Policy Reports: KCA practice questions

Policy reports are the custom resources in which Kyverno records how resources fare against its policies. A PolicyReport is namespaced and holds results for resources in its namespace; a ClusterPolicyReport is cluster-scoped and holds results for cluster-scoped resources. Reports describe the current state of the cluster and do not keep history, so a fixed resource simply stops failing.

By Ibrahim Yesilay · Published 23 Oct 2026 · Updated 23 Oct 2026

Independent community practice, not affiliated with or endorsed by CNCF or The Linux Foundation.

What Policy Reports covers in KCA

Each result has one of five values. pass means the rule applied and the resource satisfied it. fail means it did not. warn is a failure downgraded because the policy carries the annotation policies.kyverno.io/scored set to "false". error means variable substitution failed outside of preconditions, for example inside a pattern. skip means the rule was not evaluated because its preconditions were not met or a PolicyException applied, and a skip is not a failure. Every report also has a summary block counting pass, fail, warn, error and skip.

Reports are produced in two stages. Admission activity first creates AdmissionReports and ClusterAdmissionReports, background processing creates BackgroundScanReports and ClusterBackgroundScanReports, and the reports controller merges these intermediate objects into the final PolicyReport and ClusterPolicyReport resources. Background scanning runs periodically, every hour by default, set by the reports controller's backgroundScanInterval flag, which also accepts values such as 10m. Results for existing resources therefore lag behind changes until the next scan.

Whether a violation shows up depends on the policy's action and its background setting. With Enforce, violating new resources are blocked at admission, so for new resources only passes are recorded; existing resources are still reported if background is true. With Audit, new resources are reported as they are admitted and existing ones through the scan. With background false, existing resources do not appear at all. A background scan never blocks a resource, even under Enforce. For CI gates this means a policy in Audit mode still produces fail entries, and a report seen right after a change may not yet reflect it.

Report names are tied to the resource they describe. The examples show reports named after the UID of the resource, with an owner reference to it, and the guide notes that names look random, so kubectl get polr -o wide is the way to see which resource each belongs to. kubectl get policyreport -A lists the namespaced reports with their summary counts, kubectl get clusterpolicyreport lists the cluster-scoped ones, and a jsonpath filter on results where result is fail extracts the failing entries. The Kyverno CLI can produce the same kind of output offline with kyverno apply and --policy-report for validate policies, with --cluster to check live resources.

Key points

warn is a fail converted by the policies.kyverno.io/scored: "false" annotation.
skip results come from unmet preconditions or applied PolicyExceptions.
Background scans run every hour by default and are tuned with backgroundScanInterval.
Under Enforce, new resources only ever appear as passes because violations are blocked.

Three sample questions

10 KCA questions on Policy Reports, 10 with explanations. How practice works

Question 1

A ClusterPolicy evaluates Namespace resources and records a violation on the finance namespace. Where does that finding land?

A.In a ClusterPolicyReport, because Namespace is a cluster-scoped resource — the report kind follows the resource, not the policy.
B.In both a PolicyReport and a ClusterPolicyReport, mirrored.
C.In a PolicyReport inside the kyverno namespace, where all cluster-level findings are collected.
D.In a PolicyReport inside the finance namespace, because that is the resource involved.

Correct answer: A

The choice between PolicyReport and ClusterPolicyReport is determined by the scope of the *reported resource*. A Namespace is cluster-scoped, so its findings go into a ClusterPolicyReport, even though a namespace "contains" things.

Question 2

kubectl get polr -A returns reports whose names are UUIDs like 487df031-11d8-4ab4-b089-dfc0db1e533e. What is that UUID?

A.The metadata.uid of the resource the report describes — modern Kyverno keeps one report per resource.
B.A hash of the policy name plus the namespace name.
C.The UID of the ClusterPolicy that produced the finding.
D.A random identifier assigned per scan cycle.

Correct answer: A

Since Kyverno 1.10 reports are stored per-resource and named after the reported resource's UID, with an ownerReferences entry back to that resource so the report is garbage-collected when the resource is deleted. You find a report by the KIND/NAME printer columns or via the resource's UID, never by guessing a name.

Question 3

A report entry reads result: skip. What does that tell you?

A.The rule did not match the resource, so nothing was evaluated.
B.The rule matched but was deliberately not applied — a precondition was false, a conditional anchor's condition was unmet, or a PolicyException exempted the resource.
C.The resource passed, but the policy is advisory.
D.Kyverno could not evaluate the rule because of an internal error.

Correct answer: B

skip is a positive statement that the rule *did* apply to this resource and was then deliberately not enforced. When the cause is a PolicyException, the entry also carries properties.exceptions naming the exception — which is exactly what makes exemptions auditable.

Practice this topic

Focus mode keeps every question on Policy Reports until you leave it. 10 free guest answers, then a free account; no credit card.

Or open KCA practice across all topics.

Sources

The explanation above was checked against these official documents.

Kyverno docs: Policy Reports (checked 2026-10-23)
Kyverno docs: Configuring Kyverno (checked 2026-10-23)
Kyverno docs: Kyverno CLI (checked 2026-10-23)

Frequently asked questions

Why does my report show an opaque name instead of the resource name?

Reports are named after the UID of the resource they describe. Use kubectl get polr with -o wide to see the kind and name of the resource each report belongs to.