CKS Kyverno pattern matching Practice Question
A Kyverno policy is written to require all images to use SHA256 digests instead of tags. The policy uses a 'validate' rule with 'pattern' on 'spec.containers[*].image'. Which pattern would match an image reference like 'registry.example.com/myapp@sha256:abc123...'?
⚠ Common exam trap
Candidates may mistakenly choose option A, noticing that both A and C contain 'sha256', but A is not strict enough and would match non-SHA256 digests. The difference between a wildcard match and a colon is subtle but crucial.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
"*@sha256:*"
Option C ('*@sha256:*') correctly matches image references using SHA256 digest. It ensures the digest algorithm is exactly 'sha256' followed by a colon and digest. Option A ('*@sha256*') is too permissive as it matches any image reference containing 'sha256' as a substring, potentially allowing other algorithms like 'sha256-extra'. Option B ('*@*') matches any digest algorithm, not specifically SHA256. Option D ('*:*') matches tags, not digests. Therefore, only C meets the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
*@sha256*
Why it's wrong here
Without the colon after 'sha256', this pattern matches any string containing '@sha256' as a substring, regardless of what follows. It would therefore accept invalid references such as '@sha256-extra' or '@sha256' alone, and it fails to ensure the colon separator and the hexadecimal digest required by the OCI distribution specification. This makes it overly permissive and not specific to a properly formatted SHA256 digest.
- ✗
"*@*"
Why it's wrong here
This pattern uses an '@' to split the image name from a digest but places a wildcard on both sides, so it accepts any digest algorithm such as 'sha512' or even arbitrary text after the '@'. It does not enforce that the algorithm is SHA256 or that the digest has the required 'algorithm:digest' structure, meaning images tagged with any digest type would pass. Consequently, it is too permissive and does not meet the policy's requirement to specifically require SHA256 digests.
- ✓
"*@sha256:*"
Why this is correct
Correct: In Kyverno's wildcard matching, this pattern requires an image reference that has '@sha256:' followed by any sequence of characters. That means the immutable part of the reference is a SHA256 digest with the standard 'algorithm:digest' format; the leading '*' accounts for the registry/repository/name, and the trailing '*' consumes the 64-character hex digest. This precisely ensures images are pinned to a SHA256 digest and not to a mutable tag.
- ✗
"*:*"
Why it's wrong here
This pattern is too broad: it matches any image reference that contains a colon, which includes ordinary tags like 'nginx:latest' as well as registry ports like 'localhost:5000/nginx'. It does not require an '@' digest marker or 'sha256', so images using tags or non-digest references would unexpectedly satisfy the policy. Thus, it fails to enforce the use of SHA256 digests.
Go deeper
Related to this question
About these practice questions
One of 114 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.