I85PREP
⌘ K
Kyverno Certified Associate study materials
Kyverno Certified Associate study resources

Kyverno Certified Associate: Kyverno CLI

Kyverno Certified Associate · Work through your exam, one topic at a time.

All guide sections

Kyverno CLI

The CLI domain tests whether you can evaluate and test policies offline, before anything reaches a cluster - the workflow CI pipelines depend on.

Core commands

  • kyverno apply <policy> --resource <manifest> evaluates policies against local YAML and prints per-rule results. Add --cluster to pull resources from the current kubeconfig context, and --policy-report to emit report output.
  • kyverno test <dir> runs declarative cases from kyverno-test.yaml; a non-zero exit code on failures makes it a CI gate.
  • kyverno jp query -i input.yaml "<expression>" evaluates JMESPath - the same language used in policy variables and context.
  • kyverno create scaffolds policies and test scaffolding.

Test file structure

A test file lists policies, resources, and expected results entries with policy, rule, resource, kind, and status. Status values mirror runtime outcomes: pass, fail, skip, warn, error. Expected failures must be declared, otherwise a regression that starts denying everything passes silently.

What the CLI is not

The CLI evaluates with the same engine but without a real API server: generate rules are not fully simulated, and cluster-dependent data (ConfigMaps, API calls, namespace labels) must be supplied as resources or variables. Version drift between CLI and cluster produces misleading results.

Worked example

You write a rule denying :latest images and a test expecting a Deployment to fail. You run kyverno test . and see the Deployment pass. Reasoning: the resource listed in the test file is the Pod, but the failing manifest is a Deployment, and without autogen coverage or with a mismatched kind the case never matches. Fix the resource entry, not the policy.

Traps

Confusing JMESPath with JSONPath; forgetting --cluster when a policy depends on live objects; leaving expected results out of the test file; and pinning the CLI to a different minor version than the cluster.