Course Introduction

As Kubernetes adoption continues to grow—now running in over 70% of enterprise production environments—policy management and governance are top priorities for organizations. Teams often struggle to enforce security, compliance, and operational best practices at scale. Kyverno fills that gap. Kyverno is a Kubernetes-native policy engine that enables you to validate, mutate, generate, and report on Kubernetes resources using policies written as plain YAML. Because Kyverno uses familiar Kubernetes primitives and workflows, it makes implementing “policy as code” straightforward across clusters and CI/CD pipelines.

The image shows a person speaking into a microphone, sitting indoors, with the words "Validate" and "Mutate" displayed nearby.

Demand for professionals who can design and enforce policy-as-code in cloud-native environments is rising. If you want to validate your skills and stand out as a Kubernetes security and governance specialist, the Kyverno Certified Associate (KCA) certification is an excellent next step. Welcome to the Kyverno Certified Associate Certification course. I’m Mariam Fahmy, and I’ll guide you through mastering Kyverno policies and governance in Kubernetes.

A woman wearing a hijab is speaking into a microphone, and there's a "Kyverno Certified Associate" badge overlayed on the image.

This hands-on training is designed to prepare you for the KCA exam while teaching practical techniques to enforce policies, improve security posture, and streamline operations in Kubernetes clusters. Each module contains labs, real-world scenarios, and exercises where you apply Kyverno policies directly in a cluster. Example: verifying Kyverno resources in a cluster

# List namespaces
kubectl get namespaces
NAME               STATUS   AGE
default            Active   75s
kube-flannel       Active   75s
kube-node-lease    Active   86s
kube-public        Active   87s
kube-system        Active   87s
kyverno            Active   57s

# Check Kyverno pods
kubectl get pods -n kyverno
NAME                                           READY   STATUS            RESTARTS   AGE
kyverno-admission-controller-5b789b5b-rq2f     0/1     PodInitializing   0          51s
kyverno-background-controller-5f89f696c9c9-5rf9 1/1     Running           0          51s
kyverno-cleanup-controller-84d58454-pbhsf      1/1     Running           0          51s
kyverno-reports-controller-87458444-qvhzf1     1/1     Running           0          51s

Quick policy example: enforce Pod Security baseline via a ClusterPolicy

# policy.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: podsecurity-subrule-baseline
spec:
  validationFailureAction: Enforce
  rules:
    - name: baseline
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        podSecurity:
          level: baseline
          version: latest

# Apply and check policy
kubectl apply -f policy.yaml
clusterpolicy.kyverno.io/podsecurity-subrule-baseline created

kubectl get cpol
NAME                          ADMISSION   BACKGROUND   READY   AGE   MESSAGE
podsecurity-subrule-baseline  true        true         True    9s    Ready

To help you prepare for the KCA exam, this course includes mock exams modeled on the real test so you can measure readiness and build confidence. By earning the KCA certification, you demonstrate knowledge of Kyverno’s architecture, the policy lifecycle, and advanced capabilities—skills that make you a valuable asset in modern Kubernetes environments. Course roadmap overview

Module	What you’ll learn
Introduction to Kyverno	What Kyverno is, how it works, installation options, and policy structure.
Resource filtering	Target resources precisely using `match`, `any`/`all`, `exclude`, and preconditions.
Validation rules	Build powerful `validate` policies with `patterns`, `deny` conditions, `forEach`, CEL expressions, and Pod Security sub-rules.
Mutation rules	Modify resources using JSONPatch, strategic merge patches, and conditional anchors.
Generate rules	Automate resource creation (ConfigMap, NetworkPolicy, etc.) and keep resources synchronized.
ImageVerify rules	Verify container image signatures and attestations to secure the supply chain.
Policy exceptions & cleanup	Create PolicyException resources, cleanup unused resources, reporting, and Kyverno CLI usage.

Resource filtering example — target resources with match and any

match:
  any: # Match if Block 1 OR Block 2 is true
    - resources: # Block 1: Critical Deployments
        kinds:
          - Deployment
      selector:
        matchLabels:
          app: critical
    - resources: # Block 2: All StatefulSets
        kinds:
          - StatefulSet

Validate rules example — deny a container running as root using securityContext

spec:
  securityContext:
    runAsNonRoot: true
  containers:
    - name: bad-container
      securityContext:
        runAsNonRoot: false

Mutation and generate rules let you modify or create resources automatically. For example, a generate rule can create a NetworkPolicy or ConfigMap and keep it synchronized with a source resource:

spec:
  rules:
    - name: deny-all-traffic
      match:
        ...
      generate:
        synchronize: true
        ...

ImageVerify rules teach you how to verify container image signatures and attestations to strengthen your supply chain security—an increasingly important control in enterprise deployments.

The image shows a person speaking into a microphone with a list of topics under "Kyverno Certified Associate Curriculum" on the left. The topics include introductions, filters, rules validation, mutation, generation, ImageVerify Rules, and management.

You will also learn to:

Create PolicyException resources to exempt resources from specific policy rules.
Use cleanup policies to remove orphaned or unused resources.
Track compliance and generate reports using Kyverno reporting features.
Use the Kyverno CLI to build, validate, and test policies locally before applying them to a cluster.

PolicyException example (exempt resources from specific policy rules)

apiVersion: kyverno.io/v2
kind: PolicyException
metadata:
  name: `exception-name`
  namespace: `exception-namespace`
spec:
  # 1. WHICH policy and rule(s) to bypass?
  exceptions:
    - policyName: `name-of-policy-to-exempt`
      ruleNames:
        - `name-of-rule-to-exempt`
  # 2. WHICH resource(s) get the exception?
  match:
    any:
      ...
  # 3. (Optional) Under WHAT extra conditions?
  conditions:
    any:
      ...

At KodeKloud, we foster an active learning community where you can ask questions, share insights, and collaborate with fellow learners—enhancing your hands-on experience.

This course is hands-on: expect labs, real cluster exercises, and mock exams. Apply policies in a live environment to cement your understanding.

Are you ready to master Kyverno and become a Kubernetes Policy Expert? Links and references

Kyverno Documentation: https://kyverno.io/docs/
Kubernetes Documentation: https://kubernetes.io/docs/
KCA Exam Overview: https://kyverno.io/certification/ (refer to the official Kyverno site for the latest exam details)
KodeKloud courses and community: https://www.kodekloud.com/

Course Introduction

Kyverno Introduction

Resource Filters

Validate Rules

Mutate Rules

Generate Rules

External Data Sources

ImageVerify Rules

Policy Exceptions

Cleanup Policies

Reporting

Kyverno CLI

Course Introduction

Watch Video