From 36c85798c2ca0de7df81cead60d67696109a48c5 Mon Sep 17 00:00:00 2001
From: Taylor Price <tayworm@gmail.com>
Date: Fri, 30 Aug 2019 09:28:05 -0700
Subject: [PATCH] mention `extra_binds` functionality

---
 .../v2.x/en/security/hardening-2.2/_index.md   | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/content/rancher/v2.x/en/security/hardening-2.2/_index.md b/content/rancher/v2.x/en/security/hardening-2.2/_index.md
index fdb49fa2790..2f73b7c0be2 100644
--- a/content/rancher/v2.x/en/security/hardening-2.2/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.2/_index.md
@@ -175,6 +175,10 @@ resources:
 
 Where `secret` is the 32-byte base64-encoded string generated in the first step.
 
+**NOTE:**
+
+Files that are placed in `/opt/kubernetes` need to be mounted in using the `extra_binds` functionality in RKE.
+
 ### 1.1.3 - Install the audit log configuration on all control plane nodes.
 
 **Profile Applicability**
@@ -245,6 +249,10 @@ rules:
 - level: Metadata
 ```
 
+**NOTE:**
+
+Files that are placed in `/opt/kubernetes` need to be mounted in using the `extra_binds` functionality in RKE.
+
 ### 1.1.4 - Place Kubernetes event limit configuration on each control plane host
 
 **Profile Applicability**
@@ -340,6 +348,10 @@ limits:
   burst: 20000
 ```
 
+**NOTE:**
+
+Files that are placed in `/opt/kubernetes` need to be mounted in using the `extra_binds` functionality in RKE.
+
 ## 2.1 - Rancher HA Kubernetes Cluster Configuration via RKE
 
 (See Appendix A. for full RKE `cluster.yml` example)
@@ -498,6 +510,7 @@ services:
       tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
     extra_binds:
       - "/var/log/kube-audit:/var/log/kube-audit"
+      - "/opt/kubernetes:/opt/kubernetes"
 ```
 
 - Reconfigure the cluster:
@@ -506,6 +519,10 @@ services:
 rke up --config cluster.yml
 ```
 
+**NOTE:**
+
+Files that are placed in `/opt/kubernetes` need to be mounted in using the `extra_binds` functionality in RKE.
+
 ### 2.1.3 - Configure scheduler options
 
 **Profile Applicability**
@@ -1063,6 +1080,7 @@ services:
       tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
     extra_binds:
       - "/var/log/kube-audit:/var/log/kube-audit"
+      - "/opt/kubernetes:/opt/kubernetes"
   scheduler:
     extra_args:
       profiling: "false"