An article goes into detail on how to set up and use service account impersonation.
To configure the CLI to use impersonation by default:
gcloud config set auth/impersonate_service_account [SA_FULL_EMAIL]
To clear this setting:
gcloud config unset auth/impersonate_service_account