diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
index a89f20f23bd..56ca2c0522f 100755
--- a/hack/lib/golang.sh
+++ b/hack/lib/golang.sh
@@ -631,6 +631,7 @@ kube::golang::place_bins() {
     if [[ "${platform}" == "${host_platform}" ]]; then
       platform_src=""
       rm -f "${THIS_PLATFORM_BIN}"
+      mkdir -p "$(dirname "${THIS_PLATFORM_BIN}")"
       ln -s "${KUBE_OUTPUT_BIN}/${platform}" "${THIS_PLATFORM_BIN}"
     fi
 
diff --git a/hack/pin-dependency.sh b/hack/pin-dependency.sh
index 35d37439794..65440a9bb11 100755
--- a/hack/pin-dependency.sh
+++ b/hack/pin-dependency.sh
@@ -69,15 +69,6 @@ if [[ -z "${dep}" || -z "${replacement}" || -z "${sha}" ]]; then
   exit 1
 fi
 
-_tmp="${KUBE_ROOT}/_tmp"
-cleanup() {
-  rm -rf "${_tmp}"
-}
-trap "cleanup" EXIT SIGINT
-cleanup
-mkdir -p "${_tmp}"
-
-
 # Find the resolved version before trying to use it.
 echo "Running: go mod download ${replacement}@${sha}"
 if meta=$(go mod download -json "${replacement}@${sha}"); then
diff --git a/hack/verify-openapi-docs-urls.sh b/hack/verify-openapi-docs-urls.sh
index f5265bdd4f5..64c84787e69 100755
--- a/hack/verify-openapi-docs-urls.sh
+++ b/hack/verify-openapi-docs-urls.sh
@@ -28,12 +28,12 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 SPECROOT="${KUBE_ROOT}/api/openapi-spec"
 SPECV3PATH="${SPECROOT}/v3"
 
-_tmp="${KUBE_ROOT}/_tmp"
-mkdir -p "${_tmp}"
-trap 'rm -rf ${_tmp}' EXIT SIGINT
+_tmpdir="$(kube::realpath "$(mktemp -d -t "$(basename "$0").XXXXXX")")"
+mkdir -p "${_tmpdir}"
+trap 'rm -rf ${_tmpdir}' EXIT SIGINT
 trap "echo Aborted; exit;" SIGINT SIGTERM
 
-TMP_URLS="${_tmp}/docs_urls.txt"
+TMP_URLS="${_tmpdir}/docs_urls.txt"
 touch "${TMP_URLS}"
 
 
diff --git a/hack/verify-openapi-spec.sh b/hack/verify-openapi-spec.sh
index e37fa00866c..a8eaf4ef3f2 100755
--- a/hack/verify-openapi-spec.sh
+++ b/hack/verify-openapi-spec.sh
@@ -24,52 +24,7 @@ set -o nounset
 set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
-source "${KUBE_ROOT}/hack/lib/init.sh"
 
-kube::golang::setup_env
-kube::etcd::install
+source "${KUBE_ROOT}/hack/lib/verify-generated.sh"
 
-# We use `make` here intead of `go install` to ensure that all of the
-# linker-defined values are set.
-make -C "${KUBE_ROOT}" WHAT=./cmd/kube-apiserver
-
-SPECROOT="${KUBE_ROOT}/api/openapi-spec"
-SPECV3PATH="${SPECROOT}/v3"
-DISCOVERYROOT="${KUBE_ROOT}/api/discovery"
-TMP_SPECROOT="${KUBE_ROOT}/_tmp/openapi-spec"
-TMP_DISCOVERYROOT="${KUBE_ROOT}/_tmp/discovery"
-_tmp="${KUBE_ROOT}/_tmp"
-
-mkdir -p "${_tmp}"
-cp -a "${SPECROOT}" "${TMP_SPECROOT}"
-cp -a "${DISCOVERYROOT}" "${TMP_DISCOVERYROOT}"
-trap 'cp -a ${TMP_SPECROOT} ${SPECROOT}/..; cp -a ${TMP_DISCOVERYROOT} ${DISCOVERYROOT}/..; rm -rf ${_tmp}' EXIT SIGINT
-rm -r "${SPECROOT:?}"/*
-rm -r "${DISCOVERYROOT:?}"/*
-mkdir -p "${SPECV3PATH}"
-cp "${TMP_SPECROOT}/README.md" "${SPECROOT}/README.md"
-
-"${KUBE_ROOT}/hack/update-openapi-spec.sh"
-echo "diffing ${SPECROOT} against freshly generated openapi spec"
-ret=0
-diff -Naupr -I 'Auto generated by' "${SPECROOT}" "${TMP_SPECROOT}" || ret=$?
-if [[ $ret -eq 0 ]]
-then
-  echo "${SPECROOT} up to date."
-else
-  echo "${SPECROOT} is out of date. Please run hack/update-openapi-spec.sh" >&2
-  exit 1
-fi
-
-echo "diffing ${DISCOVERYROOT} against freshly generated discovery"
-ret=0
-diff -Naupr "${DISCOVERYROOT}" "${TMP_DISCOVERYROOT}" || ret=$?
-if [[ $ret -eq 0 ]]
-then
-  echo "${DISCOVERYROOT} up to date."
-else
-  echo "${DISCOVERYROOT} is out of date. Please run hack/update-openapi-spec.sh" >&2
-  exit 1
-fi
-
-# ex: ts=2 sw=2 et filetype=sh
+kube::verify::generated "Generated files need to be updated" "Please run 'hack/update-openapi-spec.sh'" hack/update-openapi-spec.sh "$@"
diff --git a/hack/verify-vendor-licenses.sh b/hack/verify-vendor-licenses.sh
index 3cbe9c8cd14..d497c44f0db 100755
--- a/hack/verify-vendor-licenses.sh
+++ b/hack/verify-vendor-licenses.sh
@@ -24,34 +24,7 @@ set -o nounset
 set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
-source "${KUBE_ROOT}/hack/lib/init.sh"
 
-# create a nice clean place to put our new licenses
-mkdir -p "${KUBE_ROOT}/_tmp"
-_tmpdir="$(mktemp -d "${KUBE_ROOT}/_tmp/kube-licenses.XXXXXX")"
-#echo "Created workspace: ${_tmpdir}"
-function cleanup {
-  #echo "Removing workspace: ${_tmpdir}"
-  rm -rf "${_tmpdir}"
-}
-kube::util::trap_add cleanup EXIT
+source "${KUBE_ROOT}/hack/lib/verify-generated.sh"
 
-# symlink all vendor subfolders in temp vendor
-mkdir -p "${_tmpdir}/vendor"
-for child in "${KUBE_ROOT}/vendor"/*
-do
-  ln -s "${child}" "${_tmpdir}/vendor"
-done
-
-ln -s "${KUBE_ROOT}/LICENSE" "${_tmpdir}"
-ln -s "${KUBE_ROOT}/staging" "${_tmpdir}"
-
-# Update licenses
-LICENSE_ROOT="${_tmpdir}" "${KUBE_ROOT}/hack/update-vendor-licenses.sh"
-
-# Compare licenses
-if ! _out="$(diff -Naupr -x OWNERS "${KUBE_ROOT}/LICENSES" "${_tmpdir}/LICENSES")"; then
-  echo "Your LICENSES tree is out of date. Run hack/update-vendor-licenses.sh and commit the results." >&2
-  echo "${_out}" >&2
-  exit 1
-fi
+kube::verify::generated "Generated files need to be updated" "Please run 'hack/update-vendor-licenses.sh'" hack/update-vendor-licenses.sh "$@"
diff --git a/hack/verify-vendor.sh b/hack/verify-vendor.sh
index 91caaef4195..0fea7224a7f 100755
--- a/hack/verify-vendor.sh
+++ b/hack/verify-vendor.sh
@@ -28,8 +28,7 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 kube::golang::setup_env
 
 # create a nice clean place to put our new vendor tree
-mkdir -p "${KUBE_ROOT}/_tmp"
-_tmpdir="$(mktemp -d "${KUBE_ROOT}/_tmp/kube-vendor.XXXXXX")"
+_tmpdir="$(kube::realpath "$(mktemp -d -t "$(basename "$0").XXXXXX")")"
 
 if [[ -z ${KEEP_TMP:-} ]]; then
     KEEP_TMP=false
diff --git a/test/images/image-util.sh b/test/images/image-util.sh
index 12c2d3e5933..baeddbf6324 100755
--- a/test/images/image-util.sh
+++ b/test/images/image-util.sh
@@ -127,8 +127,7 @@ build() {
 
     # Create a temporary directory for every architecture and copy the image content
     # and build the image from temporary directory
-    mkdir -p "${KUBE_ROOT}"/_tmp
-    temp_dir=$(mktemp -d "${KUBE_ROOT}"/_tmp/test-images-build.XXXXXX)
+    temp_dir="$(kube::realpath "$(mktemp -d -t "$(basename "$0").XXXXXX")")"
     kube::util::trap_add "rm -rf ${temp_dir}" EXIT
 
     cp -r "${img_folder}"/* "${temp_dir}"