kythe/release/kubernetes/buildkite/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: buildkite-agent
  labels:
    app: buildkite-agent
spec:
  replicas: 1
  selector:
    matchLabels:
      app: buildkite-agent
  template:
    metadata:
      labels:
        app: buildkite-agent
    spec:
      containers:
        - name: buildkite-agent
          image: gcr.io/kythe-repo/buildkite-agent
          imagePullPolicy: Always
          securityContext:
            privileged: true
          env:
            - name: BUILDKITE_AGENT_TOKEN
              valueFrom: {secretKeyRef: {name: buildkite-agent, key: token}}
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /var/secrets/google/kythe-repo-e018b733306f.json
          volumeMounts:
            - name: google-cloud-key
              mountPath: /var/secrets/google
            - name: docker-binary
              mountPath: /usr/bin/docker
            - name: docker-socket
              mountPath: /var/run/docker.sock
      volumes:
        - name: google-cloud-key
          secret:
            secretName: buildkite-agent-rbe-key
        - name: docker-binary
          hostPath: {path: /usr/bin/docker}
        - name: docker-socket
          hostPath: {path: /var/run/docker.sock}