DescribePolicyGovernanceInCluster - Container Service for Kubernetes

Queries detailed information about the policies used by the clusters that are associated with a master instance.

Debugging

You can run this interface directly in OpenAPI Explorer, saving you the trouble of calculating signatures. After running successfully, OpenAPI Explorer can automatically generate SDK code samples.

Debug

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

Operation: the value that you can use in the Action element to specify the operation on a resource.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- For mandatory resource types, indicate with a prefix of * .
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition Key: the condition key that is defined by the cloud service.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Operation	Access level	Resource type	Condition key	Associated operation
adcp:DescribePolicyGovernanceInCluster	list	All Resources ``	none	none

Request parameters

Parameter	Type	Required	Description	Example
ClusterId	string	Yes	The ID of the master instance.	c09946603cd764dac96135f51d1ba****

Response parameters

Parameter	Type	Description	Example
	object	Schema of Response
RequestId	string	The request ID.	96C6A284-0EC3-5486-9A97-E8E9EE27E9EF
PolicyGovernances	array<object>	The detailed information about the policies.
PolicyGovernance	object	The detailed information about the policies.
Cluster	object	The information about the associated clusters in which the policies are deployed.
ClusterId	string	The ID of the associated cluster.	ca5cf1b5edb5c4736a6ea0dfb4061****
Name	string	The name of the associated cluster.	ack-001
RegionId	string	The region ID of the associated cluster.	cn-heyuan
State	string	The status of the associated cluster.	running
ClusterType	string	The type of the associated cluster.	ManagedKubernetes
ClusterSpec	string	The specifications of the associated cluster.	ack.pro.small
Profile	string	The identifier of the associated cluster.	Default
PolicyGovernance	object	The detailed policy information.
OnState	array<object>	The number of policies of each severity level enabled in the associated cluster.
State	object	The number of policies of each severity level enabled in the associated cluster.
EnabledCount	long	The types of policies that are enabled in the associated cluster.	2
TotalCount	long	The types of policies of each severity level.	2
Severity	string	The severity level.	low
AdmitLog	object	The audit log generated by the associated cluster.
Progress	string	The status of the query. Valid values: Complete: The query is successful, and the complete result is returned. Incomplete: The query is successful, but the query result is incomplete. To obtain the complete result, you must call the operation again.	Complete
Count	string	The number of log entries in the query result.	100
Logs	array<object>	The content of the audit log.
Log	object	The content of the audit log.
	string	The content of the audit log.	c8155823d057948c69a****
LogProject	string	The name of the Log Service project.	demo
LogStore	string	The name of the Logstore.	demo
Violation	object	The number of deployments that match the policies in the associated cluster, including deployments that are blocked and deployments that have triggered alerting.
TotalViolations	object	The number of deployments that match the policies in the associated cluster, including deployments that are blocked and deployments that have triggered alerting. The deployments are classified by severity level.
Deny	array<object>	The information about the deployments that are blocked.
DenySeverity	object	The information about the deployments that are blocked.
Severity	string	The severity level.	low
Violations	long	The number of deployments that are blocked.	2
Warn	array<object>	The information about the deployments that have triggered alerting.
WarnSeverity	object	The information about the deployments that have triggered alerting.
Severity	string	The severity level.	low
Violations	string	The number of deployments that have triggered alerting.	2
Violations	object	The number of deployments that match the policies in the associated cluster, including deployments that are blocked and deployments that have triggered alerting. The deployments are classified by policy type.
Deny	array<object>	The information about the deployments that are blocked.
DenyViolations	object	The information about the deployments that are blocked.
PolicyName	string	The name of the policy.	ACKPSPCapabilities
PolicyDescription	string	The description of the policy.	Restricts secrets used in pod envs
Severity	string	The severity level of the policy.	low
Violations	long	The number of times that the policy blocks deployments.	2
Warn	array<object>	The information about the deployments that have triggered alerting.
WarnViolations	object	The information about the deployments that have triggered alerting.
PolicyName	string	The name of the policy.	ACKPSPCapabilities
PolicyDescription	string	The description of the policy.	Restricts secrets used in pod envs
Severity	string	The severity level of the policy.	low
Violations	long	The number of times that the policy generates alerts.	2

Examples

Sample success responses

JSONformat

{
  "RequestId": "96C6A284-0EC3-5486-9A97-E8E9EE27E9EF",
  "PolicyGovernances": [
    {
      "Cluster": {
        "ClusterId": "ca5cf1b5edb5c4736a6ea0dfb4061****",
        "Name": "ack-001",
        "RegionId": "cn-heyuan",
        "State": "running",
        "ClusterType": "ManagedKubernetes",
        "ClusterSpec": "ack.pro.small ",
        "Profile": "Default"
      },
      "PolicyGovernance": {
        "OnState": [
          {
            "EnabledCount": 2,
            "TotalCount": 2,
            "Severity": "low"
          }
        ],
        "AdmitLog": {
          "Progress": "Complete",
          "Count": 100,
          "Logs": [
            {
              "key": "c8155823d057948c69a****\n"
            }
          ],
          "LogProject": "demo",
          "LogStore": "demo"
        },
        "Violation": {
          "TotalViolations": {
            "Deny": [
              {
                "Severity": "low",
                "Violations": 2
              }
            ],
            "Warn": [
              {
                "Severity": "low",
                "Violations": 2
              }
            ]
          },
          "Violations": {
            "Deny": [
              {
                "PolicyName": "ACKPSPCapabilities",
                "PolicyDescription": "Restricts secrets used in pod envs\n",
                "Severity": "low",
                "Violations": 2
              }
            ],
            "Warn": [
              {
                "PolicyName": "ACKPSPCapabilities",
                "PolicyDescription": "Restricts secrets used in pod envs\n",
                "Severity": "low",
                "Violations": 2
              }
            ]
          }
        }
      }
    }
  ]
}

Error codes

For a list of error codes, visit the Service error codes.

Change history

Change time	Summary of changes	Operation

No change history