All Products
Search
Document Center

:DescribePolicyGovernanceInCluster

Last Updated:Jan 09, 2024

You can call the DescribePolicyGovernanceInCluster operation to query information about policies in a Container Service for Kubernetes (ACK) cluster.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Debug

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

  • Operation: the value that you can use in the Action element to specify the operation on a resource.
  • Access level: the access level of each operation. The levels are read, write, and list.
  • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
    • The required resource types are displayed in bold characters.
    • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
  • Condition Key: the condition key that is defined by the cloud service.
  • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
OperationAccess levelResource typeCondition keyAssociated operation
cs:DescribePolicyGovernanceInClusterRead
  • Cluster
    acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}
    none
none

Request syntax

GET /clusters/{cluster_id}/policygovernance

Request parameters

ParameterTypeRequiredDescriptionExample
cluster_idstringYes

The cluster ID.

c8155823d057948c69a****

Response parameters

ParameterTypeDescriptionExample
object

Schema of Response

on_stateobject []

Details about the policies of different severity levels that are enabled for the cluster.

enabled_countinteger

The number of policies that are enabled.

3
totalinteger

The total number of policies of the severity level.

8
severitystring

The severity level of the policy.

high
admit_logobject

The audit logs of the policies in the cluster.

progressstring

The status of the query. Valid values:

  • Complete: The query succeeded and the complete query result is returned.
  • Incomplete: The query succeeded but the query result is incomplete. To obtain the complete query result, you must repeat the request.
Complete
countlong

The number of audit log entries.

100
logobject

The audit log content.

msgstring

The message that appears when an event is generated by a policy.

d4hdhs*****
cluster_idstring

The cluster ID.

c8155823d057948c69a****
constraint_kindstring

The policy type.

ACKAllowedRepos
resource_namestring

The resource name.

nginx-deployment-basic2-84ccb74bfc-df22p
resource_kindstring

The resource type.

Pod
resource_namespacestring

The namespace to which the resource belongs.

default
totalViolationsobject

Details about the blocking and alerting events that are triggered by policies of different severity levels.

denyobject

Details about the blocking events that are triggered by the policies of each severity level.

severitystring

The severity level of the policy.

high
violationslong

The number of blocking events that are triggered.

0
warnobject

Details about the alerting events that are triggered by the policies of each severity level.

severitystring

The severity level of the policy.

low
violationslong

The number of alerting events that are triggered.

5
violationsobject

Details about the blocking and alerting events that are triggered by different policies.

denyobject

Details about the blocking events that are triggered by each policy.

policyNamestring

The policy name.

policy-gatekeeper-ackallowedrepos
policyDescriptionstring

The policy description.

Requires container images to begin with a repo string from a specified list.
violationslong

The total number of blocking events that are triggered by the policy.

11
severitystring

The severity level of the policy.

high
warnobject

Details about the alerting events that are triggered by the policies of each severity level.

policyNamestring

The policy name.

policy-gatekeeper-ackpspcapabilities
policyDescriptionstring

The policy description.

Controls Linux capabilities.
violationslong

The total number of alerting events that are triggered by the policy.

81
severitystring

The severity level of the policy.

high

Examples

Sample success responses

JSONformat

{
  "on_state": [
    {
      "enabled_count": 3,
      "total": 8,
      "severity": "high"
    }
  ],
  "admit_log": {
    "progress": "Complete",
    "count": 100,
    "log": {
      "msg": "d4hdhs*****",
      "cluster_id": "c8155823d057948c69a****",
      "constraint_kind": "ACKAllowedRepos",
      "resource_name": "nginx-deployment-basic2-84ccb74bfc-df22p",
      "resource_kind": "Pod",
      "resource_namespace": "default"
    }
  },
  "totalViolations": {
    "deny": {
      "severity": "high",
      "violations": 0
    },
    "warn": {
      "severity": "low",
      "violations": 5
    }
  },
  "violations": {
    "deny": {
      "policyName": "policy-gatekeeper-ackallowedrepos",
      "policyDescription": "Requires container images to begin with a repo string from a specified list.",
      "violations": 11,
      "severity": "high"
    },
    "warn": {
      "policyName": "policy-gatekeeper-ackpspcapabilities",
      "policyDescription": "Controls Linux capabilities.",
      "violations": 81,
      "severity": "high"
    }
  }
}

Error codes

For a list of error codes, visit the Service error codes.

Change history

Change timeSummary of changesOperation
No change history