oauth2: add support client secret file in basic/post authentication methods

[fernandoalexandre]

Summary

• Add new oauth2.client_secret_file option to HTTP output (available for basic/post authentication methods)
• Secret is automatically updated if the content changes when requesting a new oauth2 token.
• Added oauth2.client_secret_file option to OpenTelemetry output as a quick-win.

Motivation

In Kubernetes, mounting secrets as files is considered best practice, widely used for projected tokens and external secret services such as CSI drivers and External Secrets Operator.

Additionally other systems offer similar functionality, for example OpenTelemetry OAuth2 client auth extension.

Validation

• cmake --build build -j8 --target flb-it-oauth2 && ./build/bin/flb-it-oauth2 - 16 passed
• Tested in a local kubernetes cluster with full authentication integration leveraging a token fetching using a mounted service account token as a client_secret_file, and calling a Gloo service that validated the resulting token as well.

Example Configuration

[OUTPUT]
        Name                            http
        Alias                           http.authenticated
        Match                           kube.*
        Host                            gateway-proxy.default.svc.cluster.local
        port                            8080
        tls                             off
        tls.verify                      off
        uri                             /v1/metrics
        oauth2.enable                   true
        oauth2.auth_method              post
        oauth2.token_url                http://token-service.auth-token-system.svc.cluster.local/oauth2/default/v1/token
        oauth2.client_id                a_client
        oauth2.client_secret_file       /var/run/secrets/auth/fluent-auth 
        storage.total_limit_size        1G
        format                          json_stream

Note

The size limitation for the secret in oauth2.auth_method=basic has not been modified, so when using large secrets the post method must be used.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• N/A Run local packaging test showing all targets (including any new ones) build.
• N/A Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature
• oauth2: adding new client_secret_file parameter to http and opentelemetry fluent-bit-docs#2629

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

Summary of changes

• New Features
  • Added oauth2.client_secret_file to load OAuth2 client secrets from a file (including OAuth2-enabled outputs).
• Bug Fixes
  • Updated OAuth2 credential validation to accept either client_secret or client_secret_file.
  • Improved handling when the secret file is missing, empty, or unreadable.
  • Client secret is reloaded during token refresh so file updates are picked up.
• Tests
  • Added test coverage for file-based auth, precedence, refresh reload behavior, and error cases.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f7ba9438-abe6-40c0-8043-c0fb8fd8fd2d

📥 Commits

Reviewing files that changed from the base of the PR and between 2b91743 and 2e9711c.

📒 Files selected for processing (6)

• include/fluent-bit/flb_oauth2.h
• plugins/out_http/http.c
• plugins/out_http/http_conf.c
• plugins/out_opentelemetry/opentelemetry_conf.c
• src/flb_oauth2.c
• tests/internal/oauth2.c

🚧 Files skipped from review as they are similar to previous changes (4)

• plugins/out_http/http_conf.c
• plugins/out_http/http.c
• src/flb_oauth2.c
• tests/internal/oauth2.c

---

📝 Walkthrough

Walkthrough

Adds oauth2.client_secret_file support across OAuth2 configuration, HTTP and OpenTelemetry validation, runtime loading and refresh, with tests covering precedence, updates, and invalid files.

Changes

OAuth2 secret file support

Layer / File(s)	Summary
Secret file configuration and validation include/fluent-bit/flb_oauth2.h, src/flb_oauth2.c, plugins/out_http/..., plugins/out_opentelemetry/opentelemetry_conf.c	Adds the file-path configuration field, manages its lifecycle, wires the HTTP option, and accepts either an inline or file-based secret.
Secret loading and refresh src/flb_oauth2.c	Loads file contents during context creation, gives the file precedence over inline secrets, trims trailing line endings, and reloads the secret before token refresh.
Secret file behavior tests tests/internal/oauth2.c	Tests file-based requests, refresh updates, file-only configuration, precedence, invalid files, temporary paths, and test registration.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• fluent/fluent-bit#11286: Introduces the core OAuth2 client implementation extended by this change.
• fluent/fluent-bit#11485: Modifies related OAuth2 client-credential validation paths.
• fluent/fluent-bit#11575: Overlaps the OpenTelemetry OAuth2 credential validation path.

Suggested labels: docs-required

Suggested reviewers: edsiper, cosmo0920

Sequence Diagram(s)

sequenceDiagram
  participant OAuth2Context
  participant ClientSecretFile
  participant TokenEndpoint
  OAuth2Context->>ClientSecretFile: Load secret during context creation
  ClientSecretFile-->>OAuth2Context: Return trimmed secret
  OAuth2Context->>ClientSecretFile: Reload secret before token refresh
  ClientSecretFile-->>OAuth2Context: Return current secret
  OAuth2Context->>TokenEndpoint: Send token request with client secret

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 9.09% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding client secret file support for OAuth2 basic and post authentication.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a0a93197cf

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".