Kyverno Certified Associate key terms

The Kubernetes API request object sent to a webhook during admission, containing the incoming object and later the allowed/denied decision with an optional patch. Kyverno receives and answers these when acting as a validating or mutating webhook.

A Kubernetes-native policy resource evaluated by the API server using CEL expressions, separate from Kyverno. Kyverno can generate these or coexist with them, so candidates should know how they differ from Kyverno ClusterPolicies.

A cluster-scoped Kyverno resource that defines one or more rules to validate, mutate, generate, or verify resources. It applies across namespaces unless rule-level selectors or namespace filters narrow its scope.

A namespaced Kyverno resource holding the same rule types as a ClusterPolicy but scoped to its own namespace by default. Useful for delegating policy ownership to namespace tenants.

The core unit inside a Kyverno policy that pairs match and exclude conditions with an action such as validate, mutate, generate, or verifyImages. Each rule is evaluated independently and can carry its own configuration.

The required section of a rule declaring which resources, kinds, namespaces, operations, or subjects trigger evaluation. If a resource does not satisfy the match block, the rule is skipped entirely.

An optional rule section that removes resources from an otherwise matching set. Exclusions are evaluated before rule logic, so excluded resources never reach validation, mutation, or generation.

Boolean structure used inside match and exclude to combine conditions. any means at least one entry must match; all means every entry must match. Nesting them allows precise targeting of resources.

A rule type that checks whether a resource complies with a condition and denies it when it fails. It can also audit without blocking by setting validationFailureAction to Audit.

A rule type that changes a resource during admission, either by strategic merge patch, JSON patch, or patchesJson6902. Mutation can add defaults, labels, or enforce settings before the object is persisted.

A rule type that creates additional resources, such as ConfigMaps or NetworkPolicies, when a triggering resource appears. Generation can be triggered by a resource or by an existing resource's state.

A rule type that checks container image signatures and attestations against configured keys or keyless identities before allowing a Pod. It supports cosign signatures and in-toto attestations.

Policy or rule setting that decides whether a failed validation denies the request or merely records a policy report. Values are Enforce and Audit; the default historically was Audit, so check your version.

A validation expression using wildcards, anchors, and conditional operators to describe acceptable field values. Patterns support negation with ! and any-value wildcards, making them concise for structural checks.

A validation condition that explicitly rejects a resource with a custom message when its expression evaluates true. It is often easier to read than an inverted pattern for complex business rules.

A rule-level expression evaluated before the main rule logic, using JMESPath or CEL. If any precondition is false, the rule is skipped, which is useful for narrowing expensive checks.

A query language for JSON used in Kyverno variables, preconditions, and deny conditions. It supports projections, filters, functions, and pipe expressions to extract values from admission requests.

Common Expression Language, an expression syntax Kyverno supports for validation and preconditions in newer versions. It offers typed, efficient evaluation and is also used by Kubernetes ValidatingAdmissionPolicy.

A rule section that loads external data, such as ConfigMaps, API calls, or image registry data, into variables before evaluation. Context entries make decisions depend on cluster or remote state.

A named value referenced with double curly braces in policy fields, resolved from the admission request, context entries, or built-in request data. Variables are substituted before rule evaluation.

The built-in data available to policies, including the resource, userInfo, operation, and namespace. Policies reference it to make decisions based on who is acting and what they are doing.

A mutation method that overlays a partial YAML document onto the resource, merging maps and lists according to strategic merge semantics. It is the most common way to add labels or defaults.

A mutation method that applies explicit JSON Patch operations such as add, remove, or replace at given paths. It gives precise control when merge behavior is insufficient.

A mutation mode that updates pre-existing resources rather than the incoming request, used with generate or mutate rules targeting other objects. It is often used for repairing drifted resources.

A generate-rule option that keeps generated resources aligned with their source, recreating or updating them when the trigger changes. Without sync, generated objects can drift or be deleted permanently.

A namespaced resource that exempts specific resources from named policies and rules, with optional conditions. It provides an auditable alternative to editing policy match blocks for one-off exceptions.

A namespaced custom resource summarizing pass, fail, warn, and error results per policy and resource. Reports are produced from audit or background scans and support compliance dashboards.

The cluster-scoped counterpart of PolicyReport, aggregating results for cluster-scoped resources and cluster-wide policy evaluation. Tools such as the policy-reporter UI consume both report types.

Periodic reevaluation of existing resources against policies without an admission request. Background scans populate reports and can trigger generation or mutation of existing objects.

The kyverno command-line tool for testing and applying policies outside a cluster. It validates policy syntax, applies policies to YAML manifests, and runs test suites in CI.

CLI subcommand that evaluates policies against local resource manifests and prints results, optionally writing mutated output. It is the fastest way to debug a rule before deploying it.

CLI subcommand that runs declarative test files describing resources and expected pass or fail outcomes. It enables regression testing of policies in pipelines.

CLI subcommand that evaluates JMESPath expressions against a JSON document. It helps authors build and verify the queries used in preconditions and variables.

The recommended way to install Kyverno, deploying controllers, webhooks, RBAC, and CRDs with configurable values. Version pinning and values overrides control replica counts and feature flags.

The Kubernetes object registering Kyverno's admission endpoint so the API server calls it for matching resources. Its failurePolicy and namespace selectors directly affect cluster safety.

Webhook setting that decides whether admission proceeds when Kyverno is unreachable. Fail means requests are rejected; Ignore means they proceed, which trades safety for availability.

The process of moving Kyverno to a newer release, typically via Helm with CRD updates and attention to webhook and API version changes. Skipping major versions can require intermediate steps.

CustomResourceDefinition extending the Kubernetes API with Kyverno types such as ClusterPolicy and PolicyException. CRDs must be installed and upgraded alongside the controller for policies to work.

The admission check Kyverno performs on its own policy resources to reject malformed rules, bad selectors, or invalid variables. It catches errors before a broken policy reaches the cluster.

A Kyverno feature that deletes matching resources on a schedule or after a time-to-live, expressed as a policy rule. It helps control accumulation of ephemeral objects such as Jobs or test namespaces.