Adds no-impersonation documentation

Signed-off-by: JoshVanL <[email protected]>

Author: JoshVanL

README.md

@@ -127,6 +127,7 @@ users:
 
 ## Configuration
  - [Token Passthrough](./docs/tasks/token-passthrough.md)
+ - [No Impersonation](./docs/tasks/no-impersonation.md)
 
 ## Development
 *NOTE*: building kube-oidc-proxy requires Go version 1.12 or higher.

docs/tasks/no-impersonation.md

@@ -0,0 +1,14 @@
+# No Impersonation
+
+kube-oidc-proxy can be configured to disable impersonation. When a request has
+been successfully authenticated, the request is forwarded as-is, without changes
+to the HTTP header and no authentication injected by the proxy. The OIDC
+bearer token is also kept in the request. This can be useful for securing
+endpoints that do not provide OIDC or any authentication methods and do not
+implement any authorization.
+
+To disable impersonation, provide the following flag:
+
+```
+--disable-impersonation
+```