out_azure_kusto: avoid logging workload identity token at info level
Bug Report
Describe the bug
When out_azure_kusto uses Azure workload identity in an AKS workload, flb_azure_workload_identity_token_get() logs the federated token value at INFO level. The affected statement in plugins/out_azure_kusto/azure_msiauth.c passes federated_token to %s:
flb_info("[azure workload identity] after read token from file %s", federated_token);
This sends credential material to normal Fluent Bit logs and any downstream log collection destination.
To Reproduce
- Configure
out_azure_kusto with auth_type workload_identity in an AKS workload using Azure workload identity.
- Start Fluent Bit with the normal INFO log level.
- Observe the workload identity token acquisition logs.
Observed behavior
Sanitized log evidence:
[2026/07/23 09:30:22.094] [ info] [azure workload identity] after read token from file <redacted federated JWT>
Expected behavior
The federated token value must not be written to Fluent Bit logs. A non-secret confirmation that the token was read may be logged if useful for diagnostics.
Your Environment
- Version used: Fluent Bit v5.0.9
- Environment: AKS with Azure workload identity
- Output plugin:
azure_kusto
Additional context
A focused fix can remove the credential-bearing INFO statement while preserving token exchange behavior.
out_azure_kusto: avoid logging workload identity token at info level
Bug Report
Describe the bug
When
out_azure_kustouses Azure workload identity in an AKS workload,flb_azure_workload_identity_token_get()logs the federated token value at INFO level. The affected statement inplugins/out_azure_kusto/azure_msiauth.cpassesfederated_tokento%s:This sends credential material to normal Fluent Bit logs and any downstream log collection destination.
To Reproduce
out_azure_kustowithauth_type workload_identityin an AKS workload using Azure workload identity.Observed behavior
Sanitized log evidence:
Expected behavior
The federated token value must not be written to Fluent Bit logs. A non-secret confirmation that the token was read may be logged if useful for diagnostics.
Your Environment
azure_kustoAdditional context
A focused fix can remove the credential-bearing INFO statement while preserving token exchange behavior.