out_azure_kusto: avoid logging workload identity token at info level
- Dominant language
- C
- Stars
- 8.1k
- Forks
- 2k
- Avg merge
- 4d 16h
- Merged PRs (30d)
- 58
Description
# out_azure_kusto: avoid logging workload identity token at info level
## Bug Report
**Describe the bug**
When `out_azure_kusto` uses Azure workload identity in an AKS workload, `flb_azure_workload_identity_token_get()` logs the federated token value at INFO level. The affected statement in `plugins/out_azure_kusto/azure_msiauth.c` passes `federated_token` to `%s`:
```c
flb_info("[azure workload identity] after read token from file %s", federated_token);
```
This sends credential material to normal Fluent Bit logs and any downstream log collection destination.
**To Reproduce**
1. Configure `out_azure_kusto` with `auth_type workload_identity` in an AKS workload using Azure workload identity.
2. Start Fluent Bit with the normal INFO log level.
3. Observe the workload identity token acquisition logs.
**Observed behavior**
Sanitized log evidence:
```text
[2026/07/23 09:30:22.094] [ info] [azure workload identity] after read token from file
```
**Expected behavior**
The federated token value must not be written to Fluent Bit logs. A non-secret confirmation that the token was read may be logged if useful for diagnostics.
**Your Environment**
* Version used: Fluent Bit v5.0.9
* Environment: AKS with Azure workload identity
* Output plugin: `azure_kusto`
**Additional context**
A focused fix can remove the credential-bearing INFO statement while preserving token exchange behavior.
Contributor guide
Research direction
Start in plugins/out_azure_kusto/azure_msiauth.c at the flb_azure_workload_identity_token_get() log statement that passes federated_token to %s. Confirm the change no longer exposes the token at INFO level while workload identity token acquisition and exchange still work; verify using the reproduction configuration and normal INFO logging.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, c
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 88/100