out_http: Added support for http_bearer_token_file option

[fernandoalexandre]

Summary

• Added support for http_bearer_token_file option that allows a bearer token to be used in an Authorization header (Authorization: Bearer <token>)
• Token is read on every request to ensure non-stale content.

Motivation

In Kubernetes, mounting secrets as files is considered best practice, with widely used for projected tokens and external secret services such as CSI drivers and External Secrets Operator.

Additionally other systems offer similar functionality, for example OpenTelemetry Bearer token extension.

Validation

• cmake --build build -j8 && cd tests/integration/ && ./run_tests.py -k bearer_token_token - 4 passed
• cmake --build build -j8 && cd tests/integration/ && ./run_tests.py -k out_http - 24 passed
• Tested in a local kubernetes cluster with full authentication integration leveraging a token fetching using a mounted service account token, and calling a Gloo service that validated the resulting token as well.

Example Configuration

[OUTPUT]
        Name                            http
        Alias                           http.authenticated
        Match                           kube.*
        Host                            gateway-proxy.default.svc.cluster.local
        port                            8080
        tls                             off
        tls.verify                      off
        uri                             /v1/metrics
        http_bearer_token_file          /var/run/secret/bearer/token
        storage.total_limit_size        1G
        format                          json_stream

Infrastructure deployment

extraVolumeMounts:
  - mountPath: /var/run/secret/bearer
    name: token
    readOnly: true

extraVolumes:
  - name: token
    secret:
      secretName: bearer-token

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• N/A Run local packaging test showing all targets (including any new ones) build.
• N/A Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature
• out_http: Adding new http_bearer_token_file option to http fluent-bit-docs#2633

Backporting

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• New Features
  • Added HTTP Bearer token authentication using a configured token file.
  • The token file is re-read for every request, allowing token rotation without restarting.
• Bug Fixes
  • Missing or empty token files now trigger retries without sending requests.
  • Prevented conflicting Bearer token, Basic authentication, and OAuth2 configurations.
• Tests
  • Added coverage for authorization headers, token rotation, retry behavior, and invalid authentication configurations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7432a1c2-5810-415a-8786-2b4351df018a

📥 Commits

Reviewing files that changed from the base of the PR and between 2a867f4 and 0da097a.

📒 Files selected for processing (2)

• tests/integration/scenarios/out_http/tests/test_out_http_001.py
• tests/runtime/out_http.c

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds file-backed Bearer authentication to out_http. The plugin rereads and trims the token for each request, retries read failures, rejects conflicting authentication settings, and adds integration and runtime coverage.

Changes

Out_http bearer authentication

Layer / File(s)	Summary
Authentication contract and validation plugins/out_http/http.h, plugins/out_http/http.c, plugins/out_http/http_conf.c	Adds the bearer token file setting and rejects combinations with Basic authentication or OAuth2.
Per-request token loading plugins/out_http/http.c	Reads and trims the token for every request, sets the Bearer authorization header, and retries with cleanup when loading fails.
Authentication behavior coverage tests/integration/scenarios/out_http/..., tests/runtime/out_http.c	Tests header generation, token rotation, missing or empty files, and invalid authentication combinations.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 0da09

This change adds optional bearer-token file authentication for HTTP output; no actionable merge-blocking risk remains based on the supplied evidence.

Sequence Diagram(s)

sequenceDiagram
  participant http_request
  participant http_bearer_token_file_auth
  participant TokenFile
  participant HTTPClient
  http_request->>http_bearer_token_file_auth: load bearer token
  http_bearer_token_file_auth->>TokenFile: read and trim token
  http_bearer_token_file_auth->>HTTPClient: set Authorization header
  http_request->>HTTPClient: send request

Loading

Suggested reviewers: cosmo0920

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding the http_bearer_token_file option to the out_http plugin.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/integration/scenarios/out_http/tests/test_out_http_001.py`:
- Around line 249-253: Wrap the service lifecycle in the test around
service.start(), configure_http_response(), and wait_for_requests() with a
try/finally block, and move service.stop() into finally so it always executes on
assertion or timeout failures. Match the cleanup structure used by the rotation
and failure-path tests.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 74f2aeae-ddb2-4718-91ed-a780af8155c0

📥 Commits

Reviewing files that changed from the base of the PR and between cb7256c and 4d843d8.

📒 Files selected for processing (6)

• plugins/out_http/http.c
• plugins/out_http/http.h
• plugins/out_http/http_conf.c
• tests/integration/scenarios/out_http/config/out_http_bearer_token_file.yaml
• tests/integration/scenarios/out_http/tests/test_out_http_001.py
• tests/runtime/out_http.c

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4d843d89f8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".