DescribePolicyGovernanceInCluster API Reference - Container Service for Kubernetes - Alibaba Cloud - Container Service for Kubernetes

ACK's container security policies offer built-in rule libraries, including Compliance, Infra, K8s-general, and PSP, to secure containers in a production environment. Call the DescribePolicyGovernanceInCluster API to query policy governance details for a target cluster, such as statistics on enabled policies by severity level, policy governance audit logs, interceptions, and alerts.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cs:DescribePolicyGovernanceInCluster

get

*Cluster

acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}

None

Request syntax

GET /clusters/{cluster_id}/policygovernance HTTP/1.1

Path Parameters

Parameter	Type	Required	Description	Example
cluster_id	string	Yes	The cluster ID.	c8155823d057948c69a****

Request parameters

Parameter

Type

Required

Description

Example

No parameters required.

Response elements

Element	Type	Description	Example
	object	The response schema.
on_state	array<object>	The statistics for enabled policies in the cluster, grouped by severity.
	object
enabled_count	integer	The number of enabled policies for the specified severity.	3
total	integer	The total number of available policies for the specified severity.	8
severity	string	The severity of the policy.	high
admit_log	object	Details of the audit log for policy governance in the cluster.
progress	string	The status of the query. Valid values: `Complete`: The query is complete, and the full result set is returned. `Incomplete`: The query is complete, but the results are partial. Another request may be needed to retrieve the remaining results.	Complete
count	integer	The total number of log entries returned by the query.	100
logs	array<object>	An array of log entries for policy violations.
	object
cluster_id	string	The cluster ID.	hash code
constraint_action	string	The action enforced by the policy. Valid values: `warn`: Generates an alert for the policy violation but does not block the request. `deny`: Blocks the request that violates the policy.	deny
constraint_api_version	string	The API version of the policy.	v1beta1
constraint_category	string	The category of the policy.	cis-k8s
constraint_group	string	The API group of the policy.	constraints.gatekeeper.sh
constraint_kind	string	The name of the policy in Policy Management.	ACKNamespacesDeleteProtection
constraint_name	string	The name of the policy instance.	namespace-delete-protection-jpjwv
event_msg	string	A detailed message about the policy enforcement event.	Admission webhook \"validation.gatekeeper.sh\" denied request, Resource Namespace: , Constraint: namespace-delete-protection-jpjwv, Message: not allow to delete protection namespace test.
event_type	string	The type of event that triggered the policy, such as `violation`.	violation
request_uid	string	The request ID.	hash code
request_userinfo	string	The user information for the request that violated the policy.	account id
request_username	string	The username for the request that violated the policy.	account user name
resource_kind	string	The type of the resource that violates the policy. For example, if a request to operate on a namespace is rejected, the value is `Namespace`.	Namespace
resource_name	string	The name of the resource that violated the policy.	test
time	string	The time when the policy violation occurred.	2025-10-27T11:31:40Z
log_project	string	The log project that stores policy enforcement logs.	k8s-log-clusterid
log_store	string	The logstore that stores policy enforcement logs.	policyadmit-clusterid
Violation	object	A summary of policy violations, aggregated by severity.
totalViolations	object	An aggregated summary of all violations.
deny	array<object>	A summary of `deny` actions.
	object
severity	string	The severity level. Valid values: `low`, `medium`, and `high`.	medium
violations	string	The total number of violations for this severity level.	2
warn	array<object>	A summary of `warn` actions.
	object
severity	string	The severity level.	high
violations	integer	The total number of violations for this severity level.	0
violations	object	A summary of violation records, aggregated by policy name.
deny	array<object>	A summary of `deny` actions for each policy.
	object
policyDescription	string	The description of the policy.	Prevent specific namespaces from being deleted.
policyName	string	The name of the policy.	ACKNamespacesDeleteProtection
severity	string	The severity of the policy.	medium
violations	integer	The total number of violations for this policy.	1
warn	array<object>	A summary of `warn` actions for each policy.
	object
policyDescription	string	The description of the policy.
policyName	string	The name of the policy.
severity	string	The severity of the policy.
violations	integer	The total number of violations for this policy.

Examples

Success response

JSON format

{
  "on_state": [
    {
      "enabled_count": 3,
      "total": 8,
      "severity": "high"
    }
  ],
  "admit_log": {
    "progress": "Complete",
    "count": 100,
    "logs": [
      {
        "cluster_id": "hash code",
        "constraint_action": "deny",
        "constraint_api_version": "v1beta1",
        "constraint_category": "cis-k8s",
        "constraint_group": "constraints.gatekeeper.sh",
        "constraint_kind": "ACKNamespacesDeleteProtection",
        "constraint_name": "namespace-delete-protection-jpjwv",
        "event_msg": "Admission webhook \\\"validation.gatekeeper.sh\\\" denied request, Resource Namespace: , Constraint: namespace-delete-protection-jpjwv, Message: not allow to delete protection namespace test.",
        "event_type": "violation",
        "request_uid": "hash code",
        "request_userinfo": "account id",
        "request_username": "account user name\n",
        "resource_kind": "Namespace",
        "resource_name": "test",
        "time": "2025-10-27T11:31:40Z"
      }
    ],
    "log_project": "k8s-log-clusterid",
    "log_store": "policyadmit-clusterid"
  },
  "Violation": {
    "totalViolations": {
      "deny": [
        {
          "severity": "medium",
          "violations": "2"
        }
      ],
      "warn": [
        {
          "severity": "high",
          "violations": 0
        }
      ]
    },
    "violations": {
      "deny": [
        {
          "policyDescription": "Prevent specific namespaces from being deleted.",
          "policyName": "ACKNamespacesDeleteProtection",
          "severity": "medium",
          "violations": 1
        }
      ],
      "warn": [
        {
          "policyDescription": "",
          "policyName": "",
          "severity": "",
          "violations": 0
        }
      ]
    }
  }
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.