In Kubernetes, the most preferred way of authenticating to the dashboard is via an authenticating proxy.
https://github.com/kubernetes/dashboard/wiki/Access-control#authentication

The authentication mechanism that Kubernetes expects is an Authorization: Bearer <token>, where the token is typically going to be the JWT ID token.
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens

While headers like X-Forwarded-Email and X-Forwarded-Groups are certainly more approachable and accessible for upstream services to consume, these aren't currently supported by Kubernetes, and unless you enable Gap-Signature, there's no guarantees beyond what firewalling you do between the proxy and the upstream service in terms of preventing impersonation. The Gap-Signature scheme doesn't appear to be standardized, so it makes more sense to me to put the feature request on the proxy side rather than to try to have the Kubernetes dashboard support X-Forwarded-Email and X-Forwarded-Groups.