Kyverno Certified Associate (KCA)
Validate foundational and practical proficiency in Kubernetes policy management using Kyverno, including declarative validation rules, mutating policies, generation rules, image signature verification, and PolicyReports.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The KCA is a multiple-choice certification from the CNCF and Linux Foundation validating foundational competence in Kubernetes policy-as-code management, security guardrails, and compliance using Kyverno.
The KCA is a 90-minute multiple-choice examination consisting of 60 questions administered online with remote proctoring.
A passing scaled score of 75% is required. Results are displayed immediately upon submission.
Domains include: (1) Kyverno Overview & Architecture (18%), (2) Policy Types & Structure (22%), (3) Validation & Mutation Rules (28%), (4) Generation & Cleanup Rules (16%), and (5) Image Verification & PolicyReports (16%).
Kyverno policies are written as native Kubernetes resources in YAML (no complex Rego programming language required). It supports validation, mutation, generation of resources, and image verification natively.
A ClusterPolicy applies cluster-wide across all namespaces. A Policy is namespaced and applies only to resources within that specific namespace.
Audit permits non-compliant resources to be created but logs violations in PolicyReports. Enforce actively blocks and rejects non-compliant admission requests at the API server boundary.
Validation rules check incoming manifests against defined patterns (pattern, anyPattern) or conditions (deny blocks) and reject or flag requests that fail the check (e.g. requiring non-root execution).
Mutation rules automatically modify incoming manifests before admission, injecting default values, sidecar containers, or annotations using patchesJson6902 or strategic merge overlays.
Generation rules automatically create auxiliary resources (e.g., Default NetworkPolicies, RoleBindings, ConfigMaps) whenever a trigger resource (such as a new Namespace) is created.
Using verifyImages rules, Kyverno verifies cryptographic signatures (using Cosign / Sigstore) and attestation manifests (in-toto) directly during pod admission before containers can run.
The CLI tests, lints, and applies Kyverno policies locally in CI/CD pipelines (kyverno test, kyverno apply) to validate Kubernetes manifests before committing to Git.