Add a concierge backend which uses service account tokens and an enhanced kubectl about pinniped HOT 2 CLOSED

Other ideas:

• We could try to re-write the kubeconfig YAML to include the as/as-groups` fields. It wouldn't be super smooth because the first kubectl command would fail, but it would work without a custom kubectl.
• If you know the username/groups ahead of time, you can generate the kubeconfig with those as/as-groups fields in advance. This means your kubeconfig becomes outdated if your groups change.

Other tradeoffs/drawbacks in this proposal:

• Couldn't use alternative CLI clients, including oc or tools like stern that use client-go but aren't kubectl itself.
• There's a risk that our change would never be accepted upstream into client-go/kubectl.

from pinniped.

We ended up deciding not to do this for now, and to continue pursuing the impersonation proxy as a solution on managed cluster environments. We could still consider doing this in the future, especially if the upstream ExecCredential API adds custom header support.

from pinniped.