From d5879135f077e4aaaa09c8e4ebf5d9ef2a063a78 Mon Sep 17 00:00:00 2001
From: Eric Wolinetz <ewolinet@redhat.com>
Date: Fri, 5 Jan 2018 11:06:43 -0600
Subject: Adding support for ES 5.x tech preview opt in

---
 .../files/rolebinding-reader.yml                   |   9 -
 .../tasks/determine_version.yaml                   |   8 +-
 .../tasks/main.yaml                                | 133 ++++++++------
 .../templates/2.x/elasticsearch-logging.yml.j2     | 105 +++++++++++
 .../templates/2.x/elasticsearch.yml.j2             |  87 +++++++++
 .../templates/2.x/es.j2                            | 187 ++++++++++++++++++++
 .../templates/2.x/logging-metrics-role.j2          |  31 ++++
 .../templates/2.x/pvc.j2                           |  30 ++++
 .../templates/2.x/rolebinding.j2                   |  14 ++
 .../templates/2.x/route_reencrypt.j2               |  36 ++++
 .../templates/5.x/elasticsearch.yml.j2             |  74 ++++++++
 .../templates/5.x/es.j2                            | 194 +++++++++++++++++++++
 .../templates/5.x/log4j2.properties.j2             |  78 +++++++++
 .../templates/5.x/logging-metrics-role.j2          |  31 ++++
 .../templates/5.x/pvc.j2                           |  30 ++++
 .../templates/5.x/rolebinding.j2                   |  14 ++
 .../templates/5.x/route_reencrypt.j2               |  36 ++++
 .../templates/elasticsearch-logging.yml.j2         | 105 -----------
 .../templates/elasticsearch.yml.j2                 |  87 ---------
 .../templates/es.j2                                | 187 --------------------
 .../templates/logging-metrics-role.j2              |  31 ----
 .../templates/pvc.j2                               |  30 ----
 .../templates/rolebinding.j2                       |  14 --
 .../templates/route_reencrypt.j2                   |  36 ----
 .../openshift_logging_elasticsearch/vars/main.yml  |   1 -
 25 files changed, 1032 insertions(+), 556 deletions(-)
 delete mode 100644 roles/openshift_logging_elasticsearch/files/rolebinding-reader.yml
 create mode 100644 roles/openshift_logging_elasticsearch/templates/2.x/elasticsearch-logging.yml.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/2.x/elasticsearch.yml.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/2.x/es.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/2.x/logging-metrics-role.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/2.x/pvc.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/2.x/rolebinding.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/2.x/route_reencrypt.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/5.x/elasticsearch.yml.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/5.x/es.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/5.x/log4j2.properties.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/5.x/logging-metrics-role.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/5.x/pvc.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/5.x/rolebinding.j2
 create mode 100644 roles/openshift_logging_elasticsearch/templates/5.x/route_reencrypt.j2
 delete mode 100644 roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2
 delete mode 100644 roles/openshift_logging_elasticsearch/templates/elasticsearch.yml.j2
 delete mode 100644 roles/openshift_logging_elasticsearch/templates/es.j2
 delete mode 100644 roles/openshift_logging_elasticsearch/templates/logging-metrics-role.j2
 delete mode 100644 roles/openshift_logging_elasticsearch/templates/pvc.j2
 delete mode 100644 roles/openshift_logging_elasticsearch/templates/rolebinding.j2
 delete mode 100644 roles/openshift_logging_elasticsearch/templates/route_reencrypt.j2

(limited to 'roles/openshift_logging_elasticsearch')

diff --git a/roles/openshift_logging_elasticsearch/files/rolebinding-reader.yml b/roles/openshift_logging_elasticsearch/files/rolebinding-reader.yml
deleted file mode 100644
index 567c9f289..000000000
--- a/roles/openshift_logging_elasticsearch/files/rolebinding-reader.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ClusterRole
-metadata:
-  name: rolebinding-reader
-rules:
-- resources:
-    - clusterrolebindings
-  verbs:
-    - get
diff --git a/roles/openshift_logging_elasticsearch/tasks/determine_version.yaml b/roles/openshift_logging_elasticsearch/tasks/determine_version.yaml
index c55e7c5ea..a7cc8f0ec 100644
--- a/roles/openshift_logging_elasticsearch/tasks/determine_version.yaml
+++ b/roles/openshift_logging_elasticsearch/tasks/determine_version.yaml
@@ -10,10 +10,14 @@
 
 # should we just assume that we will have the correct major version?
 - set_fact: es_version="{{ openshift_logging_elasticsearch_image_version | regex_replace('^v?(?P<major>\d)\.(?P<minor>\d).*$', '3_\\g<minor>') }}"
-  when: openshift_logging_elasticsearch_image_version != 'latest'
+  when:
+  - openshift_logging_elasticsearch_image_version != 'latest'
+  - not openshift_logging_es5_techpreview | default(false) | bool
 
 - fail:
     msg: Invalid version specified for Elasticsearch
-  when: es_version not in __allowed_es_versions
+  when:
+  - es_version not in __allowed_es_versions
+  - not openshift_logging_es5_techpreview | default(false) | bool
 
 - include_tasks: get_es_version.yml
diff --git a/roles/openshift_logging_elasticsearch/tasks/main.yaml b/roles/openshift_logging_elasticsearch/tasks/main.yaml
index b731d93a0..8a174f0d5 100644
--- a/roles/openshift_logging_elasticsearch/tasks/main.yaml
+++ b/roles/openshift_logging_elasticsearch/tasks/main.yaml
@@ -64,7 +64,6 @@
 # we want to make sure we have all the necessary components here
 
 # service account
-
 - name: Create ES service account
   oc_serviceaccount:
     state: present
@@ -82,19 +81,14 @@
     - openshift_logging_image_pull_secret == ''
 
 # rolebinding reader
-- copy:
-    src: rolebinding-reader.yml
-    dest: "{{ tempdir }}/rolebinding-reader.yml"
-
 - name: Create rolebinding-reader role
-  oc_obj:
+  oc_clusterrole:
     state: present
-    name: "rolebinding-reader"
-    kind: clusterrole
-    namespace: "{{ openshift_logging_elasticsearch_namespace }}"
-    files:
-      - "{{ tempdir }}/rolebinding-reader.yml"
-    delete_after: true
+    name: rolebinding-reader
+    rules:
+      - apiGroups: [""]
+        resources: ["clusterrolebindings"]
+        verbs: ["get"]
 
 # SA roles
 - name: Set rolebinding-reader permissions for ES
@@ -114,7 +108,7 @@
 
 # logging-metrics-reader role
 - template:
-    src: logging-metrics-role.j2
+    src: "{{ __base_file_dir }}/logging-metrics-role.j2"
     dest: "{{mktemp.stdout}}/templates/logging-metrics-role.yml"
   vars:
     namespace: "{{ openshift_logging_elasticsearch_namespace }}"
@@ -150,7 +144,7 @@
 # View role and binding
 - name: Generate logging-elasticsearch-view-role
   template:
-    src: rolebinding.j2
+    src: "{{ __base_file_dir }}/rolebinding.j2"
     dest: "{{mktemp.stdout}}/logging-elasticsearch-view-role.yaml"
   vars:
     obj_name: logging-elasticsearch-view-role
@@ -183,51 +177,80 @@
     msg: "The openshift_logging_es_log_appenders '{{ openshift_logging_es_log_appenders }}' has an unrecognized option and only supports the following as a list: {{ __es_log_appenders | join(', ') }}"
 
 - template:
-    src: elasticsearch-logging.yml.j2
-    dest: "{{ tempdir }}/elasticsearch-logging.yml"
-  vars:
-    root_logger: "{{openshift_logging_es_log_appenders | join(', ')}}"
-  when: es_logging_contents is undefined
-  changed_when: no
-
-- template:
-    src: elasticsearch.yml.j2
+    src: "{{ __base_file_dir }}/elasticsearch.yml.j2"
     dest: "{{ tempdir }}/elasticsearch.yml"
   vars:
     allow_cluster_reader: "{{ openshift_logging_elasticsearch_ops_allow_cluster_reader | lower | default('false') }}"
     es_number_of_shards: "{{ openshift_logging_es_number_of_shards | default(1) }}"
     es_number_of_replicas: "{{ openshift_logging_es_number_of_replicas| default(0) }}"
     es_kibana_index_mode: "{{ openshift_logging_elasticsearch_kibana_index_mode | default('unique') }}"
-
-  when: es_config_contents is undefined
   changed_when: no
 
 # create diff between current configmap files and our current files
-# NOTE: include_role must be used instead of import_role because
-# this task file is looped over from another role.
-- include_role:
-    name: openshift_logging
-    tasks_from: patch_configmap_files.yaml
-  vars:
-    configmap_name: "logging-elasticsearch"
-    configmap_namespace: "logging"
-    configmap_file_names:
-      - current_file: "elasticsearch.yml"
-        new_file: "{{ tempdir }}/elasticsearch.yml"
-        protected_lines: ["number_of_shards", "number_of_replicas"]
-      - current_file: "logging.yml"
-        new_file: "{{ tempdir }}/elasticsearch-logging.yml"
-
-- name: Set ES configmap
-  oc_configmap:
-    state: present
-    name: "{{ elasticsearch_name }}"
-    namespace: "{{ openshift_logging_elasticsearch_namespace }}"
-    from_file:
-      elasticsearch.yml: "{{ tempdir }}/elasticsearch.yml"
-      logging.yml: "{{ tempdir }}/elasticsearch-logging.yml"
-  register: es_config_creation
-  notify: "restart elasticsearch"
+- when: not openshift_logging_es5_techpreview
+  block:
+    - template:
+        src: "{{ __base_file_dir }}/elasticsearch-logging.yml.j2"
+        dest: "{{ tempdir }}/elasticsearch-logging.yml"
+      vars:
+        root_logger: "{{openshift_logging_es_log_appenders | join(', ')}}"
+      changed_when: no
+
+    - include_role:
+        name: openshift_logging
+        tasks_from: patch_configmap_files.yaml
+      vars:
+        configmap_name: "logging-elasticsearch"
+        configmap_namespace: "logging"
+        configmap_file_names:
+          - current_file: "elasticsearch.yml"
+            new_file: "{{ tempdir }}/elasticsearch.yml"
+            protected_lines: ["number_of_shards", "number_of_replicas"]
+          - current_file: "logging.yml"
+            new_file: "{{ tempdir }}/elasticsearch-logging.yml"
+
+    - name: Set ES configmap
+      oc_configmap:
+        state: present
+        name: "{{ elasticsearch_name }}"
+        namespace: "{{ openshift_logging_elasticsearch_namespace }}"
+        from_file:
+          elasticsearch.yml: "{{ tempdir }}/elasticsearch.yml"
+          logging.yml: "{{ tempdir }}/elasticsearch-logging.yml"
+      register: es_config_creation
+      notify: "restart elasticsearch"
+
+- when: openshift_logging_es5_techpreview | bool
+  block:
+    - template:
+        src: "{{ __base_file_dir }}/log4j2.properties.j2"
+        dest: "{{ tempdir }}/log4j2.properties"
+      vars:
+        root_logger: "{{ openshift_logging_es_log_appenders | list }}"
+      changed_when: no
+
+    - include_role:
+        name: openshift_logging
+        tasks_from: patch_configmap_files.yaml
+      vars:
+        configmap_name: "logging-elasticsearch"
+        configmap_namespace: "logging"
+        configmap_file_names:
+          - current_file: "elasticsearch.yml"
+            new_file: "{{ tempdir }}/elasticsearch.yml"
+          - current_file: "log4j2.properties"
+            new_file: "{{ tempdir }}/log4j2.properties"
+
+    - name: Set ES configmap
+      oc_configmap:
+        state: present
+        name: "{{ elasticsearch_name }}"
+        namespace: "{{ openshift_logging_elasticsearch_namespace }}"
+        from_file:
+          elasticsearch.yml: "{{ tempdir }}/elasticsearch.yml"
+          log4j2.properties: "{{ tempdir }}/log4j2.properties"
+      register: es_config_creation
+      notify: "restart elasticsearch"
 
 - when: es_config_creation.changed | bool
   block:
@@ -341,7 +364,7 @@
     # storageclasses with the storageClassName set to "" in pvc.j2
     - name: Creating ES storage template - static
       template:
-        src: pvc.j2
+        src: "{{ __base_file_dir }}/pvc.j2"
         dest: "{{ tempdir }}/templates/logging-es-pvc.yml"
       vars:
         obj_name: "{{ openshift_logging_elasticsearch_pvc_name }}"
@@ -355,7 +378,7 @@
     # Storageclasses are used by default if configured
     - name: Creating ES storage template - dynamic
       template:
-        src: pvc.j2
+        src: "{{ __base_file_dir }}/pvc.j2"
         dest: "{{ tempdir }}/templates/logging-es-pvc.yml"
       vars:
         obj_name: "{{ openshift_logging_elasticsearch_pvc_name }}"
@@ -386,7 +409,7 @@
 # DC
 - name: Set ES dc templates
   template:
-    src: es.j2
+    src: "{{ __base_file_dir }}/es.j2"
     dest: "{{ tempdir }}/templates/logging-es-dc.yml"
   vars:
     es_cluster_name: "{{ es_component }}"
@@ -404,6 +427,8 @@
     deploy_type: "{{ openshift_logging_elasticsearch_deployment_type }}"
     es_replicas: 1
     basic_auth_passwd: "{{ _logging_metrics_proxy_passwd | b64decode }}"
+    es_number_of_shards: "{{ openshift_logging_es_number_of_shards | default(1) }}"
+    es_number_of_replicas: "{{ openshift_logging_es_number_of_replicas| default(0) }}"
 
 - name: Set ES dc
   oc_obj:
@@ -462,7 +487,7 @@
 
 - name: Generating Elasticsearch {{ es_component }} route template
   template:
-    src: route_reencrypt.j2
+    src: "{{ __base_file_dir }}/route_reencrypt.j2"
     dest: "{{mktemp.stdout}}/templates/logging-{{ es_component }}-route.yaml"
   vars:
     obj_name: "logging-{{ es_component }}"
diff --git a/roles/openshift_logging_elasticsearch/templates/2.x/elasticsearch-logging.yml.j2 b/roles/openshift_logging_elasticsearch/templates/2.x/elasticsearch-logging.yml.j2
new file mode 100644
index 000000000..c7b2b2721
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/2.x/elasticsearch-logging.yml.j2
@@ -0,0 +1,105 @@
+# you can override this using by setting a system property, for example -Des.logger.level=DEBUG
+es.logger.level: INFO
+rootLogger: ${es.logger.level}, {{root_logger}}
+logger:
+  # log action execution errors for easier debugging
+  action: WARN
+
+  #
+  # deprecation logging, turn to DEBUG to see them
+  deprecation: WARN, deprecation_log_file
+
+  # reduce the logging for aws, too much is logged under the default INFO
+  com.amazonaws: WARN
+
+  io.fabric8.elasticsearch: ${PLUGIN_LOGLEVEL}
+  io.fabric8.kubernetes: ${PLUGIN_LOGLEVEL}
+
+  # aws will try to do some sketchy JMX stuff, but its not needed.
+  com.amazonaws.jmx.SdkMBeanRegistrySupport: ERROR
+  com.amazonaws.metrics.AwsSdkMetrics: ERROR
+
+  org.apache.http: INFO
+
+  # gateway
+  #gateway: DEBUG
+  #index.gateway: DEBUG
+
+  # peer shard recovery
+  #indices.recovery: DEBUG
+
+  # discovery
+  #discovery: TRACE
+
+  index.search.slowlog: TRACE, index_search_slow_log_file
+  index.indexing.slowlog: TRACE, index_indexing_slow_log_file
+
+  # search-guard
+  com.floragunn.searchguard: WARN
+
+additivity:
+  index.search.slowlog: false
+  index.indexing.slowlog: false
+  deprecation: false
+
+appender:
+  console:
+    type: console
+    layout:
+      type: consolePattern
+      conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %.1000m%n"
+    # need this filter until https://github.com/openshift/origin/issues/14515 is fixed
+    filter:
+      1:
+        type: org.apache.log4j.varia.StringMatchFilter
+        StringToMatch: "SSL Problem illegal change cipher spec msg, conn state = 6, handshake state = 1"
+        AcceptOnMatch: false
+
+  file:
+    type: dailyRollingFile
+    file: ${path.logs}/${cluster.name}.log
+    datePattern: "'.'yyyy-MM-dd"
+    layout:
+      type: pattern
+      conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+    # need this filter until https://github.com/openshift/origin/issues/14515 is fixed
+    filter:
+      1:
+        type: org.apache.log4j.varia.StringMatchFilter
+        StringToMatch: "SSL Problem illegal change cipher spec msg, conn state = 6, handshake state = 1"
+        AcceptOnMatch: false
+
+  # Use the following log4j-extras RollingFileAppender to enable gzip compression of log files.
+  # For more information see https://logging.apache.org/log4j/extras/apidocs/org/apache/log4j/rolling/RollingFileAppender.html
+  #file:
+    #type: extrasRollingFile
+    #file: ${path.logs}/${cluster.name}.log
+    #rollingPolicy: timeBased
+    #rollingPolicy.FileNamePattern: ${path.logs}/${cluster.name}.log.%d{yyyy-MM-dd}.gz
+    #layout:
+      #type: pattern
+      #conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+
+  deprecation_log_file:
+    type: dailyRollingFile
+    file: ${path.logs}/${cluster.name}_deprecation.log
+    datePattern: "'.'yyyy-MM-dd"
+    layout:
+      type: pattern
+      conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+
+  index_search_slow_log_file:
+    type: dailyRollingFile
+    file: ${path.logs}/${cluster.name}_index_search_slowlog.log
+    datePattern: "'.'yyyy-MM-dd"
+    layout:
+      type: pattern
+      conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+
+  index_indexing_slow_log_file:
+    type: dailyRollingFile
+    file: ${path.logs}/${cluster.name}_index_indexing_slowlog.log
+    datePattern: "'.'yyyy-MM-dd"
+    layout:
+      type: pattern
+      conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
diff --git a/roles/openshift_logging_elasticsearch/templates/2.x/elasticsearch.yml.j2 b/roles/openshift_logging_elasticsearch/templates/2.x/elasticsearch.yml.j2
new file mode 100644
index 000000000..65b08d970
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/2.x/elasticsearch.yml.j2
@@ -0,0 +1,87 @@
+cluster:
+  name: ${CLUSTER_NAME}
+
+script:
+  inline: on
+  indexed: on
+
+index:
+  number_of_shards: {{ es_number_of_shards | default ('1') }}
+  number_of_replicas: {{ es_number_of_replicas | default ('0') }}
+  unassigned.node_left.delayed_timeout: 2m
+  translog:
+    flush_threshold_size: 256mb
+    flush_threshold_period: 5m
+
+node:
+  name: ${DC_NAME}
+  master: ${IS_MASTER}
+  data: ${HAS_DATA}
+  max_local_storage_nodes: 1
+
+network:
+  host: 0.0.0.0
+
+cloud:
+  kubernetes:
+    pod_label: ${POD_LABEL}
+    pod_port: 9300
+    namespace: ${NAMESPACE}
+
+discovery:
+  type: kubernetes
+  zen.ping.multicast.enabled: false
+  zen.minimum_master_nodes: ${NODE_QUORUM}
+
+gateway:
+  recover_after_nodes: ${NODE_QUORUM}
+  expected_nodes: ${RECOVER_EXPECTED_NODES}
+  recover_after_time: ${RECOVER_AFTER_TIME}
+
+io.fabric8.elasticsearch.authentication.users: ["system.logging.kibana", "system.logging.fluentd", "system.logging.curator", "system.admin"]
+io.fabric8.elasticsearch.kibana.mapping.app: /usr/share/elasticsearch/index_patterns/com.redhat.viaq-openshift.index-pattern.json
+io.fabric8.elasticsearch.kibana.mapping.ops: /usr/share/elasticsearch/index_patterns/com.redhat.viaq-openshift.index-pattern.json
+io.fabric8.elasticsearch.kibana.mapping.empty: /usr/share/elasticsearch/index_patterns/com.redhat.viaq-openshift.index-pattern.json
+
+openshift.config:
+  use_common_data_model: true
+  project_index_prefix: "project"
+  time_field_name: "@timestamp"
+
+openshift.searchguard:
+  keystore.path: /etc/elasticsearch/secret/admin.jks
+  truststore.path: /etc/elasticsearch/secret/searchguard.truststore
+
+openshift.operations.allow_cluster_reader: {{allow_cluster_reader | default (false)}}
+
+openshift.kibana.index.mode: {{es_kibana_index_mode | default('unique')}}
+
+path:
+  data: /elasticsearch/persistent/${CLUSTER_NAME}/data
+  logs: /elasticsearch/${CLUSTER_NAME}/logs
+  work: /elasticsearch/${CLUSTER_NAME}/work
+  scripts: /elasticsearch/${CLUSTER_NAME}/scripts
+
+searchguard:
+  authcz.admin_dn:
+  - CN=system.admin,OU=OpenShift,O=Logging
+  config_index_name: ".searchguard.${DC_NAME}"
+  ssl:
+    transport:
+      enabled: true
+      enforce_hostname_verification: false
+      keystore_type: JKS
+      keystore_filepath: /etc/elasticsearch/secret/searchguard.key
+      keystore_password: kspass
+      truststore_type: JKS
+      truststore_filepath: /etc/elasticsearch/secret/searchguard.truststore
+      truststore_password: tspass
+    http:
+      enabled: true
+      keystore_type: JKS
+      keystore_filepath: /etc/elasticsearch/secret/key
+      keystore_password: kspass
+      clientauth_mode: OPTIONAL
+      truststore_type: JKS
+      truststore_filepath: /etc/elasticsearch/secret/truststore
+      truststore_password: tspass
diff --git a/roles/openshift_logging_elasticsearch/templates/2.x/es.j2 b/roles/openshift_logging_elasticsearch/templates/2.x/es.j2
new file mode 100644
index 000000000..b1d6a4489
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/2.x/es.j2
@@ -0,0 +1,187 @@
+apiVersion: "v1"
+kind: "DeploymentConfig"
+metadata:
+  name: "{{deploy_name}}"
+  labels:
+    provider: openshift
+    component: "{{component}}"
+    deployment: "{{deploy_name}}"
+    logging-infra: "{{logging_component}}"
+spec:
+  replicas: {{es_replicas|default(1)}}
+  revisionHistoryLimit: 0
+  selector:
+    provider: openshift
+    component: "{{component}}"
+    deployment: "{{deploy_name}}"
+    logging-infra: "{{logging_component}}"
+  strategy:
+    type: Recreate
+  triggers: []
+  template:
+    metadata:
+      name: "{{deploy_name}}"
+      labels:
+        logging-infra: "{{logging_component}}"
+        provider: openshift
+        component: "{{component}}"
+        deployment: "{{deploy_name}}"
+    spec:
+      terminationGracePeriod: 600
+      serviceAccountName: aggregated-logging-elasticsearch
+      securityContext:
+        supplementalGroups:
+{% for group in es_storage_groups %}
+        - {{group}}
+{% endfor %}
+{% if es_node_selector is iterable and es_node_selector | length > 0 %}
+      nodeSelector:
+{% for key, value in es_node_selector.items() %}
+        {{key}}: "{{value}}"
+{% endfor %}
+{% endif %}
+      containers:
+        - name: proxy
+          image: {{ proxy_image }}
+          imagePullPolicy: IfNotPresent
+          args:
+           - --upstream-ca=/etc/elasticsearch/secret/admin-ca
+           - --https-address=:4443
+           - -provider=openshift
+           - -client-id={{openshift_logging_elasticsearch_prometheus_sa}}
+           - -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
+           - -cookie-secret={{ 16 | lib_utils_oo_random_word | b64encode }}
+           - -basic-auth-password={{ basic_auth_passwd }}
+           - -upstream=https://localhost:9200
+           - '-openshift-sar={"namespace": "{{ openshift_logging_elasticsearch_namespace}}", "verb": "view", "resource": "prometheus", "group": "metrics.openshift.io"}'
+           - '-openshift-delegate-urls={"/": {"resource": "prometheus", "verb": "view", "group": "metrics.openshift.io", "namespace": "{{ openshift_logging_elasticsearch_namespace}}"}}'
+           - --tls-cert=/etc/tls/private/tls.crt
+           - --tls-key=/etc/tls/private/tls.key
+           - -pass-access-token
+           - -pass-user-headers
+          ports:
+          - containerPort: 4443
+            name: proxy
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /etc/tls/private
+            name: proxy-tls
+            readOnly: true
+          - mountPath: /etc/elasticsearch/secret
+            name: elasticsearch
+            readOnly: true
+          resources:
+            limits:
+              memory: "{{openshift_logging_elasticsearch_proxy_memory_limit }}"
+            requests:
+              cpu: "{{openshift_logging_elasticsearch_proxy_cpu_request }}"
+              memory: "{{openshift_logging_elasticsearch_proxy_memory_limit }}"
+        -
+          name: "elasticsearch"
+          image: {{image}}
+          imagePullPolicy: IfNotPresent
+          resources:
+            limits:
+{% if es_cpu_limit is defined and es_cpu_limit is not none and es_cpu_limit != '' %}
+              cpu: "{{es_cpu_limit}}"
+{% endif %}
+              memory: "{{es_memory_limit}}"
+            requests:
+              cpu: "{{es_cpu_request}}"
+              memory: "{{es_memory_limit}}"
+{% if es_container_security_context %}
+          securityContext: {{ es_container_security_context | to_yaml }}
+{% endif %}
+          ports:
+            -
+              containerPort: 9200
+              name: "restapi"
+            -
+              containerPort: 9300
+              name: "cluster"
+          env:
+            -
+              name: "DC_NAME"
+              value: "{{deploy_name}}"
+            -
+              name: "NAMESPACE"
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            -
+              name: "KUBERNETES_TRUST_CERT"
+              value: "true"
+            -
+              name: "SERVICE_DNS"
+              value: "logging-{{es_cluster_name}}-cluster"
+            -
+              name: "CLUSTER_NAME"
+              value: "logging-{{es_cluster_name}}"
+            -
+              name: "INSTANCE_RAM"
+              value: "{{openshift_logging_elasticsearch_memory_limit}}"
+            -
+              name: "HEAP_DUMP_LOCATION"
+              value: "/elasticsearch/persistent/heapdump.hprof"
+            -
+              name: "NODE_QUORUM"
+              value: "{{es_node_quorum | int}}"
+            -
+              name: "RECOVER_EXPECTED_NODES"
+              value: "{{es_recover_expected_nodes}}"
+            -
+              name: "RECOVER_AFTER_TIME"
+              value: "{{openshift_logging_elasticsearch_recover_after_time}}"
+            -
+              name: "READINESS_PROBE_TIMEOUT"
+              value: "30"
+            -
+              name: "POD_LABEL"
+              value: "component={{component}}"
+            -
+              name: "IS_MASTER"
+              value: "{% if deploy_type in ['data-master', 'master'] %}true{% else %}false{% endif %}"
+
+            -
+              name: "HAS_DATA"
+              value: "{% if deploy_type in ['data-master', 'data-client'] %}true{% else %}false{% endif %}"
+            -
+              name: "PROMETHEUS_USER"
+              value: "{{openshift_logging_elasticsearch_prometheus_sa}}"
+
+          volumeMounts:
+            - name: elasticsearch
+              mountPath: /etc/elasticsearch/secret
+              readOnly: true
+            - name: elasticsearch-config
+              mountPath: /usr/share/java/elasticsearch/config
+              readOnly: true
+            - name: elasticsearch-storage
+              mountPath: /elasticsearch/persistent
+          readinessProbe:
+            exec:
+              command:
+              - "/usr/share/java/elasticsearch/probe/readiness.sh"
+            initialDelaySeconds: 10
+            timeoutSeconds: 30
+            periodSeconds: 5
+      volumes:
+        - name: proxy-tls
+          secret:
+            secretName: prometheus-tls
+        - name: elasticsearch
+          secret:
+            secretName: logging-elasticsearch
+        - name: elasticsearch-config
+          configMap:
+            name: logging-elasticsearch
+        - name: elasticsearch-storage
+{% if openshift_logging_elasticsearch_storage_type == 'pvc' %}
+          persistentVolumeClaim:
+            claimName: {{ openshift_logging_elasticsearch_pvc_name }}
+{% elif openshift_logging_elasticsearch_storage_type == 'hostmount' %}
+          hostPath:
+            path: {{ openshift_logging_elasticsearch_hostmount_path }}
+{% else %}
+          emptydir: {}
+{% endif %}
diff --git a/roles/openshift_logging_elasticsearch/templates/2.x/logging-metrics-role.j2 b/roles/openshift_logging_elasticsearch/templates/2.x/logging-metrics-role.j2
new file mode 100644
index 000000000..d9800e5a5
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/2.x/logging-metrics-role.j2
@@ -0,0 +1,31 @@
+---
+apiVersion: v1
+kind: List
+items:
+- apiVersion: rbac.authorization.k8s.io/v1beta1
+  kind: Role
+  metadata:
+    annotations:
+      rbac.authorization.kubernetes.io/autoupdate: "true"
+    name: prometheus-metrics-viewer
+    namespace: {{ namespace }}
+  rules:
+  - apiGroups:
+    - metrics.openshift.io
+    resources:
+    - prometheus
+    verbs:
+    - view
+- apiVersion: rbac.authorization.k8s.io/v1beta1
+  kind: RoleBinding
+  metadata:
+    name: prometheus-metrics-viewer
+    namespace: {{ namespace }}
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: prometheus-metrics-viewer
+  subjects:
+  - kind: ServiceAccount
+    namespace: {{ role_namespace }}
+    name: {{ role_user }}
diff --git a/roles/openshift_logging_elasticsearch/templates/2.x/pvc.j2 b/roles/openshift_logging_elasticsearch/templates/2.x/pvc.j2
new file mode 100644
index 000000000..3c6896df4
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/2.x/pvc.j2
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{obj_name}}
+  labels:
+    logging-infra: support
+{% if annotations is defined %}
+  annotations:
+{% for key,value in annotations.items() %}
+    {{key}}: {{value}}
+{% endfor %}
+{% endif %}
+spec:
+{% if pv_selector is defined and pv_selector is mapping %}
+  selector:
+    matchLabels:
+{% for key,value in pv_selector.items() %}
+      {{key}}: {{value}}
+{% endfor %}
+{% endif %}
+  accessModes:
+{% for mode in access_modes %}
+    - {{ mode }}
+{% endfor %}
+  resources:
+    requests:
+      storage: {{size}}
+{% if storage_class_name is defined %}
+  storageClassName: {{ storage_class_name }}
+{% endif %}
diff --git a/roles/openshift_logging_elasticsearch/templates/2.x/rolebinding.j2 b/roles/openshift_logging_elasticsearch/templates/2.x/rolebinding.j2
new file mode 100644
index 000000000..fcd4e87cc
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/2.x/rolebinding.j2
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: RoleBinding
+metadata:
+  name: {{obj_name}}
+roleRef:
+{% if roleRef.kind is defined %}
+  kind: {{ roleRef.kind }}
+{% endif %}
+  name: {{ roleRef.name }}
+subjects:
+{% for sub in subjects %}
+  - kind: {{ sub.kind }}
+    name: {{ sub.name }}
+{% endfor %}
diff --git a/roles/openshift_logging_elasticsearch/templates/2.x/route_reencrypt.j2 b/roles/openshift_logging_elasticsearch/templates/2.x/route_reencrypt.j2
new file mode 100644
index 000000000..d2e8b8bcb
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/2.x/route_reencrypt.j2
@@ -0,0 +1,36 @@
+apiVersion: "v1"
+kind: "Route"
+metadata:
+  name: "{{obj_name}}"
+{% if labels is defined%}
+  labels:
+{% for key, value in labels.items() %}
+    {{key}}: {{value}}
+{% endfor %}
+{% endif %}
+spec:
+  host: {{ route_host }}
+  tls:
+{% if tls_key is defined and tls_key | length > 0 %}
+    key: |
+{{ tls_key|indent(6, true) }}
+{% if tls_cert is defined and tls_cert | length > 0 %}
+    certificate: |
+{{ tls_cert|indent(6, true) }}
+{% endif %}
+{% endif %}
+    caCertificate: |
+{% for line in tls_ca_cert.split('\n') %}
+      {{ line }}
+{% endfor %}
+    destinationCACertificate: |
+{% for line in tls_dest_ca_cert.split('\n') %}
+      {{ line }}
+{% endfor %}
+    termination: reencrypt
+{% if edge_term_policy is defined and edge_term_policy | length > 0 %}
+    insecureEdgeTerminationPolicy: {{ edge_term_policy }}
+{% endif %}
+  to:
+    kind: Service
+    name: {{ service_name }}
diff --git a/roles/openshift_logging_elasticsearch/templates/5.x/elasticsearch.yml.j2 b/roles/openshift_logging_elasticsearch/templates/5.x/elasticsearch.yml.j2
new file mode 100644
index 000000000..009471d2c
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/5.x/elasticsearch.yml.j2
@@ -0,0 +1,74 @@
+cluster:
+  name: ${CLUSTER_NAME}
+
+script:
+  inline: true
+  stored: true
+
+node:
+  name: ${DC_NAME}
+  master: ${IS_MASTER}
+  data: ${HAS_DATA}
+  max_local_storage_nodes: 1
+
+network:
+  host: 0.0.0.0
+
+cloud:
+  kubernetes:
+    service: ${SERVICE_DNS}
+    namespace: ${NAMESPACE}
+
+discovery.zen:
+  hosts_provider: kubernetes
+  minimum_master_nodes: ${NODE_QUORUM}
+
+gateway:
+  recover_after_nodes: ${NODE_QUORUM}
+  expected_nodes: ${RECOVER_EXPECTED_NODES}
+  recover_after_time: ${RECOVER_AFTER_TIME}
+
+io.fabric8.elasticsearch.kibana.mapping.app: /usr/share/elasticsearch/index_patterns/com.redhat.viaq-openshift.index-pattern.json
+io.fabric8.elasticsearch.kibana.mapping.ops: /usr/share/elasticsearch/index_patterns/com.redhat.viaq-openshift.index-pattern.json
+io.fabric8.elasticsearch.kibana.mapping.empty: /usr/share/elasticsearch/index_patterns/com.redhat.viaq-openshift.index-pattern.json
+
+openshift.config:
+  use_common_data_model: true
+  project_index_prefix: "project"
+  time_field_name: "@timestamp"
+
+openshift.searchguard:
+  keystore.path: /etc/elasticsearch/secret/admin.jks
+  truststore.path: /etc/elasticsearch/secret/searchguard.truststore
+
+openshift.operations.allow_cluster_reader: {{allow_cluster_reader | default (false)}}
+
+openshift.kibana.index.mode: {{es_kibana_index_mode | default('unique')}}
+
+path:
+  data: /elasticsearch/persistent/${CLUSTER_NAME}/data
+  logs: /elasticsearch/${CLUSTER_NAME}/logs
+
+searchguard:
+  authcz.admin_dn:
+  - CN=system.admin,OU=OpenShift,O=Logging
+  config_index_name: ".searchguard.${DC_NAME}"
+  ssl:
+    transport:
+      enabled: true
+      enforce_hostname_verification: false
+      keystore_type: JKS
+      keystore_filepath: /etc/elasticsearch/secret/searchguard.key
+      keystore_password: kspass
+      truststore_type: JKS
+      truststore_filepath: /etc/elasticsearch/secret/searchguard.truststore
+      truststore_password: tspass
+    http:
+      enabled: true
+      keystore_type: JKS
+      keystore_filepath: /etc/elasticsearch/secret/key
+      keystore_password: kspass
+      clientauth_mode: OPTIONAL
+      truststore_type: JKS
+      truststore_filepath: /etc/elasticsearch/secret/truststore
+      truststore_password: tspass
diff --git a/roles/openshift_logging_elasticsearch/templates/5.x/es.j2 b/roles/openshift_logging_elasticsearch/templates/5.x/es.j2
new file mode 100644
index 000000000..bcfd6f273
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/5.x/es.j2
@@ -0,0 +1,194 @@
+apiVersion: "v1"
+kind: "DeploymentConfig"
+metadata:
+  name: "{{deploy_name}}"
+  labels:
+    provider: openshift
+    component: "{{component}}"
+    deployment: "{{deploy_name}}"
+    logging-infra: "{{logging_component}}"
+spec:
+  replicas: {{es_replicas|default(1)}}
+  revisionHistoryLimit: 0
+  selector:
+    provider: openshift
+    component: "{{component}}"
+    deployment: "{{deploy_name}}"
+    logging-infra: "{{logging_component}}"
+  strategy:
+    type: Recreate
+  triggers: []
+  template:
+    metadata:
+      name: "{{deploy_name}}"
+      labels:
+        logging-infra: "{{logging_component}}"
+        provider: openshift
+        component: "{{component}}"
+        deployment: "{{deploy_name}}"
+    spec:
+      terminationGracePeriod: 600
+      serviceAccountName: aggregated-logging-elasticsearch
+      securityContext:
+        supplementalGroups:
+{% for group in es_storage_groups %}
+        - {{group}}
+{% endfor %}
+{% if es_node_selector is iterable and es_node_selector | length > 0 %}
+      nodeSelector:
+{% for key, value in es_node_selector.items() %}
+        {{key}}: "{{value}}"
+{% endfor %}
+{% endif %}
+      containers:
+        - name: proxy
+          image: {{ proxy_image }}
+          imagePullPolicy: IfNotPresent
+          args:
+           - --upstream-ca=/etc/elasticsearch/secret/admin-ca
+           - --https-address=:4443
+           - -provider=openshift
+           - -client-id={{openshift_logging_elasticsearch_prometheus_sa}}
+           - -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
+           - -cookie-secret={{ 16 | lib_utils_oo_random_word | b64encode }}
+           - -upstream=https://localhost:9200
+           - '-openshift-sar={"namespace": "{{ openshift_logging_elasticsearch_namespace}}", "verb": "view", "resource": "prometheus", "group": "metrics.openshift.io"}'
+           - '-openshift-delegate-urls={"/": {"resource": "prometheus", "verb": "view", "group": "metrics.openshift.io", "namespace": "{{ openshift_logging_elasticsearch_namespace}}"}}'
+           - --tls-cert=/etc/tls/private/tls.crt
+           - --tls-key=/etc/tls/private/tls.key
+           - -pass-access-token
+           - -pass-user-headers
+          ports:
+          - containerPort: 4443
+            name: proxy
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /etc/tls/private
+            name: proxy-tls
+            readOnly: true
+          - mountPath: /etc/elasticsearch/secret
+            name: elasticsearch
+            readOnly: true
+          resources:
+            limits:
+              memory: "{{openshift_logging_elasticsearch_proxy_memory_limit }}"
+            requests:
+              cpu: "{{openshift_logging_elasticsearch_proxy_cpu_request }}"
+              memory: "{{openshift_logging_elasticsearch_proxy_memory_limit }}"
+        -
+          name: "elasticsearch"
+          image: {{image}}
+          imagePullPolicy: IfNotPresent
+          resources:
+            limits:
+{% if es_cpu_limit is defined and es_cpu_limit is not none and es_cpu_limit != '' %}
+              cpu: "{{es_cpu_limit}}"
+{% endif %}
+              memory: "{{es_memory_limit}}"
+            requests:
+              cpu: "{{es_cpu_request}}"
+              memory: "{{es_memory_limit}}"
+{% if es_container_security_context %}
+          securityContext: {{ es_container_security_context | to_yaml }}
+{% endif %}
+          ports:
+            -
+              containerPort: 9200
+              name: "restapi"
+            -
+              containerPort: 9300
+              name: "cluster"
+          env:
+            -
+              name: "DC_NAME"
+              value: "{{deploy_name}}"
+            -
+              name: "NAMESPACE"
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            -
+              name: "KUBERNETES_TRUST_CERT"
+              value: "true"
+            -
+              name: "SERVICE_DNS"
+              value: "logging-{{es_cluster_name}}-cluster"
+            -
+              name: "CLUSTER_NAME"
+              value: "logging-{{es_cluster_name}}"
+            -
+              name: "INSTANCE_RAM"
+              value: "{{openshift_logging_elasticsearch_memory_limit}}"
+            -
+              name: "HEAP_DUMP_LOCATION"
+              value: "/elasticsearch/persistent/heapdump.hprof"
+            -
+              name: "NODE_QUORUM"
+              value: "{{es_node_quorum | int}}"
+            -
+              name: "RECOVER_EXPECTED_NODES"
+              value: "{{es_recover_expected_nodes}}"
+            -
+              name: "RECOVER_AFTER_TIME"
+              value: "{{openshift_logging_elasticsearch_recover_after_time}}"
+            -
+              name: "READINESS_PROBE_TIMEOUT"
+              value: "30"
+            -
+              name: "POD_LABEL"
+              value: "component={{component}}"
+            -
+              name: "IS_MASTER"
+              value: "{% if deploy_type in ['data-master', 'master'] %}true{% else %}false{% endif %}"
+
+            -
+              name: "HAS_DATA"
+              value: "{% if deploy_type in ['data-master', 'data-client'] %}true{% else %}false{% endif %}"
+            -
+              name: "PROMETHEUS_USER"
+              value: "{{openshift_logging_elasticsearch_prometheus_sa}}"
+
+            -
+             name: "PRIMARY_SHARDS"
+             value: "{{ es_number_of_shards | default ('1') }}"
+
+            -
+             name: "REPLICA_SHARDS"
+             value: "{{ es_number_of_replicas | default ('0') }}"
+
+          volumeMounts:
+            - name: elasticsearch
+              mountPath: /etc/elasticsearch/secret
+              readOnly: true
+            - name: elasticsearch-config
+              mountPath: /usr/share/java/elasticsearch/config
+              readOnly: true
+            - name: elasticsearch-storage
+              mountPath: /elasticsearch/persistent
+          readinessProbe:
+            exec:
+              command:
+              - "/usr/share/elasticsearch/probe/readiness.sh"
+            initialDelaySeconds: 10
+            timeoutSeconds: 30
+            periodSeconds: 5
+      volumes:
+        - name: proxy-tls
+          secret:
+            secretName: prometheus-tls
+        - name: elasticsearch
+          secret:
+            secretName: logging-elasticsearch
+        - name: elasticsearch-config
+          configMap:
+            name: logging-elasticsearch
+        - name: elasticsearch-storage
+{% if openshift_logging_elasticsearch_storage_type == 'pvc' %}
+          persistentVolumeClaim:
+            claimName: {{ openshift_logging_elasticsearch_pvc_name }}
+{% elif openshift_logging_elasticsearch_storage_type == 'hostmount' %}
+          hostPath:
+            path: {{ openshift_logging_elasticsearch_hostmount_path }}
+{% else %}
+          emptydir: {}
+{% endif %}
diff --git a/roles/openshift_logging_elasticsearch/templates/5.x/log4j2.properties.j2 b/roles/openshift_logging_elasticsearch/templates/5.x/log4j2.properties.j2
new file mode 100644
index 000000000..1e78e4ea0
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/5.x/log4j2.properties.j2
@@ -0,0 +1,78 @@
+status = error
+
+# log action execution errors for easier debugging
+logger.action.name = org.elasticsearch.action
+logger.action.level = debug
+
+appender.console.type = Console
+appender.console.name = console
+appender.console.layout.type = PatternLayout
+appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n
+
+appender.rolling.type = RollingFile
+appender.rolling.name = rolling
+appender.rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}.log
+appender.rolling.layout.type = PatternLayout
+appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%.-10000m%n
+appender.rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}-%d{yyyy-MM-dd}.log
+appender.rolling.policies.type = Policies
+appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
+appender.rolling.policies.time.interval = 1
+appender.rolling.policies.time.modulate = true
+
+rootLogger.level = info
+{% if 'console' in root_logger  %}
+rootLogger.appenderRef.console.ref = console
+{% endif %}
+{% if 'file' in root_logger %}
+rootLogger.appenderRef.rolling.ref = rolling
+{% endif %}
+
+appender.deprecation_rolling.type = RollingFile
+appender.deprecation_rolling.name = deprecation_rolling
+appender.deprecation_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation.log
+appender.deprecation_rolling.layout.type = PatternLayout
+appender.deprecation_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%.-10000m%n
+appender.deprecation_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation-%i.log.gz
+appender.deprecation_rolling.policies.type = Policies
+appender.deprecation_rolling.policies.size.type = SizeBasedTriggeringPolicy
+appender.deprecation_rolling.policies.size.size = 1GB
+appender.deprecation_rolling.strategy.type = DefaultRolloverStrategy
+appender.deprecation_rolling.strategy.max = 4
+
+logger.deprecation.name = org.elasticsearch.deprecation
+logger.deprecation.level = warn
+logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_rolling
+logger.deprecation.additivity = false
+
+appender.index_search_slowlog_rolling.type = RollingFile
+appender.index_search_slowlog_rolling.name = index_search_slowlog_rolling
+appender.index_search_slowlog_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_search_slowlog.log
+appender.index_search_slowlog_rolling.layout.type = PatternLayout
+appender.index_search_slowlog_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %marker%.-10000m%n
+appender.index_search_slowlog_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_search_slowlog-%d{yyyy-MM-dd}.log
+appender.index_search_slowlog_rolling.policies.type = Policies
+appender.index_search_slowlog_rolling.policies.time.type = TimeBasedTriggeringPolicy
+appender.index_search_slowlog_rolling.policies.time.interval = 1
+appender.index_search_slowlog_rolling.policies.time.modulate = true
+
+logger.index_search_slowlog_rolling.name = index.search.slowlog
+logger.index_search_slowlog_rolling.level = trace
+logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling.ref = index_search_slowlog_rolling
+logger.index_search_slowlog_rolling.additivity = false
+
+appender.index_indexing_slowlog_rolling.type = RollingFile
+appender.index_indexing_slowlog_rolling.name = index_indexing_slowlog_rolling
+appender.index_indexing_slowlog_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_indexing_slowlog.log
+appender.index_indexing_slowlog_rolling.layout.type = PatternLayout
+appender.index_indexing_slowlog_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %marker%.-10000m%n
+appender.index_indexing_slowlog_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_indexing_slowlog-%d{yyyy-MM-dd}.log
+appender.index_indexing_slowlog_rolling.policies.type = Policies
+appender.index_indexing_slowlog_rolling.policies.time.type = TimeBasedTriggeringPolicy
+appender.index_indexing_slowlog_rolling.policies.time.interval = 1
+appender.index_indexing_slowlog_rolling.policies.time.modulate = true
+
+logger.index_indexing_slowlog.name = index.indexing.slowlog.index
+logger.index_indexing_slowlog.level = trace
+logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling.ref = index_indexing_slowlog_rolling
+logger.index_indexing_slowlog.additivity = false
diff --git a/roles/openshift_logging_elasticsearch/templates/5.x/logging-metrics-role.j2 b/roles/openshift_logging_elasticsearch/templates/5.x/logging-metrics-role.j2
new file mode 100644
index 000000000..d9800e5a5
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/5.x/logging-metrics-role.j2
@@ -0,0 +1,31 @@
+---
+apiVersion: v1
+kind: List
+items:
+- apiVersion: rbac.authorization.k8s.io/v1beta1
+  kind: Role
+  metadata:
+    annotations:
+      rbac.authorization.kubernetes.io/autoupdate: "true"
+    name: prometheus-metrics-viewer
+    namespace: {{ namespace }}
+  rules:
+  - apiGroups:
+    - metrics.openshift.io
+    resources:
+    - prometheus
+    verbs:
+    - view
+- apiVersion: rbac.authorization.k8s.io/v1beta1
+  kind: RoleBinding
+  metadata:
+    name: prometheus-metrics-viewer
+    namespace: {{ namespace }}
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: prometheus-metrics-viewer
+  subjects:
+  - kind: ServiceAccount
+    namespace: {{ role_namespace }}
+    name: {{ role_user }}
diff --git a/roles/openshift_logging_elasticsearch/templates/5.x/pvc.j2 b/roles/openshift_logging_elasticsearch/templates/5.x/pvc.j2
new file mode 100644
index 000000000..3c6896df4
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/5.x/pvc.j2
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{obj_name}}
+  labels:
+    logging-infra: support
+{% if annotations is defined %}
+  annotations:
+{% for key,value in annotations.items() %}
+    {{key}}: {{value}}
+{% endfor %}
+{% endif %}
+spec:
+{% if pv_selector is defined and pv_selector is mapping %}
+  selector:
+    matchLabels:
+{% for key,value in pv_selector.items() %}
+      {{key}}: {{value}}
+{% endfor %}
+{% endif %}
+  accessModes:
+{% for mode in access_modes %}
+    - {{ mode }}
+{% endfor %}
+  resources:
+    requests:
+      storage: {{size}}
+{% if storage_class_name is defined %}
+  storageClassName: {{ storage_class_name }}
+{% endif %}
diff --git a/roles/openshift_logging_elasticsearch/templates/5.x/rolebinding.j2 b/roles/openshift_logging_elasticsearch/templates/5.x/rolebinding.j2
new file mode 100644
index 000000000..fcd4e87cc
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/5.x/rolebinding.j2
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: RoleBinding
+metadata:
+  name: {{obj_name}}
+roleRef:
+{% if roleRef.kind is defined %}
+  kind: {{ roleRef.kind }}
+{% endif %}
+  name: {{ roleRef.name }}
+subjects:
+{% for sub in subjects %}
+  - kind: {{ sub.kind }}
+    name: {{ sub.name }}
+{% endfor %}
diff --git a/roles/openshift_logging_elasticsearch/templates/5.x/route_reencrypt.j2 b/roles/openshift_logging_elasticsearch/templates/5.x/route_reencrypt.j2
new file mode 100644
index 000000000..d2e8b8bcb
--- /dev/null
+++ b/roles/openshift_logging_elasticsearch/templates/5.x/route_reencrypt.j2
@@ -0,0 +1,36 @@
+apiVersion: "v1"
+kind: "Route"
+metadata:
+  name: "{{obj_name}}"
+{% if labels is defined%}
+  labels:
+{% for key, value in labels.items() %}
+    {{key}}: {{value}}
+{% endfor %}
+{% endif %}
+spec:
+  host: {{ route_host }}
+  tls:
+{% if tls_key is defined and tls_key | length > 0 %}
+    key: |
+{{ tls_key|indent(6, true) }}
+{% if tls_cert is defined and tls_cert | length > 0 %}
+    certificate: |
+{{ tls_cert|indent(6, true) }}
+{% endif %}
+{% endif %}
+    caCertificate: |
+{% for line in tls_ca_cert.split('\n') %}
+      {{ line }}
+{% endfor %}
+    destinationCACertificate: |
+{% for line in tls_dest_ca_cert.split('\n') %}
+      {{ line }}
+{% endfor %}
+    termination: reencrypt
+{% if edge_term_policy is defined and edge_term_policy | length > 0 %}
+    insecureEdgeTerminationPolicy: {{ edge_term_policy }}
+{% endif %}
+  to:
+    kind: Service
+    name: {{ service_name }}
diff --git a/roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2 b/roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2
deleted file mode 100644
index c7b2b2721..000000000
--- a/roles/openshift_logging_elasticsearch/templates/elasticsearch-logging.yml.j2
+++ /dev/null
@@ -1,105 +0,0 @@
-# you can override this using by setting a system property, for example -Des.logger.level=DEBUG
-es.logger.level: INFO
-rootLogger: ${es.logger.level}, {{root_logger}}
-logger:
-  # log action execution errors for easier debugging
-  action: WARN
-
-  #
-  # deprecation logging, turn to DEBUG to see them
-  deprecation: WARN, deprecation_log_file
-
-  # reduce the logging for aws, too much is logged under the default INFO
-  com.amazonaws: WARN
-
-  io.fabric8.elasticsearch: ${PLUGIN_LOGLEVEL}
-  io.fabric8.kubernetes: ${PLUGIN_LOGLEVEL}
-
-  # aws will try to do some sketchy JMX stuff, but its not needed.
-  com.amazonaws.jmx.SdkMBeanRegistrySupport: ERROR
-  com.amazonaws.metrics.AwsSdkMetrics: ERROR
-
-  org.apache.http: INFO
-
-  # gateway
-  #gateway: DEBUG
-  #index.gateway: DEBUG
-
-  # peer shard recovery
-  #indices.recovery: DEBUG
-
-  # discovery
-  #discovery: TRACE
-
-  index.search.slowlog: TRACE, index_search_slow_log_file
-  index.indexing.slowlog: TRACE, index_indexing_slow_log_file
-
-  # search-guard
-  com.floragunn.searchguard: WARN
-
-additivity:
-  index.search.slowlog: false
-  index.indexing.slowlog: false
-  deprecation: false
-
-appender:
-  console:
-    type: console
-    layout:
-      type: consolePattern
-      conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %.1000m%n"
-    # need this filter until https://github.com/openshift/origin/issues/14515 is fixed
-    filter:
-      1:
-        type: org.apache.log4j.varia.StringMatchFilter
-        StringToMatch: "SSL Problem illegal change cipher spec msg, conn state = 6, handshake state = 1"
-        AcceptOnMatch: false
-
-  file:
-    type: dailyRollingFile
-    file: ${path.logs}/${cluster.name}.log
-    datePattern: "'.'yyyy-MM-dd"
-    layout:
-      type: pattern
-      conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
-    # need this filter until https://github.com/openshift/origin/issues/14515 is fixed
-    filter:
-      1:
-        type: org.apache.log4j.varia.StringMatchFilter
-        StringToMatch: "SSL Problem illegal change cipher spec msg, conn state = 6, handshake state = 1"
-        AcceptOnMatch: false
-
-  # Use the following log4j-extras RollingFileAppender to enable gzip compression of log files.
-  # For more information see https://logging.apache.org/log4j/extras/apidocs/org/apache/log4j/rolling/RollingFileAppender.html
-  #file:
-    #type: extrasRollingFile
-    #file: ${path.logs}/${cluster.name}.log
-    #rollingPolicy: timeBased
-    #rollingPolicy.FileNamePattern: ${path.logs}/${cluster.name}.log.%d{yyyy-MM-dd}.gz
-    #layout:
-      #type: pattern
-      #conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
-
-  deprecation_log_file:
-    type: dailyRollingFile
-    file: ${path.logs}/${cluster.name}_deprecation.log
-    datePattern: "'.'yyyy-MM-dd"
-    layout:
-      type: pattern
-      conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
-
-  index_search_slow_log_file:
-    type: dailyRollingFile
-    file: ${path.logs}/${cluster.name}_index_search_slowlog.log
-    datePattern: "'.'yyyy-MM-dd"
-    layout:
-      type: pattern
-      conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
-
-  index_indexing_slow_log_file:
-    type: dailyRollingFile
-    file: ${path.logs}/${cluster.name}_index_indexing_slowlog.log
-    datePattern: "'.'yyyy-MM-dd"
-    layout:
-      type: pattern
-      conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
diff --git a/roles/openshift_logging_elasticsearch/templates/elasticsearch.yml.j2 b/roles/openshift_logging_elasticsearch/templates/elasticsearch.yml.j2
deleted file mode 100644
index 65b08d970..000000000
--- a/roles/openshift_logging_elasticsearch/templates/elasticsearch.yml.j2
+++ /dev/null
@@ -1,87 +0,0 @@
-cluster:
-  name: ${CLUSTER_NAME}
-
-script:
-  inline: on
-  indexed: on
-
-index:
-  number_of_shards: {{ es_number_of_shards | default ('1') }}
-  number_of_replicas: {{ es_number_of_replicas | default ('0') }}
-  unassigned.node_left.delayed_timeout: 2m
-  translog:
-    flush_threshold_size: 256mb
-    flush_threshold_period: 5m
-
-node:
-  name: ${DC_NAME}
-  master: ${IS_MASTER}
-  data: ${HAS_DATA}
-  max_local_storage_nodes: 1
-
-network:
-  host: 0.0.0.0
-
-cloud:
-  kubernetes:
-    pod_label: ${POD_LABEL}
-    pod_port: 9300
-    namespace: ${NAMESPACE}
-
-discovery:
-  type: kubernetes
-  zen.ping.multicast.enabled: false
-  zen.minimum_master_nodes: ${NODE_QUORUM}
-
-gateway:
-  recover_after_nodes: ${NODE_QUORUM}
-  expected_nodes: ${RECOVER_EXPECTED_NODES}
-  recover_after_time: ${RECOVER_AFTER_TIME}
-
-io.fabric8.elasticsearch.authentication.users: ["system.logging.kibana", "system.logging.fluentd", "system.logging.curator", "system.admin"]
-io.fabric8.elasticsearch.kibana.mapping.app: /usr/share/elasticsearch/index_patterns/com.redhat.viaq-openshift.index-pattern.json
-io.fabric8.elasticsearch.kibana.mapping.ops: /usr/share/elasticsearch/index_patterns/com.redhat.viaq-openshift.index-pattern.json
-io.fabric8.elasticsearch.kibana.mapping.empty: /usr/share/elasticsearch/index_patterns/com.redhat.viaq-openshift.index-pattern.json
-
-openshift.config:
-  use_common_data_model: true
-  project_index_prefix: "project"
-  time_field_name: "@timestamp"
-
-openshift.searchguard:
-  keystore.path: /etc/elasticsearch/secret/admin.jks
-  truststore.path: /etc/elasticsearch/secret/searchguard.truststore
-
-openshift.operations.allow_cluster_reader: {{allow_cluster_reader | default (false)}}
-
-openshift.kibana.index.mode: {{es_kibana_index_mode | default('unique')}}
-
-path:
-  data: /elasticsearch/persistent/${CLUSTER_NAME}/data
-  logs: /elasticsearch/${CLUSTER_NAME}/logs
-  work: /elasticsearch/${CLUSTER_NAME}/work
-  scripts: /elasticsearch/${CLUSTER_NAME}/scripts
-
-searchguard:
-  authcz.admin_dn:
-  - CN=system.admin,OU=OpenShift,O=Logging
-  config_index_name: ".searchguard.${DC_NAME}"
-  ssl:
-    transport:
-      enabled: true
-      enforce_hostname_verification: false
-      keystore_type: JKS
-      keystore_filepath: /etc/elasticsearch/secret/searchguard.key
-      keystore_password: kspass
-      truststore_type: JKS
-      truststore_filepath: /etc/elasticsearch/secret/searchguard.truststore
-      truststore_password: tspass
-    http:
-      enabled: true
-      keystore_type: JKS
-      keystore_filepath: /etc/elasticsearch/secret/key
-      keystore_password: kspass
-      clientauth_mode: OPTIONAL
-      truststore_type: JKS
-      truststore_filepath: /etc/elasticsearch/secret/truststore
-      truststore_password: tspass
diff --git a/roles/openshift_logging_elasticsearch/templates/es.j2 b/roles/openshift_logging_elasticsearch/templates/es.j2
deleted file mode 100644
index b1d6a4489..000000000
--- a/roles/openshift_logging_elasticsearch/templates/es.j2
+++ /dev/null
@@ -1,187 +0,0 @@
-apiVersion: "v1"
-kind: "DeploymentConfig"
-metadata:
-  name: "{{deploy_name}}"
-  labels:
-    provider: openshift
-    component: "{{component}}"
-    deployment: "{{deploy_name}}"
-    logging-infra: "{{logging_component}}"
-spec:
-  replicas: {{es_replicas|default(1)}}
-  revisionHistoryLimit: 0
-  selector:
-    provider: openshift
-    component: "{{component}}"
-    deployment: "{{deploy_name}}"
-    logging-infra: "{{logging_component}}"
-  strategy:
-    type: Recreate
-  triggers: []
-  template:
-    metadata:
-      name: "{{deploy_name}}"
-      labels:
-        logging-infra: "{{logging_component}}"
-        provider: openshift
-        component: "{{component}}"
-        deployment: "{{deploy_name}}"
-    spec:
-      terminationGracePeriod: 600
-      serviceAccountName: aggregated-logging-elasticsearch
-      securityContext:
-        supplementalGroups:
-{% for group in es_storage_groups %}
-        - {{group}}
-{% endfor %}
-{% if es_node_selector is iterable and es_node_selector | length > 0 %}
-      nodeSelector:
-{% for key, value in es_node_selector.items() %}
-        {{key}}: "{{value}}"
-{% endfor %}
-{% endif %}
-      containers:
-        - name: proxy
-          image: {{ proxy_image }}
-          imagePullPolicy: IfNotPresent
-          args:
-           - --upstream-ca=/etc/elasticsearch/secret/admin-ca
-           - --https-address=:4443
-           - -provider=openshift
-           - -client-id={{openshift_logging_elasticsearch_prometheus_sa}}
-           - -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
-           - -cookie-secret={{ 16 | lib_utils_oo_random_word | b64encode }}
-           - -basic-auth-password={{ basic_auth_passwd }}
-           - -upstream=https://localhost:9200
-           - '-openshift-sar={"namespace": "{{ openshift_logging_elasticsearch_namespace}}", "verb": "view", "resource": "prometheus", "group": "metrics.openshift.io"}'
-           - '-openshift-delegate-urls={"/": {"resource": "prometheus", "verb": "view", "group": "metrics.openshift.io", "namespace": "{{ openshift_logging_elasticsearch_namespace}}"}}'
-           - --tls-cert=/etc/tls/private/tls.crt
-           - --tls-key=/etc/tls/private/tls.key
-           - -pass-access-token
-           - -pass-user-headers
-          ports:
-          - containerPort: 4443
-            name: proxy
-            protocol: TCP
-          volumeMounts:
-          - mountPath: /etc/tls/private
-            name: proxy-tls
-            readOnly: true
-          - mountPath: /etc/elasticsearch/secret
-            name: elasticsearch
-            readOnly: true
-          resources:
-            limits:
-              memory: "{{openshift_logging_elasticsearch_proxy_memory_limit }}"
-            requests:
-              cpu: "{{openshift_logging_elasticsearch_proxy_cpu_request }}"
-              memory: "{{openshift_logging_elasticsearch_proxy_memory_limit }}"
-        -
-          name: "elasticsearch"
-          image: {{image}}
-          imagePullPolicy: IfNotPresent
-          resources:
-            limits:
-{% if es_cpu_limit is defined and es_cpu_limit is not none and es_cpu_limit != '' %}
-              cpu: "{{es_cpu_limit}}"
-{% endif %}
-              memory: "{{es_memory_limit}}"
-            requests:
-              cpu: "{{es_cpu_request}}"
-              memory: "{{es_memory_limit}}"
-{% if es_container_security_context %}
-          securityContext: {{ es_container_security_context | to_yaml }}
-{% endif %}
-          ports:
-            -
-              containerPort: 9200
-              name: "restapi"
-            -
-              containerPort: 9300
-              name: "cluster"
-          env:
-            -
-              name: "DC_NAME"
-              value: "{{deploy_name}}"
-            -
-              name: "NAMESPACE"
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            -
-              name: "KUBERNETES_TRUST_CERT"
-              value: "true"
-            -
-              name: "SERVICE_DNS"
-              value: "logging-{{es_cluster_name}}-cluster"
-            -
-              name: "CLUSTER_NAME"
-              value: "logging-{{es_cluster_name}}"
-            -
-              name: "INSTANCE_RAM"
-              value: "{{openshift_logging_elasticsearch_memory_limit}}"
-            -
-              name: "HEAP_DUMP_LOCATION"
-              value: "/elasticsearch/persistent/heapdump.hprof"
-            -
-              name: "NODE_QUORUM"
-              value: "{{es_node_quorum | int}}"
-            -
-              name: "RECOVER_EXPECTED_NODES"
-              value: "{{es_recover_expected_nodes}}"
-            -
-              name: "RECOVER_AFTER_TIME"
-              value: "{{openshift_logging_elasticsearch_recover_after_time}}"
-            -
-              name: "READINESS_PROBE_TIMEOUT"
-              value: "30"
-            -
-              name: "POD_LABEL"
-              value: "component={{component}}"
-            -
-              name: "IS_MASTER"
-              value: "{% if deploy_type in ['data-master', 'master'] %}true{% else %}false{% endif %}"
-
-            -
-              name: "HAS_DATA"
-              value: "{% if deploy_type in ['data-master', 'data-client'] %}true{% else %}false{% endif %}"
-            -
-              name: "PROMETHEUS_USER"
-              value: "{{openshift_logging_elasticsearch_prometheus_sa}}"
-
-          volumeMounts:
-            - name: elasticsearch
-              mountPath: /etc/elasticsearch/secret
-              readOnly: true
-            - name: elasticsearch-config
-              mountPath: /usr/share/java/elasticsearch/config
-              readOnly: true
-            - name: elasticsearch-storage
-              mountPath: /elasticsearch/persistent
-          readinessProbe:
-            exec:
-              command:
-              - "/usr/share/java/elasticsearch/probe/readiness.sh"
-            initialDelaySeconds: 10
-            timeoutSeconds: 30
-            periodSeconds: 5
-      volumes:
-        - name: proxy-tls
-          secret:
-            secretName: prometheus-tls
-        - name: elasticsearch
-          secret:
-            secretName: logging-elasticsearch
-        - name: elasticsearch-config
-          configMap:
-            name: logging-elasticsearch
-        - name: elasticsearch-storage
-{% if openshift_logging_elasticsearch_storage_type == 'pvc' %}
-          persistentVolumeClaim:
-            claimName: {{ openshift_logging_elasticsearch_pvc_name }}
-{% elif openshift_logging_elasticsearch_storage_type == 'hostmount' %}
-          hostPath:
-            path: {{ openshift_logging_elasticsearch_hostmount_path }}
-{% else %}
-          emptydir: {}
-{% endif %}
diff --git a/roles/openshift_logging_elasticsearch/templates/logging-metrics-role.j2 b/roles/openshift_logging_elasticsearch/templates/logging-metrics-role.j2
deleted file mode 100644
index d9800e5a5..000000000
--- a/roles/openshift_logging_elasticsearch/templates/logging-metrics-role.j2
+++ /dev/null
@@ -1,31 +0,0 @@
----
-apiVersion: v1
-kind: List
-items:
-- apiVersion: rbac.authorization.k8s.io/v1beta1
-  kind: Role
-  metadata:
-    annotations:
-      rbac.authorization.kubernetes.io/autoupdate: "true"
-    name: prometheus-metrics-viewer
-    namespace: {{ namespace }}
-  rules:
-  - apiGroups:
-    - metrics.openshift.io
-    resources:
-    - prometheus
-    verbs:
-    - view
-- apiVersion: rbac.authorization.k8s.io/v1beta1
-  kind: RoleBinding
-  metadata:
-    name: prometheus-metrics-viewer
-    namespace: {{ namespace }}
-  roleRef:
-    apiGroup: rbac.authorization.k8s.io
-    kind: Role
-    name: prometheus-metrics-viewer
-  subjects:
-  - kind: ServiceAccount
-    namespace: {{ role_namespace }}
-    name: {{ role_user }}
diff --git a/roles/openshift_logging_elasticsearch/templates/pvc.j2 b/roles/openshift_logging_elasticsearch/templates/pvc.j2
deleted file mode 100644
index 3c6896df4..000000000
--- a/roles/openshift_logging_elasticsearch/templates/pvc.j2
+++ /dev/null
@@ -1,30 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: {{obj_name}}
-  labels:
-    logging-infra: support
-{% if annotations is defined %}
-  annotations:
-{% for key,value in annotations.items() %}
-    {{key}}: {{value}}
-{% endfor %}
-{% endif %}
-spec:
-{% if pv_selector is defined and pv_selector is mapping %}
-  selector:
-    matchLabels:
-{% for key,value in pv_selector.items() %}
-      {{key}}: {{value}}
-{% endfor %}
-{% endif %}
-  accessModes:
-{% for mode in access_modes %}
-    - {{ mode }}
-{% endfor %}
-  resources:
-    requests:
-      storage: {{size}}
-{% if storage_class_name is defined %}
-  storageClassName: {{ storage_class_name }}
-{% endif %}
diff --git a/roles/openshift_logging_elasticsearch/templates/rolebinding.j2 b/roles/openshift_logging_elasticsearch/templates/rolebinding.j2
deleted file mode 100644
index fcd4e87cc..000000000
--- a/roles/openshift_logging_elasticsearch/templates/rolebinding.j2
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: RoleBinding
-metadata:
-  name: {{obj_name}}
-roleRef:
-{% if roleRef.kind is defined %}
-  kind: {{ roleRef.kind }}
-{% endif %}
-  name: {{ roleRef.name }}
-subjects:
-{% for sub in subjects %}
-  - kind: {{ sub.kind }}
-    name: {{ sub.name }}
-{% endfor %}
diff --git a/roles/openshift_logging_elasticsearch/templates/route_reencrypt.j2 b/roles/openshift_logging_elasticsearch/templates/route_reencrypt.j2
deleted file mode 100644
index d2e8b8bcb..000000000
--- a/roles/openshift_logging_elasticsearch/templates/route_reencrypt.j2
+++ /dev/null
@@ -1,36 +0,0 @@
-apiVersion: "v1"
-kind: "Route"
-metadata:
-  name: "{{obj_name}}"
-{% if labels is defined%}
-  labels:
-{% for key, value in labels.items() %}
-    {{key}}: {{value}}
-{% endfor %}
-{% endif %}
-spec:
-  host: {{ route_host }}
-  tls:
-{% if tls_key is defined and tls_key | length > 0 %}
-    key: |
-{{ tls_key|indent(6, true) }}
-{% if tls_cert is defined and tls_cert | length > 0 %}
-    certificate: |
-{{ tls_cert|indent(6, true) }}
-{% endif %}
-{% endif %}
-    caCertificate: |
-{% for line in tls_ca_cert.split('\n') %}
-      {{ line }}
-{% endfor %}
-    destinationCACertificate: |
-{% for line in tls_dest_ca_cert.split('\n') %}
-      {{ line }}
-{% endfor %}
-    termination: reencrypt
-{% if edge_term_policy is defined and edge_term_policy | length > 0 %}
-    insecureEdgeTerminationPolicy: {{ edge_term_policy }}
-{% endif %}
-  to:
-    kind: Service
-    name: {{ service_name }}
diff --git a/roles/openshift_logging_elasticsearch/vars/main.yml b/roles/openshift_logging_elasticsearch/vars/main.yml
index 122231031..aa8d583ba 100644
--- a/roles/openshift_logging_elasticsearch/vars/main.yml
+++ b/roles/openshift_logging_elasticsearch/vars/main.yml
@@ -4,7 +4,6 @@ __allowed_es_versions: ["3_5", "3_6", "3_7", "3_8", "3_9"]
 __allowed_es_types: ["data-master", "data-client", "master", "client"]
 __es_log_appenders: ['file', 'console']
 __kibana_index_modes: ["unique", "shared_ops"]
-__es_version: "2.4.4"
 
 __es_local_curl: "curl -s --cacert /etc/elasticsearch/secret/admin-ca --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key"
 
-- 
cgit v1.2.3