Skip to content

out_azure_kusto: avoid logging workload identity token at info level #12145

Description

@admhn

out_azure_kusto: avoid logging workload identity token at info level

Bug Report

Describe the bug

When out_azure_kusto uses Azure workload identity in an AKS workload, flb_azure_workload_identity_token_get() logs the federated token value at INFO level. The affected statement in plugins/out_azure_kusto/azure_msiauth.c passes federated_token to %s:

flb_info("[azure workload identity] after read token from file %s", federated_token);

This sends credential material to normal Fluent Bit logs and any downstream log collection destination.

To Reproduce

  1. Configure out_azure_kusto with auth_type workload_identity in an AKS workload using Azure workload identity.
  2. Start Fluent Bit with the normal INFO log level.
  3. Observe the workload identity token acquisition logs.

Observed behavior

Sanitized log evidence:

[2026/07/23 09:30:22.094] [ info] [azure workload identity] after read token from file <redacted federated JWT>

Expected behavior

The federated token value must not be written to Fluent Bit logs. A non-secret confirmation that the token was read may be logged if useful for diagnostics.

Your Environment

  • Version used: Fluent Bit v5.0.9
  • Environment: AKS with Azure workload identity
  • Output plugin: azure_kusto

Additional context

A focused fix can remove the credential-bearing INFO statement while preserving token exchange behavior.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions