IDaaS Kubernetes M2M Federated Credential (OIDC, Without AK)

Implement the verified end-to-end flow: Kubernetes ServiceAccount OIDC token → signature verification by an EIAM OIDC federated credential provider (three JWKS source modes, matching console terminology: Static Fill-in = static, Issuer Address Resolution = dynamic_from_issuer, JWKS URI Resolution = dynamic_from_jwks_uri) → kubernetes-mode application federated credential verification → M2M token issuance using client_credentials → SDK onboarding for PAM-to-STS.

Architecture: Kubernetes Cluster (OIDC Issuer + ServiceAccount Token) → IDaaS EIAM (OIDC Federated Credential Provider + M2M Application + Application Federated Credential) → PAM Feature Permission → M2M Token (id-token-bearer)

All scripts are in scripts/. They use Python 3 with the standard library only, calling the aliyun CLI through subprocess (credentials must already be configured); kubectl is optional (probe first, degrade to paste-back). Run scripts from the workspace root: python3 scripts/<script>.py.

Respond in the user's language unless they request otherwise.

Source document: "[PAM]Native Kubernetes Static-Credential-Free STS Token" (DingTalk doc EpGBa2Lm8aZxe5myCzw3bwBEWgN7R35y).

Installation

Pre-check: Aliyun CLI >= 3.3.3 required

[MUST] Verify: aliyun version — must be >= 3.3.3.

• First install or major upgrade: /bin/bash -c "$(curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh)"
• Routine update (CLI >= 3.3.5): aliyun upgrade — prefer this built-in self-update over re-running the install script.
• See references/cli-installation-guide.md for full installation instructions.