In the future (kube-apiserver 1.32+) we can consider making kube-apiserver also include the standard username/groups/extra/uid headers the aggregator uses (which are not configurable) in the configmap it publishes containing auth config, so that aggregation works even if kube-apiserver only set non-standard requestheader flag options

Originally posted by @liggitt in #115834 (comment)

Note: the earliest is now v1.33 because #115834 will not merge until v1.32.