KCA: The Kyverno Certified Associate Exam, Domain by Domain

The Kyverno Certified Associate (KCA) is the only certification for Kyverno, the Kubernetes-native policy engine. The Linux Foundation rates it beginner with no prerequisites, and it follows the shape of the other associate exams: 90 minutes, multiple choice, online proctored, $250 for the exam alone, valid two years with one retake included.

The blueprint is lopsided in a way that shapes preparation. Writing Policies is 32 %, followed by Fundamentals and Installation, Configuration and Upgrades at 18 % each, the Kyverno CLI at 12 %, and Applying Policies and Policy Management at 10 % each. So the largest block is authoring — and because the format is multiple choice, you are asked to recognise correct policy structure rather than produce it, with no editor to catch a mistyped field. Linux Foundation multiple-choice exams also require 75 % to pass and permit no tools, resources or external sites, so Kyverno's documentation is not available to you.

There is a second thing to settle before you study, and the exam page does not settle it for you: Kyverno changed its policy model, and the blueprint names no version. That question gets its own section below. For the wider field see which cloud native certification should you take?, and for the engine comparison people usually make alongside it, Kyverno vs OPA and Gatekeeper. Gnoseed does not sell or proctor this exam — it is a free study companion.

Kyverno replaced its policy model, and the change is not cosmetic. The CEL-based types — ValidatingPolicy, MutatingPolicy, GeneratingPolicy, DeletingPolicy and ImageValidatingPolicy — arrived across v1.14 and v1.15 and became stable in v1.18. The older ClusterPolicy was marked deprecated in v1.17 and, as of v1.19, is scheduled for removal in v1.20. Field names differ throughout: match became matchConstraints, preconditions became matchConditions, and validationFailureAction: Enforce became validationActions: Deny.

The Linux Foundation's KCA page publishes the domains and their weights but no Kyverno version, and there is no program-changes notice resolving it. Meanwhile the official prep course, LFS255, still lists a classic-model syllabus with no mention of CEL. So the two signals available point in opposite directions, and roughly half the blueprint — Writing Policies, Applying Policies and Policy Management — sits exactly where the two APIs differ.

The practical answer is to learn the current API and know the mapping. Study the CEL types, because that is what a cluster you touch after v1.20 will run, and learn which legacy field each new one replaced — that mapping is cheap to hold and covers you whichever spelling the exam uses. Then confirm the current exam version with the Linux Foundation before you book, because this is precisely the kind of detail that changes without much noise.

A performance-based exam rewards fluency: half-remember a flag and you can check it, and the clock is the real constraint. KCA is the opposite. It is closed-book, so an approximate memory of whether enforcement lives in validationActions or failurePolicy converts straight into a wrong answer — and those two are genuinely easy to conflate, because both describe something failing.

The same is true of Kyverno's controllers. There are four — admission, background, reports and cleanup — and only the admission controller is required. The trap is that the background controller does not run background scans; the reports controller does, while the background controller handles generation and mutate-existing. That pairing accounts for a surprising share of confusion, and it spans two domains of the blueprint.

So the highest-value preparation is exact recall of names, defaults and boundaries: which field does what, which controller owns which work, what the default webhook timeout is, what a given report result actually means. That is the shape of knowledge spaced repetition builds well — and the reason this page sits on a flashcards site rather than a lab one.

KCA sits in the Linux Foundation's associate tier and follows its conventions: no prerequisites, $250 for the exam alone or $495 bundled with a THRIVE-ONE annual subscription, two years of validity, a twelve-month eligibility window and one retake included.

It is a narrow credential, and that is the point — it certifies a product you either run or do not. If policy as code interests you but Kyverno is not what your clusters use, the neighbouring exam families are worth comparing first; if you want the broader landscape rather than one engine, an exam like KCNA covers the ecosystem instead. Confirm the current price and policies on the Linux Foundation's KCA page before booking, rather than from a comparison page including this one.