Kyverno Certified Associate study guide
Kyverno Certified Associate · Work through your exam, one topic at a time.
The Kyverno Certified Associate (KCA) is an entry-level, online, proctored, multiple-choice certification offered through Linux Foundation Education. It validates practical knowledge of Kyverno, the open-source policy engine for Kubernetes, covering how policies are written, applied, and managed to enforce security and compliance across clusters. The Kyverno Certified Associate study guide has 6 sections and about 2,104 words.
01Fundamentals of Kyverno
The Fundamentals domain tests whether you understand what Kyverno is, how a request reaches it, and what each rule type can do. Expect questions on architecture, rule types, enforcement outcomes, and reporting rather than on YAML micro-syntax.
364 words, about 2 min02Installation, Configuration, and Upgrades
This domain checks that you can stand Kyverno up safely, tune it, and move between versions without breaking admission for the whole cluster. The Helm chart from https://kyverno.github.io/kyverno/ is the standard route; a plain install.yaml exists for quick trials.
367 words, about 2 min03Kyverno CLI
The CLI domain tests whether you can evaluate and test policies offline, before anything reaches a cluster - the workflow CI pipelines depend on. kyverno apply <policy --resource <manifest evaluates policies against local YAML and prints per-rule results.
367 words, about 2 min04Applying Policies
Applying Policies asks how a written policy actually reaches resources: which requests it intercepts, how you narrow or widen that set, and how existing objects get covered. match is mandatory and decides which requests a rule sees: resources.kinds , names , namespaces , operations , selector (labels on the resource), and namespaceSelector (labels on the namespace).
326 words, about 2 min05Writing Policies
Writing Policies is the heaviest domain: rule structure, variables, context data, and mutation that does not destroy what users wrote. apiVersion: kyverno.io/v1 , kind: ClusterPolicy , and spec.rules[] where each rule has a required name , a match , and exactly one of validate , mutate , generate , or verifyImages .
335 words, about 2 min06Policy Management
Policy Management covers the lifecycle around your policies: how they are tested, rolled out, excepted, and cleaned up after. Keep policies in Git, run kyverno test and an apply check in CI, and promote through GitOps so every change is reviewable.
345 words, about 2 min