I85PREP
⌘ K
Kyverno Certified Associate study materials
Kyverno Certified Associate study resources

Kyverno Certified Associate: Installation, Configuration, and Upgrades

Kyverno Certified Associate · Work through your exam, one topic at a time.

All guide sections

Installation, Configuration, and Upgrades

This domain checks that you can stand Kyverno up safely, tune it, and move between versions without breaking admission for the whole cluster.

Installation paths

The Helm chart from https://kyverno.github.io/kyverno/ is the standard route; a plain install.yaml exists for quick trials. The install creates the Kyverno namespace (conventionally kyverno) plus CRDs such as ClusterPolicy, Policy, PolicyException, CleanupPolicy, ClusterCleanupPolicy, and the report CRDs.

Components you scale

Contemporary releases split responsibilities across admission, background, reports, and cleanup controllers. The admission controller is the webhook backend: in production run at least three replicas with anti-affinity and real resource requests. A single replica plus failurePolicy: Fail is a cluster-wide outage risk.

Configuration knobs

  • The kyverno ConfigMap holds resourceFilters, which exclude kinds, namespaces, or names from admission. Exclude kube-system and the Kyverno namespace itself to avoid deadlock.
  • Webhook settings control failurePolicy, timeoutSeconds, and namespace selectors. Scope them down instead of leaving everything matched.
  • Deployment flags control metrics, report generation, and background scan intervals.

Upgrades

Read release notes for CRD and API changes, reapply the new CRD manifests first (Helm installs crds/ on install but does not upgrade it), then run helm upgrade with your values file. Confirm webhook service references, pod readiness, and that reports still populate.

Worked example

After an upgrade, a policy using a newer schema field is rejected and existing policies stop reporting. Reasoning: the chart was upgraded but the CRD schema was never reapplied, so the API server still enforces the old schema. Reapplying the release's CRD YAML restores it - the fix is CRD order, not reinstalling Kyverno.

Traps

Deleting webhooks by hand, skipping CRD upgrades, running one replica in production, forgetting to exclude the Kyverno namespace, and hand-editing chart-managed values so the next upgrade silently reverts them.