apiVersion: batch/v1
kind: Job
metadata:
  name: buildkite-agent
spec:
  template:
    metadata:
      labels:
        application: buildkite-agent
      annotations:
        iam.amazonaws.com/role: a-role-with-ecr-privileges-goes-here
    spec:
      restartPolicy: OnFailure
      terminationGracePeriodSeconds: 1800
      containers:
      - name: sockguard
        image: webflow/sockguard:1.0
        args: ["-upstream-socket", "/docker/docker.sock", "-filename", "/sockguard-socket/sockguard.sock", "-allow-host-mode-networking", "true", "--allow-bind", "/scratch"]
        imagePullPolicy: Always
        securityContext:
          privileged: true
        volumeMounts:
        - mountPath: /docker/docker.sock
          name: docker-sock
        - mountPath: /sockguard-socket
          name: sockguard-sock
      - name: buildkite-agent
        image: webflow/buildkite-agent-kube:3.2.1
        args: ["start", "--disconnect-after-job", "--disconnect-after-job-timeout", "300"]
        imagePullPolicy: Always
        securityContext:
          privileged: true
        env:
          - name: TERM
            value: dumb
          - name: BUILDKITE_AGENT_TOKEN
            value: your-token-goes-here
          - name: BUILDKITE_BUILD_PATH
            value: /scratch
          - name: BUILDKITE_AGENT_TAGS
            value: "queue=autoscaling-build-cluster"
          - name: BUILDKITE_AGENT_DEBUG
            value: "true"
          - name: BUILDKITE_GIT_CLEAN_FLAGS
            value: "-fdqx"
          - name: BUILDKITE_PLUGIN_S3_SECRETS_BUCKET
            value: "your-secrets-bucket"
          - name: AWS_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
                name: aws-secrets
                key: AWS_ACCESS_KEY_ID
          - name: AWS_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: aws-secrets
                key: AWS_SECRET_ACCESS_KEY
        volumeMounts:
          - mountPath: /scratch
            name: scratch
          - mountPath: /sockguard-socket
            name: sockguard-sock
          - mountPath: /docker/docker.sock
            name: docker-sock
        resources:
          requests:
            cpu: "500m"
            memory: "8000M"
          limits:
            cpu: "4000m"
            memory: "28000M"
      volumes:
        - name: scratch
          emptyDir: {}
        - name: sockguard-sock
          emptyDir: {}
        - name: docker-sock
          hostPath:
            path: /var/run/docker.sock
            type: Socket
