Move the ARC retirement guard to ValidatingPolicy before Kyverno 1.20 #6026

🤖 Generated by the Agentic Engineer

Evidence

restrict-arc-retirement is one of the two policies from #4995 still deployed as a Kyverno ClusterPolicy (read from production on 10 November 2026). Kyverno 1.20 is planned to remove ClusterPolicy (#4984), so this guard must exist as a ValidatingPolicy before that upgrade, or the ARC retirement fence silently disappears.

The policy has eight rules. They stop a retired ARC runner pool, scale set, listener, listener pod, credential-sync object and credential from being recreated, and protect the retirement journal on the arc-runners Namespace. Six of the rules read that Namespace through a Kyverno API call and compare long JMESPath expressions against the journal. CLI fixtures already exist under tests/restrict-arc-retirement-*.

No retirement is in progress today: the arc-runners Namespace carries no retirement journal, so most rules are inactive in production. That lowers the risk of a gap during the move, but the guard still has to work when a retirement starts.

Problem

The earlier #4995 batches were single-rule policies. This one combines API-call contexts, CREATE/UPDATE/DELETE handling and user-group checks, so it needs its own plan and tests rather than riding along with a batch.

Acceptance criteria

• Confirm, at the running Kyverno version, that a ValidatingPolicy can express each rule, including the Namespace lookup (for example with a CEL resource lookup), the DELETE rule on the Namespace and the system:masters check. A rule it cannot express is recorded on Migrate Kyverno ClusterPolicy and Policy before Kyverno 1.20 removes them #4984 and blocks only that rule.
• The existing tests/restrict-arc-retirement-* fixtures pass unchanged in their expected results against the new kind, with at least one negative control per rule.
• The failure action stays Enforce, with the same match scope and failurePolicy: Fail, as recorded in tests/policy-failure-actions.json.
• The replacement is added and the ClusterPolicy is deleted in the same change. After deploy, the new policy reports ready and no ClusterPolicy of this name remains.

Size

Medium. Part of #4995.