Skip to content

Commit 8a3f7b8

Browse files
zshuang0316zshuang0316
committed
out_azure_kusto: migrate to common Azure authentication
Refactor Azure Kusto plugin to use the centralized Azure authentication module instead of local azure_msiauth implementation. Changes: - Remove azure_msiauth.c from build (deprecated) - Use common flb_azure_auth functions for MSI and workload identity - Replace local auth enum with common flb_azure_auth_type - Use flb_azure_auth_build_oauth_url for OAuth URL construction - Pass Kusto-specific resource scope to auth functions This unifies authentication behavior across all Azure output plugins while maintaining full backward compatibility. Signed-off-by: zshuang0316 <zshuang0316@163.com>
1 parent 919b763 commit 8a3f7b8

4 files changed

Lines changed: 38 additions & 62 deletions

File tree

‎plugins/out_azure_kusto/CMakeLists.txt‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,11 @@ set(src
22
azure_kusto.c
33
azure_kusto_conf.c
44
azure_kusto_ingest.c
5-
azure_msiauth.c
65
azure_kusto_store.c
76
)
87

9-
FLB_PLUGIN(out_azure_kusto "${src}" "")
8+
if(FLB_TLS)
9+
FLB_PLUGIN(out_azure_kusto "${src}" "")
10+
else()
11+
message(STATUS "out_azure_kusto plugin disabled (requires FLB_TLS=ON)")
12+
endif()

‎plugins/out_azure_kusto/azure_kusto.c‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,15 +36,14 @@
3636
#include "azure_kusto.h"
3737
#include "azure_kusto_conf.h"
3838
#include "azure_kusto_ingest.h"
39-
#include "azure_msiauth.h"
4039
#include "azure_kusto_store.h"
4140

4241
static int azure_kusto_get_msi_token(struct flb_azure_kusto *ctx)
4342
{
4443
char *token;
4544

46-
/* Retrieve access token */
47-
token = flb_azure_msiauth_token_get(ctx->o);
45+
/* Retrieve access token using common auth function */
46+
token = flb_azure_msi_token_get(ctx->o);
4847
if (!token) {
4948
flb_plg_error(ctx->ins, "error retrieving oauth2 access token");
5049
return -1;
@@ -57,10 +56,12 @@ static int azure_kusto_get_workload_identity_token(struct flb_azure_kusto *ctx)
5756
{
5857
int ret;
5958

59+
/* Use common auth function for workload identity */
6060
ret = flb_azure_workload_identity_token_get(ctx->o,
6161
ctx->workload_identity_token_file,
6262
ctx->client_id,
63-
ctx->tenant_id);
63+
ctx->tenant_id,
64+
FLB_AZURE_KUSTO_RESOURCE_SCOPE);
6465
if (ret == -1) {
6566
flb_plg_error(ctx->ins, "error retrieving workload identity token");
6667
return -1;
@@ -83,7 +84,8 @@ static int azure_kusto_get_service_principal_token(struct flb_azure_kusto *ctx)
8384
return -1;
8485
}
8586

86-
ret = flb_oauth2_payload_append(ctx->o, "scope", 5, FLB_AZURE_KUSTO_SCOPE, 39);
87+
ret = flb_oauth2_payload_append(ctx->o, "scope", 5, FLB_AZURE_KUSTO_SCOPE,
88+
sizeof(FLB_AZURE_KUSTO_SCOPE) - 1);
8789
if (ret == -1) {
8890
flb_plg_error(ctx->ins, "error appending oauth2 params");
8991
return -1;
@@ -124,14 +126,14 @@ flb_sds_t get_azure_kusto_token(struct flb_azure_kusto *ctx)
124126

125127
if (flb_oauth2_token_expired(ctx->o) == FLB_TRUE) {
126128
switch (ctx->auth_type) {
127-
case FLB_AZURE_KUSTO_AUTH_WORKLOAD_IDENTITY:
129+
case FLB_AZURE_AUTH_WORKLOAD_IDENTITY:
128130
ret = azure_kusto_get_workload_identity_token(ctx);
129131
break;
130-
case FLB_AZURE_KUSTO_AUTH_MANAGED_IDENTITY_SYSTEM:
131-
case FLB_AZURE_KUSTO_AUTH_MANAGED_IDENTITY_USER:
132+
case FLB_AZURE_AUTH_MANAGED_IDENTITY_SYSTEM:
133+
case FLB_AZURE_AUTH_MANAGED_IDENTITY_USER:
132134
ret = azure_kusto_get_msi_token(ctx);
133135
break;
134-
case FLB_AZURE_KUSTO_AUTH_SERVICE_PRINCIPAL:
136+
case FLB_AZURE_AUTH_SERVICE_PRINCIPAL:
135137
default:
136138
ret = azure_kusto_get_service_principal_token(ctx);
137139
break;

‎plugins/out_azure_kusto/azure_kusto.h‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
#include <fluent-bit/flb_output.h>
2626
#include <fluent-bit/flb_sds.h>
2727
#include <fluent-bit/flb_upstream_ha.h>
28+
#include <fluent-bit/flb_azure_auth.h>
2829

2930
#include <fluent-bit/flb_scheduler.h>
3031
#include <fluent-bit/flb_utils.h>
@@ -35,13 +36,8 @@
3536
/* refresh token every 50 minutes */
3637
#define FLB_AZURE_KUSTO_TOKEN_REFRESH 3000
3738

38-
/* Authentication types */
39-
typedef enum {
40-
FLB_AZURE_KUSTO_AUTH_SERVICE_PRINCIPAL = 0, /* Client ID + Client Secret */
41-
FLB_AZURE_KUSTO_AUTH_MANAGED_IDENTITY_SYSTEM, /* System-assigned managed identity */
42-
FLB_AZURE_KUSTO_AUTH_MANAGED_IDENTITY_USER, /* User-assigned managed identity */
43-
FLB_AZURE_KUSTO_AUTH_WORKLOAD_IDENTITY /* Workload Identity */
44-
} flb_azure_kusto_auth_type;
39+
/* Kusto resource scope for Azure authentication */
40+
#define FLB_AZURE_KUSTO_RESOURCE_SCOPE "https://help.kusto.windows.net/"
4541

4642
/* Kusto streaming inserts oauth scope */
4743
#define FLB_AZURE_KUSTO_SCOPE "https://help.kusto.windows.net/.default"

‎plugins/out_azure_kusto/azure_kusto_conf.c‎

Lines changed: 19 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@
3131

3232
#include "azure_kusto.h"
3333
#include "azure_kusto_conf.h"
34-
#include "azure_msiauth.h"
3534

3635
/* Constants for PCG random number generator */
3736
#define PCG_DEFAULT_MULTIPLIER_64 6364136223846793005ULL
@@ -724,7 +723,7 @@ struct flb_azure_kusto *flb_azure_kusto_conf_create(struct flb_output_instance *
724723

725724
/* Auth method validation and setup */
726725
if (strcasecmp(ctx->auth_type_str, "service_principal") == 0) {
727-
ctx->auth_type = FLB_AZURE_KUSTO_AUTH_SERVICE_PRINCIPAL;
726+
ctx->auth_type = FLB_AZURE_AUTH_SERVICE_PRINCIPAL;
728727

729728
/* Verify required parameters for Service Principal auth */
730729
if (!ctx->tenant_id || !ctx->client_id || !ctx->client_secret) {
@@ -742,13 +741,13 @@ struct flb_azure_kusto *flb_azure_kusto_conf_create(struct flb_output_instance *
742741
}
743742

744743
if (strcasecmp(ctx->client_id, "system") == 0) {
745-
ctx->auth_type = FLB_AZURE_KUSTO_AUTH_MANAGED_IDENTITY_SYSTEM;
744+
ctx->auth_type = FLB_AZURE_AUTH_MANAGED_IDENTITY_SYSTEM;
746745
} else {
747-
ctx->auth_type = FLB_AZURE_KUSTO_AUTH_MANAGED_IDENTITY_USER;
746+
ctx->auth_type = FLB_AZURE_AUTH_MANAGED_IDENTITY_USER;
748747
}
749748
}
750749
else if (strcasecmp(ctx->auth_type_str, "workload_identity") == 0) {
751-
ctx->auth_type = FLB_AZURE_KUSTO_AUTH_WORKLOAD_IDENTITY;
750+
ctx->auth_type = FLB_AZURE_AUTH_WORKLOAD_IDENTITY;
752751

753752
/* Verify required parameters for Workload Identity auth */
754753
if (!ctx->tenant_id || !ctx->client_id) {
@@ -759,7 +758,7 @@ struct flb_azure_kusto *flb_azure_kusto_conf_create(struct flb_output_instance *
759758

760759
/* Set default token file path if not specified */
761760
if (!ctx->workload_identity_token_file) {
762-
ctx->workload_identity_token_file = flb_strdup("/var/run/secrets/azure/tokens/azure-identity-token");
761+
ctx->workload_identity_token_file = flb_strdup(FLB_AZURE_WORKLOAD_IDENTITY_TOKEN_FILE);
763762
if (!ctx->workload_identity_token_file) {
764763
flb_errno();
765764
flb_plg_error(ins, "Could not allocate default workload identity token path");
@@ -796,44 +795,15 @@ struct flb_azure_kusto *flb_azure_kusto_conf_create(struct flb_output_instance *
796795
return NULL;
797796
}
798797

799-
/* Create oauth2 context */
800-
if (ctx->auth_type == FLB_AZURE_KUSTO_AUTH_MANAGED_IDENTITY_SYSTEM ||
801-
ctx->auth_type == FLB_AZURE_KUSTO_AUTH_MANAGED_IDENTITY_USER) {
802-
/* MSI auth */
803-
/* Construct the URL template with or without client_id for managed identity */
804-
if (ctx->auth_type == FLB_AZURE_KUSTO_AUTH_MANAGED_IDENTITY_SYSTEM) {
805-
ctx->oauth_url = flb_sds_create_size(sizeof(FLB_AZURE_MSIAUTH_URL_TEMPLATE) - 1);
806-
if (!ctx->oauth_url) {
807-
flb_errno();
808-
flb_azure_kusto_conf_destroy(ctx);
809-
return NULL;
810-
}
811-
flb_sds_snprintf(&ctx->oauth_url, flb_sds_alloc(ctx->oauth_url),
812-
FLB_AZURE_MSIAUTH_URL_TEMPLATE, "", "");
813-
} else {
814-
/* User-assigned managed identity */
815-
ctx->oauth_url = flb_sds_create_size(sizeof(FLB_AZURE_MSIAUTH_URL_TEMPLATE) - 1 +
816-
sizeof("&client_id=") - 1 +
817-
flb_sds_len(ctx->client_id));
818-
if (!ctx->oauth_url) {
819-
flb_errno();
820-
flb_azure_kusto_conf_destroy(ctx);
821-
return NULL;
822-
}
823-
flb_sds_snprintf(&ctx->oauth_url, flb_sds_alloc(ctx->oauth_url),
824-
FLB_AZURE_MSIAUTH_URL_TEMPLATE, "&client_id=", ctx->client_id);
825-
}
826-
} else {
827-
/* Standard OAuth2 for service principal or workload identity */
828-
ctx->oauth_url = flb_sds_create_size(sizeof(FLB_MSAL_AUTH_URL_TEMPLATE) - 1 +
829-
flb_sds_len(ctx->tenant_id));
830-
if (!ctx->oauth_url) {
831-
flb_errno();
832-
flb_azure_kusto_conf_destroy(ctx);
833-
return NULL;
834-
}
835-
flb_sds_snprintf(&ctx->oauth_url, flb_sds_alloc(ctx->oauth_url),
836-
FLB_MSAL_AUTH_URL_TEMPLATE, ctx->tenant_id);
798+
/* Create oauth2 context using common auth URL builder */
799+
ctx->oauth_url = flb_azure_auth_build_oauth_url(ctx->auth_type,
800+
ctx->tenant_id,
801+
ctx->client_id,
802+
FLB_AZURE_KUSTO_RESOURCE_SCOPE);
803+
if (!ctx->oauth_url) {
804+
flb_plg_error(ctx->ins, "failed to create OAuth URL");
805+
flb_azure_kusto_conf_destroy(ctx);
806+
return NULL;
837807
}
838808

839809
ctx->resources = flb_calloc(1, sizeof(struct flb_azure_kusto_resources));
@@ -862,6 +832,11 @@ int flb_azure_kusto_conf_destroy(struct flb_azure_kusto *ctx)
862832
ctx->oauth_url = NULL;
863833
}
864834

835+
if (ctx->workload_identity_token_file) {
836+
flb_free(ctx->workload_identity_token_file);
837+
ctx->workload_identity_token_file = NULL;
838+
}
839+
865840
if (ctx->o) {
866841
flb_oauth2_destroy(ctx->o);
867842
ctx->o = NULL;

0 commit comments

Comments
 (0)