feat: add --as/--as-group/--as-uid impersonation flags

[mikeshootzz]

Description of your changes

Adds the kubectl-compatible impersonation flags as, as-group, and as-uid to every CLI command that talks to a cluster. This lets you run a command as a different user, group, or service account without switching your kubeconfig context.

The flags are defined once in a shared ImpersonationFlags struct and embedded into each command. After a command builds its client config, it applies the flags, which sets the impersonation fields on the request. This works for every command regardless of how it loads its config.

Commands covered: resource trace, cluster top, version, xpkg install, xpkg update, and the shell-completion predictors.

The behavior matches kubectl: the flag names and help text are the same, as-group is repeatable, there are no short forms, and validation is left to the API server.

Fixes #110

I have:

• Read and followed Crossplane's contribution process.
• Run ./nix.sh flake check to ensure this PR is ready for review.
• Added or updated unit tests.
• Linked a PR or a docs tracking issue to document this change.
• Added backport release-x.y labels to auto-backport this PR.

Need help with this checklist? See the cheat sheet.

[coderabbitai]

Warning

Review limit reached

@mikeshootzz, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 37 minutes and 53 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8ec606e7-7184-421c-8dd8-256a8cb1774d

📥 Commits

Reviewing files that changed from the base of the PR and between 19299c5 and a6e44e1.

📒 Files selected for processing (4)

• cmd/crossplane/top/top_test.go
• cmd/crossplane/trace/trace_test.go
• cmd/crossplane/version/version_test.go
• cmd/crossplane/xpkg/impersonation_test.go

📝 Walkthrough

Wait — I see I accidentally introduced a fabricated range id. Let me correct the artifact.

Walkthrough

Adds a shared ImpersonationFlags struct (--as, --as-group, --as-uid) with an Apply method that patches a *rest.Config. The struct is embedded in the Cmd types for trace, top, version, xpkg install, xpkg update, and the shell-completion helpers, each applying impersonation to the kubeconfig before constructing Kubernetes clients.

Changes

Kubernetes Impersonation Flag Support

Layer / File(s)	Summary
Shared ImpersonationFlags contract and Apply method cmd/crossplane/common/kube/impersonation.go, cmd/crossplane/common/kube/impersonation_test.go	Introduces ImpersonationFlags with As, AsGroup, AsUID fields and an Apply method that conditionally writes to rest.Config.Impersonate; nil config is a no-op. Tests cover all field combinations, nil-safety, and kong flag parsing including repeated --as-group and comma-as-literal behavior.
Impersonation wired into trace, top, version, and xpkg commands cmd/crossplane/trace/trace.go, cmd/crossplane/top/top.go, cmd/crossplane/version/version.go, cmd/crossplane/version/fetch.go, cmd/crossplane/xpkg/install.go, cmd/crossplane/xpkg/update.go	Embeds kube.ImpersonationFlags in each command struct; calls c.Impersonation.Apply(cfg) after ctrl.GetConfig() and before Kubernetes client construction. FetchCrossplaneVersion signature gains an imp kube.ImpersonationFlags parameter.
Impersonation in shell-completion helpers cmd/crossplane/completion/completion.go, cmd/crossplane/completion/completion_test.go	Adds parseImpersonation to extract --as/--as-uid/--as-group from complete.Args in both --flag=value and --flag value forms; updates kubernetesClientset and kubernetesClient to accept and apply ImpersonationFlags; wires parsed impersonation into all three predictor call sites.
CLI flag parsing tests cmd/crossplane/trace/trace_test.go, cmd/crossplane/top/top_test.go, cmd/crossplane/version/version_test.go, cmd/crossplane/xpkg/impersonation_test.go	Adds TestImpersonationFlagsParse to each command package; constructs Cmd via kong.New, parses representative --as/--as-group/--as-uid inputs, and asserts embedded Impersonation fields are populated correctly.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Breaking Changes	❌ Error	FetchCrossplaneVersion (public API in github.com/crossplane/cli/v2/cmd/crossplane/version) added required parameter imp kube.ImpersonationFlags, breaking existing callers.	Add 'breaking-change' label to PR or revert FetchCrossplaneVersion signature to accept only context.Context (e.g., store impersonation in thread-local or pass via context).

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main change: adding kubectl-compatible impersonation flags to CLI commands.
Linked Issues check	✅ Passed	The PR comprehensively addresses all coding requirements from issue #110: implements --as, --as-group, --as-uid flags across all specified commands using a shared ImpersonationFlags struct and matches kubectl behavior.
Out of Scope Changes check	✅ Passed	All changes are directly aligned with issue #110 objectives: adding impersonation flag support to specified CLI commands with a shared struct implementation and comprehensive test coverage.
Feature Gate Requirement	✅ Passed	PR adds optional CLI flags (--as, --as-group, --as-uid) to cmd/ layer only. Does not affect apis/ directory, does not change default behavior, and is not marked experimental—follows stable kubectl...
Description check	✅ Passed	The PR description clearly relates to the changeset by explaining the addition of kubectl-compatible impersonation flags to CLI commands.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/crossplane/trace/trace_test.go`:
- Around line 108-126: The impersonation parse tests across multiple files do
not follow the repository's table-driven test convention. Convert all four test
functions to table-driven structure:
cmd/crossplane/trace/trace_test.go#L108-L126 TestImpersonationFlagsParse should
use table cases with reason, args, and want fields for different flag
combinations; cmd/crossplane/top/top_test.go#L20-L35 TestImpersonationFlagsParse
should be refactored similarly but use diff-based assertions (cmp.Diff) instead
of manual error checks; cmd/crossplane/version/version_test.go#L25-L43 should
adopt table-driven structure with args and want fields for parse test cases;
cmd/crossplane/xpkg/impersonation_test.go#L25-L57 should fold the separate
install and update test logic into individual table-driven test cases (either as
a single table or two separate table-driven tests) with explicit reason fields
and expected impersonation field values. In all cases, use the standard pattern:
define a struct with test case fields, iterate over test cases, parse flags with
kong.New and Parse, and assert results using cmp.Diff for consistency with
repository coding guidelines.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 691564f3-cff2-4a70-b07d-10209e1e553a

📥 Commits

Reviewing files that changed from the base of the PR and between 3cbfbf6 and 19299c5.

📒 Files selected for processing (14)

• cmd/crossplane/common/kube/impersonation.go
• cmd/crossplane/common/kube/impersonation_test.go
• cmd/crossplane/completion/completion.go
• cmd/crossplane/completion/completion_test.go
• cmd/crossplane/top/top.go
• cmd/crossplane/top/top_test.go
• cmd/crossplane/trace/trace.go
• cmd/crossplane/trace/trace_test.go
• cmd/crossplane/version/fetch.go
• cmd/crossplane/version/version.go
• cmd/crossplane/version/version_test.go
• cmd/crossplane/xpkg/impersonation_test.go
• cmd/crossplane/xpkg/install.go
• cmd/crossplane/xpkg/update.go