anchor.diff:  are distinguishable by the *-ops* included in their names and have parallel
   deployment options listed below.
   
  -|`*KIBANA_HOSTNAME*`, `*KIBANA_OPS_HOSTNAME*`
  -|(Required with the `oc new-app` command) The external host name for web clients
  -to reach Kibana.
  -
  -|`*ES_CLUSTER_SIZE*`, `*ES_OPS_CLUSTER_SIZE*`
  -|(Required with the `oc new-app` command) The number of instances of
  -Elasticsearch to deploy. Redundancy requires at least three, and more can be
  -used for scaling.
  -
  -|`*ES_INSTANCE_RAM*`, `*ES_OPS_INSTANCE_RAM*`
  -|Amount of RAM to reserve per Elasticsearch instance. The default is 8G (for 8GB), and it
  -must be at least 512M. Possible suffixes are G,g,M,m.
  -
  -|`*ES_NODE_QUORUM*`, `*ES_OPS_NODE_QUORUM*`
  -|The quorum required to elect a new master. Should be more than half the intended cluster size.
  -
  -|`*ES_RECOVER_AFTER_NODES*`, `*ES_OPS_RECOVER_AFTER_NODES*`
  -|When restarting the cluster, require this many nodes to be present before starting recovery.
  -Defaults to one less than the cluster size to allow for one missing node.
  -
  -|`*ES_RECOVER_EXPECTED_NODES*`, `*ES_OPS_RECOVER_EXPECTED_NODES*`
  -|When restarting the cluster, wait for this number of nodes to be present before starting recovery.
  -By default, the same as the cluster size.
  -
  -|`*ES_RECOVER_AFTER_TIME*`, `*ES_OPS_RECOVER_AFTER_TIME*`
  -|When restarting the cluster, this is a timeout for waiting for the expected number of nodes to be present.
  -Defaults to "5m".
  +|*_kibana-ops-hostname, es-ops-instance-ram, es-ops-pvc-size, es-ops-pvc-prefix, es-ops-cluster-size, es-ops-nodeselector, kibana-ops-nodeselector, curator-ops-nodeselector_*
  +| Parallel parameters for the ops log cluster.
  +
  +|*_image-pull-secret_*
  +| Specify the name of an existing pull secret to be used for pulling component images from an authenticated registry.
  +|===
  +
  +. Create a xref:../dev_guide/secrets.adoc#dev-guide-secrets[secret] to provide security-related files to the deployer. The contents of the secret are optional, and will be randomly generated if not supplied.
  ++
  +You can supply the following files when creating a new secret, for example:
  ++
  +----
  +$ oc create secret generic logging-deployer \
  +   --from-file kibana.crt=/path/to/cert \
  +   --from-file kibana.key=/path/to/key
  +----
  ++
  +[cols="3,7",options="header"]
  +|===
  +|File Name
  +|Description
  +
  +|*_kibana.crt_*
  +|A browser-facing certificate for the Kibana server.
  +
  +|*_kibana.key_*
  +|A key to be used with the Kibana certificate.
  +
  +|*_kibana-ops.crt_*
  +|A browser-facing certificate for the Ops Kibana server.
  +
  +|*_kibana-ops.key_*
  +|A key to be used with the Ops Kibana certificate.
  +
  +|*_server-tls.json_*
  +|JSON TLS options to override the Kibana server defaults. Refer to
  +https://nodejs.org/api/tls.html#tls_tls_connect_options_callback[Node.JS] docs
  +for available options.
  +
  +|*_ca.crt_*
  +|A certificate for a CA that will be used to sign all certificates generated by
  +the deployer.
  +
  +|*_ca.key_*
  +|A matching CA key.
  +|===
  +
  +[[deploying-the-efk-stack]]
  +== Deploying the EFK Stack
  +
  +The EFK stack is deployed using a
  +xref:../dev_guide/templates.adoc#dev-guide-templates[template] to
  +create a deployer pod that reads the deployment parameters and manages
  +the deployment.
  +
  +. Run the deployer, optionally specifying parameters (described in the table below), for example:
  ++
  +====
  +Without template parameters:
  +
  +----
  +$ oc new-app logging-deployer-template
  +----
  +
  +With parameters:
   
   ifdef::openshift-origin[]
  -|`*ES_NODESELECTOR*`, `*ES_OPS_NODESELECTOR*`
  -| A node selector that specifies which nodes are eligible targets
  -for deploying Elasticsearch instances. This can be used to place
  -these instances on nodes reserved and/or optimized for running them.
  -For example, the selector could be `*node-type=infrastructure*`. At least
  -one active node must have this label before Elasticsearch will deploy.
  -
  -|`*KIBANA_NODESELECTOR*`, `*KIBANA_OPS_NODESELECTOR*`, `*CURATOR_NODESELECTOR*`
  -| A node selector that specifies which nodes are eligible targets
  -for deploying Kibana or Curator instances.
  -
  -|`*FLUENTD_NODESELECTOR*`
  -| A node selector that specifies which nodes are eligible targets
  -for deploying Fluentd instances. Defaults to "logging-infra-fluentd=true".
  -
  -|`*IMAGE_PREFIX*`
  +----
  +$ oc new-app logging-deployer-template \
  +             --param IMAGE_VERSION=v1.2.0 \
  +             --param MODE=install
  +----
  +endif::openshift-origin[]
  +ifdef::openshift-enterprise[]
  +----
  +$ oc new-app logging-deployer-template \
  +             --param IMAGE_VERSION=3.3.0 \
  +             --param MODE=install
  +----
  +endif::openshift-enterprise[]
  +====
  ++
  +[cols="3,7",options="header"]
  +|===
  +|Parameter Name
  +|Description
  +
  +ifdef::openshift-origin[]
  +|*_IMAGE_PREFIX_*
   |The prefix for logging component images. For example, setting the prefix to
   *openshift/origin-* creates *openshift/origin-logging-deployer:v1.2*.
   
  -|`*IMAGE_VERSION*`
  +|*_IMAGE_VERSION_*
   |The version for logging component images. For example, setting the version to
   *v1.2* creates *openshift/origin-logging-deployer:v1.2*.
   endif::openshift-origin[]
   ifdef::openshift-enterprise[]
  -|`*IMAGE_PREFIX*`
  +|*_IMAGE_PREFIX_*
   |The prefix for logging component images. For example, setting the prefix to
   *registry.access.redhat.com/openshift3/ose-* creates *registry.access.redhat.com/openshift3/ose-logging-deployer:latest*.
   
  -|`*IMAGE_VERSION*`
  +|*_IMAGE_VERSION_*
   |The version for logging component images. For example, setting the version to
   *v3.2* creates *registry.access.redhat.com/openshift3/ose-logging-deployer:v3.2*.
   endif::openshift-enterprise[]
  +
  +|*_MODE_* (default: *install*)
  +| Mode to run the deployer in; one of `*install, uninstall, reinstall, upgrade, migrate, start, stop*`.
   |===
   +
   Running the deployer creates a deployer pod and prints its name.
  
positive.code: +
  ====
  ----
  $ oc create -n openshift -f \
      https://raw.githubusercontent.com/openshift/origin-aggregated-logging/master/deployer/deployer.yaml
  ----
  ====
  
negative.code: If it uses Mutual TLS as the provided Elasticsearch instance does, patch or
  recreate the `logging-fluentd` secret with your client key, client cert, and CA.
  
  Since Fluentd is deployed by a DaemonSet, update the
  `logging-fluentd-template` template, delete your current DaemonSet, and recreate
  it with `oc new-app logging-fluentd-template` after seeing all previous Fluentd
  pods have terminated.
  
  [NOTE]
  ====
  