Kyverno Certified Associate study plan

Explain how a Kyverno policy is structured (apiVersion, kind, spec.rules, match/exclude, validate/filter blocks) well enough to describe it from memory without notes.

Write three ClusterPolicies from scratch that validate Pod labels, image registry, and resource requests, then apply them to a local cluster and confirm the expected admit/deny behavior.

Distinguish validate, mutate, generate, and verifyImages rule types by stating the purpose, the required fields, and one realistic use case for each.

Trace the admission request lifecycle (API server to admission webhook to Kyverno to response) and identify where a PolicyReport entry is created.

Write match and exclude blocks using resources, kinds, namespaces, selector, and annotations, and test each variant against live resources.

Use wildcards, operators, and JMESPath expressions inside preconditions and deny conditions to filter which resources a rule evaluates.

Implement a mutate rule using patchesJson6902 and a second using strategic merge patch, then compare the resulting resource manifests.

Configure a generate rule with a data block and a synchronize flag, and observe what happens when the source changes or the target is deleted.

Build validate rules using pattern matching, deny with conditions, and the pod-policies subresource for Pod Security Standards, then show each blocking a non-compliant workload.

Use context variables and API call lookups (ConfigMap and a cluster resource) inside a rule so decisions depend on external data rather than the request alone.

Write a verifyImages rule that enforces an image signature and digest, and describe what happens to unsigned images.

Apply a policy in Audit mode and in Enforce mode and record the difference in admission outcome and reporting.

Explain policy precedence and how background scanning, PolicyReports, and ClusterPolicyReports relate to the resources they describe.

Configure a policy exception resource and confirm the exempted resource is admitted while others remain blocked.

Describe the difference between a Policy and a ClusterPolicy and choose the correct scope for three given scenarios.

Demonstrate how failurePolicy, validationFailureAction, and background flags change behavior under a simulated webhook timeout.

Install Kyverno with Helm into a local cluster in both a standard HA configuration and a single-replica mode, and list the resources each creates.

Identify and explain the key installation values (replica counts, resource limits, webhook configuration, namespace, image tags) and the effect of changing three of them.

Perform an upgrade to a newer chart version and a rollback, capturing the commands and the resulting pod and webhook state.

Diagnose a deliberately broken installation (wrong namespace or missing webhook) using logs, events, and webhook configuration inspection.

Use the Kyverno CLI to apply policies to local resource manifests and to test policies against a directory of fixtures, interpreting pass/fail output.

Run the CLI test command with a test manifest that asserts specific resources are allowed and others denied, and fix a failing assertion.

Use CLI commands to validate policy syntax and to explain how CLI results differ from in-cluster admission results.

Apply a policy set to a cluster in a controlled order and verify enforcement using dry-run and real admission requests.

Implement a GitOps-style policy workflow where policies live in a repository and are synced to the cluster, then demonstrate a policy change flowing through.

Generate and read PolicyReport and ClusterPolicyReport results for audit-mode policies and summarize which resources fail which rules.

Design a policy lifecycle (author, test in CLI, audit in cluster, enforce, exception handling, deprecation) and document it as a checklist.

Review a set of policies for conflicting or overlapping rules and resolve one conflict.

Complete a timed full-length practice set across all domains and score it by domain to find weak areas.

Re-derive from memory the structure of each rule type, key CLI commands, and installation values, then correct gaps against your notes.

Rebuild two policies you found hardest from scratch without notes and verify them with the CLI and on-cluster.

Write a one-page cheat sheet covering rule types, match/exclude syntax, CLI flags, and policy management concepts.