move handling back to main.yml and rename role to sysadmin-openshift-readonly

Signed-off-by: Vít Smolík <me@smoliicek.cz>

roles/openshift/cluster/handlers/main.yml

@@ -1,20 +0,0 @@
----
-- name: Apply base resources
-  ansible.builtin.command: "oc apply --validate=strict -f {{ cluster_filepath }}/{{ item }}"
-  with_items:
-    - sysadmin-openshift-group.yml
-    - sysadmin-openshift-rolebinding.yml
-    - webhooks-clusterrolebinding.yml
-    - forward-logs-to-log01.yml
-  tags:
-    - create-resources
-
-- name: Apply staging resources
-  ansible.builtin.command: "oc apply --validate=strict -f {{ cluster_filepath }}/{{ item }}"
-  with_items:
-    - sysadmin-readonly-group.yml
-    - sysadmin-readonly-rolebinding.yml
-    - sysadmin-readonly-role.yml
-  when: env == "staging"
-  tags:
-    - create-resources

roles/openshift/cluster/tasks/main.yaml

@@ -10,33 +10,34 @@
   tags:
     - create-resources
 
+- name: Set template lists
+  ansible.builtin.set_fact:
+    base_templates:
+      - sysadmin-openshift-group.yml
+      - sysadmin-openshift-rolebinding.yml
+      - webhooks-clusterrolebinding.yml
+      - forward-logs-to-log01.yml
+    stg_templates:
+      - sysadmin-openshift-readonly-rolebinding.yml
+      - sysadmin-openshift-readonly-role.yml
+      - sysadmin-openshift-readonly-group.yml
+
 # generate the templates for project to be created
-- name: Copy base templates
+- name: Copy templates
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "{{ cluster_filepath }}/{{ item }}"
     mode: "0640"
-
-  with_items:
-    - sysadmin-openshift-group.yml
-    - sysadmin-openshift-rolebinding.yml
-    - webhooks-clusterrolebinding.yml
-    - forward-logs-to-log01.yml
-  register: cluster_template_result_base
+  with_items: "{{ base_templates + (stg_templates if env == 'staging' else []) }}"
+  register: cluster_template_result
   tags:
     - create-resources
 
-- name: Copy stg-only templates
-  ansible.builtin.template:
-    src: "{{ item }}.j2"
-    dest: "{{ cluster_filepath }}/{{ item }}"
-    mode: "0640"
-
-  with_items:
-    - sysadmin-readonly-group.yml
-    - sysadmin-readonly-rolebinding.yml
-    - sysadmin-readonly-role.yml
-  register: cluster_template_result_staging
-  when: env == "staging"
+# apply created openshift resources
+- name: Oc apply resources
+  ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}"
+  with_items: "{{ cluster_template_result.results }}"
+  when: item_changed
+  changed_when: true
   tags:
     - create-resources

roles/openshift/cluster/templates/sysadmin-openshift-readonly-group.yml.j2

@@ -2,7 +2,7 @@
 kind: Group
 apiVersion: user.openshift.io/v1
 metadata:
-  name: "sysadmin-readonly"
+  name: "sysadmin-openshift-readonly"
 users:
 {% for item in cluster_appowners %}
 - "{{ item }}"

roles/openshift/cluster/templates/sysadmin-openshift-readonly-role.yml.j2

@@ -2,7 +2,7 @@
 kind: Role
 apiVersion: user.openshift.io/v1
 metadata:
-  name: "sysadmin-readonly"
+  name: "sysadmin-openshift-readonly"
 rules:
 - apiGroups:
   - ""

roles/openshift/cluster/templates/sysadmin-openshift-readonly-rolebinding.yml.j2

@@ -2,11 +2,11 @@
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: "sysadmin-readonly"
+  name: "sysadmin-openshift-readonly"
 subjects:
   - kind: Group
     apiGroup: rbac.authorization.k8s.io
-    name: "sysadmin-readonly"
+    name: "sysadmin-openshift-readonly"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role