# KodeKloud: Beta Courses Prep Course - Kyverno Certified Associate (KCA) Certification

## Prep Course - Kyverno Certified Associate (KCA) Certification

### Course Introduction

- [Course Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Course-Introduction/Course-Introduction/page.md): A hands-on course preparing learners for the Kyverno Certified Associate exam, teaching Kubernetes policy management with Kyverno validation, mutation, generation, ImageVerify, exceptions, labs, and mock exams

### Kyverno Introduction

- [Section Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Kyverno-Introduction/Section-Introduction/page.md): Introduction to Kyverno explaining its purpose, Kubernetes integration, installation, and rule types for codifying cluster policies and governance
- [Kyverno Overview](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Kyverno-Introduction/Kyverno-Overview/page.md): Overview of Kyverno, a Kubernetes-native policy engine that validates, mutates, and generates resources to enforce security, compliance, and standardization across clusters
- [Kyverno Architecture Part 1](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Kyverno-Introduction/Kyverno-Architecture-Part-1/page.md): Overview of Kyverno's integration with the Kubernetes API server via mutating and validating admission webhooks, request flow, webhook configuration, failure policies, and mutation before validation
- [Kyverno Architecture Part 2](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Kyverno-Introduction/Kyverno-Architecture-Part-2/page.md): Overview of Kyverno internal architecture and controllers detailing admission, reports, background, and cleanup responsibilities for policy enforcement, reporting, asynchronous processing, and resource housekeeping.
- [Installing Kyverno on Your Cluster](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Kyverno-Introduction/Installing-Kyverno-on-Your-Cluster/page.md): Instructions for installing Kyverno on Kubernetes with Helm, explaining standalone versus high availability modes, installation commands, verification steps, and RBAC and resource setup.
- [Kyverno Policies](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Kyverno-Introduction/Kyverno-Policies/page.md): Introduction to Kyverno policies for automating Kubernetes governance, explaining rule types validate mutate generate verifyImages and how platform engineers enforce and auto-correct cluster-wide policies

### Resource Filters

- [Section Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Resource-Filters/Section-Introduction/page.md): How to use Kyverno resource filters match and exclude to target Kubernetes resources and create advanced, context-aware policy exceptions.
- [Match Statements](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Resource-Filters/Match-Statements/page.md): Explains Kyverno match block filters for precisely targeting Kubernetes resources and API requests using kinds, names, namespaces, label selectors, operations, and identity or role checks.
- [Demo Match Statements](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Resource-Filters/Demo-Match-Statements/page.md): Demonstrates Kyverno match blocks to enforce non-empty env label on Pods and Deployments, and how to scope the rule to specific namespaces
- [Any and All Statements](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Resource-Filters/Any-and-All-Statements/page.md): Explains using Kyverno's any and all resource filters to combine matching criteria (OR and AND) with examples and evaluation behavior.
- [Demo Any and All Statements](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Resource-Filters/Demo-Any-and-All-Statements/page.md): Explains Kyverno ClusterPolicy match.any and match.all filters to apply OR or AND resource matching and enforce Pod label validation
- [Exclude Statements](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Resource-Filters/Exclude-Statements/page.md): Explains Kyverno exclude blocks to omit specific resources from match selections, including identity-based exceptions and background scan implications, with examples and configuration guidance.
- [Demo Exclude Statements](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Resource-Filters/Demo-Exclude-Statements/page.md): Demonstrates a Kyverno ClusterPolicy that requires Pods in the monitoring namespace to have an env label while excluding Pods labeled team=operations
- [Introduction to JMESPath](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Resource-Filters/Introduction-to-JMESPath/page.md): Introduction to using JMESPath to query Kubernetes AdmissionReview JSON and write Kyverno policies that access request data such as userInfo, namespaces, and resource fields
- [Preconditions Part 1](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Resource-Filters/Preconditions-Part-1/page.md): Explains Kyverno preconditions using JMESPath to gate rule execution, safe defaults for missing fields, and logical any versus all composition for Kubernetes resource filtering
- [Preconditions Part 2](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Resource-Filters/Preconditions-Part-2/page.md): Explains Kyverno precondition operators and practical examples for equality set membership numeric duration and regex matching to precisely scope and debug policy application
- [Demo Preconditions](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Resource-Filters/Demo-Preconditions/page.md): Demonstrates using Kyverno preconditions to validate NodePort Services and enforce externalTrafficPolicy set to Local.

### Validate Rules

- [Section Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Section-Introduction/page.md): Teaching Kyverno validate rules to enforce Kubernetes policies, rejecting noncompliant resources using patterns, deny CEL expressions, podSecurity, foreach, and autogen for cluster enforcement.
- [Basic Validations](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Basic-Validations/page.md): Explains creating a Kyverno ClusterPolicy that enforces that every new Kubernetes Namespace includes the label purpose with value production for cost allocation and governance
- [Failure Action](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Failure-Action/page.md): Explains Kyverno failureAction settings, Audit versus Enforce modes, emitWarning and allowExistingViolations to control reporting, warnings, and enforcement of policy violations
- [Demo Failure Action](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Demo-Failure-Action/page.md): Describes Kyverno failureAction modes Enforce and Audit plus allowExistingViolations and emitWarning to control namespace label validation and update behavior in Kubernetes.
- [Failure Action Overrides](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Failure-Action-Overrides/page.md): Explains Kyverno's failureActionOverrides for ClusterPolicies, allowing namespace specific enforcement or audit of validation rules to avoid duplicating policies.
- [Patterns Wildcards](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Patterns-Wildcards/page.md): Explains Kyverno pattern-based validation and using wildcards like * ? and ?* to require presence or non-empty fields such as labels and container resources
- [Demo Patterns Wildcards](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Demo-Patterns-Wildcards/page.md): Explains a Kyverno ClusterPolicy using wildcards to require non-empty CPU and memory requests and limits for every container in Pods, with examples and best practices.
- [Patterns Operators](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Patterns-Operators/page.md): Explains Kyverno pattern operator strings for comparisons, ranges, negations, and logical combinations to validate Kubernetes resource fields with examples and best practices.
- [Demo Patterns Operators](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Demo-Patterns-Operators/page.md): Explains using Kyverno pattern operators to enforce minimum Deployment replicas and forbid the default namespace via validation ClusterPolicies
- [Patterns Anchors Part 1](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Patterns-Anchors-Part-1/page.md): Explains Kyverno anchors, demonstrating conditional and equality anchors to express if-then validation logic across sibling fields or child fields with examples and tips
- [Patterns Anchors Part 2](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Patterns-Anchors-Part-2/page.md): Explains Kyverno anchors for policy patterns, showing existence, negation, and global gates with examples to require nginx, forbid hostPath, and enforce registry secrets.
- [Demo Patterns Anchors](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Demo-Patterns-Anchors/page.md): Explains Kyverno validation anchors with conditional, equality, and existence examples to enforce Pod policies such as hostPath restrictions and required container images.
- [The anyPattern OR Logic](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/The-anyPattern-OR-Logic/page.md): Explains using Kyverno anyPattern to accept either pod-level or per-container runAsNonRoot configurations and prevent unsafe overrides
- [Deny Rules](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Deny-Rules/page.md): Explains Kyverno deny rules for context aware admission control, blocking deletes of CI/CD managed ConfigMaps while exempting cluster admins.
- [ForEach Part 1](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/ForEach-Part-1/page.md): Explains Kyverno's forEach loop to validate each list item in Kubernetes resources, using JMESPath expressions to enforce container image policies like trusted-registry.io.
- [ForEach Part 2](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/ForEach-Part-2/page.md): Advanced Kyverno foreach techniques for validating Kubernetes resources using element, list, deny, preconditions, and JMESPath to enforce policies like blocking wildcard Ingress hosts and emptyDir storage requirements
- [Demo ForEach](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Demo-ForEach/page.md): Explains Kyverno foreach usage to validate lists like containers and initContainers, enforcing image patterns and reducing rule duplication.
- [Pod Security](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Pod-Security/page.md): Explains using Kyverno's podSecurity rule to enforce Kubernetes Pod Security Standards cluster wide, simplifying management and providing actionable validation errors.
- [Pod Security Exemptions](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Pod-Security-Exemptions/page.md): Using Kyverno podSecurity exclude to create narrow, image-scoped exemptions for Pod Security Standards, covering pod level, container level, and mixed controls while minimizing security risk.
- [CEL Expressions Part 1](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/CEL-Expressions-Part-1/page.md): Introducing CEL usage in Kyverno for concise admission-time validation rules and namespace aware policies
- [CEL Expressions Part 2](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/CEL-Expressions-Part-2/page.md): Guidance on advanced CEL usage in Kyverno to create configurable, content aware, and maintainable validation policies using params, celPreconditions, and variables.
- [Autogen Rules](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Validate-Rules/Autogen-Rules/page.md): Explains Kyverno autogen which generates controller-specific Kubernetes validation rules from a single Pod-focused policy to reduce duplication and simplify image registry enforcement

### Mutate Rules

- [Section Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Mutate-Rules/Section-Introduction/page.md): Using Kyverno mutate rules to automatically modify Kubernetes resources to enforce policies, add missing metadata like cost center labels, reduce developer friction and ensure cluster compliance.
- [JSONPatch](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Mutate-Rules/JSONPatch/page.md): Guide to using JSON Patch in Kyverno to precisely mutate Kubernetes resources including add replace remove operations, array handling, JSON Pointer escaping, limitations, and best practices
- [Strategic Merge Patch](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Mutate-Rules/Strategic-Merge-Patch/page.md): Explains Kyverno's patchStrategicMerge mutation method, its declarative overlays, autogen for pod controllers, and when to use it versus JSON Patch.
- [Conditional Anchors](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Mutate-Rules/Conditional-Anchors/page.md): Explains Kyverno patchStrategicMerge anchors for conditional and safe mutations of Kubernetes resources, including conditional, add-if-not-present, and global anchors with examples and processing order.
- [Mutate Existing Resources Part 1](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Mutate-Rules/Mutate-Existing-Resources-Part-1/page.md): Explains Kyverno's mutate existing feature that uses admission created UpdateRequests and the background controller to asynchronously mutate existing resources and required RBAC setup.
- [Mutate Existing Resources Part 2](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Mutate-Rules/Mutate-Existing-Resources-Part-2/page.md): Explains advanced Kyverno mutate-existing policies including immediate application, label selectors, per-target variables, and preconditions for precise resource mutations
- [ForEach](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Mutate-Rules/ForEach/page.md): Explains Kyverno foreach to iterate list items like containers and apply strategic merge or JSON patches using element and elementIndex to safely mutate each item.

### Generate Rules

- [Section Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Generate-Rules/Section-Introduction/page.md): Explains Kyverno generate rules to automatically create or clone NetworkPolicies, Roles, and other resources for new and existing Kubernetes Namespaces.
- [Data Source](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Generate-Rules/Data-Source/page.md): Explains embedding Kubernetes resource manifests in Kyverno generate rules to automatically create and synchronize downstream resources like NetworkPolicy, plus RBAC permission setup for Kyverno background controller.
- [Data Source Syncronization Effect](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Generate-Rules/Data-Source-Syncronization-Effect/page.md): Explains Kyverno's generate synchronize option that actively reconciles generated resources, enabling self heal, update propagation, and cleanup, with orphaned flag to retain resources after policy deletion.
- [Clone Source](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Generate-Rules/Clone-Source/page.md): Using Kyverno clone generate rules to replicate a central image pull Secret from a golden namespace into new namespaces and keep clones synchronized while avoiding embedded secret data
- [Clone List](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Generate-Rules/Clone-List/page.md): Explains Kyverno's cloneList feature for cloning multiple Secrets and ConfigMaps from a staging namespace into new namespaces to automate and synchronize onboarding configuration bundles.
- [Generate Existing](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Generate-Rules/Generate-Existing/page.md): Explains Kyverno's generateExisting feature that retroactively runs generate rules on existing resources to remediate drift and enforce baseline policies across current namespaces.

### External Data Sources

- [Section Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/External-Data-Sources/Section-Introduction/page.md): Explains using Kyverno policies to consult external data sources like ConfigMaps, the Kubernetes API, global context, and image registry metadata to validate, mutate, and generate resources
- [Variables from ConfigMaps](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/External-Data-Sources/Variables-from-ConfigMaps/page.md): Using Kubernetes ConfigMaps as dynamic external data for Kyverno policies to centrally manage values and auto add cost center labels to Deployments
- [Variables from API Calls](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/External-Data-Sources/Variables-from-API-Calls/page.md): Guide to using Kyverno apiCall to query the Kubernetes API with JMESPath to enforce stateful policies such as limiting LoadBalancer Services per namespace
- [Global Context](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/External-Data-Sources/Global-Context/page.md): Explains Kyverno GlobalContextEntry caching to reduce API server load by caching Kubernetes resources or external API data for efficient policy evaluations.
- [Variables from Image Registeries](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/External-Data-Sources/Variables-from-Image-Registeries/page.md): Explains using Kyverno's imageRegistry context to fetch OCI image config and manifest, enabling policies to detect root-running images and enforce image-level admission controls

### ImageVerify Rules

- [Section Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/ImageVerify-Rules/Section-Introduction/page.md): Guide to Kyverno image verification using Sigstore cosign and Notary to cryptographically validate container image signatures and attestations so clusters run only trusted build artifacts.
- [Container Image Signing](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/ImageVerify-Rules/Container-Image-Signing/page.md): Explains why container image tags are insecure and how cryptographic signing and Kyverno verification with tools like Cosign enforce image authenticity and integrity
- [Image Signature using Notary](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/ImageVerify-Rules/Image-Signature-using-Notary/page.md): Guide to signing container images with Notation, inspecting Notary v2 signatures, and verifying integrity using image digests and trust stores, with notes on demo keys and Kyverno verification policies
- [Verify Notary Signatures with Kyverno](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/ImageVerify-Rules/Verify-Notary-Signatures-with-Kyverno/page.md): Explains configuring Kyverno verifyImages rules to validate Notary image signatures, resolve tags to digests, use attestors and caching for efficient cryptographic verification.
- [Verify Image Attestations](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/ImageVerify-Rules/Verify-Image-Attestations/page.md): Explains using signed attestations like SBOMs and vulnerability scans with Kyverno to verify signatures and enforce image security policies during admission

### Policy Exceptions

- [Section Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Policy-Exceptions/Section-Introduction/page.md): Explains Kyverno policy exceptions to allow scoped, auditable exceptions for workloads while preserving cluster security, with examples and best practices.
- [Policy Exceptions](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Policy-Exceptions/Policy-Exceptions/page.md): Explains Kyverno PolicyException enabling, configuring, and using auditable namespace scoped exceptions to bypass specific policy rules for targeted resources without editing core policies.
- [Pod Security Exemptions](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Policy-Exceptions/Pod-Security-Exemptions/page.md): Explains creating narrow Kyverno PolicyException to exempt specific Pod Security Standard controls for targeted workloads without weakening central policies

### Cleanup Policies

- [Section Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Cleanup-Policies/Section-Introduction/page.md): Automating Kubernetes resource cleanup using Kyverno via declarative CleanupPolicy and ClusterCleanupPolicy or per-resource TTL labels to remove aged or orphaned objects.
- [Cleanup Policy](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Cleanup-Policies/Cleanup-Policy/page.md): Describes Kyverno cleanup policies and controller that schedule and delete matched Kubernetes resources, including RBAC aggregation to grant safe deletion permissions.
- [Cleanup Label](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Cleanup-Policies/Cleanup-Label/page.md): Explains Kyverno's per resource cleanup TTL label for automatic deletion, supported TTL formats, RBAC needs, reconciliation timing, and when to use label versus cluster cleanup policies.

### Reporting

- [Section Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Reporting/Section-Introduction/page.md): Explains Kyverno reporting using PolicyReport and ClusterPolicyReport to convert policy evaluations into structured, queryable compliance reports with audit-mode entries and background scans.
- [PolicyReport Schema](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Reporting/PolicyReport-Schema/page.md): Explains Kyverno PolicyReport schema and reports controller generating and interpreting policy evaluation results in Kubernetes
- [PolicyReport from Admission Requests](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Reporting/PolicyReport-from-Admission-Requests/page.md): Explains how Kyverno creates PolicyReports during real time admission requests, detailing admission versus background modes, failureAction effects, ephemeral reports, and the Reports Controller lifecycle
- [PolicyReport from Background Scan](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Reporting/PolicyReport-from-Background-Scan/page.md): Explains Kyverno background scanning that evaluates existing cluster resources to generate PolicyReports, how spec.background controls it, scheduling by the Reports Controller, use cases and limitations.

### Kyverno CLI

- [Section Introduction](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Kyverno-CLI/Section-Introduction/page.md): Explains using the Kyverno CLI to shift validation left, enabling local policy validation, mutation, and testing to catch Kubernetes configuration errors before applying to clusters.
- [apply Command Part 1](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Kyverno-CLI/apply-Command-Part-1/page.md): Guide to using the Kyverno CLI and kyverno apply to locally validate Kubernetes policies and manifests for fast feedback, enforcement simulation, and CI integration.
- [apply Command Part 2](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Kyverno-CLI/apply-Command-Part-2/page.md): Using kyverno apply to produce PolicyReport output, test policies against live clusters, validate PolicyExceptions, and supply Values files for accurate local policy evaluation.
- [apply Command Part 3](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Kyverno-CLI/apply-Command-Part-3/page.md): Using the Kyverno CLI apply to preview and save mutate and generate policy effects, including handling target resources and common flags
- [test Command](https://notes.kodekloud.com/docs/Prep-Course-Kyverno-Certified-Associate-KCA-Certification/Kyverno-CLI/test-Command/page.md): Describes using kyverno test to create declarative policy test suites with kyverno-test.yaml, asserting validation mutate and generate outcomes for automated CI CD regression detection.