Pin the kyverno pod-security policies to a commit and put it in the cached file name

[wallrj-cyberark]

make verify-pod-security-standards fails in every project that vendors the helm module. It has been failing on every fresh checkout since 04:24 UTC on 2026-09-29, whatever the PR changes:

Error: evalsymlink failure on '/tmp/kustomize-.../pod-security/enforce' : lstat /tmp/kustomize-.../pod-security: no such file or directory

The cause is kyverno/policies#1544, which deleted pod-security/ from the main branch of kyverno/policies. kyverno/policies#1543 tracks the move to the CEL policies in pod-security-vpol/, which replaced it. helm.mk built https://github.com/kyverno/policies/pod-security/enforce without a ref, so it always read main.

No open-source project has failed yet. None of the eight repositories that vendor the helm module has run a verify job since the deletion, so the first PR push to any of them will fail. Please merge this so verify goes green again. Downstream repositories will pick it up with their next make upgrade-klone.

What was wrong

The deletion exposed three problems, and this PR fixes all three.

1. The policies are gone from main. Every fresh checkout fails verify until the URL points somewhere that still has them.
2. Verify was not reproducible. The URL had no ref, so every CI run fetched whatever was on main at that moment. A change upstream could break or alter every downstream verify job without a diff in the consuming repository. That is exactly what happened.
3. The cached policy file was never rebuilt. _bin/scratch/kyverno/pod-security-policy.yaml had no prerequisites, so an existing checkout kept its first copy for ever. CI (fresh checkout) and developers (warm _bin) were checking against different policies, and no change to the URL could reach a developer's checkout without them deleting the file by hand. This is also why the deletion went unnoticed: a copy cached on 2026-09-23 kept passing for six days after main broke.

What this PR changes

• Fixes 1 and 2: pins the kustomize URL to commit ef9843f0, the tip of the release-1.19 branch, one of the last commits that still has pod-security/. The branch name is recorded in a comment but not used as the ref, because the branch can still receive pushes. The branch is not a compatibility boundary: pod-security/ is identical on every release branch from release-1.12 to release-1.19, and each policy declares kyverno 1.6.0 as its minimum. So this does not need bumping with the kyverno tool.
• Fixes 3: puts the commit in a kyverno_policies_version variable and in the name of the cached file, pod-security-policy-<commit>.yaml. This is what the module already does for the chart archive. Changing the version now builds a new file in every checkout, with no stamp rule and no dependency on another module.
• Cites [Tracking] Create missing policies.kyverno.io/v1 equivalents for legacy policy samples kyverno/policies#1543 and names pod-security-vpol/ as the successor in the comment, for whoever bumps this next.

CI evidence

cert-manager/approver-policy#1043 points klone at this branch. Its pull-cert-manager-approver-policy-verify job passed on a fresh checkout: build log. It fetched the policies with the new pin and applied 19 rules to the Deployment, all Pass. That PR is held and will be closed once this merges.

Follow-up

A better fix is to commit the built policy file to this module, as cert-manager/cert-manager already does in make/config/kyverno/policy.yaml. That removes the network fetch from make verify, lets Renovate manage policy updates as ordinary PRs, and lets us patch the policies. We should do that separately, once the CEL policies are in the kyverno version we pin.

How I tested it: the pinned commit builds the same 17 policies as main did before the deletion, and the cache follows the pin

I tested in a scratch project built with bootstrap.sh plus the tools and helm modules from this branch and a minimal chart with one Deployment.

Ref	kustomize build result
Unpinned (main)	Fails with the evalsymlink error above
ef9843f08d25b3555fe69616f8612c9f915af5d4 (tip of release-1.19)	17 ClusterPolicy objects
d12f1b56ff051b2b5e59ffd7d3d563f8add30547 (last commit on main before the deletion)	17 ClusterPolicy objects
release-1.19	17 ClusterPolicy objects

All three built files have the same SHA-256, and match a copy cached on 2026-09-23 from the unpinned URL. So this changes nothing about which policies charts are checked against. Note that kustomize does not accept a short SHA as a ref.

The versioned file name behaves as intended:

• A second make with the same version leaves the file untouched.
• make kyverno_policies_version=d12f1b56... verify-pod-security-standards builds a second file, pod-security-policy-d12f1b56....yaml, beside the first.
• make verify-pod-security-standards then passes: 19 rules applied to the Deployment, all Pass.

[Claude Fable 5.1]

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[inteon]

/approve
/lgtm

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [inteon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment