# New resource — didn't exist in the original devops-lib. Homelab's real
# pipelines built on static agents (node('slave02')) with Docker already
# available; this homelab's Jenkins uses dynamic per-build Kubernetes
# agents (agent.enabled in the jenkins chart), which don't have a Docker
# daemon by default. This pod template adds one as a sidecar container —
# the "docker" container runs privileged dind, "docker-cli" is what the
# pipeline actually execs into via container('docker-cli'), talking to
# its sibling over localhost since containers in one pod share a network
# namespace.
apiVersion: v1
kind: Pod
spec:
  containers:
    - name: docker
      image: docker:27-dind
      securityContext:
        privileged: true
      env:
        - name: DOCKER_TLS_CERTDIR
          value: ""
      volumeMounts:
        - name: docker-graph-storage
          mountPath: /var/lib/docker
    - name: docker-cli
      image: docker:27-cli
      command: ["cat"]
      tty: true
      env:
        - name: DOCKER_HOST
          value: tcp://localhost:2375
        # docker-config below mounts the Harbor push-auth secret
        # read-only at /root/.docker (needed so `docker push` finds
        # config.json without an explicit `docker login` step) — but
        # modern `docker build` defaults to BuildKit/buildx, which wants
        # to create its own state dir at /root/.docker/buildx and fails
        # with "read-only file system" since the whole mount is
        # read-only. Forcing the classic builder avoids needing to write
        # there at all.
        - name: DOCKER_BUILDKIT
          value: "0"
        # For syncArgoApp.groovy — read directly from the ESO-managed
        # Secret, not a Jenkins-native credential (nothing in this
        # pipeline uses Jenkins' own credential store; staying consistent
        # rather than mixing the two approaches).
        - name: ARGOCD_TOKEN
          valueFrom:
            secretKeyRef:
              name: argocd-jenkins-ci-token
              key: token
              # Without this, every build using this pod template hard-fails
              # to even start until the token secret exists — including the
              # very first demo-go-app run, before the manual
              # `argocd account generate-token` bootstrap step has happened.
              optional: true
      volumeMounts:
        - name: docker-config
          mountPath: /root/.docker
          readOnly: true
  volumes:
    - name: docker-graph-storage
      emptyDir: {}
    - name: docker-config
      secret:
        secretName: harbor-robot-dockerconfig