Support Azure AD Workload Identity for Azure output plugin authentication

[stevehipwell]

Is your feature request related to a problem? Please describe.
I don't want to provide static credentials to output data to Azure, we should be using something like OIDC.

Describe the solution you'd like

Now that Azure AD Workload Identity is GA the Azure output plugins should support this authentication method.

Describe alternatives you've considered
Azure AD Pod Identity is an alternative, but it never made it to GA and is currently deprecated in favour of Azure AD Workload Identity.

Additional context

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 5 days. Maintainers can add the exempt-stale label.

[stevehipwell]

/not-stale

cc @aydosman

[stevehipwell]

CC @edsiper @leonardo-albertovich @patrick-stephens

[stevehipwell]

Are there any updates on this?

[stevehipwell]

Has there been any progress on this? Fluentd has just got this capability via the fluent-plugin-azurestorage-gen2 plugin.

CC @edsiper @leonardo-albertovich @patrick-stephens

[nclaeys]

I encountered the same issue when trying to use azure_logs_ingestion output instead of the azure output, which uses the deprecated data collector API.

We need to use a managed identity instead of an aad application as we do not have access to the aad of our customers but only to the arm. Supporting workload identity would allow us to do so but now we the output only supports aad applications.

It would be great to have support for this. I would love to contribute, but I cannot write C. If you want me to test things out, love to help in that regard.

[stevehipwell]

Bump; with the 3.2.0 release of the Azure Blob output this still isn't supported.

From a security perspective the current stance goes directly against the Azure guidance. Shared keys are recommended to be disabled and SAS keys should be delegated rather than fixed.

[cristhiank]

Bump; this is a blocker for us too :(

[nclaeys]

Since there seemed to be little progress here, I have built my own custom plugin for fluentbit to support the log ingestion API of Azure. It is a custom plugin because I wrote it in Golang as my C skills are insufficient.
I just finished a first version, you can find it at: https://github.com/nclaeys/fluent-bit-go-azure