fluent-plugin-kusto 1.1.2 → 1.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ab5bb4131b0e2b0939db74f864dcd1ecad5ad2ca48528149f173f9c2aafff12a
-  data.tar.gz: 5d6888cc12052c1e9422c22846a5f20a13169e7fd3f43c6a84b11508b10a4df5
+  metadata.gz: 3190173672cb7fccc00ecf36ff4db6de603cb53a0f25d2f1633d267a072bd9df
+  data.tar.gz: 259a7c0b39e550380bbaddd680c5121ea432d72c8f1588a8b16d6ee9c8a3b1e4
 SHA512:
-  metadata.gz: 2572e784885fce4b64278ebd7d5bf6e6f9738396dbf0f101c0870acf6c3389119cd6b19aedcbd5d1a52f78ddda211a7f659b21b5e492f79a971b59d96b561861
-  data.tar.gz: f4dc859e2bb06f43a3e9d398f85b6a6ea7d790f6d68d2d8b9fef1a316604f3eef9736132dc5d5851c0e3b54ece3d6f60194dbee0118e14f95cce5280b0c43834
+  metadata.gz: '09aca848eece3be5f0bf58ae6aa0fbede9d1a57b7f0227a50a5a0d102b941fdc81cab7410cbf0d05a232eda7ba2b75fc84d9b0d7b7f5c55909f9a6f715741cd2'
+  data.tar.gz: adff070c6f8d48665d17bb336e1fa04b2d500ed1f22f13917b66c4d148e2f5f7810016affede57800ddc2692c0f0b46af719cbdd4f8073ea85f8728cbc002b72

data/README.md

@@ -50,7 +50,7 @@ $ gem install fluent-plugin-kusto
 Add the following line to your Gemfile:
 
 ```ruby
-gem "fluent-plugin-kusto", "~> 1.1.2"
+gem "fluent-plugin-kusto", "~> 1.1.3"
 ```
 
 And then execute:
@@ -149,6 +149,7 @@ Modern approach for Kubernetes/AKS workloads. Replaces the legacy Pod Identity s
 - `workload_identity_client_id`: The client ID for workload identity
 - `workload_identity_tenant_id`: The tenant ID for workload identity
 - `workload_identity_token_file_path`: Path to the workload identity token file (optional, defaults to `/var/run/secrets/azure/tokens/azure-identity-token`)
+- `azure_cloud`: The Azure cloud containing the identity and Kusto cluster
 
 ## Data Schema and Ingestion Mapping
 
@@ -239,9 +240,24 @@ This approach provides flexibility to transform the generic 3-column format into
 | `delayed` | Enable delayed commit for buffer chunks (requires `buffered: true`). | `false` |
 | `deferred_commit_timeout` | Max time (seconds) to wait for deferred commit verification. | `30` |
 | `ingestion_mapping_reference` | Name of a pre-defined ingestion mapping in Kusto for data transformation during ingestion. | _none_ |
-| `azure_cloud` | Azure cloud environment: `AzureCloud`, `AzureChinaCloud`, `AzureUSGovernmentCloud`, `AzureGermanCloud` | `AzureCloud` |
+| `azure_cloud` | Azure cloud environment: `AzureCloud`, `AzureChinaCloud`, or `AzureUSGovernment` (`AzureUSGovernmentCloud` is accepted as a compatibility alias) | `AzureCloud` |
 | `logger_path` | File path for plugin logs. If not set, logs to stdout. | stdout |
 
+### Sovereign Azure Clouds
+
+`azure_cloud` selects the Microsoft Entra authority used by `aad` and `workload_identity` authentication. It does not derive or rewrite the Kusto endpoint, so `endpoint` must be the full endpoint for the same cloud.
+
+For Azure US Government, use the canonical cloud name and the Government Kusto endpoint suffix:
+
+```conf
+azure_cloud AzureUSGovernment
+endpoint https://<cluster>.<region>.kusto.usgovcloudapi.net
+```
+
+Existing configurations can also use `AzureUSGovernmentCloud` as an alias. When using `azcli` authentication, select the cloud before signing in with `az cloud set --name AzureUSGovernment`; the plugin's `azure_cloud` setting does not change Azure CLI's active cloud.
+
+`AzureGermanCloud` is not supported.
+
 ## Dynamic Table Name Resolution
 
 The plugin supports dynamic table name resolution using placeholders in the `table_name` parameter. This allows you to route logs to different tables based on the Fluentd tag.
@@ -445,7 +461,12 @@ This diagram shows the main components and data flow for the plugin, including c
 
 ## Release Notes
 
-### v1.1.2 (Latest)
+### v1.1.3 (Latest)
+- **Fixed workload identity authentication in sovereign clouds** - The workload identity token provider now builds its token request from the configured `azure_cloud` AAD endpoint instead of always calling the public `login.microsoftonline.com` endpoint, unblocking Azure US Government and Azure China deployments
+- **Added `AzureUSGovernmentCloud` as a recognized `azure_cloud` value** - Accepted alongside the existing `AzureUSGovernment` alias so common Azure US Government naming works out of the box
+- **Added workload identity sovereign cloud test coverage** - New unit tests assert the token endpoint is derived per cloud, plus E2E coverage for the sovereign workload identity flow
+
+### v1.1.2
 - **Fixed deferred commit with dynamic table names** - Resolved table names are now correctly passed through to `check_data_on_server`, fixing broken ingestion verification when using placeholder-based table names with `delayed: true`
 - **Improved edge case handling** - Out-of-bounds tag part indices and nil/empty tags now correctly resolve to `"unknown"` fallback instead of empty strings
 - **Added regression tests** - New test coverage for deferred commit + dynamic table name combination

data/lib/fluent/plugin/auth/wif_tokenprovider.rb

@@ -7,7 +7,6 @@ require_relative 'tokenprovider_base'
 
 class WorkloadIdentity < AbstractTokenProvider
   DEFAULT_TOKEN_FILE = '/var/run/secrets/azure/tokens/azure-identity-token'
-  AZURE_OAUTH2_TOKEN_ENDPOINT = 'https://login.microsoftonline.com/%<tenant_id>s/oauth2/v2.0/token'
 
   def initialize(outconfiguration)
     super(outconfiguration)
@@ -22,6 +21,8 @@ class WorkloadIdentity < AbstractTokenProvider
     @tenant_id = outconfiguration.workload_identity_tenant_id
     @token_file = outconfiguration.workload_identity_token_file_path || DEFAULT_TOKEN_FILE
     @kusto_endpoint = outconfiguration.kusto_endpoint
+    aad_endpoint = outconfiguration.aad_endpoint.chomp('/')
+    @token_request_uri = "#{aad_endpoint}/#{@tenant_id}/oauth2/v2.0/token"
     @scope = "#{@kusto_endpoint}/.default"
   end
 
@@ -35,7 +36,7 @@ class WorkloadIdentity < AbstractTokenProvider
 
   def acquire_workload_identity_token
     oidc_token = read_token_file_safely
-    uri = URI.parse(format(AZURE_OAUTH2_TOKEN_ENDPOINT, tenant_id: @tenant_id))
+    uri = URI.parse(@token_request_uri)
     req = Net::HTTP::Post.new(uri)
     req.set_form_data(
       'grant_type' => 'client_credentials',

data/lib/fluent/plugin/conffile.rb

@@ -13,7 +13,8 @@ require 'logger'
 AZURE_CLOUDS = {
   'AzureCloud' => { 'aad' => 'https://login.microsoftonline.com' },
   'AzureChinaCloud' => { 'aad' => 'https://login.chinacloudapi.cn' },
-  'AzureUSGovernment' => { 'aad' => 'https://login.microsoftonline.us' }
+  'AzureUSGovernment' => { 'aad' => 'https://login.microsoftonline.us' },
+  'AzureUSGovernmentCloud' => { 'aad' => 'https://login.microsoftonline.us' }
 }.freeze
 
 class OutputConfiguration

data/lib/fluent/plugin/kusto_version.rb

@@ -3,7 +3,7 @@
 module Fluent
   module Plugin
     module Kusto
-      VERSION = '1.1.2'
+      VERSION = '1.1.3'
     end
   end
 end

data/test/plugin/test_e2e_kusto.rb

@@ -37,6 +37,7 @@ class KustoE2ETest < Test::Unit::TestCase
     @tenant_id = ENV['TENANT_ID'] || ''
     @managed_identity_client_id = ENV['MANAGED_IDENTITY_CLIENT_ID'] || ''
     @auth_type = (ENV['AUTH_TYPE'] || 'aad').downcase
+    @azure_cloud = ENV['AZURE_CLOUD'] || 'AzureCloud'
     @wi_client_id = ENV['WI_CLIENT_ID'] || ''
     @wi_tenant_id = ENV['WI_TENANT_ID'] || ''
     @wi_token_file = ENV['WI_TOKEN_FILE'] || ''
@@ -58,7 +59,7 @@ class KustoE2ETest < Test::Unit::TestCase
       kusto_endpoint: @engine_url,
       database_name: @database,
       table_name: @table,
-      azure_cloud: 'AzureCloud'
+      azure_cloud: @azure_cloud
     }
 
     case @auth_type
@@ -95,7 +96,7 @@ class KustoE2ETest < Test::Unit::TestCase
     ingester.access_token
   end
 
-  def kusto_query(query, type = :data)
+  def kusto_query(query, type = :data, raise_on_error: false)
     endpoint = @engine_url
     path = type == :management ? '/v1/rest/mgmt' : '/v1/rest/query'
     uri = URI("#{endpoint}#{path}")
@@ -121,7 +122,10 @@ class KustoE2ETest < Test::Unit::TestCase
 
     response = http.request(request)
     unless response.code.to_i.between?(200, 299)
-      @logger.error("Kusto query failed with status #{response.code}: #{response.body}")
+      error_message = "Kusto query failed with status #{response.code}: #{response.body}"
+      @logger.error(error_message)
+      raise error_message if raise_on_error
+
       return []
     end
 
@@ -133,6 +137,8 @@ class KustoE2ETest < Test::Unit::TestCase
     rescue JSON::ParserError => e
       @logger.error("Failed to parse JSON: #{e}")
       @logger.error(response.body)
+      raise if raise_on_error
+
       []
     end
   end
@@ -228,6 +234,7 @@ class KustoE2ETest < Test::Unit::TestCase
       buffered #{config_options[:buffered]}
       delayed #{config_options[:delayed]}
       endpoint #{@engine_url}
+      azure_cloud #{@azure_cloud}
       database_name #{@database}
       table_name #{config_options[:table_name]}
       compression_enabled #{config_options[:compression_enabled]}
@@ -486,6 +493,16 @@ class KustoE2ETest < Test::Unit::TestCase
   end
 
   # Relaxed authentication resilience test
+  test 'Azure US Government workload identity smoke' do
+    government_clouds = %w[AzureUSGovernment AzureUSGovernmentCloud]
+    government_workload_identity = @auth_type == 'workload_identity' && government_clouds.include?(@azure_cloud)
+    omit('Requires Azure US Government workload identity credentials') unless government_workload_identity
+
+    rows = kusto_query("print smoke_test = 'ok'", raise_on_error: true)
+
+    assert_equal [['ok']], rows, 'Azure US Government workload identity could not query Kusto'
+  end
+
   test 'basic_authentication_resilience' do
     test_table = "FluentD_auth_basic_#{Time.now.to_i}"
     configure_and_start_driver(

data/test/plugin/test_out_kusto_config.rb

@@ -58,7 +58,8 @@ class KustoOutputConfigTest < Test::Unit::TestCase
     clouds = {
       'AzureCloud' => 'https://login.microsoftonline.com',
       'AzureChinaCloud' => 'https://login.chinacloudapi.cn',
-      'AzureUSGovernment' => 'https://login.microsoftonline.us'
+      'AzureUSGovernment' => 'https://login.microsoftonline.us',
+      'AzureUSGovernmentCloud' => 'https://login.microsoftonline.us'
     }
     base_conf_sym = @base_conf.transform_keys(&:to_sym)
     clouds.each do |cloud, aad_url|

data/test/plugin/test_out_kusto_workload_identity.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require_relative '../helper'
+require 'fluent/plugin/auth/wif_tokenprovider'
+require 'fluent/plugin/conffile'
+require 'mocha/test_unit'
+require 'tempfile'
+require 'uri'
+
+class WorkloadIdentityTokenProviderTest < Test::Unit::TestCase
+  OUTPUT_CONFIGURATION_CLASS = OutputConfiguration
+
+  def setup
+    @token_file = Tempfile.new('federated-token')
+    @token_file.write('federated-token-for-testing')
+    @token_file.flush
+  end
+
+  def teardown
+    @token_file.close!
+  end
+
+  test 'builds the workload identity token endpoint for each supported cloud' do
+    endpoints = {
+      'AzureCloud' => 'https://login.microsoftonline.com/test-tenant/oauth2/v2.0/token',
+      'AzureChinaCloud' => 'https://login.chinacloudapi.cn/test-tenant/oauth2/v2.0/token',
+      'AzureUSGovernment' => 'https://login.microsoftonline.us/test-tenant/oauth2/v2.0/token',
+      'AzureUSGovernmentCloud' => 'https://login.microsoftonline.us/test-tenant/oauth2/v2.0/token'
+    }
+
+    endpoints.each do |cloud, expected_endpoint|
+      provider = WorkloadIdentity.new(configuration_for(cloud))
+
+      assert_equal expected_endpoint, provider.instance_variable_get(:@token_request_uri)
+    end
+  end
+
+  test 'exchanges a workload identity assertion against Azure US Government' do
+    provider = WorkloadIdentity.new(configuration_for('AzureUSGovernment'))
+    response = Net::HTTPOK.new('1.1', '200', 'OK')
+    response.stubs(:body).returns({ access_token: 'government-access-token', expires_in: 3600 }.to_json)
+    http = mock('Azure US Government token endpoint')
+
+    provider.expects(:create_http_client).with do |uri|
+      assert_equal 'https://login.microsoftonline.us/test-tenant/oauth2/v2.0/token', uri.to_s
+      true
+    end.returns(http)
+    http.expects(:request).with do |request|
+      form_data = URI.decode_www_form(request.body).to_h
+      assert_equal 'client_credentials', form_data['grant_type']
+      assert_equal 'test-client', form_data['client_id']
+      assert_equal 'https://test.usgovvirginia.kusto.usgovcloudapi.net/.default', form_data['scope']
+      assert_equal 'federated-token-for-testing', form_data['client_assertion']
+      true
+    end.returns(response)
+
+    assert_equal 'government-access-token', provider.get_token
+  end
+
+  private
+
+  def configuration_for(cloud)
+    OUTPUT_CONFIGURATION_CLASS.new(
+      auth_type: 'workload_identity',
+      azure_cloud: cloud,
+      workload_identity_client_id: 'test-client',
+      workload_identity_tenant_id: 'test-tenant',
+      workload_identity_token_file_path: @token_file.path,
+      kusto_endpoint: 'https://test.usgovvirginia.kusto.usgovcloudapi.net',
+      database_name: 'test-database',
+      table_name: 'test-table'
+    )
+  end
+end

metadata

@@ -1,15 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-kusto
 version: !ruby/object:Gem::Version
-  version: 1.1.2
+  version: 1.1.3
 platform: ruby
 authors:
 - Komal Rani
 - Kusto OSS IDC Team
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-02-10 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -156,6 +155,7 @@ files:
 - test/plugin/test_out_kusto_resolve_table_name.rb
 - test/plugin/test_out_kusto_start.rb
 - test/plugin/test_out_kusto_try_write.rb
+- test/plugin/test_out_kusto_workload_identity.rb
 - test/plugin/test_out_kusto_write.rb
 homepage: https://github.com/Azure/azure-kusto-fluentd
 licenses:
@@ -163,7 +163,6 @@ licenses:
 metadata:
   fluentd_plugin: 'true'
   fluentd_group: output
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -178,8 +177,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.7.1
 specification_version: 4
 summary: A custom Fluentd output plugin for Azure Kusto ingestion.
 test_files:
@@ -192,4 +190,5 @@ test_files:
 - test/plugin/test_out_kusto_resolve_table_name.rb
 - test/plugin/test_out_kusto_start.rb
 - test/plugin/test_out_kusto_try_write.rb
+- test/plugin/test_out_kusto_workload_identity.rb
 - test/plugin/test_out_kusto_write.rb