public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

mention extra_binds functionality

Browse Source
This commit is contained in:
Taylor Price
2019-08-30 13:00:12 -07:00
committed by Denise
parent 349381a36d
commit 36c85798c2
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/security/hardening-2.2/_index.md
+18
View File
@@ -175,6 +175,10 @@ resources:
Where `secret` is the 32-byte base64-encoded string generated in the first step.
**NOTE:**
Files that are placed in `/opt/kubernetes` need to be mounted in using the `extra_binds` functionality in RKE.
### 1.1.3 - Install the audit log configuration on all control plane nodes.
**Profile Applicability**
@@ -245,6 +249,10 @@ rules:
- level: Metadata
```
**NOTE:**
Files that are placed in `/opt/kubernetes` need to be mounted in using the `extra_binds` functionality in RKE.
### 1.1.4 - Place Kubernetes event limit configuration on each control plane host
**Profile Applicability**
@@ -340,6 +348,10 @@ limits:
burst: 20000
```
**NOTE:**
Files that are placed in `/opt/kubernetes` need to be mounted in using the `extra_binds` functionality in RKE.
## 2.1 - Rancher HA Kubernetes Cluster Configuration via RKE
(See Appendix A. for full RKE `cluster.yml` example)
@@ -498,6 +510,7 @@ services:
tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
extra_binds:
- "/var/log/kube-audit:/var/log/kube-audit"
- "/opt/kubernetes:/opt/kubernetes"
```
- Reconfigure the cluster:
@@ -506,6 +519,10 @@ services:
rke up --config cluster.yml
```
**NOTE:**
Files that are placed in `/opt/kubernetes` need to be mounted in using the `extra_binds` functionality in RKE.
### 2.1.3 - Configure scheduler options
**Profile Applicability**
@@ -1063,6 +1080,7 @@ services:
tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
extra_binds:
- "/var/log/kube-audit:/var/log/kube-audit"
- "/opt/kubernetes:/opt/kubernetes"
scheduler:
extra_args:
profiling: "false"