apply sysadmin-readonly when env is staging

Signed-off-by: Vít Smolík <me@smoliicek.cz>

roles/openshift/cluster/tasks/main.yaml

@@ -11,24 +11,49 @@
     - create-resources
 
 # generate the templates for project to be created
-- name: Copy the templates
+- name: Copy base templates
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "{{ cluster_filepath }}/{{ item }}"
     mode: "0640"
+  
   with_items:
     - sysadmin-openshift-group.yml
     - sysadmin-openshift-rolebinding.yml
     - webhooks-clusterrolebinding.yml
     - forward-logs-to-log01.yml
-  register: cluster_template_result
+  register: cluster_template_result_base
+  tags:
+    - create-resources
+
+- name: Copy stg-only templates
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "{{ cluster_filepath }}/{{ item }}"
+    mode: "0640"
+  
+  with_items:
+    - sysadmin-readonly-group.yml
+    - sysadmin-readonly-rolebinding.yml
+    - sysadmin-readonly-role.yml
+  register: cluster_template_result_staging
+  when: env == "staging"
   tags:
     - create-resources
 
 # apply created openshift resources
-- name: Oc apply resources
+- name: Oc apply base resources
   ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}"
-  with_items: "{{ cluster_template_result.results }}"
+  with_items: "{{ cluster_template_result_base.results }}"
   when: item.changed
   tags:
     - create-resources
+
+- name: Oc apply stg-only resources
+  ansible.builtin.command: "oc apply --validate=strict -f {{ item.dest }}"
+  with_items: "{{ cluster_template_result_staging.results }}"
+  when: 
+    - item.changed
+    - env == "staging"
+  tags:
+    - create-resources