Job acquisition tokens for ephemeral agents

Stack-managed ephemeral agents can now start with a credential for one job. The controller keeps its cluster agent token and issues a short-lived job acquisition token (JAT) after reserving work. The workload uses that JAT to register an agent and acquire only the named job.

A JAT expires fifteen minutes after issuance by default. The Stacks API accepts a lifetime of up to one hour, but the token expires sooner if the job reservation does. When the agent registers, Buildkite also checks that the issuing agent token is still active and applies its expiration and IP restrictions.

Agent Stack for Kubernetes

The Agent Stack for Kubernetes uses JATs by default. The controller requests one immediately before scheduling each reserved job Pod and supplies it only to the agent container. If issuance fails, the job remains unscheduled rather than receiving the cluster agent token.

Custom stacks

Custom stack implementations can use the same flow: reserve a job, wait for execution capacity, then issue a JAT through the Stacks API. Start the workload with the JAT as BUILDKITE_AGENT_TOKEN and the reserved job UUID as BUILDKITE_AGENT_ACQUIRE_JOB.

See the job acquisition token guide for the complete flow, retry guidance, and credential-handling recommendations.