I wrote the longer version, with the full study order and every trap I hit, on my blog.
I passed the Kyverno Certified Associate on the first attempt with 85 out of 100. The policy YAML was the easy part. Every point I dropped came from not knowing exactly what runs where, and what blocks what.
It was one of the 15 CNCF certs I did on the Golden Kubestronaut track.
No Rego, no DSL
With OPA Gatekeeper you learn Rego first, a separate query language, before you can write anything useful. Kyverno skips that step. A policy is a Kubernetes resource with a spec block, applied with kubectl apply. If you can write a Deployment, you can read a Kyverno policy on day one.
So I think the KCA is a YAML exam with an architecture question hiding inside it, and prep is faster than most material suggests.
Format and domains
60 questions, 90 minutes, multiple choice, 75 to pass.
| Domain | Weight |
|---|---|
| Writing Policies | 32% |
| Fundamentals of Kyverno | 18% |
| Installation, Configuration & Upgrades | 18% |
| Kyverno CLI | 12% |
| Applying Policies | 10% |
| Policy Management | 10% |
Policy Management at 10% looks skippable. I gave it about an hour and still lost a question there.
Policy types (and the bit I'm unsure about)
Validate is the admission gate and holds most of the 32%. Audit reports a violation, Enforce blocks the request, and that split comes up again and again. Mutate changes resources on the way in with a strategic merge patch or JSON patch. Generate creates a resource in response to an event, like a default NetworkPolicy when a namespace appears. Cleanup deletes resources. Image verification checks signatures with Cosign.
Kyverno is mid-transition. Most tutorials still use ClusterPolicy, where every type lives as a rule inside one policy. The official docs now show the CEL based per-type resources like ValidatingPolicy, and ClusterPolicy is marked for deprecation. I studied the new ones, but I can't promise every question I saw used the new syntax. Know both shapes well enough to recognise them.
Mechanics worth drilling: match/exclude with any (OR) and all (AND), the anchors (), ^(), =() and X(), ClusterPolicy vs namespaced Policy, and autogen (a Pod rule gets Deployment, DaemonSet, Job and CronJob rules generated for you).
Admission controller vs policy controller
The exam keeps coming back to this.
The admission controller sits on the request path as a dynamic admission webhook. Validate and mutate run there. Because it's inline, a webhook failure becomes a cluster problem, which is why failurePolicy exists and gets asked about.
The policy controller runs off the request path: background scans, generate, cleanup. Background scans produce PolicyReport and ClusterPolicyReport. If it goes down, workloads keep running and nothing gets blocked.
Expect "which component handles this" and "what breaks when this is down". I'd derive both from the architecture in how Kyverno works rather than memorize a table.
The CLI is the cheapest 12%
kyverno apply policy.yaml --resource resource.yaml
kyverno test .
kyverno apply tells you whether a resource passes or fails. kyverno test runs a manifest of expected outcomes across several resources. Keep both running the whole time you study.
Where I lost points
- Audit vs Enforce. Both look right when the question asks which one blocks admission. Enforce blocks.
- Background scan vs admission time. The wrong option is always the other one.
- Old vs new syntax. Stale ClusterPolicy patterns look correct on a multiple choice screen.
How I'd prepare
Reading docs gives you recognition, and a timed exam with four plausible answers punishes that. What worked for me was writing a policy, running a resource through it, breaking it on purpose, fixing it. About 20 rounds with kyverno apply in a loop. After that I didn't need to memorize Audit vs Enforce because I'd watched both happen. Passive video courses didn't work for me.
- Start with the Kyverno introduction, then the per-type pages. The docs are good, which I don't say often.
- Spend most of your time on Writing Policies with the apply loop. About a week if you build real policies.
- Learn the controller split until "what breaks if this goes down" needs no thought.
- Give Policy Management its hour. Maybe more than I did.
- Run a practice test before booking. I put every scenario I built during prep into a free KCA practice test that shows which domain is still weak.
The rest of my study links live in awesome-kubestronaut.
Two questions for every answer
Does this run on the request path or off it? Does it block, or only report? Validate and mutate are on the path; generate, cleanup and background scans are off it. Once I had that, I worked answers out from where the thing sits.
85 left me 10 points of headroom, and I still got caught by a Policy Management question in the domain I just told you not to skip.
I don't know how long the classic ClusterPolicy questions stay in the pool. If you sit it soon, I'd like to hear which syntax most of your questions used.
Originally published on yetmike.com
Top comments (0)