I85PREP
⌘ K
Kyverno Certified Associate study materials
Kyverno Certified Associate study resources

Kyverno Certified Associate: Fundamentals of Kyverno

Kyverno Certified Associate · Work through your exam, one topic at a time.

All guide sections

Fundamentals of Kyverno

The Fundamentals domain tests whether you understand what Kyverno is, how a request reaches it, and what each rule type can do. Expect questions on architecture, rule types, enforcement outcomes, and reporting rather than on YAML micro-syntax.

Kubernetes-native by design

Kyverno runs inside the cluster and speaks Kubernetes. Policies are custom resources - ClusterPolicy (cluster-scoped) and Policy (namespaced) - written in plain YAML. There is no Rego and no separate policy language: you declare match conditions, optional preconditions, then a rule body.

How admission works

Kyverno registers MutatingWebhookConfiguration and ValidatingWebhookConfiguration objects. The API server sends an AdmissionReview for matching requests, and Kyverno evaluates every policy whose match block selects that resource, returning allow, deny, or a JSON patch. Admission fires on create, update, delete and connect - existing objects are left to the background controller.

The four rule types

  • validate - allow or deny via patterns or deny.conditions; failureAction: Enforce blocks, Audit only records.
  • mutate - patch the incoming object.
  • generate - create a downstream resource (ConfigMap, Secret, NetworkPolicy) when a trigger appears.
  • verifyImages - check image signatures and attestations.

Reporting

Background scans and admission decisions feed PolicyReport (namespaced) and ClusterPolicyReport resources in the wgpolicyk8s.io group, with pass/fail/skip/error counts per policy and rule.

Worked example

A ClusterPolicy requires metadata.labels.team on every Pod in namespaces named prod-*. The rule matches kinds: [Pod] with namespaces: ["prod-*"] and validates team: "?*". Reasoning: ?* requires at least one character, so an empty label fails; a namespace name pattern is simpler than namespaceSelector here; and with Audit the Pod is still admitted, but the report records a failure.

Traps

Assuming Audit blocks; confusing Policy with ClusterPolicy; using namespaceSelector when you meant a namespace name pattern (selectors read namespace labels); and expecting admission to remediate objects that already exist.