ci: Run in Kubernetes instead of Docker

We'll use the `podTemplate` block to define an ephemeral agent running in
a Kubernetes pod as the node for this pipeline.  This takes the place of
the Docker container we used previously.

vars/applyConfigPolicy.groovy

@@ -1,11 +1,7 @@
+// vim: set sw=4 ts=4 sts=4 et :
 import groovy.transform.Field
 import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
 
-@Field
-def DOCKER_ARGS = '''\
--v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
-'''
-
 def call(rw_limit, stages) {
     properties([
         pipelineTriggers([cron('H H * * *')])
@@ -13,19 +9,28 @@ def call(rw_limit, stages) {
 
     timeout(time: 1, unit: 'HOURS') {
         lock('cfgpol') {
-            node {
+            podTemplate(containers: [
-                checkout scm
+                containerTemplate(
-                docker.build("configpolicy", 'ci').inside(DOCKER_ARGS) {
+                    name: 'ansible',
+                    image: 'git.pyrocufflink.net/containerimages/ansible',
+                    command: 'sleep',
+                    args: 'infinity',
+                )
+            ]) {
+                node(POD_LABEL) {
+                    checkout scm
                     withEnv(["KRB5CCNAME=${WORKSPACE}/.krb5cc"]) {
-                        try {
+                        container('ansible') {
-                            stageKinit()
+                            try {
-                            stageRemountRW(rw_limit)
+                                stageKinit()
-                            generateStages(stages)
+                                stageRemountRW(rw_limit)
-                            stageRemountRO(rw_limit)
+                                generateStages(stages)
-                        } catch (err) {
+                                stageRemountRO(rw_limit)
-                            postFailure(err)
+                            } catch (err) {
-                        } finally {
+                                postFailure(err)
-                            postCleanup()
+                            } finally {
+                                postCleanup()
+                            }
                         }
                     }
                 }