From 712f2848934095730842ac4baa5cb50cbac94679 Mon Sep 17 00:00:00 2001
From: Mark Bishop <mark@rancher.com>
Date: Wed, 15 Aug 2018 18:41:19 -0700
Subject: [PATCH] adding content to RKE

---
 .../en/installation/api-auditing/_index.md    |  2 +
 .../en/installation/single-node/_index.md     | 10 ++++
 .../add-ons/api-auditing/_index.md            | 47 +++++++++++++++++++
 3 files changed, 59 insertions(+)
 create mode 100644 content/rke/v0.1.x/en/config-options/add-ons/api-auditing/_index.md

diff --git a/content/rancher/v2.x/en/installation/api-auditing/_index.md b/content/rancher/v2.x/en/installation/api-auditing/_index.md
index 69f54ff47d3..baace9ceb47 100644
--- a/content/rancher/v2.x/en/installation/api-auditing/_index.md
+++ b/content/rancher/v2.x/en/installation/api-auditing/_index.md
@@ -5,6 +5,8 @@ weight: 10000
 
 Rancher ships with API Auditing to record the sequence of system events initiated by individual users. You can know what happened, when it happened, who initiated it, and what cluster it affected. API auditing records all requests and responses to and from the Rancher API, which includes use of the Rancher UI and any other use of the Rancher API through programmatic use.
 
+You can enable API Auditing during Rancher installation or upgrade.
+
 ## API Auditing Usage
 
 Each API transaction creates two entries for it in the audit log, one for requests and one for response: `RequestReceived` and `ResponseComplete`. Each log transaction for a request/response pair uses the same `auditID` value.
diff --git a/content/rancher/v2.x/en/installation/single-node/_index.md b/content/rancher/v2.x/en/installation/single-node/_index.md
index dbad2d3808e..23aacfa6808 100644
--- a/content/rancher/v2.x/en/installation/single-node/_index.md
+++ b/content/rancher/v2.x/en/installation/single-node/_index.md
@@ -68,6 +68,16 @@ Choose from the following options:
 - [Option D—Bring Your Own Certificate: Private CA Root Certificate CA](#option-d-bring-your-own-certificate-private-ca-root-certificate)
 - [Option E—Let's Encrypt Certificate](#option-e-let-s-encrypt-certificate)
 
+>**Note:** When entering the command to install Rancher using any of the options below, you can declare additional flags to enable [API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing), which records all interactions with the Rancher API. If you want to enable API Auditing, append the following flags to your install command:
+>
+>```
+-e AUDIT_LEVEL=1 \
+-e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \
+-e AUDIT_LOG_MAXAGE=20 \
+-e AUDIT_LOG_MAXBACKUP=20 \
+-e AUDIT_LOG_MAXSIZE=100 \
+```
+
 ### Option A—Default Self-Signed Certificate
 
 If you install Rancher without using your own certificate, Rancher generates a self-signed certificate that's used for encryption. If you're satisfied with this certificate, there's no need to obtain your own.
diff --git a/content/rke/v0.1.x/en/config-options/add-ons/api-auditing/_index.md b/content/rke/v0.1.x/en/config-options/add-ons/api-auditing/_index.md
new file mode 100644
index 00000000000..6b4e72ff36b
--- /dev/null
+++ b/content/rke/v0.1.x/en/config-options/add-ons/api-auditing/_index.md
@@ -0,0 +1,47 @@
+---
+title: API Auditing
+weight: 10000
+---
+
+If you're using RKE to install Rancher, you can use directives to enable API Auditing for your Rancher install. You can know what happened, when it happened, who initiated it, and what cluster it affected. API auditing records all requests and responses to and from the Rancher API, which includes use of the Rancher UI and any other use of the Rancher API through programmatic use.
+
+## In-line Arguments
+
+Enable API Auditing using RKE by adding arguments to your Rancher container.
+
+To enable API auditing:
+
+- Add API Auditing arguments (`args`) to your Rancher container.
+- Declare a `mountPath` in the `volumeMounts` directive of the container.
+- Declare a `path` in the `volumes` directive.
+
+For more information about each argument, its syntax, and how to view API Audit logs, see [Rancher v2.0 Documentation: API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing).
+
+```yaml
+...
+containers:
+        - image: rancher/rancher:latest
+          imagePullPolicy: Always
+          name: cattle-server
+          args: ["--audit-log-path", "/var/log/auditlog/rancher-api-audit.log", "--audit-log-maxbackup", "5", "--audit-log-maxsize", "50", "--audit-level", "2"]
+          ports:
+          - containerPort: 80
+            protocol: TCP
+          - containerPort: 443
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /etc/rancher/ssl
+            name: cattle-keys-volume
+            readOnly: true
+          - mountPath: /var/log/auditlog
+            name: audit-log-dir
+        volumes:
+        - name: cattle-keys-volume
+          secret:
+            defaultMode: 420
+            secretName: cattle-keys-server
+        - name: audit-log-dir
+          hostPath:
+            path: /var/log/rancher/auditlog
+            type: Directory
+```