fluent / fluent/fluent-bit

Add Azure authentication module (MSI, Workload Identity, Service Principal) for azure_blob output plugin

Open
#11,835 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
8.1k
Forks
2k
Avg merge
4d 20h
Merged PRs (30d)
71

Description

**Is your feature request related to a problem? Please describe.**
out_azure_blob currently only supports shared key and SAS token authentication. Shared key is not a recommended or secure approach as it grants full account access. SAS token has an expiration time, requiring manual rotation and operational overhead. We hope to leverage OAuth/Managed Identity for authentication instead.

**Describe the solution you'd like**

Add a common Azure authentication module (flb_azure_auth) to Fluent Bit core that supports:
- System-assigned and user-assigned Managed Identity (MSI) via IMDS endpoint
- Workload Identity authentication with federated tokens
- Service Principal authentication with client credentials (OAuth2 client_credentials flow)

Integrate this into out_azure_blob alongside the existing methods (fully backward compatible), with new config
parameters:
- tenant_id, client_id, client_secret — for Service Principal
- workload_identity_token_file — for Workload Identity
- client_id = system — for system-assigned Managed Identity

Also migrate out_azure_kusto to use the same common module, removing its local duplicate azure_msiauth.c.

A working implementation is available at: https://github.com/zshuang0316/fluent-bit/tree/azure-msi-auth

**Describe alternatives you've considered**

**Additional context**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.