separate template copying for stg/prod

Signed-off-by: Vít Smolík <me@smoliicek.cz>

roles/openshift/cluster/tasks/main.yaml

@@ -23,21 +23,42 @@
       - sysadmin-openshift-readonly-group.yml
 
 # generate the templates for project to be created
-- name: Copy templates
+- name: Copy tempaltes to production
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "{{ cluster_filepath }}/{{ item }}"
     mode: "0640"
-  with_items: "{{ base_templates + (stg_templates if env == 'staging' else []) }}"
+  with_items:
+    - sysadmin-openshift-group.yml
+    - sysadmin-openshift-rolebinding.yml
+    - webhooks-clusterrolebinding.yml
+    - forward-logs-to-log01.yml
   register: cluster_template_result
-  tags:
-    - create-resources
+  when: env == 'production'
+
+
+- name: Copy templates to staging
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "{{ cluster_filepath }}/{{ item }}"
+    mode: "0640"
+  with_items:
+    - sysadmin-openshift-group.yml
+    - sysadmin-openshift-rolebinding.yml
+    - webhooks-clusterrolebinding.yml
+    - forward-logs-to-log01.yml
+    - sysadmin-readonly-group.yml
+    - sysadmin-readonly-rolebinding.yml
+    - sysadmin-readonly-role.yml
+  register: cluster_template_result
+  when: env == 'staging'
+
 
 # apply created openshift resources
 - name: Oc apply resources
   ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}"
   with_items: "{{ cluster_template_result.results }}"
-  when: item_changed
+  when: item.changed
   changed_when: true
   tags:
     - create-resources

roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2

@@ -4,6 +4,6 @@ apiVersion: user.openshift.io/v1
 metadata:
   name: "sysadmin-openshift-readonly"
 users:
-{% for item in cluster_appowners %}
+{% for item in cluster_readonly_appowners %}
 - "{{ item }}"
 {% endfor %}

roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2

@@ -20,4 +20,3 @@ rules:
   - get
   - list
   - watch
-  - watch