fluent / fluent/fluent-bit

out_azure_kusto: avoid logging workload identity token at info level

Open Beginner friendly
#12,145 0 comments 0 reactions 0 assignees View on GitHub
status: waiting-for-triage
Dominant language
C
Stars
8.1k
Forks
2k
Avg merge
4d 16h
Merged PRs (30d)
58

Description

# out_azure_kusto: avoid logging workload identity token at info level

## Bug Report

**Describe the bug**

When `out_azure_kusto` uses Azure workload identity in an AKS workload, `flb_azure_workload_identity_token_get()` logs the federated token value at INFO level. The affected statement in `plugins/out_azure_kusto/azure_msiauth.c` passes `federated_token` to `%s`:

```c
flb_info("[azure workload identity] after read token from file %s", federated_token);
```

This sends credential material to normal Fluent Bit logs and any downstream log collection destination.

**To Reproduce**

1. Configure `out_azure_kusto` with `auth_type workload_identity` in an AKS workload using Azure workload identity.
2. Start Fluent Bit with the normal INFO log level.
3. Observe the workload identity token acquisition logs.

**Observed behavior**

Sanitized log evidence:

```text
[2026/07/23 09:30:22.094] [ info] [azure workload identity] after read token from file
```

**Expected behavior**

The federated token value must not be written to Fluent Bit logs. A non-secret confirmation that the token was read may be logged if useful for diagnostics.

**Your Environment**

* Version used: Fluent Bit v5.0.9
* Environment: AKS with Azure workload identity
* Output plugin: `azure_kusto`

**Additional context**

A focused fix can remove the credential-bearing INFO statement while preserving token exchange behavior.

Contributor guide

Open the contributing guide

Research direction

Start in plugins/out_azure_kusto/azure_msiauth.c at the flb_azure_workload_identity_token_get() log statement that passes federated_token to %s. Confirm the change no longer exposes the token at INFO level while workload identity token acquisition and exchange still work; verify using the reproduction configuration and normal INFO logging.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, c
Domain
authentication, security
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.