From df3d410e7f452f0f8a306b83a096390fcbdb71fe Mon Sep 17 00:00:00 2001 From: MBishop17 Date: Fri, 17 Aug 2018 18:33:45 -0700 Subject: [PATCH] added notes to install procedure about setting up API auditing --- .../en/installation/ha/rke-add-on/layer-4-lb/_index.md | 2 ++ .../en/installation/ha/rke-add-on/layer-7-lb/_index.md | 3 +++ .../single-node-install-external-lb/_index.md | 10 ++++++++++ 3 files changed, 15 insertions(+) diff --git a/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-4-lb/_index.md index 581fa1b6f21..d253f14cbc9 100644 --- a/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-4-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-4-lb/_index.md @@ -230,6 +230,8 @@ RKE uses a `.yml` config file to install and configure your Kubernetes cluster. - [Template for self-signed certificate
`3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/e9d29b3f3b9673421961c68adf0516807d1317eb/rke-templates/3-node-certificate.yml) - [Template for certificate signed by recognized CA
`3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/d8ca0805a3958552e84fdf5d743859097ae81e0b/rke-templates/3-node-certificate-recognizedca.yml) + >**Note:** When setting up your RKE config file, you can declare additional flags to enable API Auditing, which records all interactions with the Rancher API. For more information, see [RKE Documentation: API Auditing]({{< baseurl >}}\rke\v0.1.x\en\config-options\add-ons\api-auditing). + 2. Rename the file to `rancher-cluster.yml`. ## 6. Configure Nodes diff --git a/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb/_index.md index a000c8089ea..d717805103e 100644 --- a/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb/_index.md @@ -179,6 +179,9 @@ RKE uses a YAML config file to install and configure your Kubernetes cluster. Th - [Template for self-signed certificate
`3-node-externalssl-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/58e695b51096b1f404188379cea6f6a35aea9e4c/rke-templates/3-node-externalssl-certificate.yml) - [Template for certificate signed by recognized CA
`3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/7f60dc3afe1b45287ac36ba6bde6f7c6e35c11fe/rke-templates/3-node-externalssl-recognizedca.yml) + >**Note:** When setting up your RKE config file, you can declare additional flags to enable API Auditing, which records all interactions with the Rancher API. For more information, see [RKE Documentation: API Auditing]({{< baseurl >}}\rke\v0.1.x\en\config-options\add-ons\api-auditing). + + 2. Rename the file to `rancher-cluster.yml`. ## 6. Configure Nodes diff --git a/content/rancher/v2.x/en/installation/single-node/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node/single-node-install-external-lb/_index.md index 0340095d70b..27be3372e95 100644 --- a/content/rancher/v2.x/en/installation/single-node/single-node-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/single-node-install-external-lb/_index.md @@ -70,6 +70,16 @@ For security purposes, SSL (Secure Sockets Layer) is required when using Rancher - [Option A-Bring Your Own Certificate: Self-Signed](#option-a-bring-your-own-certificate-self-signed) - [Option B-Bring Your Own Certificate: Signed by Recognized CA](#option-b-bring-your-own-certificate-signed-by-recognized-ca) +>**Note:** When entering the command to install Rancher using any of the options below, you can declare additional flags to enable [API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing), which records all interactions with the Rancher API. If you want to enable API Auditing, append the following flags to your install command: +> +>``` +-e AUDIT_LEVEL=1 \ +-e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \ +-e AUDIT_LOG_MAXAGE=20 \ +-e AUDIT_LOG_MAXBACKUP=20 \ +-e AUDIT_LOG_MAXSIZE=100 \ +``` + ### Option A-Bring Your Own Certificate: Self-Signed If you elect to use a self-signed certificate to encrypt communication, you must install the certificate on your load balancer (which you'll do later) and your Rancher container. Run the docker command to deploy Rancher, pointing it toward your certificate.