requires modifications to the deployed resources to work alongside the platform ELK. If multiple ELK stacks are needed for team or application dedicated ELK stacks where the use of NodePort (no authentication required) is acceptable, then standard mode is suitable. 

The recommended way to deploy additional ELK stacks is by using the standard mode. Managed mode is possible to achieve, but introduces a lot of additional configuration to enable all the beneficial features of managed mode and it is not covered in this book. 

## Storage 

Data node replicas in each deployment of ELK require a dedicated PersistentVolume (PV) and PersistentVolumeClaim (PVC). If a dynamic storage provider is available, ELK can be configured to use this during deployment. If dynamic provisioning is not available, then suitable PVs must be created first. 

## Deploying ELK stacks 

This section will deploy a new standard mode ELK stack to the elk  namespace and this namespace will be used in all subsequent example commands. 

To create the namespace, use kubectl create namespace elk  and then label is using k ubectl label namespace elk -l name=elk . Alternatively, use the YAML definition in Example 5-16. 

apiVersion: v1 kind: Namespace metadata: labels: name: elk name: elk 

## RBAC 

The ELK stack requires privileged containers, IPC_LOCK and  SYS_RESOURCE capabilities, which means giving the default  Service Account (SA) in the elk  namespace elevated privileges, as the default restricted policy is too restrictive for ELK to function. To allow this, a new Pod Security Policy (PSP) is required, as well as a Cluster Role and Role Binding to the new PSP. To create the required RBAC resources perform the following steps 

1. Copy the elk-psp.yaml  in Example 5-17 to a local file called elk-psp.yaml  and create it in Kubernetes using kubectl create -f elk-psp.yaml . 

apiVersion: extensions/v1beta1 kind: PodSecurityPolicy metadata: name: ibm-elk-psp spec: allowPrivilegeEscalation: true privileged: true allowedCapabilities: - CHMOD - CHOWN - IPC_LOCK - SYS_RESOURCE forbiddenSysctls: 

