100+ Free Kyverno Certified Associate Practice Questions

Fundamentals of Kyverno

Understand Kyverno as a Kubernetes-native dynamic admission controller, the difference between ClusterPolicy and Policy, the structure of rules (one match plus one of validate, mutate, generate, or verifyImages), mutation-before-validation ordering, and OCI image references.

Installation, Configuration and Upgrades

Install Kyverno with the official Helm chart, recognize the admission, background, cleanup, and reports controllers, configure high availability per controller, manage RBAC via aggregated ClusterRoles, tune the ConfigMap and resourceFilters, and handle CRDs during upgrades.

Kyverno CLI

Install the CLI (for example via Krew) and use kyverno apply to evaluate policies offline, kyverno test to compare actual results against declared expectations, and kyverno jp to debug JMESPath, integrating policy testing into CI/CD pipelines.

Applying Policies

Select resources with match and exclude using kinds, names, namespaces, label selectors, namespaceSelector, operations, and subjects, and tune common settings such as background, failurePolicy, and applyRules to control how and when rules run.

Writing Policies

Author validation rules with patterns, anchors (conditional, equality, existence, negation, global), anyPattern, deny, preconditions, and foreach; mutation rules with patchStrategicMerge and JSON 6902; generation rules with data, clone, and synchronize; and verifyImages rules with Cosign attestors, plus autogen for Pod controllers.

Policy Management

Manage policies in production with PolicyExceptions, interpret PolicyReport and ClusterPolicyReport results and their pass/fail/warn/error/skip categories, understand background scan reporting behavior and UpdateRequests, use CleanupPolicy and Policy Reporter, and roll out from Audit to Enforce safely.