adding content to RKE

content/rancher/v2.x/en/installation/api-auditing/_index.md

@@ -5,6 +5,8 @@ weight: 10000
 
 Rancher ships with API Auditing to record the sequence of system events initiated by individual users. You can know what happened, when it happened, who initiated it, and what cluster it affected. API auditing records all requests and responses to and from the Rancher API, which includes use of the Rancher UI and any other use of the Rancher API through programmatic use.
 
+You can enable API Auditing during Rancher installation or upgrade.
+
 ## API Auditing Usage
 
 Each API transaction creates two entries for it in the audit log, one for requests and one for response: `RequestReceived` and `ResponseComplete`. Each log transaction for a request/response pair uses the same `auditID` value.

content/rancher/v2.x/en/installation/single-node/_index.md

@@ -68,6 +68,16 @@ Choose from the following options:
 - [Option D—Bring Your Own Certificate: Private CA Root Certificate CA](#option-d-bring-your-own-certificate-private-ca-root-certificate)
 - [Option E—Let's Encrypt Certificate](#option-e-let-s-encrypt-certificate)
 
+>**Note:** When entering the command to install Rancher using any of the options below, you can declare additional flags to enable [API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing), which records all interactions with the Rancher API. If you want to enable API Auditing, append the following flags to your install command:
+>
+>```
+-e AUDIT_LEVEL=1 \
+-e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \
+-e AUDIT_LOG_MAXAGE=20 \
+-e AUDIT_LOG_MAXBACKUP=20 \
+-e AUDIT_LOG_MAXSIZE=100 \
+```
+
 ### Option A—Default Self-Signed Certificate
 
 If you install Rancher without using your own certificate, Rancher generates a self-signed certificate that's used for encryption. If you're satisfied with this certificate, there's no need to obtain your own.

content/rke/v0.1.x/en/config-options/add-ons/api-auditing/_index.md

@@ -0,0 +1,47 @@
+---
+title: API Auditing
+weight: 10000
+---
+
+If you're using RKE to install Rancher, you can use directives to enable API Auditing for your Rancher install. You can know what happened, when it happened, who initiated it, and what cluster it affected. API auditing records all requests and responses to and from the Rancher API, which includes use of the Rancher UI and any other use of the Rancher API through programmatic use.
+
+## In-line Arguments
+
+Enable API Auditing using RKE by adding arguments to your Rancher container.
+
+To enable API auditing:
+
+- Add API Auditing arguments (`args`) to your Rancher container.
+- Declare a `mountPath` in the `volumeMounts` directive of the container.
+- Declare a `path` in the `volumes` directive.
+
+For more information about each argument, its syntax, and how to view API Audit logs, see [Rancher v2.0 Documentation: API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing).
+
+```yaml
+...
+containers:
+        - image: rancher/rancher:latest
+          imagePullPolicy: Always
+          name: cattle-server
+          args: ["--audit-log-path", "/var/log/auditlog/rancher-api-audit.log", "--audit-log-maxbackup", "5", "--audit-log-maxsize", "50", "--audit-level", "2"]
+          ports:
+          - containerPort: 80
+            protocol: TCP
+          - containerPort: 443
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /etc/rancher/ssl
+            name: cattle-keys-volume
+            readOnly: true
+          - mountPath: /var/log/auditlog
+            name: audit-log-dir
+        volumes:
+        - name: cattle-keys-volume
+          secret:
+            defaultMode: 420
+            secretName: cattle-keys-server
+        - name: audit-log-dir
+          hostPath:
+            path: /var/log/rancher/auditlog
+            type: Directory
+```