SupportConsoleDevelopersStart a trialContact

Chapter 11. Governance dashboard

Use the Governance dashboard in the Red Hat Advanced Cluster Management console to manage policies and policy set violations, and review fleet compliance from a single view.

  • Governance page

    The following tabs are displayed on the Governance page: Overview, Policy sets, and Policies. Read the following descriptions to know which information is displayed:

    • Overview

      The following summary cards are displayed from the Overview tab: Policy set violations, Policy violations, Clusters, Categories, Controls, and Standards.

    • Policy sets

      Create and manage hub cluster policy sets.

    • Policies

      • Create and manage security policies. The policy table displays the Name, Namespace, and Cluster violations of each policy.
      • You can edit, enable or disable, set remediation to inform or enforce, or remove a policy by selecting the Actions icon. You can view the categories and standards of a specific policy by selecting the drop-down arrow to expand the row.
      • Reorder your table columns in the Manage column dialog box. Select the Manage column icon for the dialog box to be displayed. To reorder your columns, select the Reorder icon and move the column name. For columns that you want to appear in the table, click the checkbox for specific column names and select the Save button.

  • Complete bulk actions by selecting multiple policies and clicking the Actions button. You can also customize your policy table by clicking the Filter button.

    When you select a policy in the table list, the following tabs of information are displayed from the console:

    • Details: Select the Details tab to view policy details and placement details. In the Placement table, the Compliance column provides links to view the compliance of the clusters that are displayed.
    • Results: Select the Results tab to view a table list of all clusters that are associated to the policy. From the Message column, click the View details link to view the template details, template YAML, and related resources. You can also view related resources. Click the View history link to view the violation message and a time of the last report.

Additional resources

11.1. Governance metrics
Copy link

The policy framework exposes metrics that show policy distribution and status on the hub cluster and managed clusters.

Use these metrics to monitor policy compliance across the fleet and to assess configuration policy evaluation performance on managed clusters. Hub metrics (policy_governance_info) track root and propagated policies. Managed cluster metrics (cluster_policy_governance_info) track policy status on each cluster. The evaluation duration histogram helps you tune concurrency and evaluation intervals. If you enable observability, you can query these metrics from the Grafana Explore page.

The policy framework exposes the following metrics:

  • policy_governance_info

    The policy_governance_info metric records compliance status for root and propagated policies on the hub cluster.

The OpenShift Container Platform monitoring component collects this metric. If you enable observability, the component collects some aggregate data.

When you create a policy, you create a root policy. The framework watches for root policies, Placement resources, and PlacementBindings resources for information about where to create propagated policies on managed clusters.

For both root and propagated policies, the metric records the following values:

  • 0: compliant
  • 1: non-compliant
  • -1: unknown or pending

The policy_governance_info metric uses the following labels:

  • type: root or propagated
  • policy: name of the associated root policy
  • policy_namespace: namespace on the hub cluster where the root policy is defined
  • cluster_namespace: namespace for the cluster where the policy is distributed

These labels and values enable queries that show policy activity in the cluster that might otherwise be difficult to track.

+ * If you do not need these metrics and have performance or security concerns, disable collection by setting the DISABLE_REPORT_METRICS environment variable to true in the propagator deployment. * You can add policy_governance_info to the observability allowlist as a custom metric. See Adding custom metrics for more details.

  • cluster_policy_governance_info

    The cluster_policy_governance_info metric records compliance status for policies on managed clusters.

The OpenShift Container Platform monitoring component collects this metric. If you enable observability, the component collects the data.

For managed cluster policies, the metric records the following values:

  • 0: compliant
  • 1: non-compliant
  • -1: unknown or pending

The cluster_policy_governance_info metric uses the following labels:

  • kind: kind of the policy
  • policy: name of the policy
  • policy_namespace: namespace on the managed cluster where the policy is defined
  • severity: severity specified on the policy

Use these labels and values to enable detailed queries on changes in the cluster that might be difficult to track.

+ * You can add cluster_policy_governance_info to the observability allowlist as a custom metric. See Adding custom metrics for more details.

  • config_policies_evaluation_duration_seconds

    The config_policies_evaluation_duration_seconds histogram tracks how long the configuration policy controller takes to evaluate policies that are ready on a managed cluster.

Use this metric to determine whether to change the ConfigurationPolicy evaluationInterval for resource-intensive policies that do not need frequent evaluation. You can also increase concurrency at the cost of higher resource utilization on the Kubernetes API server. See Configure configuration policy controller concurrency for more details.

Query the histogram with the following metrics:

  • config_policies_evaluation_duration_seconds_bucket: cumulative buckets in seconds (1, 3, 9, 10.5, 15, 30, 60, 90, 120, 180, 300, 450, 600, and greater)
  • config_policies_evaluation_duration_seconds_count: count of all events
  • config_policies_evaluation_duration_seconds_sum: sum of all values

To calculate average evaluation time, use a Prometheus query similar to the following expression:

rate(config_policies_evaluation_duration_seconds_sum[10m])/rate(config_policies_evaluation_duration_seconds_count[10m])

The config-policy-controller pod in the open-cluster-management-agent-addon namespace on managed clusters calculates this metric. The controller does not send this metric to observability by default.

Additional resources

Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top