ci: Run in Kubernetes instead of Docker

We'll use the `podTemplate` block to define an ephemeral agent running in
a Kubernetes pod as the node for this pipeline.  This takes the place of
the Docker container we used previously.

vars/applyConfigPolicy.groovy

@@ -1,11 +1,7 @@
+// vim: set sw=4 ts=4 sts=4 et :
 import groovy.transform.Field
 import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
 
-@Field
-def DOCKER_ARGS = '''\
--v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
-'''
-
 def call(rw_limit, stages) {
     properties([
         pipelineTriggers([cron('H H * * *')])
@@ -13,10 +9,18 @@ def call(rw_limit, stages) {
 
     timeout(time: 1, unit: 'HOURS') {
         lock('cfgpol') {
-            node {
+            podTemplate(containers: [
+                containerTemplate(
+                    name: 'ansible',
+                    image: 'git.pyrocufflink.net/containerimages/ansible',
+                    command: 'sleep',
+                    args: 'infinity',
+                )
+            ]) {
+                node(POD_LABEL) {
                     checkout scm
-                docker.build("configpolicy", 'ci').inside(DOCKER_ARGS) {
                     withEnv(["KRB5CCNAME=${WORKSPACE}/.krb5cc"]) {
+                        container('ansible') {
                             try {
                                 stageKinit()
                                 stageRemountRW(rw_limit)
@@ -32,6 +36,7 @@ def call(rw_limit, stages) {
                 }
             }
         }
+    }
 }
 
 def stageKinit() {