Kyverno Certified Associate flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

ClusterPolicy vs Policy

ClusterPolicy is cluster-scoped and its rules apply to all namespaces. Policy is namespaced and its rules apply only to resources in that same namespace.

Rule types in Kyverno

Kyverno rules are validate, mutate, generate, or verifyImages. Each rule has match and optionally exclude, plus exactly one action block.

Audit versus Enforce

validationFailureAction set to Audit records failures in PolicyReports without blocking. Enforce denies the admission request. Enforce is the default behavior.

PolicyReport purpose

PolicyReport and ClusterPolicyReport aggregate per-resource rule results with pass, fail, warn, error, and skip counts, enabling dashboards and alerting.

Background scanning

The background controller re-evaluates existing resources on a schedule and on policy changes, so violations that predate a policy appear in reports.

match and exclude blocks

These select resources by kinds, names, namespaces, label selector, annotations, and operations such as CREATE, UPDATE, or DELETE. Exclude removes matches.

Admission review flow

The API server sends an AdmissionReview to Kyverno's webhook. Kyverno evaluates matching rules and returns allowed or denied with a message.

Kyverno controllers

The deployment runs admission, background, reports, cleanup, and webhook registration components. Each has its own replica count and resource settings.

Helm install command

Add the Kyverno Helm repository, then run helm install kyverno kyverno/kyverno -n kyverno --create-namespace. Pin --version for reproducible installs.

Kyverno ConfigMap settings

The kyverno ConfigMap in the kyverno namespace holds runtime settings including resourceFilters, webhook namespaceSelector, timeoutSeconds, and generateExisting behavior.

resourceFilters entry structure

Each entry uses any, all, and exclude blocks to skip admission processing. A common pattern excludes system namespaces and Kyverno's own namespace.

CRD upgrades with Helm

Helm does not upgrade CRDs automatically. Apply updated CRDs separately before helm upgrade, and check release notes for API version changes.

High availability setup

Run at least three admission controller replicas with a PodDisruptionBudget. Set webhook failurePolicy and timeoutSeconds to control behavior during outages.

Policy exceptions

Exception resources, or ConfigMap entries, let named policies and rules skip specific resources. They are matched by policy name and rule names.

Verify installation

Check pods in the kyverno namespace, list ClusterPolicies, and run the Kyverno CLI test command against a known policy to confirm behavior.

kyverno apply

kyverno apply evaluates policies against local resource manifests and prints per-rule pass or fail results without contacting a cluster.

kyverno test

kyverno test runs declarative suites from kyverno-test.yaml files that list policies, resources, and expected results of pass, fail, skip, or warn.

kyverno jp query

kyverno jp query evaluates a JMESPath expression against a JSON or YAML document. Use it to debug variables before embedding them in policies.

kyverno create

kyverno create scaffolds policies, tests, and exceptions, reducing boilerplate when authoring new rules and their matching test fixtures.

kyverno migrate

kyverno migrate converts legacy policies, including PodSecurityPolicy, into Kyverno policy manifests to ease cluster upgrades and policy rewrites.

CLI version matching

Match the Kyverno CLI version to the cluster's Kyverno version. Mismatched versions can produce different pattern and JMESPath evaluation results.

Server-side dry run

kubectl apply --dry-run=server sends the request through the admission webhook, showing whether a policy would block or mutate the resource.

generateExisting setting

Setting generateExisting to true backfills resources that already exist when a generate rule is created. Without it, only new triggers create resources.

Generate synchronize option

Setting synchronize to true keeps generated resources aligned with the policy definition. Without it, manual edits to generated resources persist.

Confirming applied policies

Use kubectl get clusterpolicy to confirm stored specs and kubectl get policyreport -A to see enforcement results across namespaces.

Mutation before validation

In the admission pipeline, mutate rules run before validate rules, so validation sees the mutated object. Rule order within a policy is not guaranteed.

Pattern overlay matching

In validate patterns, omitted fields are ignored, null requires the field to be absent, and (X) negates. Patterns match as overlays, not exact documents.

JMESPath conditions

Conditions use JMESPath expressions with operators including Equals, NotEquals, In, AnyIn, AllIn, GreaterThan, and LessThan to gate rule evaluation.

patchesJSON6902

This mutate block lists explicit add, replace, and remove operations with paths. It is precise and can remove list entries that strategic merge cannot.

foreach in mutate rules

The foreach block iterates over an array in the resource, applying patches per element, with optional context and order control for deterministic results.

verifyImages rule

verifyImages checks image signatures and attestations against attestors such as keys, certificates, or keyless identity, denying the pod in Enforce mode.

GitOps policy management

Store policies in Git and deliver with Argo CD or Flux. Policies are ordinary Kubernetes objects, so drift detection and review work as for other resources.

Cleanup policies

CleanupPolicy and ClusterCleanupPolicy delete stale resources on a schedule. They are separate from admission rules and managed as their own policy set.

Webhook latency risk

A slow admission webhook adds latency to every matching API request. Narrow match blocks and set modest timeoutSeconds to limit the impact.