>default</code> service account configured?</p>

<p>I have downloaded <code>kubectl</code> to a host with only the <code>default</code> service account configured. If I try to impersonate any user, e.g. <code>system:anonymous</code>, the following error message is returned: "The connection to the server localhost:8080 was refused".</p>

<p>I can resolve the issue by starting a local proxy using <code>kubectl proxy --port=8080</code>, however, I would like to avoid this.</p>

<p>Why does <code>kubectl</code> try to connect to <code>localhost:8080</code>, when using impersonation (<code>--as=</code>)?</p>

<pre><code>kube@ctf1-k8s-deploy1-545977f47-g9dpl:~$ kubectl config view
apiVersion: v1
clusters: null
contexts: null
current-context: ""
kind: Config
preferences: {}
users: null
kube@ctf1-k8s-deploy1-545977f47-g9dpl:~$ ls /var/run/secrets/kubernetes.io/serviceaccount/
ca.crt  namespace  token
kube@ctf1-k8s-deploy1-545977f47-g9dpl:~$ kubectl auth can-i --list --as=system:anonymous
The connection to the server localhost:8080 was refused - did you specify the right host or port?
</code></pre>

Shuzheng
<p>The <code>clusters</code> need to have the host and port of the Kubernetes API Server.</p>

<pre><code>clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://API_SERVER_HOST:PORT
</code></pre>

<p>Edit:</p>

<p>When <code>--as</code> is added as parameter to <code>kubectl auth can-i</code> then kubectl is not using in-cluster configuration any more which is why its referring to localhost:8080 instead of correct API Server IP.</p>
