Skip to content

Commit bfff2ab

Browse files
temporaerCopilot
temporaer
and
Copilot
committed
docs(azure_blob): add managed identity and workload identity auth
Document new auth_type values (managed_identity, workload_identity) and related configuration parameters (client_id, tenant_id, workload_identity_token_file) with configuration examples. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent dbbe7ed commit bfff2ab

1 file changed

Lines changed: 184 additions & 1 deletion

File tree

‎pipeline/outputs/azure_blob.md‎

Lines changed: 184 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,12 @@ Fluent Bit exposes the following configuration properties.
1919
| Key | Description | Default |
2020
| :--------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------- |
2121
| `account_name` | Azure Storage account name. | _none_ |
22-
| `auth_type` | Specify the type to authenticate against the service. Supported values: `key`, `sas`. | `key` |
22+
| `auth_type` | Specify the type to authenticate against the service. Supported values: `key`, `sas`, `managed_identity`, `workload_identity`. | `key` |
2323
| `shared_key` | Specify the Azure Storage Shared Key to authenticate against the service. This configuration property is mandatory when `auth_type` is `key`. | _none_ |
2424
| `sas_token` | Specify the Azure Storage shared access signatures to authenticate against the service. This configuration property is mandatory when `auth_type` is `sas`. | _none_ |
25+
| `client_id` | Azure client ID for managed identity or workload identity authentication. For system-assigned managed identity, set to `system`. Required when `auth_type` is `managed_identity` or `workload_identity`. | _none_ |
26+
| `tenant_id` | Azure tenant ID. Required when `auth_type` is `workload_identity`. | _none_ |
27+
| `workload_identity_token_file` | Path to the projected service account token file for workload identity authentication. Only used when `auth_type` is `workload_identity`. | `/var/run/secrets/azure/tokens/azure-identity-token` |
2528
| `container_name` | Name of the container that will contain the blobs. | _none_ |
2629
| `blob_type` | Specify the desired blob type. Supported values: `appendblob`, `blockblob`. | `appendblob` |
2730
| `auto_create_container` | If `container_name` doesn't exist in the remote service, enabling this option handles the exception and auto-creates the container. | `on` |
@@ -111,6 +114,186 @@ After you run the configuration file, you will be able to query the data using t
111114

112115
![Azure Blob](../../.gitbook/assets/azure_blob.png)
113116

117+
### Configuration for Managed Identity
118+
119+
Azure Managed Identity lets your application authenticate to Azure Blob Storage without managing credentials. This works on Azure VMs, Azure Container Instances, Azure App Service, and other Azure compute services with managed identity support.
120+
121+
#### System-assigned managed identity
122+
123+
{% tabs %}
124+
{% tab title="fluent-bit.yaml" %}
125+
126+
```yaml
127+
service:
128+
flush: 1
129+
log_level: info
130+
131+
pipeline:
132+
inputs:
133+
- name: dummy
134+
dummy: '{"name": "Fluent Bit", "year": 2024}'
135+
samples: 1
136+
tag: var.log.containers.app-default-96cbdef2340.log
137+
138+
outputs:
139+
- name: azure_blob
140+
match: "*"
141+
account_name: YOUR_ACCOUNT_NAME
142+
auth_type: managed_identity
143+
client_id: system
144+
container_name: logs
145+
auto_create_container: on
146+
tls: on
147+
```
148+
149+
{% endtab %}
150+
{% tab title="fluent-bit.conf" %}
151+
152+
```text
153+
[SERVICE]
154+
flush 1
155+
log_level info
156+
157+
[INPUT]
158+
name dummy
159+
dummy {"name": "Fluent Bit", "year": 2024}
160+
samples 1
161+
tag var.log.containers.app-default-96cbdef2340.log
162+
163+
[OUTPUT]
164+
name azure_blob
165+
match *
166+
account_name YOUR_ACCOUNT_NAME
167+
auth_type managed_identity
168+
client_id system
169+
container_name logs
170+
auto_create_container on
171+
tls on
172+
```
173+
174+
{% endtab %}
175+
{% endtabs %}
176+
177+
#### User-assigned managed identity
178+
179+
For user-assigned managed identities, set `client_id` to the client ID (UUID) of the managed identity:
180+
181+
{% tabs %}
182+
{% tab title="fluent-bit.yaml" %}
183+
184+
```yaml
185+
service:
186+
flush: 1
187+
log_level: info
188+
189+
pipeline:
190+
inputs:
191+
- name: dummy
192+
dummy: '{"name": "Fluent Bit", "year": 2024}'
193+
samples: 1
194+
tag: var.log.containers.app-default-96cbdef2340.log
195+
196+
outputs:
197+
- name: azure_blob
198+
match: "*"
199+
account_name: YOUR_ACCOUNT_NAME
200+
auth_type: managed_identity
201+
client_id: YOUR_MANAGED_IDENTITY_CLIENT_ID
202+
container_name: logs
203+
auto_create_container: on
204+
tls: on
205+
```
206+
207+
{% endtab %}
208+
{% tab title="fluent-bit.conf" %}
209+
210+
```text
211+
[SERVICE]
212+
flush 1
213+
log_level info
214+
215+
[INPUT]
216+
name dummy
217+
dummy {"name": "Fluent Bit", "year": 2024}
218+
samples 1
219+
tag var.log.containers.app-default-96cbdef2340.log
220+
221+
[OUTPUT]
222+
name azure_blob
223+
match *
224+
account_name YOUR_ACCOUNT_NAME
225+
auth_type managed_identity
226+
client_id YOUR_MANAGED_IDENTITY_CLIENT_ID
227+
container_name logs
228+
auto_create_container on
229+
tls on
230+
```
231+
232+
{% endtab %}
233+
{% endtabs %}
234+
235+
### Configuration for Workload Identity
236+
237+
Azure Workload Identity lets pods in Azure Kubernetes Service (AKS) authenticate to Azure Blob Storage using a Kubernetes service account federated with Azure AD.
238+
239+
{% tabs %}
240+
{% tab title="fluent-bit.yaml" %}
241+
242+
```yaml
243+
service:
244+
flush: 1
245+
log_level: info
246+
247+
pipeline:
248+
inputs:
249+
- name: dummy
250+
dummy: '{"name": "Fluent Bit", "year": 2024}'
251+
samples: 1
252+
tag: var.log.containers.app-default-96cbdef2340.log
253+
254+
outputs:
255+
- name: azure_blob
256+
match: "*"
257+
account_name: YOUR_ACCOUNT_NAME
258+
auth_type: workload_identity
259+
client_id: YOUR_CLIENT_ID
260+
tenant_id: YOUR_TENANT_ID
261+
container_name: logs
262+
auto_create_container: on
263+
tls: on
264+
```
265+
266+
{% endtab %}
267+
{% tab title="fluent-bit.conf" %}
268+
269+
```text
270+
[SERVICE]
271+
flush 1
272+
log_level info
273+
274+
[INPUT]
275+
name dummy
276+
dummy {"name": "Fluent Bit", "year": 2024}
277+
samples 1
278+
tag var.log.containers.app-default-96cbdef2340.log
279+
280+
[OUTPUT]
281+
name azure_blob
282+
match *
283+
account_name YOUR_ACCOUNT_NAME
284+
auth_type workload_identity
285+
client_id YOUR_CLIENT_ID
286+
tenant_id YOUR_TENANT_ID
287+
container_name logs
288+
auto_create_container on
289+
tls on
290+
```
291+
292+
{% endtab %}
293+
{% endtabs %}
294+
295+
The `workload_identity_token_file` option can be set to override the default token file path if your AKS cluster mounts the projected service account token at a non-standard location.
296+
114297
### Configuring and using Azure Emulator: Azurite
115298

116299
#### Install and run Azurite

0 commit comments

Comments
 (0)