metadata:
  annotations:
    io.kubernetes.cri-o.TrySkipVolumeSELinuxLabel: 'true'
spec:
  affinity:
    nodeAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        preference:
          matchExpressions:
          - key: node-role.kubernetes.io/jenkins
            operator: Exists
  containers:
  - name: build
    image: git.pyrocufflink.net/containerimages/buildroot
    resources:
      limits: &resources
        cpu: 6
        memory: 12Gi
      requests: *resources
    volumeMounts:
    - mountPath: /etc/ssh/ssh_known_hosts
      name: ssh-known-hosts
      subPath: ssh_known_hosts
  nodeSelector:
    kubernetes.io/arch: amd64
  securityContext:
    fsGroupChangePolicy: OnRootMismatch
    seLinuxOptions:
      level: s0:c596,c675
  tolerations:
  - key: du5t1n.me/jenkins
  volumes:
  - name: ssh-known-hosts
    configMap:
      name: ssh-known-hosts