anchor.diff:  +
   [NOTE]
   ====
  -Specifying a non-empty
  +Specifying an empty
   xref:../admin_guide/managing_projects.adoc#using-node-selectors[node
  -selector] on the project is not recommended, as this would restrict
  -where Fluentd can be deployed. Instead, specify node selectors for the
  -deployer to be applied to your other deployment configurations.
  -====
  -
  -. Create a xref:../dev_guide/secrets.adoc#dev-guide-secrets[secret] to provide security-related files to the deployer. While the secret is necessary, the contents of the secret are optional, and will be generated for you if none are supplied.
  -+
  -You can supply the following files when creating a new secret:
  -+
  -[cols="2",options="header"]
  -|===
  -|File Name
  -|Description
  -
  -|*_kibana.crt_*
  -|A browser-facing certificate for the Kibana server.
  -
  -|*_kibana.key_*
  -|A key to be used with the Kibana certificate.
  -
  -|*_kibana-ops.crt_*
  -|A browser-facing certificate for the Ops Kibana server.
  -
  -|*_kibana-ops.key_*
  -|A key to be used with the Ops Kibana certificate.
  -
  -|*_server-tls.json_*
  -|JSON TLS options to override the Kibana server defaults. Refer to
  -https://nodejs.org/api/tls.html#tls_tls_connect_options_callback[Node.JS] docs
  -for available options.
  -
  -|*_ca.crt_*
  -|A certificate for a CA that will be used to sign all certificates generated by
  -the deployer.
  -
  -|*_ca.key_*
  -|A matching CA key.
  -|===
  -+
  -For example:
  -+
  -----
  -$ oc secrets new logging-deployer \
  -   kibana.crt=/path/to/cert kibana.key=/path/to/key
  -----
  -+
  -If a certificate file is not passed as a secret, the deployer will generate a
  -self-signed certificate instead. However, a secret is still required for
  -the deployer to run. In this case, you can create a "dummy" secret that
  -does not specify a certificate value:
  -+
  -----
  -$ oc secrets new logging-deployer nothing=/dev/null
  -----
  -
  -ifdef::openshift-enterprise[]
  -. Create the deployer xref:../admin_guide/service_accounts.adoc#admin-guide-service-accounts[service
  -account]:
  -+
  -====
  -----
  -$ oc create -f - <<API
  -apiVersion: v1
  -kind: ServiceAccount
  -metadata:
  -  name: logging-deployer
  -secrets:
  -- name: logging-deployer
  -API
  -----
  -====
  -endif::openshift-enterprise[]
  -ifdef::openshift-origin[]
  -. Create the deployer xref:../admin_guide/service_accounts.adoc#admin-guide-service-accounts[service
  -account] and custom roles:
  -+
  -====
  +selector] on the project is recommended, as Fluentd should be deployed
  +throughout the cluster and any selector would restrict where it is
  +deployed. To control component placement, specify node selectors per component to
  +be applied to their deployment configurations.
  +====
  +
  +. Create the logging xref:../admin_guide/service_accounts.adoc#admin-guide-service-accounts[service
  +accounts] and custom roles:
  ++
   ----
   $ oc new-app logging-deployer-account-template
   ----
  -====
  -endif::openshift-origin[]
  -+
  -Then, enable the *logging-deployer* service account to create the objects
  -needed for a logging deployment:
  -ifdef::openshift-enterprise[]
  -+
  -====
  -----
  -$ oc policy add-role-to-user edit --serviceaccount logging-deployer
  -----
  -====
  -endif::openshift-enterprise[]
  -ifdef::openshift-origin[]
  -+
  -====
  -----
  -$ oc policy add-role-to-user edit --serviceaccount logging-deployer
  -$ oc policy add-role-to-user daemonset-admin --serviceaccount logging-deployer
  ++
  +[NOTE]
  +====
  +If you have deployed logging previously, for example in a different project, then
  +it is normal for the cluster roles to fail to be created as they already exist.
  +====
  +
  +. Enable the deployer service account to create an OAuthClient (normally
  +a cluster-admin privilege) for Kibana to use later when authenticating
  +against the master.
  ++
  +====
  +----
   $ oadm policy add-cluster-role-to-user oauth-editor \
          system:serviceaccount:logging:logging-deployer <1>
   ----
  -<1> Use the new project you created earlier (e.g., *logging*) when specifying
  +<1> Use the project you created earlier (e.g., *logging*) when specifying
   this service account.
   ====
  -endif::openshift-origin[]
  -
  -. Enable the Fluentd service account, which the deployer will create, that
  -requires special privileges to operate Fluentd. Add the service account user to
  -the security context:
  -+
  -====
  -----
  -$ oadm policy add-scc-to-user  \
  -    privileged system:serviceaccount:logging:aggregated-logging-fluentd <1>
  -----
  -<1> Use the new project you created earlier (e.g., *logging*) when specifying
  -this service account.
  -====
  -+
  -Give the Fluentd service account permission to read labels from all pods:
  -+
  -====
  -----
  +
  +. Enable the Fluentd service account to mount and read system logs by adding
  +it to the *privileged* security context, and also enable it to read pod metadata
  +by giving it the *cluster-reader* role:
  ++
  +====
  +----
  +$ oadm policy add-scc-to-user privileged  \
  +    system:serviceaccount:logging:aggregated-logging-fluentd <1>
   $ oadm policy add-cluster-role-to-user cluster-reader \
       system:serviceaccount:logging:aggregated-logging-fluentd <1>
   ----
  -<1> Use the new project you created earlier (e.g., *logging*) when specifying
  +<1> Use the project you created earlier (e.g., *logging*) when specifying
   this service account.
   ====
   
  -[[deploying-the-efk-stack]]
  -== Deploying the EFK Stack
  -
  -The EFK stack is deployed xref:../dev_guide/templates.adoc#dev-guide-templates[using a template].
  -
  -. Run the deployer, specifying at least the parameters in the following example (more are described in the table below):
  -+
  -====
  -----
  -$ oc new-app logging-deployer-template \
  -    --param KIBANA_HOSTNAME=kibana.example.com \
  -    --param ES_CLUSTER_SIZE=1 \
  -    --param PUBLIC_MASTER_URL=https://localhost:8443
  -----
  -====
  -+
  -Be sure to replace at least `*KIBANA_HOSTNAME*` and `*PUBLIC_MASTER_URL*` with
  -values relevant to your deployment.
  -+
  -The available parameters are:
  +[[aggregate-logging-specifying-deployer-parameters]]
  +== Specifying Deployer Parameters
  +
  +Parameters for the EFK deployment may be specified in the
  +form of a xref:../dev_guide/configmaps.adoc[configmap],
  +a xref:../dev_guide/secrets.adoc#dev-guide-secrets[secret],
  +or template parameters (which are passed to the deployer in
  +environment variables). The deployer looks for each value first in a
  +*logging-deployer* configmap, then a *logging-deployer* secret, then as
  +an environment variable. Any or all may be omitted if not needed.
  +
  +Read about the available parameters below. Typically you should at
  +least specify the hostname at which Kibana should be exposed to client
  +browsers, and also the master URL where client browsers will be directed
  +for authenticating to OpenShift.
  +
  +. Create a xref:../dev_guide/configmaps.adoc[configmap] to provide most deployer parameters. An invocation supplying the most important parameters might be:
  ++
  +----
  +$ oc create configmap logging-deployer \
  +   --from-literal kibana-hostname=kibana.example.com \
  +   --from-literal public-master-url=https://master.example.com:8443 \
  +   --from-literal es-cluster-size=3 \
  +   --from-literal es-instance-ram=8G
  +----
  ++
  +It is also easy to edit ConfigMap YAML after creating it:
  ++
  +----
  +$ oc edit configmap logging-deployer
  +----
  ++
  +These and other parameters are available (you should read the ElasticSearch section below before choosing ElasticSearch parameters for the deployer):
   +
   [cols="3,7",options="header"]
   |===
  -|Variable Name
  +|Parameter
   |Description
   
  -|`*PUBLIC_MASTER_URL*`
  -|(Required with the `oc new-app` command) The external URL for the master. For
  -OAuth use.
  -
  -|`*ENABLE_OPS_CLUSTER*`
  +|*_kibana-hostname_*
  +| The external host name for web clients to reach Kibana.
  +
  +|*_public-master-url_*
  +|The external URL for the master. For OAuth purposes.
  +
  +|*_es-cluster-size_* (default: 1)
  +| The number of instances of
  +Elasticsearch to deploy. Redundancy requires at least three, and more can be
  +used for scaling.
  +
  +|*_es-instance-ram_* (default: 8G)
  +|Amount of RAM to reserve per Elasticsearch instance. The default is 8G (for 8GB), and it
  +must be at least 512M. Possible suffixes are G,g,M,m.
  +
  +|*_es-pvc-prefix_* (default: *logging-es-*)
  +| Prefix for the names of PersistentVolumeClaims to be used as storage for Elasticsearch instances; a number will be appended per instance (e.g. *logging-es-1*). If they don't already exist, they will be created with size *_es-pvc-size_*.
  +
  +|*_es-pvc-size_*
  +| Size of the PersistentVolumeClaim to create per ElasticSearch instance, e.g. 100G. If omitted, no PVCs will be created and ephemeral volumes are used instead.
  +
  +|*_es-pvc-dynamic_*
  +| Set to true to have created PersistentVolumeClaims annotated such that their backing storage can be dynamically provisioned (if that is available for your cluster).
  +
  +|*_storage-group_*
  +| Number of a supplemental group ID for access to Elasticsearch storage volumes; backing volumes should allow access by this group ID (defaults to 65534).
  +
  +|*_fluentd-nodeselector_* (default: *logging-infra-fluentd=true*)
  +| A node selector that specifies which nodes are eligible targets
  +for deploying Fluentd instances.
  +All nodes where Fluentd should run (typically, all) must have this label
  +before Fluentd will be able to run and collect logs.
  +
  +|*_es-nodeselector_*
  +| A node selector that specifies which nodes are eligible targets
  +for deploying Elasticsearch instances. This can be used to place
  +these instances on nodes reserved and/or optimized for running them.
  +For example, the selector could be `*node-type=infrastructure*`. At least
  +one active node must have this label before Elasticsearch will deploy.
  +
  +|*_kibana-nodeselector_*
  +| A node selector that specifies which nodes are eligible targets
  +for deploying Kibana instances.
  +
  +|*_curator-nodeselector_*
  +| A node selector that specifies which nodes are eligible targets
  +for deploying Curator instances.
  +
  +|*_enable-ops-cluster_*
   |If set to `*true*`, configures a second Elasticsearch cluster and Kibana for
   operations logs. Fluentd splits
   logs between the main cluster and a cluster reserved for operations
  
positive.code: $ oc label nodes --all logging-infra-fluentd=true
  ----
  ====
  
  endif::openshift-origin[]
  
  === Kibana
  
  To access the Kibana console from the {product-title} web console, add the
  `loggingPublicURL` parameter in the *_/etc/origin/master/master-config.yaml_*
  file, with the URL of the Kibana console (the `*KIBANA_HOSTNAME*` parameter).
  The value must be an HTTPS URL:
  
  ====
  
negative.code: $ oc get pod/<pod_name> -w
  ----
  +
  It should eventually enter Running status and end in Complete status.
  If it seems to be taking too long to start, you can retrieve more details about
  the pod and any associated events with:
  +
  