# What is the proper way to allow impersonating a single service account in k8s via RBAC?

**URL:** https://discuss.kubernetes.io/t/what-is-the-proper-way-to-allow-impersonating-a-single-service-account-in-k8s-via-rbac/24168
**Category:** General Discussions
**Tags:** authn, authz
**Created:** [May 11, 2023, 12:54am UTC](https://discuss.kubernetes.io/t/what-is-the-proper-way-to-allow-impersonating-a-single-service-account-in-k8s-via-rbac/24168 "2023-05-11T00:54:04Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![L1ghtman2k](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/l1ghtman2k/32/8582_2.png) [@L1ghtman2k](https://discuss.kubernetes.io/u/L1ghtman2k)
#### Post date: [May 11, 2023, 12:54am UTC](https://discuss.kubernetes.io/t/what-is-the-proper-way-to-allow-impersonating-a-single-service-account-in-k8s-via-rbac/24168/1 "2023-05-11T00:54:04Z")

</div>

I would like a cluster role or a service role to be able to impersonate a role in a different.

I have tried both

```auto
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: "2023-05-10T23:52:33Z"
  name: example-impersonator
  resourceVersion: "1627"
  uid: 34e413ca-f733-4198-99af-7b442a764a21
rules:
- apiGroups:
  - ""
  resourceNames:
  - system:serviceaccount:example-namespace:example-role
  resources:
  - users
  verbs:
  - impersonate

```

and

```auto
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: "2023-05-10T23:52:33Z"
  name: example-impersonator
  resourceVersion: "1627"
  uid: 34e413ca-f733-4198-99af-7b442a764a21
rules:
- apiGroups:
  - ""
  resourceNames:
  - example-namespace:example-role
  resources:
  - serviceaccount
  verbs:
  - impersonate

```

and a few other combination, but when running

`kubectl auth can-i impersonate users/system:serviceaccount:example-namespace:example-role --as=default:test` (I have bounded above policy to a different service account test, in default namespace), I am getting `no`

---

<div class="post-metadata">

### Author: ![David\_P](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/david_p/32/14245_2.png) [@David\_P](https://discuss.kubernetes.io/u/David_P)
#### Post date: [February 7, 2024, 9:18am UTC](https://discuss.kubernetes.io/t/what-is-the-proper-way-to-allow-impersonating-a-single-service-account-in-k8s-via-rbac/24168/2 "2024-02-07T09:18:12Z")

</div>

Hello, implementing the sudo functionality is a three steps process:

1. Create a virtual identity:

```auto
apiVersion : rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
 name: sudo
roleRef :
 apiGroup : rbac.authorization.k8s.io
 kind: ClusterRole
 name: cluster-admin
subjects:
- apiGroup : rbac.authorization.k8s.io
  kind: User
  name: sudo

```

1. Create a cluster/role allowing impersonation:

```auto
apiVersion : rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name: sudo
rules:
- apiGroups: [""]
  resourceNames:
  - sudo
  resources:
  - users
  verbs:
  - impersonate

```

1. Create a clusterrole/rolebinding to allow selected users impersonate “sudo” virtual user:

```auto
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sudoer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: sudo
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: davidp

```