From 3b07acdcd41e215dedc4d4c7c7303b807e59333d Mon Sep 17 00:00:00 2001
From: Michael Gugino <mgugino@redhat.com>
Date: Tue, 9 Jan 2018 14:11:16 -0500
Subject: Remove become statements

This commit removes become:no statements that break
the installer in various ways.
---
 .../openshift-cluster/upgrades/create_service_signer_cert.yml     | 2 --
 .../common/openshift-cluster/upgrades/upgrade_control_plane.yml   | 2 --
 playbooks/init/evaluate_groups.yml                                | 1 -
 playbooks/openshift-etcd/private/embedded2external.yml            | 2 --
 playbooks/openshift-etcd/private/migrate.yml                      | 2 --
 playbooks/openshift-etcd/private/redeploy-ca.yml                  | 2 --
 playbooks/openshift-etcd/private/upgrade_backup.yml               | 1 -
 playbooks/openshift-master/private/redeploy-openshift-ca.yml      | 2 --
 playbooks/openshift-master/private/tasks/restart_hosts.yml        | 1 -
 playbooks/openshift-master/private/validate_restart.yml           | 2 --
 playbooks/openshift-master/scaleup.yml                            | 1 -
 playbooks/openshift-node/private/setup.yml                        | 1 -
 playbooks/openshift-node/scaleup.yml                              | 1 -
 .../openshift_certificate_expiry/filter_plugins/oo_cert_expiry.py | 1 -
 roles/openshift_certificate_expiry/tasks/main.yml                 | 2 --
 roles/openshift_expand_partition/README.md                        | 2 --
 roles/openshift_logging/tasks/generate_jks.yaml                   | 6 ------
 roles/openshift_logging/tasks/main.yaml                           | 2 --
 roles/openshift_logging_fluentd/tasks/label_and_wait.yaml         | 1 -
 roles/openshift_master_certificates/tasks/main.yml                | 2 --
 roles/openshift_named_certificates/tasks/main.yml                 | 1 -
 roles/openshift_storage_nfs_lvm/README.md                         | 8 +++-----
 roles/openshift_web_console/tasks/install.yml                     | 2 --
 roles/openshift_web_console/tasks/update_asset_config.yml         | 2 --
 roles/template_service_broker/tasks/install.yml                   | 2 --
 roles/template_service_broker/tasks/remove.yml                    | 2 --
 26 files changed, 3 insertions(+), 50 deletions(-)

diff --git a/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml b/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml
index 372a39e74..00a731cb0 100644
--- a/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml
+++ b/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml
@@ -2,7 +2,6 @@
 - name: Create local temp directory for syncing certs
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - name: Create local temp directory for syncing certs
@@ -65,7 +64,6 @@
 - name: Delete local temp directory
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - name: Delete local temp directory
diff --git a/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml b/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml
index 50be0dee0..412075d41 100644
--- a/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml
+++ b/playbooks/common/openshift-cluster/upgrades/upgrade_control_plane.yml
@@ -108,7 +108,6 @@
 - name: Gate on master update
   hosts: localhost
   connection: local
-  become: no
   tasks:
   - set_fact:
       master_update_completed: "{{ hostvars
@@ -242,7 +241,6 @@
 - name: Gate on reconcile
   hosts: localhost
   connection: local
-  become: no
   tasks:
   - set_fact:
       reconcile_completed: "{{ hostvars
diff --git a/playbooks/init/evaluate_groups.yml b/playbooks/init/evaluate_groups.yml
index 8087f6ffc..c4cd226c9 100644
--- a/playbooks/init/evaluate_groups.yml
+++ b/playbooks/init/evaluate_groups.yml
@@ -2,7 +2,6 @@
 - name: Populate config host groups
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - name: Load group name mapping variables
diff --git a/playbooks/openshift-etcd/private/embedded2external.yml b/playbooks/openshift-etcd/private/embedded2external.yml
index b71eaacd0..917cfc800 100644
--- a/playbooks/openshift-etcd/private/embedded2external.yml
+++ b/playbooks/openshift-etcd/private/embedded2external.yml
@@ -89,7 +89,6 @@
     local_action: command mktemp -d /tmp/etcd_backup-XXXXXXX
     register: g_etcd_client_mktemp
     changed_when: False
-    become: no
 
   - import_role:
       name: etcd
@@ -116,7 +115,6 @@
   - name: Delete temporary directory
     local_action: file path="{{ g_etcd_client_mktemp.stdout }}" state=absent
     changed_when: False
-    become: no
 
 # 7. force new cluster from the backup
 - name: Force new etcd cluster
diff --git a/playbooks/openshift-etcd/private/migrate.yml b/playbooks/openshift-etcd/private/migrate.yml
index 0a2ac7f1a..3f8b44032 100644
--- a/playbooks/openshift-etcd/private/migrate.yml
+++ b/playbooks/openshift-etcd/private/migrate.yml
@@ -2,7 +2,6 @@
 - name: Check if the master has embedded etcd
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tags:
   - always
@@ -53,7 +52,6 @@
 - name: Gate on etcd backup
   hosts: localhost
   connection: local
-  become: no
   tasks:
   - set_fact:
       etcd_backup_completed: "{{ hostvars
diff --git a/playbooks/openshift-etcd/private/redeploy-ca.yml b/playbooks/openshift-etcd/private/redeploy-ca.yml
index 7b0d99255..e6dd87de1 100644
--- a/playbooks/openshift-etcd/private/redeploy-ca.yml
+++ b/playbooks/openshift-etcd/private/redeploy-ca.yml
@@ -26,7 +26,6 @@
 - name: Create temp directory for syncing certs
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - name: Create local temp directory for syncing certs
@@ -74,7 +73,6 @@
 - name: Delete temporary directory on localhost
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - file:
diff --git a/playbooks/openshift-etcd/private/upgrade_backup.yml b/playbooks/openshift-etcd/private/upgrade_backup.yml
index 97b6edba5..081c024fc 100644
--- a/playbooks/openshift-etcd/private/upgrade_backup.yml
+++ b/playbooks/openshift-etcd/private/upgrade_backup.yml
@@ -14,7 +14,6 @@
 - name: Gate on etcd backup
   hosts: localhost
   connection: local
-  become: no
   tasks:
   - set_fact:
       etcd_backup_completed: "{{ hostvars
diff --git a/playbooks/openshift-master/private/redeploy-openshift-ca.yml b/playbooks/openshift-master/private/redeploy-openshift-ca.yml
index 9d3c12ba1..f649af976 100644
--- a/playbooks/openshift-master/private/redeploy-openshift-ca.yml
+++ b/playbooks/openshift-master/private/redeploy-openshift-ca.yml
@@ -125,7 +125,6 @@
 - name: Create temp directory for syncing certs
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - name: Create local temp directory for syncing certs
@@ -264,7 +263,6 @@
 - name: Delete temporary directory on localhost
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - file:
diff --git a/playbooks/openshift-master/private/tasks/restart_hosts.yml b/playbooks/openshift-master/private/tasks/restart_hosts.yml
index a5dbe0590..76e1ea5f3 100644
--- a/playbooks/openshift-master/private/tasks/restart_hosts.yml
+++ b/playbooks/openshift-master/private/tasks/restart_hosts.yml
@@ -27,7 +27,6 @@
       delay=10
       timeout=600
       port="{{ ansible_port | default(ansible_ssh_port | default(22,boolean=True),boolean=True) }}"
-  become: no
 
 # Now that ssh is back up we can wait for API on the remote system,
 # avoiding some potential connection issues from local system:
diff --git a/playbooks/openshift-master/private/validate_restart.yml b/playbooks/openshift-master/private/validate_restart.yml
index 1077d0b9c..60b0e5bb6 100644
--- a/playbooks/openshift-master/private/validate_restart.yml
+++ b/playbooks/openshift-master/private/validate_restart.yml
@@ -21,7 +21,6 @@
 - name: Create temp file on localhost
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - local_action: command mktemp
@@ -38,7 +37,6 @@
 - name: Cleanup temp file on localhost
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - file: path="{{ hostvars.localhost.mktemp.stdout }}" state=absent
diff --git a/playbooks/openshift-master/scaleup.yml b/playbooks/openshift-master/scaleup.yml
index f717cd0e9..7d31340a2 100644
--- a/playbooks/openshift-master/scaleup.yml
+++ b/playbooks/openshift-master/scaleup.yml
@@ -4,7 +4,6 @@
 - name: Ensure there are new_masters or new_nodes
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - fail:
diff --git a/playbooks/openshift-node/private/setup.yml b/playbooks/openshift-node/private/setup.yml
index 802dce37e..41c323f2b 100644
--- a/playbooks/openshift-node/private/setup.yml
+++ b/playbooks/openshift-node/private/setup.yml
@@ -8,7 +8,6 @@
 
 - name: Evaluate node groups
   hosts: localhost
-  become: no
   connection: local
   tasks:
   - name: Evaluate oo_containerized_master_nodes
diff --git a/playbooks/openshift-node/scaleup.yml b/playbooks/openshift-node/scaleup.yml
index bdfd3d3e6..cf13692ae 100644
--- a/playbooks/openshift-node/scaleup.yml
+++ b/playbooks/openshift-node/scaleup.yml
@@ -4,7 +4,6 @@
 - name: Ensure there are new_nodes
   hosts: localhost
   connection: local
-  become: no
   gather_facts: no
   tasks:
   - fail:
diff --git a/roles/openshift_certificate_expiry/filter_plugins/oo_cert_expiry.py b/roles/openshift_certificate_expiry/filter_plugins/oo_cert_expiry.py
index a2bc9ecdb..58b228fee 100644
--- a/roles/openshift_certificate_expiry/filter_plugins/oo_cert_expiry.py
+++ b/roles/openshift_certificate_expiry/filter_plugins/oo_cert_expiry.py
@@ -31,7 +31,6 @@ certificates
 Example playbook usage:
 
   - name: Generate expiration results JSON
-    become: no
     run_once: yes
     delegate_to: localhost
     when: openshift_certificate_expiry_save_json_results|bool
diff --git a/roles/openshift_certificate_expiry/tasks/main.yml b/roles/openshift_certificate_expiry/tasks/main.yml
index b5234bd1e..8dea2c07f 100644
--- a/roles/openshift_certificate_expiry/tasks/main.yml
+++ b/roles/openshift_certificate_expiry/tasks/main.yml
@@ -7,7 +7,6 @@
   register: check_results
 
 - name: Generate expiration report HTML
-  become: no
   run_once: yes
   template:
     src: cert-expiry-table.html.j2
@@ -21,7 +20,6 @@
   when: openshift_certificate_expiry_save_json_results|bool
 
 - name: Generate results JSON file
-  become: no
   run_once: yes
   template:
     src: save_json_results.j2
diff --git a/roles/openshift_expand_partition/README.md b/roles/openshift_expand_partition/README.md
index c9c7b378c..402c3dc3e 100644
--- a/roles/openshift_expand_partition/README.md
+++ b/roles/openshift_expand_partition/README.md
@@ -45,7 +45,6 @@ space on /dev/xvda, and the file system will be expanded to fill the new
 partition space.
 
     - hosts: mynodes
-      become: no
       remote_user: root
       gather_facts: no
       roles:
@@ -68,7 +67,6 @@ partition space.
 * Create an ansible playbook, say `expandvar.yaml`:
     ```
     - hosts: mynodes
-      become: no
       remote_user: root
       gather_facts: no
       roles:
diff --git a/roles/openshift_logging/tasks/generate_jks.yaml b/roles/openshift_logging/tasks/generate_jks.yaml
index d6ac88dcc..6e3204589 100644
--- a/roles/openshift_logging/tasks/generate_jks.yaml
+++ b/roles/openshift_logging/tasks/generate_jks.yaml
@@ -24,25 +24,21 @@
   local_action: file path="{{local_tmp.stdout}}/elasticsearch.jks" state=touch mode="u=rw,g=r,o=r"
   when: elasticsearch_jks.stat.exists
   changed_when: False
-  become: no
 
 - name: Create placeholder for previously created JKS certs to prevent recreating...
   local_action: file path="{{local_tmp.stdout}}/logging-es.jks" state=touch mode="u=rw,g=r,o=r"
   when: logging_es_jks.stat.exists
   changed_when: False
-  become: no
 
 - name: Create placeholder for previously created JKS certs to prevent recreating...
   local_action: file path="{{local_tmp.stdout}}/system.admin.jks" state=touch mode="u=rw,g=r,o=r"
   when: system_admin_jks.stat.exists
   changed_when: False
-  become: no
 
 - name: Create placeholder for previously created JKS certs to prevent recreating...
   local_action: file path="{{local_tmp.stdout}}/truststore.jks" state=touch mode="u=rw,g=r,o=r"
   when: truststore_jks.stat.exists
   changed_when: False
-  become: no
 
 - name: pulling down signing items from host
   fetch:
@@ -61,12 +57,10 @@
   vars:
     - top_dir: "{{local_tmp.stdout}}"
   when: not elasticsearch_jks.stat.exists or not logging_es_jks.stat.exists or not system_admin_jks.stat.exists or not truststore_jks.stat.exists
-  become: no
 
 - name: Run JKS generation script
   local_action: script generate-jks.sh {{local_tmp.stdout}} {{openshift_logging_namespace}}
   check_mode: no
-  become: no
   when: not elasticsearch_jks.stat.exists or not logging_es_jks.stat.exists or not system_admin_jks.stat.exists or not truststore_jks.stat.exists
 
 - name: Pushing locally generated JKS certs to remote host...
diff --git a/roles/openshift_logging/tasks/main.yaml b/roles/openshift_logging/tasks/main.yaml
index 9949bb95d..1d8f2c53a 100644
--- a/roles/openshift_logging/tasks/main.yaml
+++ b/roles/openshift_logging/tasks/main.yaml
@@ -17,7 +17,6 @@
   register: local_tmp
   changed_when: False
   check_mode: no
-  become: no
 
 - include_tasks: install_logging.yaml
   when:
@@ -31,4 +30,3 @@
   local_action: file path="{{local_tmp.stdout}}" state=absent
   tags: logging_cleanup
   changed_when: False
-  become: no
diff --git a/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml b/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml
index 1cef6c25e..2721438f0 100644
--- a/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml
+++ b/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml
@@ -8,4 +8,3 @@
 
 # wait half a second between labels
 - local_action: command sleep {{ openshift_logging_fluentd_label_delay | default('.5') }}
-  become: no
diff --git a/roles/openshift_master_certificates/tasks/main.yml b/roles/openshift_master_certificates/tasks/main.yml
index 00cabe574..a80950cde 100644
--- a/roles/openshift_master_certificates/tasks/main.yml
+++ b/roles/openshift_master_certificates/tasks/main.yml
@@ -120,7 +120,6 @@
   register: g_master_certs_mktemp
   changed_when: False
   when: master_certs_missing | bool
-  become: no
 
 - name: Create a tarball of the master certs
   command: >
@@ -157,7 +156,6 @@
   local_action: file path="{{ g_master_certs_mktemp.stdout }}" state=absent
   changed_when: False
   when: master_certs_missing | bool
-  become: no
 
 - name: Lookup default group for ansible_ssh_user
   command: "/usr/bin/id -g {{ ansible_ssh_user | quote }}"
diff --git a/roles/openshift_named_certificates/tasks/main.yml b/roles/openshift_named_certificates/tasks/main.yml
index ad5472445..021fa8385 100644
--- a/roles/openshift_named_certificates/tasks/main.yml
+++ b/roles/openshift_named_certificates/tasks/main.yml
@@ -3,7 +3,6 @@
     parsed_named_certificates: "{{ named_certificates | lib_utils_oo_parse_named_certificates(named_certs_dir, internal_hostnames) }}"
   when: named_certificates | length > 0
   delegate_to: localhost
-  become: no
   run_once: true
 
 - openshift_facts:
diff --git a/roles/openshift_storage_nfs_lvm/README.md b/roles/openshift_storage_nfs_lvm/README.md
index cc674d3fd..a11219f6d 100644
--- a/roles/openshift_storage_nfs_lvm/README.md
+++ b/roles/openshift_storage_nfs_lvm/README.md
@@ -1,7 +1,7 @@
 # openshift_storage_nfs_lvm
 
 This role is useful to create and export nfs disks for openshift persistent volumes.
-It does so by creating lvm partitions on an already setup pv/vg, creating xfs 
+It does so by creating lvm partitions on an already setup pv/vg, creating xfs
 filesystem on each partition, mounting the partitions, exporting the mounts via NFS
 and creating a json file for each mount that an openshift master can use to
 create persistent volumes.
@@ -20,7 +20,7 @@ create persistent volumes.
 osnl_nfs_export_options: "*(rw,sync,all_squash)"
 
 # Directory, where the created partitions should be mounted. They will be
-# mounted as <osnl_mount_dir>/<lvm volume name> 
+# mounted as <osnl_mount_dir>/<lvm volume name>
 osnl_mount_dir: /exports/openshift
 
 # Volume Group to use.
@@ -64,11 +64,10 @@ None
 ## Example Playbook
 
 With this playbook, 2 5Gig lvm partitions are created, named stg5g0003 and stg5g0004
-Both of them are mounted into `/exports/openshift` directory.  Both directories are 
+Both of them are mounted into `/exports/openshift` directory.  Both directories are
 exported via NFS.  json files are created in /root.
 
     - hosts: nfsservers
-      become: no
       remote_user: root
       gather_facts: no
       roles:
@@ -94,7 +93,6 @@ exported via NFS.  json files are created in /root.
 * Create an ansible playbook, say `setupnfs.yaml`:
     ```
     - hosts: nfsservers
-      become: no
       remote_user: root
       gather_facts: no
       roles:
diff --git a/roles/openshift_web_console/tasks/install.yml b/roles/openshift_web_console/tasks/install.yml
index 8120c13e3..8ee95e36b 100644
--- a/roles/openshift_web_console/tasks/install.yml
+++ b/roles/openshift_web_console/tasks/install.yml
@@ -23,7 +23,6 @@
   command: mktemp -d /tmp/console-ansible-XXXXXX
   register: mktemp
   changed_when: False
-  become: no
 
 - name: Copy asset config template to temp directory
   copy:
@@ -76,4 +75,3 @@
     state: absent
     name: "{{ mktemp.stdout }}"
   changed_when: False
-  become: no
diff --git a/roles/openshift_web_console/tasks/update_asset_config.yml b/roles/openshift_web_console/tasks/update_asset_config.yml
index 36e37e35d..0992b32e1 100644
--- a/roles/openshift_web_console/tasks/update_asset_config.yml
+++ b/roles/openshift_web_console/tasks/update_asset_config.yml
@@ -30,7 +30,6 @@
   command: mktemp -d /tmp/console-ansible-XXXXXX
   register: mktemp
   changed_when: False
-  become: no
 
 - name: Copy asset config to temp file
   copy:
@@ -55,7 +54,6 @@
     state: absent
     name: "{{ mktemp.stdout }}"
   changed_when: False
-  become: no
 
 # There's currently no command to trigger a rollout for a k8s deployment
 # without changing the pod spec. Add an annotation to force a rollout after
diff --git a/roles/template_service_broker/tasks/install.yml b/roles/template_service_broker/tasks/install.yml
index 765263db5..604e94602 100644
--- a/roles/template_service_broker/tasks/install.yml
+++ b/roles/template_service_broker/tasks/install.yml
@@ -21,7 +21,6 @@
 - command: mktemp -d /tmp/tsb-ansible-XXXXXX
   register: mktemp
   changed_when: False
-  become: no
 
 - copy:
     src: "{{ __tsb_files_location }}/{{ item }}"
@@ -86,4 +85,3 @@
     state: absent
     name: "{{ mktemp.stdout }}"
   changed_when: False
-  become: no
diff --git a/roles/template_service_broker/tasks/remove.yml b/roles/template_service_broker/tasks/remove.yml
index 8b4d798db..db1b558e4 100644
--- a/roles/template_service_broker/tasks/remove.yml
+++ b/roles/template_service_broker/tasks/remove.yml
@@ -2,7 +2,6 @@
 - command: mktemp -d /tmp/tsb-ansible-XXXXXX
   register: mktemp
   changed_when: False
-  become: no
 
 - copy:
     src: "{{ __tsb_files_location }}/{{ item }}"
@@ -32,4 +31,3 @@
     state: absent
     name: "{{ mktemp.stdout }}"
   changed_when: False
-  become: no
-- 
cgit v1.2.3


From 4b06eaf83e137ddeba2ce498e141ad87413761c0 Mon Sep 17 00:00:00 2001
From: Michael Gugino <mgugino@redhat.com>
Date: Tue, 9 Jan 2018 16:01:58 -0500
Subject: Chmod temp dirs created on localhost

After remove become:no statements on local_action tasks,
we need to ensure that the proper file permssions are
applied to local temp directories.

This reason for this is that the 'fetch' module
does not use 'become' for the localhost, just the remote
host.

Additionally, users may not wish for the localhost to
become during a fetch.  local_action will execute with
whatever permissions are specified in inventory or via
cli.
---
 .../openshift-cluster/upgrades/create_service_signer_cert.yml       | 5 +++++
 playbooks/openshift-etcd/private/embedded2external.yml              | 4 ++++
 playbooks/openshift-etcd/private/redeploy-ca.yml                    | 4 ++++
 playbooks/openshift-master/private/redeploy-openshift-ca.yml        | 4 ++++
 roles/openshift_examples/tasks/main.yml                             | 6 +++---
 roles/openshift_hosted_templates/tasks/main.yml                     | 6 +++---
 roles/openshift_logging/tasks/main.yaml                             | 5 +++++
 roles/openshift_master_certificates/tasks/main.yml                  | 5 +++++
 8 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml b/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml
index 00a731cb0..ef8233b67 100644
--- a/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml
+++ b/playbooks/common/openshift-cluster/upgrades/create_service_signer_cert.yml
@@ -10,6 +10,11 @@
     changed_when: false
     when: not (hostvars[groups.oo_first_master.0].service_signer_cert_stat.stat.exists | bool)
 
+  - name: Chmod local temp directory
+    local_action: command chmod 777 "{{ local_cert_sync_tmpdir.stdout }}"
+    changed_when: false
+    when: not (hostvars[groups.oo_first_master.0].service_signer_cert_stat.stat.exists | bool)
+
 - name: Create service signer certificate
   hosts: oo_first_master
   tasks:
diff --git a/playbooks/openshift-etcd/private/embedded2external.yml b/playbooks/openshift-etcd/private/embedded2external.yml
index 917cfc800..674bd5088 100644
--- a/playbooks/openshift-etcd/private/embedded2external.yml
+++ b/playbooks/openshift-etcd/private/embedded2external.yml
@@ -90,6 +90,10 @@
     register: g_etcd_client_mktemp
     changed_when: False
 
+  - name: Chmod local temp directory for syncing etcd backup
+    local_action: command chmod 777 "{{ g_etcd_client_mktemp.stdout }}"
+    changed_when: False
+
   - import_role:
       name: etcd
       tasks_from: backup.fetch.yml
diff --git a/playbooks/openshift-etcd/private/redeploy-ca.yml b/playbooks/openshift-etcd/private/redeploy-ca.yml
index e6dd87de1..a3acf6945 100644
--- a/playbooks/openshift-etcd/private/redeploy-ca.yml
+++ b/playbooks/openshift-etcd/private/redeploy-ca.yml
@@ -33,6 +33,10 @@
     register: g_etcd_mktemp
     changed_when: false
 
+  - name: Chmod local temp directory for syncing certs
+    local_action: command chmod 777 "{{ g_etcd_mktemp.stdout }}"
+    changed_when: false
+
 - name: Distribute etcd CA to etcd hosts
   hosts: oo_etcd_to_config
   tasks:
diff --git a/playbooks/openshift-master/private/redeploy-openshift-ca.yml b/playbooks/openshift-master/private/redeploy-openshift-ca.yml
index f649af976..663c39868 100644
--- a/playbooks/openshift-master/private/redeploy-openshift-ca.yml
+++ b/playbooks/openshift-master/private/redeploy-openshift-ca.yml
@@ -132,6 +132,10 @@
     register: g_master_mktemp
     changed_when: false
 
+  - name: Chmod local temp directory for syncing certs
+    local_action: command chmod 777 "{{ g_master_mktemp.stdout }}"
+    changed_when: false
+
 - name: Retrieve OpenShift CA
   hosts: oo_first_master
   vars:
diff --git a/roles/openshift_examples/tasks/main.yml b/roles/openshift_examples/tasks/main.yml
index ff04cdf9c..7787da4f0 100644
--- a/roles/openshift_examples/tasks/main.yml
+++ b/roles/openshift_examples/tasks/main.yml
@@ -16,8 +16,8 @@
   register: copy_examples_mktemp
   run_once: True
 
-- name: Create local temp dir for OpenShift examples copy
-  local_action: command chmod 755 "{{ copy_examples_mktemp.stdout }}"
+- name: Chmod local temp dir for OpenShift examples copy
+  local_action: command chmod 777 "{{ copy_examples_mktemp.stdout }}"
   run_once: True
 
 - name: Create tar of OpenShift examples
@@ -27,7 +27,7 @@
     # Consider using unarchive module rather than running tar
     warn: no
 
-- name: Create local temp dir for OpenShift examples copy
+- name: Chmod local temp dir for OpenShift examples copy
   local_action: command chmod 744 "{{ copy_examples_mktemp.stdout }}/openshift-examples.tar"
   run_once: True
 
diff --git a/roles/openshift_hosted_templates/tasks/main.yml b/roles/openshift_hosted_templates/tasks/main.yml
index 672d25b4d..34d39f3a5 100644
--- a/roles/openshift_hosted_templates/tasks/main.yml
+++ b/roles/openshift_hosted_templates/tasks/main.yml
@@ -6,8 +6,8 @@
   # AUDIT:changed_when: not set here because this task actually
   # creates something
 
-- name: Create local temp dir for OpenShift examples copy
-  local_action: command chmod 755 "{{ copy_hosted_templates_mktemp.stdout }}"
+- name: Chmod local temp dir for OpenShift examples copy
+  local_action: command chmod 777 "{{ copy_hosted_templates_mktemp.stdout }}"
   run_once: True
 
 - name: Create tar of OpenShift examples
@@ -17,7 +17,7 @@
     # Consider using unarchive module rather than running tar
     warn: no
 
-- name: Create local temp dir for OpenShift examples copy
+- name: Chmod local tar of OpenShift examples
   local_action: command chmod 744 "{{ copy_hosted_templates_mktemp.stdout }}/openshift-hosted-templates.tar"
   run_once: True
 
diff --git a/roles/openshift_logging/tasks/main.yaml b/roles/openshift_logging/tasks/main.yaml
index 1d8f2c53a..60cc399fa 100644
--- a/roles/openshift_logging/tasks/main.yaml
+++ b/roles/openshift_logging/tasks/main.yaml
@@ -18,6 +18,11 @@
   changed_when: False
   check_mode: no
 
+- name: Chmod local temp directory for doing work in
+  local_action: command chmod 777 "{{ local_tmp.stdout }}"
+  changed_when: False
+  check_mode: no
+
 - include_tasks: install_logging.yaml
   when:
     - openshift_logging_install_logging | default(false) | bool
diff --git a/roles/openshift_master_certificates/tasks/main.yml b/roles/openshift_master_certificates/tasks/main.yml
index a80950cde..649a4bc5d 100644
--- a/roles/openshift_master_certificates/tasks/main.yml
+++ b/roles/openshift_master_certificates/tasks/main.yml
@@ -121,6 +121,11 @@
   changed_when: False
   when: master_certs_missing | bool
 
+- name: Chmod local temp directory for syncing certs
+  local_action: command chmod 777 "{{ g_master_certs_mktemp.stdout }}"
+  changed_when: False
+  when: master_certs_missing | bool
+
 - name: Create a tarball of the master certs
   command: >
     tar -czvf {{ openshift_master_generated_config_dir }}.tgz
-- 
cgit v1.2.3