Kyverno Certified Associate (KCA) Roadmap

Build a clean mental model before writing syntax. Separate Kubernetes authentication, authorization, mutation, validation, persistence, background reconciliation, and reporting.

• Explain Kyverno as a declarative policy engine rather than a scheduler, runtime, CNI, or API-server replacement
• Read policy resources as apiVersion, kind, metadata, spec, rules, selection, context, preconditions, and behavior
• Distinguish namespaced and cluster scope and select the narrowest sufficient policy type
• Trace an AdmissionReview through authentication, authorization, mutation, validation, persistence, and report intermediates
• Explain why ordinary reads do not run through admission and why background scans lack the original actor context
• Identify OCI registry, repository, tag, manifest, digest, signature, and attestation as separate concepts
• Compare the public curriculum's legacy vocabulary with current stable CEL-based Kyverno policy types
• Complete questions 1-9 and explain every distractor

Operate Kyverno as a critical admission dependency. Know which controller owns each behavior and which ServiceAccount needs each permission.

• Install a pinned official Helm chart in a dedicated Namespace and inventory all installed resources
• Map the admission, background, reports, and cleanup controllers to webhooks, UpdateRequests, reports, and deletions
• Inspect CRDs and distinguish policy resources from supporting and internal resources
• Review ConfigMap keys, container flags, dynamically managed webhooks, resource filters, and Namespace selectors
• Extend controller RBAC with explicit aggregated ClusterRoles instead of editing chart-owned roles
• Understand concurrent admission replicas versus leader-elected reports and background processing
• Model fail-closed security against availability and test protected system-Namespace recovery
• Read every intervening release note, render the chart diff, back up policies and values, test CRD/API migration, and prepare rollback
• Complete questions 10-18 and project 1

Make policy behavior repeatable before it reaches an admission webhook. Pin versions and model external context instead of relying on hidden cluster state.

• Use kyverno apply against resource files and explore detailed results, reports, values, exceptions, and cluster mode
• Use kyverno test with expected pass, fail, skip, mutation, generation, and exception outcomes
• Use kyverno jp function, parse, and query to develop JMESPath safely
• Supply values files, context, user information, parameter resources, target resources, and registry access only as required
• Produce machine-readable CI output and fail when tests are missing or expected outcomes change
• Test malformed input, absent optional fields, array variation, controller templates, exceptions, and dependency failure
• Validate in a disposable cluster because CLI success does not prove webhook, RBAC, registry, TLS, or controller health
• Complete questions 19-24 and build the project 2 test suite

Selection errors are policy errors. Learn when a request never reaches Kyverno, when the engine filters it, when a rule skips, and when a violation is audited or enforced.

• Combine kinds, operations, names, Namespaces, selectors, namespaceSelectors, subjects, roles, match, and exclude carefully
• Differentiate API-server webhook selectors from Kyverno engine resource filters and policy match logic
• Use per-rule failureAction, policy failurePolicy, timeout, background, warnings, and reporting settings deliberately
• Start broad new validation in Audit, inspect current-state reports, fix resources, approve narrow exceptions, and stage Enforce
• Test selected, excluded, inapplicable, and request-only scenarios rather than only compliant resources
• Protect labels used for scoping or break-glass from unauthorized mutation
• Measure admission latency and errors before increasing scope
• Complete questions 25-30

This is the largest official domain. Practice complete behavior chains, not isolated YAML fragments.

• Write validation with patterns, anyPattern, anchors, deny conditions, foreach, Pod Security, and CEL
• Use preconditions to skip rule bodies and mark request-dependent rules background false
• Write idempotent strategic-merge mutations and precise RFC 6902 patches with correct JSON Pointer escaping
• Understand mutation ordering, cascading rules, foreach element and elementIndex, and immutable Kubernetes fields
• Generate resources from data, clone, or cloneList; decide synchronize and generateExisting lifecycle behavior
• Grant the background controller exact permissions and inspect failed UpdateRequests
• Verify image digests, trusted attestors, signatures, attestations, and registry credentials using safe lab images
• Use AdmissionReview variables, ConfigMaps, Kubernetes API calls, service calls, registry context, and JMESPath with bounded data
• Inspect autogen rules and cover suppression cases such as mixed kinds, selectors, and Pod JSON Patch mutation
• Use current DeletingPolicy for new scheduled cleanup work while recognizing legacy cleanup and TTL concepts
• Complete questions 31-45 and projects 2-3

Treat management evidence as a live operating system. A report result needs context, an exception needs governance, and a metric needs a service objective.

• Interpret PolicyReport and ClusterPolicyReport results: pass, fail, warn, error, and skip
• Remember that reports represent current resources and are not immutable blocked-request history
• Enable exceptions only in a controlled Namespace and protect creation with RBAC and review
• Scope exceptions to exact policy, target, condition, owner, rationale, compensating controls, and expiry
• Monitor admission volume and latency, policy results and duration, controller reconciliation/requeues/drops, cleanup, API clients, and version
• Rehearse troubleshooting across readiness, endpoints, certificates, RBAC, UpdateRequests, reports, metrics, events, logs, and release notes
• Take a timed 50-question session inside 90 minutes, review every wrong answer, then repeat weak domains
• Complete questions 46-50, review all 40 flashcards, and finalize project evidence