kyverno: 3.3/v1.13 -> 3.9/v1.19 (stay-current) + CLI lockstep

- HR chart 3.3.x -> 3.9.x (Kyverno v1.13.6 -> v1.19.0).
- crds.install:false + CRDs pre-applied server-side (5.7 MB bundle exceeds kubectl's 256 KB
  annotation limit; Helm client-side apply would stall the platform Kustomization, kps-style).
- CLI lockstep (ci/conformance/devcontainer versions.env + run-l0.sh default) -> 1.19.0.
  Pre-verified: v1.19.0 kyverno CLI passes the L0 suite 17/17 with the existing test format.
- Policies are kyverno.io/v1 ClusterPolicy (stable API, unchanged in v1.19).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

ci/versions.env

@@ -9,7 +9,7 @@
 # whatever platform/kyverno and conformance/ pin — see integration notes in README.
 
 # L0 policy gate (Kyverno CLI) + ServiceDefinition validation (kyverno-json)
-KYVERNO_VERSION="1.13.4"
+KYVERNO_VERSION="1.19.0"
 KYVERNO_JSON_VERSION="0.0.3"
 
 # L1/L2/L3 declarative runner (Chainsaw) — invoked via conformance/ entrypoint,

conformance/versions.env

@@ -13,7 +13,7 @@ KUBECTL_VERSION="v1.36.4"
 
 # Kyverno CLI — L0 static/policy gate (owned by T-0.5, referenced here for a single
 # pinned toolchain view). Not invoked by run.sh yet.
-KYVERNO_VERSION="v1.13.2"
+KYVERNO_VERSION="v1.19.0"
 
 # Python 3 — coverage generator + JUnit emitter use stdlib only (no pip deps), so the
 # only constraint is a modern interpreter.

infra/devcontainer/versions.env

@@ -16,7 +16,7 @@ KUBECTL_VERSION=1.36.4
 HELM_VERSION=3.16.0
 
 # --- Conformance test toolchain (match ci/versions.env) ----------------------
-KYVERNO_VERSION=1.13.4
+KYVERNO_VERSION=1.19.0
 # ci/versions.env pins KYVERNO_JSON_VERSION=0.0.5, but NO such release exists:
 # kyverno/kyverno-json's highest tag is v0.0.3 (git ls-remote --tags), and the
 # platform's own platform/kyverno/scripts/run-l0.sh already defaults to v0.0.3.

platform/kyverno/admission/helmrelease.yaml

@@ -22,7 +22,7 @@ spec:
   chart:
     spec:
       chart: kyverno
-      version: "3.3.x"            # pin to the exact chart the operator vendors
+      version: "3.9.x"            # Kyverno v1.19.x (k8s-1.36-era stay-current, from 3.3/v1.13). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: kyverno
@@ -34,6 +34,15 @@ spec:
     remediation:
       retries: 3
   values:
+    # CRD management is OFF the Helm release (mirror velero): the Kyverno CRD bundle is ~5.7 MB, far
+    # past kubectl's 256 KB last-applied-configuration annotation limit, so Helm's client-side apply
+    # fails ("metadata.annotations: Too long") and STALLS the upgrade → the platform Kustomization
+    # would block (the kps-cascade failure mode). CRDs are instead pre-applied server-side on each
+    # chart bump: `helm template kyverno/kyverno --version <v> --include-crds | kubectl apply
+    # --server-side --force-conflicts -f -` (22 CRDs at v1.19). Trade-off: CRD schema upgrades become a
+    # manual/Renovate step, same as velero's upgradeCRDs:false.
+    crds:
+      install: false
     # The chart's cleanup Jobs default to bitnami/kubectl:1.30.2, which Bitnami PURGED from Docker Hub
     # (2024 catalog change) → the jobs ImagePullBackOff. policyReportsCleanup runs as a Helm
     # post-upgrade HOOK, so its failure STALLS every helm upgrade (5m timeout → HelmRelease not-Ready →

platform/kyverno/scripts/run-l0.sh

@@ -9,7 +9,7 @@
 set -euo pipefail
 
 # --- pinned tool versions (bump via the normal update path; suite re-green is the gate) ---
-KYVERNO_VERSION="${KYVERNO_VERSION:-v1.13.4}"
+KYVERNO_VERSION="${KYVERNO_VERSION:-v1.19.0}"
 KYVERNO_JSON_VERSION="${KYVERNO_JSON_VERSION:-v0.0.3}"
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"