User impersonation with kubectl "--as argument"

In our Kubernetes cluster, we use Pinniped (https://pinniped.dev/) for access control. This makes access to the cluster a lot more strict and requires that the user pass in a "--as" argument to kubectl. For example:

kubectl get pods --as <some-admin-user-name>

Without the --as argument, the call to kubectl is denied. This can be worked around by adding the line:

as: <some-admin-user-name>

To the kubeconfig file, but this does not work well as the user name is different for different namespaces and adding as: to the kubeconfig is a global cluster setting.

It would be very useful to be able to configure the VS Code Dev Container extension to specify the user to be passed to the --as parameter, and to have the extension use this parameter when calling kubectl. This setting should be able to be made on a per-namespace basis.

I would add this functionality myself, but the Dev Container extension is not open source (I have added the functionality to the VS Code Kubernetes extension, which is open source).

This is the error that we currently get in VS Code:

Unable to use a TTY - input is not a terminal or the right kind of file Error from server (Forbidden): pods "my-pod-8f8f868bd-mglbd" is forbidden: User "redacted@redacted.com" cannot create resource "pods/exec" in API group "" in the namespace "my-namespace": decision made by impersonation-proxy.concierge.pinniped.dev