kubectl debug with --as and --as-group overwrites service account

[youwalther65]

What happened:
I am running kubectl debug in an AWS environment and want to use the AWS IAM privileges of the kube-system/ebs-csi-controller-sa (using AWS IAM roles for service accounts). But this service account does not have K8s privileges for node objects, so I have to run with --as-group system:masters in addition. So finally I have
When running:

$ kubectl debug node/ip-<redacted>.compute.internal -it --profile=sysadmin --image=<redacted>.dkr.ecr.<redacted>.amazonaws.com/node-debug-container:1.4 --as kube-system/ebs-csi-controller-sa --as-group system:masters

which gives me a Bash prompt. But looking at the pod spec I see that it runs with serviceAccount: default and so the pod does not have the IAM privileges of kube-system/ebs-csi-controller-sa

What you expected to happen:
kubectl debug should merge --as ... --as-group .. and run debug pod with respective service account

How to reproduce it (as minimally and precisely as possible):

Run a command similar to the above in an EKS cluster with EBS CSI driver installed and using IRSA and specify for example a publicly available image like:

kubectl debug node/<redacted> -it --profile=sysadmin --image=public.ecr.aws/amazonlinux/amazonlinux:2023 --as kube-system/ebs-csi-controller-sa --as-group system:masters

Anything else we need to know?:

Environment:

• Kubernetes client and server versions (use kubectl version): v1.32.1
• Cloud provider or hardware configuration: AWS EKS
• OS (e.g: cat /etc/os-release):

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[youwalther65]

Oops, I saw i sued wrong syntax for service account which needs --as=system:serviceaccount:kube-system/ebs-csi-controller-sa. Will check and try again

[youwalther65]

I was on the wrong way because I had to use spec.serviceAccount directly not run --as or --as-group