RedHat OpenShift | PS

kubectl create secret generic bt-oauth \
  --from-literal=client-id=YOUR_CLIENT_ID \
  --from-literal=client-secret=YOUR_CLIENT_SECRET

package main

import (
    "context"
    "encoding/json"
    "fmt"
    "log"
    "os"
    "time"

    logging "github.com/BeyondTrust/go-client-library-passwordsafe/api/logging"
    "github.com/BeyondTrust/go-client-library-passwordsafe/api/session"
    "github.com/BeyondTrust/go-client-library-passwordsafe/api/utils"
    backoff "github.com/cenkalti/backoff/v4"
    "go.uber.org/zap"
)

const tokenPath = "/run/beyondtrust/access-token"

// tokenFile mirrors the JSON written by the authenticator sidecar.
type tokenFile struct {
    AccessToken string    `json:"access_token"`
    ExpiresAt   time.Time `json:"expires_at"`
}

// waitForToken blocks until the token file exists or the deadline is exceeded.
// When using an init container the file is guaranteed present before this
// container starts; the wait covers the pure-sidecar case where both
// containers start concurrently.
func waitForToken(deadline time.Duration) (*tokenFile, error) {
    start := time.Now()
    for {
        data, err := os.ReadFile(tokenPath)
        if err == nil {
            var tf tokenFile
            if err := json.Unmarshal(data, &tf); err != nil {
                return nil, fmt.Errorf("parsing token file: %w", err)
            }
            if time.Now().After(tf.ExpiresAt) {
                return nil, fmt.Errorf("token already expired at %v", tf.ExpiresAt)
            }
            return &tf, nil
        }
        if time.Since(start) > deadline {
            return nil, fmt.Errorf("token file not available after %v", deadline)
        }
        time.Sleep(500 * time.Millisecond)
    }
}

func main() {
    // Wait up to 30 s for the sidecar to write a valid token.
    tf, err := waitForToken(30 * time.Second)
    if err != nil {
        log.Fatalf("startup: %v", err)
    }

    apiURL := os.Getenv("BT_API_URL") // only env var the app needs

    zapLogger, _ := zap.NewProduction()
    logger := logging.NewZapLogger(zapLogger)

    backoffDef := backoff.NewExponentialBackOff()
    backoffDef.InitialInterval = 1 * time.Second
    backoffDef.MaxElapsedTime = 2 * time.Minute

    httpClient, err := utils.GetHttpClient(30, true, "", "", logger)
    if err != nil {
        log.Fatalf("http client: %v", err)
    }

    // ClientID and ClientSecret are intentionally omitted — the sidecar
    // owns those credentials. NewSessionFromToken signs in using the token
    // it has already obtained on our behalf.
    sess, err := session.NewSessionFromToken(context.Background(), tf.AccessToken, session.Parameters{
        EndpointURL:                apiURL,
        HTTPClient:                 *httpClient,
        BackoffDefinition:          backoffDef,
        Logger:                     logger,
        APIVersion:                 "3.1",
        RetryMaxElapsedTimeSeconds: 30,
    })
    if err != nil {
        log.Fatalf("session: %v", err)
    }
    defer func() {
        if err := sess.Close(); err != nil {
            log.Printf("session close: %v", err)
        }
    }()

    // ── Retrieve Secrets Safe secrets ─────────────────────────────────────
    // Paths follow the "folder/title" convention used in the Password Safe UI.
    retrieved, err := sess.GetSecrets([]string{
        "infrastructure/db-password",
        "infrastructure/api-key",
    }, "/")
    if err != nil {
        log.Fatalf("GetSecrets: %v", err)
    }

    // ── Retrieve a managed-account password ──────────────────────────────
    // Paths follow the "managed-system/account-name" convention.
    dbAccount, err := sess.GetManagedAccount("prod-db-server/app-service-account", "/")
    if err != nil {
        log.Fatalf("GetManagedAccount: %v", err)
    }

    // Use the secrets — never log them in production.
    fmt.Println("Secrets retrieved successfully")
    _ = retrieved["infrastructure/db-password"]
    _ = retrieved["infrastructure/api-key"]
    _ = dbAccount
}

        # Application container — holds no BeyondTrust credentials
        - name: myapp
          image: myorg/myapp:latest
          env:
            - name: BT_API_URL
              value: "https://passwordsafe.example.com/api/v3"
          volumeMounts:
            - name: bt-token
              mountPath: /run/beyondtrust
              readOnly: true

sudo rm -rf /tmp/bt-token
mkdir -p /tmp/bt-token
chmod o+w /tmp/bt-token

securityContext:
  fsGroup: 1000
volumes:
- name: token-vol
  emptyDir:
    medium: Memory

kubectl describe pod <pod-name> | grep -A6 Readiness
kubectl logs <pod-name> -c beyondtrust-authenticator

BT_HEALTH_PORT=9090   # use a different port
BT_HEALTH_PORT=0      # disable health server