Kyverno Certified Associate
Kyverno Certified Associate (KCA)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Kyverno Certified Associate (KCA) is an entry-level, online, proctored, multiple-choice certification offered through Linux Foundation Education. It validates practical knowledge of Kyverno, the open-source policy engine for Kubernetes, covering how policies are written, applied, and managed to enforce security and compliance across clusters. The exam is aimed at platform engineers, DevSecOps practitioners, SREs, cloud security engineers, and Kubernetes architects who want a vendor-neutral credential proving they can define and implement policy as code. Linux Foundation Education lists the experience level as Beginner and states there are no prerequisites, though a working foundation in IT infrastructure, cloud computing, DevOps, and security helps; the page points to LFCS, CKA, CKAD, and CKS as complementary certifications. The published domains weight policy authoring most heavily, followed by Kyverno fundamentals and installation, configuration, and upgrades, with smaller shares for the CLI, applying policies, and policy management. Within those domains the blueprint names topics such as validation, mutation, generation, and verifyImages rules, preconditions, background scans, variables and API calls, JSON patches, autogen rules, cleanup policies, CEL, Helm-based installation, CRDs, controller flags, RBAC, high availability, upgrades, policy reports, PolicyExceptions, and metrics. Preparation typically combines hands-on work with a test cluster, the Kyverno CLI apply and test workflows, and the Linux Foundation courses Mastering Kubernetes Security with Kyverno (LFS255) or Kubernetes Security Essentials (LFS260).
What you'll study
About Kyverno Certified Associate preparation
What is the exam format?
Linux Foundation Education describes the KCA as an online, proctored, multiple-choice exam. There are no hands-on lab items, so you are answering knowledge questions rather than performing tasks in a live cluster. Plan to sit it in a quiet environment with a stable connection and a webcam, since proctoring rules apply.
How long is the exam and how much does it cost?
The published exam duration is 90 minutes. The exam-only price listed is $250. Linux Foundation Education also advertises a bundle with the THRIVE-ONE Annual Subscription at $495, which it describes as saving 40 percent and adding access to more than 100 educational products and SkillCreds.
How many attempts do I get, and how long is the certification valid?
The included package lists one retake alongside 12 months of exam eligibility, so you have time to schedule and, if needed, retake. The online certification is stated to be valid for 2 years. After passing, you can add the badge to LinkedIn, LFX, GitHub, and other profiles.
Do I need prerequisites or prior certifications?
The page states there are no pre-requisites for this exam and lists the experience level as Beginner. That said, Linux Foundation Education notes that a solid foundation in IT infrastructure, cloud computing, DevOps, and security is essential for cloud professionals and points to LFCS, CKA, CKAD, and CKS as useful groundwork.
How difficult is the KCA, and where should I start studying?
With a beginner experience level and no prerequisites, the difficulty is moderate for anyone already working with Kubernetes. Start with fundamentals: policy and rule YAML structure, admission control, and OCI images. Then move to installation and configuration, since those two domains together account for 36 percent of the blueprint before you reach authoring.
Which domain should I prioritize?
Writing Policies carries the largest weight at 32 percent, so it deserves the most study time. It spans validation, mutation, generation, and verifyImages rules, preconditions, background scans, variables and API calls, JSON patches, autogen rules, cleanup policies, and Common Expression Language. Fundamentals of Kyverno and Installation, Configuration, and Upgrades are next at 18 percent each.
What are common failure modes on this exam?
Candidates often under-prepare the smaller domains. Policy Management covers only 10 percent but tests policy reports, PolicyExceptions, and Kyverno metrics, which are easy to skip. Likewise the CLI domain at 12 percent tests apply, test, jp, and installation. Ignoring these because they look minor can cost enough questions to matter. Also watch time: 90 minutes goes quickly across a broad blueprint.
Are there official courses to prepare?
Linux Foundation Education recommends Mastering Kubernetes Security with Kyverno (LFS255) or Kubernetes Security Essentials (LFS260), which you can find by searching those course codes. Pairing either course with hands-on practice in a test cluster and with the Kyverno CLI is the most practical way to cover the writing and installation domains.
What certification comes next after the KCA?
Linux Foundation Education suggests demonstrating Kubernetes and cloud native security skills by earning the Certified Kubernetes Security Specialist (CKS) certification, or going further and becoming a Kubestronaut. The KCA itself is positioned as an entry point into policy and security work rather than a senior-level credential.