Specify 'become' for only neccesary tasks (all other roles)

Add become to only neccesary tasks in roles:

- aodh
- barbican
- bifrost
- ceilometer
- ceph
- chrony
- cinder
- cloudkitty
- collectd
- congress
- designate
- elasticsearch
- etcd
- freezer
- gnocchi
- grafana
- influxdb
- ironic
- iscsi
- karbor
- kibana
- kuryr
- magnum
- manila
- mistral
- mongodb
- multipathd
- murano
- octavia
- panko
- qdrouterd
- rally
- sahara
- searchlight
- senlin
- skydive
- solum
- swift
- swift
- tacker
- telegraf
- tempest
- trove
- vmtp
- watcher
- zun

Change-Id: I6e32d94d4172dd96d09d8609e8a5221ab5586a31
Partial-Implements: blueprint ansible-specific-task-become

ansible/roles/aodh/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - item.value.enabled | bool
     - inventory_hostname in groups[item.value.group]
@@ -30,6 +33,8 @@
   template:
     src: "{{ aodh_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ aodh_policy_file }}"
+    mode: "0660"
+  become: true
   register: aodh_policy_overwriting
   when:
     - aodh_policy_file is defined
@@ -46,6 +51,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: aodh_config_jsons
   when:
     - item.value.enabled | bool
@@ -68,6 +75,8 @@
       - "{{ node_custom_config }}/aodh/{{ item.key }}.conf"
       - "{{ node_custom_config }}/aodh/{{ inventory_hostname }}/aodh.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/aodh.conf"
+    mode: "0660"
+  become: true
   register: aodh_confs
   when:
     - item.value.enabled | bool
@@ -85,6 +94,8 @@
   template:
     src: "wsgi-aodh.conf.j2"
     dest: "{{ node_config_directory }}/aodh-api/wsgi-aodh.conf"
+    mode: "0660"
+  become: true
   register: aodh_conf_wsgi
   when:
     - inventory_hostname in groups[service.group]

ansible/roles/barbican/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   with_items:
     - "barbican-api/vassals"
     - "barbican-keystone-listener"
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: barbican_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -47,6 +52,8 @@
       - "{{ node_custom_config }}/barbican-api/barbican-api.ini"
       - "{{ node_custom_config }}/barbican-api/{{ inventory_hostname }}/barbican-api.ini"
     dest: "{{ node_config_directory }}/barbican-api/vassals/barbican-api.ini"
+    mode: "0660"
+  become: true
   register: barbican_api_ini
   when:
     - inventory_hostname in groups['barbican-api']
@@ -69,6 +76,8 @@
   template:
     src: "{{ node_custom_config }}/barbican/barbican-api-paste.ini"
     dest: "{{ node_config_directory }}/barbican-api/barbican-api-paste.ini"
+    mode: "0660"
+  become: true
   when:
     - inventory_hostname in groups['barbican-api']
     - service.enabled | bool
@@ -88,6 +97,8 @@
       - "{{ node_custom_config }}/barbican/{{ item.key }}.conf"
       - "{{ node_custom_config }}/barbican/{{ inventory_hostname }}/barbican.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/barbican.conf"
+    mode: "0660"
+  become: true
   register: barbican_confs
   when:
     - item.value.enabled | bool
@@ -100,6 +111,8 @@
   template:
     src: "{{ barbican_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ barbican_policy_file }}"
+    mode: "0660"
+  become: true
   register: barbican_policy_overwriting
   when:
     - barbican_policy_file is defined

ansible/roles/bifrost/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   with_items:
     - "bifrost"
 
@@ -14,6 +17,8 @@
       - "{{ node_custom_config }}/{{ item }}.yml"
       - "{{ node_custom_config }}/bifrost/{{ item }}.yml"
     dest: "{{ node_config_directory }}/bifrost/{{ item }}.yml"
+    mode: "0660"
+  become: true
   with_items:
     - "bifrost"
     - "dib"
@@ -23,6 +28,8 @@
   template:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/bifrost/{{ item }}"
+    mode: "0660"
+  become: true
   with_items:
      - "rabbitmq-env.conf"
 
@@ -30,6 +37,8 @@
   template:
     src: "{{ item.src }}"
     dest: "{{ node_config_directory }}/bifrost/{{ item.dest }}"
+    mode: "0660"
+  become: true
   with_items:
     - { src: "id_rsa", dest: "id_rsa" }
     - { src: "id_rsa.pub", dest: "id_rsa.pub" }

ansible/roles/ceilometer/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: ceilometer_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -51,6 +56,8 @@
       - "{{ node_custom_config }}/ceilometer/{{ item.key }}.conf"
       - "{{ node_custom_config }}/ceilometer/{{ inventory_hostname }}/ceilometer.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/ceilometer.conf"
+    mode: "0660"
+  become: true
   register: ceilometer_confs
   when:
     - item.value.enabled | bool
@@ -67,6 +74,8 @@
   template:
     src: "{{ item }}.j2"
     dest: "{{ node_config_directory }}/ceilometer-notification/{{ item }}"
+    mode: "0660"
+  become: true
   register: ceilometer_events
   when:
     - inventory_hostname in groups[service.group]
@@ -107,6 +116,8 @@
       - "{{ node_custom_config }}/panko/panko.conf"
       - "{{ node_custom_config }}/panko/{{ inventory_hostname }}/panko.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/panko.conf"
+    mode: "0660"
+  become: true
   register: panko_confs
   when:
     - enable_panko | bool
@@ -136,6 +147,8 @@
   template:
     src: "{{ ceilometer_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ ceilometer_policy_file }}"
+    mode: "0660"
+  become: true
   register: policy_jsons
   when:
     - ceilometer_policy_file is defined

ansible/roles/ceph/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   with_items:
     - "ceph-mon"
     - "ceph-osd"
@@ -16,6 +19,8 @@
   template:
     src: "{{ item.name }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.name }}/config.json"
+    mode: "0660"
+  become: true
   when:
     - inventory_hostname in groups[item.group]
   with_items:
@@ -41,6 +46,8 @@
       - "{{ node_custom_config }}/ceph.conf"
       - "{{ node_custom_config }}/ceph/{{ inventory_hostname }}/ceph.conf"
     dest: "{{ node_config_directory }}/{{ item }}/ceph.conf"
+    mode: "0660"
+  become: true
   with_items:
     - "ceph-mon"
     - "ceph-osd"

ansible/roles/ceph/tasks/distribute_keyrings.yml

@@ -12,21 +12,25 @@
     ceph_files: "{{ (ceph_files_json.stdout | from_json) }}"
 
 - name: Pushing Ceph keyring for OSDs
+  become: true
   bslurp:
     src: "{{ item.content }}"
     dest: "{{ node_config_directory }}/ceph-osd/{{ item.filename }}"
-    mode: 0600
     sha1: "{{ item.sha1 }}"
+    mode: 0600
+  become: true
   with_items:
     - "{{ ceph_files['ceph.client.admin.keyring'] }}"
   when: inventory_hostname in groups['ceph-osd']
 
 - name: Pushing Ceph keyrings for Mons
+  become: true
   bslurp:
     src: "{{ item.content }}"
     dest: "{{ node_config_directory }}/ceph-mon/{{ item.filename }}"
-    mode: 0600
     sha1: "{{ item.sha1 }}"
+    mode: 0600
+  become: true
   with_items:
     - "{{ ceph_files['ceph.client.admin.keyring'] }}"
     - "{{ ceph_files['ceph.client.mon.keyring'] }}"
@@ -35,11 +39,13 @@
   when: inventory_hostname in groups['ceph-mon']
 
 - name: Pushing Ceph keyrings for RGWs
+  become: true
   bslurp:
     src: "{{ item.content }}"
     dest: "{{ node_config_directory }}/ceph-rgw/{{ item.filename }}"
-    mode: 0600
     sha1: "{{ item.sha1 }}"
+    mode: 0600
+  become: true
   with_items:
     - "{{ ceph_files['ceph.client.admin.keyring'] }}"
     - "{{ ceph_files['ceph.client.radosgw.keyring'] }}"

ansible/roles/ceph/tasks/start_osds.yml

@@ -12,6 +12,7 @@
     osds: "{{ (osd_lookup.stdout.split('localhost | SUCCESS => ')[1]|from_json).disks|from_json }}"
 
 - name: Mounting Ceph OSD volumes
+  become: true
   mount:
     src: "UUID={{ item.fs_uuid }}"
     fstype: "{{ ceph_osd_filesystem }}"
@@ -23,6 +24,7 @@
   become_method: sudo
 
 - name: Gathering OSD IDs
+  become: true
   command: "cat /var/lib/ceph/osd/{{ item['fs_uuid'] }}/whoami"
   with_items: "{{ osds }}"
   register: id

ansible/roles/chrony/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   with_items:
     - "chrony"
 
@@ -11,6 +14,8 @@
   template:
     src: "{{ item }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item }}/config.json"
+    mode: "0660"
+  become: true
   with_items:
     - "chrony"
   notify:
@@ -20,6 +25,8 @@
   template:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/chrony/chrony.conf"
+    mode: "0660"
+  become: true
   with_first_found:
     - "{{ node_custom_config }}/chrony/{{ inventory_hostname }}/chrony.conf"
     - "{{ node_custom_config }}/chrony/chrony.conf"

ansible/roles/cinder/tasks/ceph.yml

@@ -7,6 +7,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - item.value.enabled | bool
     - inventory_hostname in groups[item.value.group]
@@ -24,6 +28,8 @@
       - "{{ node_custom_config }}/ceph.conf"
       - "{{ node_custom_config }}/ceph/{{ inventory_hostname }}/ceph.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/ceph.conf"
+    mode: "0660"
+  become: true
   when:
     - item.value.enabled | bool
     - inventory_hostname in groups[item.value.group]
@@ -67,6 +73,7 @@
     content: "{{ item.content }}\n\r"
     dest: "{{ node_config_directory }}/{{ item.service_name }}/ceph.client.{{ item.key_name }}.keyring"
     mode: "0600"
+  become: true
   with_items:
     - { service_name: "cinder-volume", key_name: "cinder", content: "{{ cephx_key_cinder.stdout }}" }
     - { service_name: "cinder-backup", key_name: "cinder", content: "{{ cephx_key_cinder.stdout }}" }

ansible/roles/cinder/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: cinder_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -69,6 +74,8 @@
       - "{{ node_custom_config }}/cinder/{{ item.key }}.conf"
       - "{{ node_custom_config }}/cinder/{{ inventory_hostname }}/cinder.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/cinder.conf"
+    mode: "0660"
+  become: true
   register: cinder_confs
   when:
     - item.value.enabled | bool

ansible/roles/cinder/tasks/external_ceph.yml

@@ -7,6 +7,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - item.value.enabled | bool
     - inventory_hostname in groups[item.value.group]
@@ -23,6 +27,8 @@
       - "{{ node_custom_config }}/cinder/ceph.conf"
       - "{{ node_custom_config }}/cinder/{{ item.key }}/ceph.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/ceph.conf"
+    mode: "0660"
+  become: true
   when:
     - item.value.enabled | bool
     - inventory_hostname in groups[item.value.group]
@@ -36,6 +42,8 @@
   copy:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/cinder-volume/"
+    mode: "0660"
+  become: true
   with_fileglob:
     - "{{ node_custom_config }}/cinder/cinder-volume/ceph.client*"
   when:
@@ -49,6 +57,8 @@
   copy:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/cinder-backup/"
+    mode: "0660"
+  become: true
   with_fileglob:
     - "{{ node_custom_config }}/cinder/cinder-backup/ceph.client*"
   when:

ansible/roles/cloudkitty/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: cloudkitty_config_jsons
   when:
     - item.value.enabled | bool
@@ -50,6 +55,8 @@
       - "{{ node_custom_config }}/cloudkitty/{{ item.key }}.conf"
       - "{{ node_custom_config }}/cloudkitty/{{ inventory_hostname }}/cloudkitty.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/cloudkitty.conf"
+    mode: "0660"
+  become: true
   register: cloudkitty_confs
   when:
     - inventory_hostname in groups[item.value.group]
@@ -65,6 +72,8 @@
   template:
     src: "wsgi-cloudkitty.conf.j2"
     dest: "{{ node_config_directory }}/cloudkitty-api/wsgi-cloudkitty.conf"
+    mode: "0660"
+  become: true
   register: cloudkitty_conf_wsgi
   when:
     - inventory_hostname in groups[service.group]
@@ -76,6 +85,8 @@
   template:
     src: "{{ cloudkitty_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ cloudkitty_policy_file }}"
+    mode: "0660"
+  become: true
   register: cloudkitty_policy_overwriting
   when:
     - cloudkitty_policy_file is defined

ansible/roles/collectd/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,7 +16,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}/collectd.conf.d"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -23,6 +29,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: collectd_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -37,6 +45,8 @@
   template:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/collectd/collectd.conf"
+    mode: "0660"
+  become: true
   with_first_found:
     - "{{ node_custom_config }}/collectd/{{ inventory_hostname }}/collectd.conf"
     - "{{ node_custom_config }}/collectd/collectd.conf"

ansible/roles/congress/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when: inventory_hostname in groups[item.value.group]
   with_dict: "{{ congress_services }}"
 
@@ -28,6 +31,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: congress_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -47,6 +52,8 @@
       - "{{ node_custom_config }}/congress/{{ item.key }}.conf"
       - "{{ node_custom_config }}/congress/{{ inventory_hostname }}/congress.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/congress.conf"
+    mode: "0660"
+  become: true
   register: congress_confs
   when:
     - inventory_hostname in groups[item.value.group]
@@ -64,6 +71,8 @@
   template:
     src: "{{ congress_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ congress_policy_file }}"
+    mode: "0660"
+  become: true
   register: congress_policy_overwriting
   when:
     - congress_policy_file is defined

ansible/roles/designate/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: designate_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -55,6 +60,8 @@
       - "{{ node_custom_config }}/designate/{{ item.key }}.conf"
       - "{{ node_custom_config }}/designate/{{ inventory_hostname }}/designate.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/designate.conf"
+    mode: "0660"
+  become: true
   register: designate_confs
   when:
     - inventory_hostname in groups[item.value.group]
@@ -74,6 +81,8 @@
   template:
     src:  "{{ item }}"
     dest: "{{ node_config_directory }}/designate-worker/pools.yaml"
+    mode: "0660"
+  become: true
   register: designate_pool
   when:
     - inventory_hostname in groups[service.group]
@@ -90,6 +99,8 @@
   template:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/designate-backend-bind9/named.conf"
+    mode: "0660"
+  become: true
   register: designate_named
   when:
     - designate_backend == 'bind9'
@@ -107,6 +118,8 @@
   template:
     src: "rndc.conf.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/rndc.conf"
+    mode: "0660"
+  become: true
   register: designate_rndc_conf
   when:
     - designate_backend == 'bind9' and designate_backend_external == 'no'
@@ -122,6 +135,8 @@
   template:
     src: "rndc.key.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/rndc.key"
+    mode: "0660"
+  become: true
   register: designate_rndc_key_file
   when:
     - designate_backend == 'bind9' and designate_backend_external == 'no'
@@ -145,6 +160,8 @@
   template:
     src: "{{ designate_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ designate_policy_file }}"
+    mode: "0770"
+  become: true
   register: designate_policy_overwriting
   when:
     - designate_policy_file is defined

ansible/roles/elasticsearch/tasks/config.yml

@@ -12,7 +12,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -22,6 +25,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: elasticsearch_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -34,6 +39,8 @@
   template:
     src: "elasticsearch.yml.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ item.key }}.yml"
+    mode: "0660"
+  become: true
   register: elasticsearch_confs
   when:
     - inventory_hostname in groups[item.value.group]

ansible/roles/etcd/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - item.value.enabled | bool
     - item.value.host_in_groups | bool
@@ -13,6 +16,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: etcd_config_jsons
   when:
     - item.value.enabled | bool
@@ -28,6 +33,8 @@
     name: "{{ item.value.container_name }}"
     image: "{{ item.value.image }}"
     volumes: "{{ item.value.volumes }}"
+    mode: "0660"
+  become: true
   register: check_etcd_containers
   when:
     - action != "config"

ansible/roles/freezer/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: freezer_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -42,6 +47,8 @@
   template:
     src: "wsgi-freezer-api.conf.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/wsgi-freezer-api.conf"
+    mode: "0660"
+  become: true
   register: wsgi_freezer_api
   when:
     - inventory_hostname in groups[item.value.group]
@@ -61,6 +68,8 @@
       - "{{ node_custom_config }}/freezer/{{ item.key }}.conf"
       - "{{ node_custom_config }}/freezer/{{ inventory_hostname }}/{{ item.key }}.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/freezer-api.conf"
+    mode: "0660"
+  become: true
   register: freezer_confs
   when:
     - inventory_hostname in groups[item.value.group]
@@ -73,6 +82,8 @@
   template:
     src: "{{ freezer_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ freezer_policy_file }}"
+    mode: "0770"
+  become: true
   register: freezer_policy_overwriting
   when:
     - freezer_policy_file is defined

ansible/roles/gnocchi/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: gnocchi_config_jsons
   when:
     - item.value.enabled | bool
@@ -51,6 +56,8 @@
       - "{{ node_custom_config }}/gnocchi/{{ item.key }}.conf"
       - "{{ node_custom_config }}/gnocchi/{{ inventory_hostname }}/gnocchi.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/gnocchi.conf"
+    mode: "0660"
+  become: true
   register: gnocchi_confs
   when:
     - item.value.enabled | bool
@@ -67,6 +74,8 @@
   template:
     src: "wsgi-gnocchi.conf.j2"
     dest: "{{ node_config_directory }}/{{ item }}/wsgi-gnocchi.conf"
+    mode: "0660"
+  become: true
   register: gnocchi_wsgi_conf
   when:
     - inventory_hostname in groups['gnocchi-api']

ansible/roles/grafana/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +16,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: grafana_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -30,6 +35,8 @@
       - "{{ node_custom_config }}/{{ item.key }}.ini"
       - "{{ node_custom_config }}/grafana/{{ inventory_hostname }}/{{ item.key }}.ini"
     dest: "{{ node_config_directory }}/grafana/grafana.ini"
+    mode: "0660"
+  become: true
   register: grafana_confs
   when:
     - inventory_hostname in groups[item.value.group]

ansible/roles/influxdb/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/influxdb"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +16,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/influxdb/config.json"
+    mode: "0660"
+  become: true
   register: influxdb_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -27,6 +32,8 @@
   template:
     src: "{{ role_path }}/templates/{{ item }}.conf.j2"
     dest: "{{ node_config_directory }}/influxdb/influxdb.conf"
+    mode: "0660"
+  become: true
   register: influxdb_confs
   when:
     - inventory_hostname in groups[service.group]

ansible/roles/ironic/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   with_items:
     - "ironic-api"
     - "ironic-conductor"
@@ -32,6 +35,8 @@
   template:
     src: "{{ item }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item }}/config.json"
+    mode: "0660"
+  become: true
   with_items:
     - "ironic-api"
     - "ironic-conductor"
@@ -50,6 +55,8 @@
       - "{{ node_custom_config }}/ironic/{{ item }}.conf"
       - "{{ node_custom_config }}/ironic/{{ inventory_hostname }}/ironic.conf"
     dest: "{{ node_config_directory }}/{{ item }}/ironic.conf"
+    mode: "0660"
+  become: true
   with_items:
     - "ironic-api"
     - "ironic-conductor"
@@ -65,12 +72,16 @@
       - "{{ node_custom_config }}/ironic-inspector/inspector.conf"
       - "{{ node_custom_config }}/ironic-inspector/{{ inventory_hostname }}/inspector.conf"
     dest: "{{ node_config_directory }}/ironic-inspector/inspector.conf"
+    mode: "0660"
+  become: true
   when: inventory_hostname in groups['ironic-inspector']
 
 - name: Copying over dnsmasq.conf
   template:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/ironic-dnsmasq/dnsmasq.conf"
+    mode: "0660"
+  become: true
   with_first_found:
     - "{{ node_custom_config }}/ironic/ironic-dnsmasq.conf"
     - "{{ node_custom_config }}/ironic/{{ inventory_hostname }}/ironic-dnsmasq.conf"
@@ -81,6 +92,8 @@
   template:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/ironic-pxe/default"
+    mode: "0660"
+  become: true
   with_first_found:
     - "{{ node_custom_config }}/ironic/pxelinux.default"
     - "{{ node_custom_config }}/ironic/{{ inventory_hostname }}/pxelinux.default"
@@ -95,6 +108,8 @@
   template:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/ironic-pxe/default"
+    mode: "0660"
+  become: true
   with_first_found:
     - "{{ node_custom_config }}/ironic/ironic_pxe_uefi.default"
     - "{{ node_custom_config }}/ironic/{{ inventory_hostname }}/ironic_pxe_uefi.default"
@@ -107,6 +122,8 @@
   copy:
     src: "{{ node_custom_config }}/ironic/{{ item }}"
     dest: "{{ node_config_directory }}/ironic-pxe/{{ item }}"
+    mode: "0660"
+  become: true
   with_items:
     - "ironic-agent.kernel"
     - "ironic-agent.initramfs"
@@ -120,6 +137,8 @@
   template:
     src: "{{ ironic_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item }}/{{ ironic_policy_file }}"
+    mode: "0770"
+  become: true
   with_items:
     - "ironic-api"
     - "ironic-conductor"

ansible/roles/iscsi/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when: ( ( inventory_hostname in groups['compute'] or inventory_hostname in groups['cinder-volume'] ) and enable_cinder | bool and enable_cinder_backend_iscsi | bool )
          or ( inventory_hostname in groups['ironic-conductor'] and enable_ironic | bool )
   with_items:
@@ -13,6 +16,8 @@
   template:
     src: "{{ item }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item }}/config.json"
+    mode: "0660"
+  become: true
   when: ( ( inventory_hostname in groups['compute'] or inventory_hostname in groups['cinder-volume'] ) and enable_cinder | bool and enable_cinder_backend_iscsi | bool )
          or ( inventory_hostname in groups['ironic-conductor'] and enable_ironic | bool )
   with_items:
@@ -22,7 +27,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - enable_cinder_backend_lvm | bool
     - inventory_hostname in groups['tgtd']
@@ -33,8 +41,11 @@
   template:
     src: "{{ item }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item }}/config.json"
+    mode: "0660"
+  become: true
   when:
     - enable_cinder_backend_lvm | bool
     - inventory_hostname in groups['tgtd']
+    - enable_cinder_backend_lvm | bool
   with_items:
     - "tgtd"

ansible/roles/karbor/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}/providers.d"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +16,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: karbor_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -34,6 +39,8 @@
       - "{{ node_custom_config }}/karbor/{{ item.key }}.conf"
       - "{{ node_custom_config }}/karbor/{{ inventory_hostname }}/karbor.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/karbor.conf"
+    mode: "0660"
+  become: true
   register: karbor_confs
   when:
     - inventory_hostname in groups[item.value.group]
@@ -51,6 +58,8 @@
   template:
     src: "providers.d/openstack-infra.conf.j2"
     dest: "{{ node_config_directory }}/{{ service_name }}/providers.d/openstack-infra.conf"
+    mode: "0660"
+  become: true
   register: openstack_infra_conf
   when:
     - inventory_hostname in groups[service.group]
@@ -65,6 +74,8 @@
     name: "{{ item.value.container_name }}"
     image: "{{ item.value.image }}"
     volumes: "{{ item.value.volumes }}"
+    mode: "0660"
+  become: true
   register: check_karbor_containers
   when:
     - action != "config"

ansible/roles/kibana/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +16,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: kibana_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -25,6 +30,8 @@
   template:
     src: "{{ item.key }}.yml.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ item.key }}.yml"
+    mode: "0660"
+  become: true
   register: kibana_confs
   when:
     - inventory_hostname in groups[item.value.group]

ansible/roles/kuryr/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: kuryr_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -49,6 +54,8 @@
       - "{{ node_custom_config }}/kuryr/{{ item.key }}.conf"
       - "{{ node_custom_config }}/kuryr/{{ inventory_hostname }}/{{ item.key }}.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/kuryr.conf"
+    mode: "0660"
+  become: true
   register: kuryr_confs
   when:
     - inventory_hostname in groups[item.value.group]
@@ -63,6 +70,8 @@
   template:
     src: "kuryr.spec.j2"
     dest: "{{ node_config_directory }}/{{ item }}/kuryr.spec"
+    mode: "0660"
+  become: true
   register: kuryr_spec
   when:
     - inventory_hostname in groups[service.group]
@@ -76,6 +85,8 @@
   template:
     src: "{{ kuryr_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ kuryr_policy_file }}"
+    mode: "0660"
+  become: true
   register: kuryr_policy_overwriting
   when:
     - kuryr_policy_file is defined

ansible/roles/magnum/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: magnum_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -50,6 +55,8 @@
       - "{{ node_custom_config }}/magnum/{{ item.key }}.conf"
       - "{{ node_custom_config }}/magnum/{{ inventory_hostname }}/magnum.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/magnum.conf"
+    mode: "0660"
+  become: true
   register: magnum_confs
   when:
     - inventory_hostname in groups[item.value.group]
@@ -63,6 +70,8 @@
   template:
     src: "{{ magnum_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ magnum_policy_file }}"
+    mode: "0660"
+  become: true
   register: magnum_policy_overwriting
   when:
     - magnum_policy_file is defined

ansible/roles/manila/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: manila_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -49,6 +54,8 @@
       - "{{ node_custom_config }}/manila/{{ item.key }}.conf"
       - "{{ node_custom_config }}/manila/{{ inventory_hostname }}/manila.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/manila.conf"
+    mode: "0660"
+  become: true
   register: manila_confs
   when:
     - item.key in [ "manila-api", "manila-data", "manila-scheduler" ]
@@ -74,6 +81,8 @@
       - "{{ node_custom_config }}/manila/{{ item }}.conf"
       - "{{ node_custom_config }}/manila/{{ inventory_hostname }}/manila.conf"
     dest: "{{ node_config_directory }}/{{ item }}/manila.conf"
+    mode: "0660"
+  become: true
   register: manila_conf_share
   when:
     - inventory_hostname in groups[service.group]

ansible/roles/mistral/tasks/config.yml

@@ -4,6 +4,8 @@
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
     recurse: yes
+    mode: "0770"
+  become: true
   when: inventory_hostname in groups[item.value.group]
   with_dict: "{{ mistral_services }}"
 
@@ -28,6 +30,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: mistral_config_jsons
   when:
     - item.value.enabled | bool
@@ -47,6 +51,8 @@
       - "{{ node_custom_config }}/mistral/{{ item.key }}.conf"
       - "{{ node_custom_config }}/mistral/{{ inventory_hostname }}/mistral.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/mistral.conf"
+    mode: "0660"
+  become: true
   register: mistral_confs
   when:
     - item.value.enabled | bool

ansible/roles/mongodb/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +16,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: mongodb_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -25,6 +30,8 @@
   template:
     src: "{{ item.key }}.conf.j2"
     dest: "{{ node_config_directory }}/mongodb/{{ item.key }}.conf"
+    mode: "0660"
+  become: true
   register: mongodb_confs
   when:
     - inventory_hostname in groups[item.value.group]

ansible/roles/multipathd/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when: inventory_hostname in groups['compute']
   with_items:
     - "multipathd"
@@ -12,6 +15,8 @@
   template:
     src: "{{ item }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item }}/config.json"
+    mode: "0660"
+  become: true
   when: inventory_hostname in groups['compute']
   with_items:
     - "multipathd"
@@ -20,5 +25,7 @@
   template:
     src: "{{ role_path }}/templates/multipath.conf.j2"
     dest: "{{ node_config_directory }}/{{ item }}/multipath.conf"
+    mode: "0660"
+  become: true
   with_items:
     - "multipathd"

ansible/roles/murano/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   with_items:
     - "murano-api"
     - "murano-engine"
@@ -29,6 +32,8 @@
   template:
     src: "{{ item }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item }}/config.json"
+    mode: "0660"
+  become: true
   with_items:
     - "murano-api"
     - "murano-engine"
@@ -44,6 +49,8 @@
       - "{{ node_custom_config }}/murano/{{ item }}.conf"
       - "{{ node_custom_config }}/murano/{{ inventory_hostname }}/murano.conf"
     dest: "{{ node_config_directory }}/{{ item }}/murano.conf"
+    mode: "0660"
+  become: true
   with_items:
     - "murano-api"
     - "murano-engine"

ansible/roles/octavia/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +16,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: octavia_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -32,6 +37,8 @@
       - "{{ node_custom_config }}/octavia/{{ item.key }}.conf"
       - "{{ node_custom_config }}/octavia/{{ inventory_hostname }}/octavia.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/octavia.conf"
+    mode: "0660"
+  become: true
   register: octavia_confs
   when:
     - inventory_hostname in groups[item.value.group]
@@ -46,6 +53,8 @@
   copy:
     src: "{{ node_custom_config }}/octavia/{{ item }}"
     dest: "{{ node_config_directory }}/octavia-worker/{{ item }}"
+    mode: "0660"
+  become: true
   register: octavia_worker_certificate
   when:
     - inventory_hostname in groups[service.group]

ansible/roles/panko/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: panko_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -47,6 +52,8 @@
       - "{{ node_custom_config }}/panko/{{ item.key }}.conf"
       - "{{ node_custom_config }}/panko/{{ inventory_hostname }}/{{ item.key }}.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/panko.conf"
+    mode: "0660"
+  become: true
   register: panko_confs
   when:
     - inventory_hostname in groups[item.value.group]
@@ -61,6 +68,8 @@
   template:
     src: "wsgi-panko.conf.j2"
     dest: "{{ node_config_directory }}/{{ item }}/wsgi-panko.conf"
+    mode: "0660"
+  become: true
   register: panko_wsgi
   when:
     - inventory_hostname in groups[service.group]
@@ -74,6 +83,8 @@
   template:
     src: "{{ panko_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ panko_policy_file }}"
+    mode: "0660"
+  become: true
   register: panko_policy_overwriting
   when:
     - panko_policy_file is defined

ansible/roles/qdrouterd/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +16,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: qdrouterd_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -27,6 +32,8 @@
   template:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/qdrouterd/qdrouterd.conf"
+    mode: "0660"
+  become: true
   register: qdrouterd_confs
   when:
     - inventory_hostname in groups[service.group]
@@ -44,6 +51,8 @@
   template:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/qdrouterd/qdrouterd-sasl.conf"
+    mode: "0660"
+  become: true
   register: qdrouterd_sasl_confs
   when:
     - inventory_hostname in groups[service.group]

ansible/roles/rally/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: rally_config_jsons
   when:
     - item.value.enabled | bool
@@ -46,6 +51,8 @@
       - "{{ role_path }}/templates/rally.conf.j2"
       - "{{ node_custom_config }}/rally.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ item.key }}.conf"
+    mode: "0660"
+  become: true
   register: rally_confs
   when:
     - item.value.enabled | bool
@@ -58,6 +65,8 @@
   template:
     src: "{{ rally_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ rally_policy_file }}"
+    mode: "0660"
+  become: true
   register: rally_policy_overwriting
   when:
     - rally_policy_file is defined

ansible/roles/sahara/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: sahara_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -50,6 +55,8 @@
       - "{{ node_custom_config }}/sahara/{{ item.key }}.conf"
       - "{{ node_custom_config }}/sahara/{{ inventory_hostname }}/sahara.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/sahara.conf"
+    mode: "0660"
+  become: true
   register: sahara_confs
   when:
     - inventory_hostname in groups[item.value.group]
@@ -63,6 +70,8 @@
   template:
     src: "{{ sahara_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ sahara_policy_file }}"
+    mode: "0660"
+  become: true
   register: sahara_policy_overwriting
   when:
     - sahara_policy_file is defined

ansible/roles/searchlight/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: searchlight_config_jsons
   when:
     - item.value.enabled | bool
@@ -46,6 +51,8 @@
       - "{{ node_custom_config }}/searchlight.conf"
       - "{{ node_custom_config }}/searchlight/{{ inventory_hostname }}/searchlight.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/searchlight.conf"
+    mode: "0660"
+  become: true
   register: searchlight_confs
   when:
     - item.value.enabled | bool
@@ -59,6 +66,8 @@
   template:
     src: "{{ searchlight_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ searchlight_policy_file }}"
+    mode: "0660"
+  become: true
   register: searchlight_policy_overwriting
   when:
     - searchlight_policy_file is defined

ansible/roles/senlin/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: senlin_config_jsons
   when:
     - item.value.enabled | bool
@@ -50,6 +55,8 @@
       - "{{ node_custom_config }}/senlin/{{ item.key }}.conf"
       - "{{ node_custom_config }}/senlin/{{ inventory_hostname }}/senlin.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/senlin.conf"
+    mode: "0660"
+  become: true
   register: senlin_confs
   when:
     - item.value.enabled | bool
@@ -63,6 +70,8 @@
   template:
     src: "{{ senlin_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ senlin_policy_file }}"
+    mode: "0660"
+  become: true
   register: senlin_policy_overwriting
   when:
     - senlin_policy_file is defined

ansible/roles/skydive/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +16,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: skydive_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -26,6 +31,8 @@
   template:
     src: "{{ item.key }}.conf.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/skydive.conf"
+    mode: "0660"
+  become: true
   register: skydive_confs
   when:
     - item.value.enabled | bool

ansible/roles/solum/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +16,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: solum_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -35,6 +40,8 @@
       - "{{ node_custom_config }}/solum/{{ item.key }}.conf"
       - "{{ node_custom_config }}/solum/{{ inventory_hostname }}/solum.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/solum.conf"
+    mode: "0660"
+  become: true
   register: solum_confs
   when:
     - inventory_hostname in groups[item.value.group]

ansible/roles/swift/tasks/config.yml

@@ -4,6 +4,8 @@
     path: "{{ node_config_directory }}/{{ item }}"
     state: "directory"
     recurse: yes
+    mode: "0770"
+  become: true
   with_items:
     - "swift"
     - "swift-account-auditor"
@@ -26,6 +28,8 @@
   template:
     src: "{{ item }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item }}/config.json"
+    mode: "0660"
+  become: true
   with_items:
     - "swift-account-auditor"
     - "swift-account-reaper"
@@ -54,6 +58,8 @@
       - "{{ node_custom_config }}/swift/{{ item }}.conf"
       - "{{ node_custom_config }}/swift/{{ inventory_hostname }}/{{ item }}.conf"
     dest: "{{ node_config_directory }}/swift-{{ item }}/swift.conf"
+    mode: "0660"
+  become: true
   with_items:
     - "account-auditor"
     - "account-reaper"
@@ -81,6 +87,8 @@
       - "{{ node_custom_config }}/swift/{{ item }}.conf"
       - "{{ node_custom_config }}/swift/{{ inventory_hostname }}/{{ item }}.conf"
     dest: "{{ node_config_directory }}/swift-{{ item }}/{{ item }}.conf"
+    mode: "0660"
+  become: true
   with_items:
     - "account-auditor"
     - "account-reaper"
@@ -98,6 +106,8 @@
       - "{{ node_custom_config }}/swift/{{ item }}.conf"
       - "{{ node_custom_config }}/swift/{{ inventory_hostname }}/{{ item }}.conf"
     dest: "{{ node_config_directory }}/swift-{{ item }}/{{ item }}.conf"
+    mode: "0660"
+  become: true
   with_items:
     - "container-auditor"
     - "container-replicator"
@@ -115,6 +125,8 @@
       - "{{ node_custom_config }}/swift/{{ item }}.conf"
       - "{{ node_custom_config }}/swift/{{ inventory_hostname }}/{{ item }}.conf"
     dest: "{{ node_config_directory }}/swift-{{ item }}/{{ item }}.conf"
+    mode: "0660"
+  become: true
   with_items:
     - "object-auditor"
     - "object-expirer"
@@ -132,6 +144,8 @@
       - "{{ node_custom_config }}/swift/{{ item }}.conf"
       - "{{ node_custom_config }}/swift/{{ inventory_hostname }}/{{ item }}.conf"
     dest: "{{ node_config_directory }}/swift-{{ item }}/{{ item }}.conf"
+    mode: "0660"
+  become: true
   with_items:
     - "proxy-server"
 
@@ -139,12 +153,16 @@
   template:
     src: "rsyncd.conf.j2"
     dest: "{{ node_config_directory }}/swift-rsyncd/rsyncd.conf"
+    mode: "0660"
+  become: true
 
 - name: Copying over Swift ring files
   copy:
     src: "{{ node_custom_config }}/swift/{{ item }}"
     dest: "{{ node_config_directory }}/swift/{{ item }}"
     backup: yes
+    mode: "0660"
+  become: true
   with_items:
     - "account.builder"
     - "account.ring.gz"

ansible/roles/swift/tasks/start.yml

@@ -20,6 +20,7 @@
         inventory_hostname in groups['swift-object-server']
 
 - name: Mounting Swift disks
+  become: true
   mount:
     src: "UUID={{ item.fs_uuid }}"
     fstype: xfs

ansible/roles/tacker/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled
@@ -30,6 +33,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: tacker_config_jsons
   with_dict: "{{ tacker_services }}"
   when:
@@ -50,6 +55,8 @@
       - "{{ node_custom_config }}/tacker/{{ item.key }}.conf"
       - "{{ node_custom_config }}/tacker/{{ inventory_hostname }}/tacker.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/tacker.conf"
+    mode: "0660"
+  become: true
   register: tacker_confs
   with_dict: "{{ tacker_services }}"
   when:
@@ -63,6 +70,8 @@
   template:
     src: "{{ tacker_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ tacker_policy_file }}"
+    mode: "0660"
+  become: true
   register: tacker_policy_overwriting
   when:
     - inventory_hostname in groups[item.value.group]

ansible/roles/telegraf/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}/config"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +16,8 @@
   template:
     src: "telegraf.json.j2"
     dest: "{{ node_config_directory }}/telegraf/config.json"
+    mode: "0660"
+  become: true
   register: telegraf_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -27,6 +32,8 @@
   template:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/telegraf/telegraf.conf"
+    mode: "0660"
+  become: true
   register: telegraf_confs
   when:
     - inventory_hostname in groups[service.group]
@@ -44,6 +51,8 @@
   copy:
     src: "{{ item }}"
     dest: "{{ node_config_directory }}/telegraf/config"
+    mode: "0660"
+  become: true
   register: telegraf_plugin
   when:
     - inventory_hostname in groups[service.group]

ansible/roles/tempest/tasks/config.yml

@@ -3,7 +3,9 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +15,7 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
   register: tempest_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -29,6 +32,7 @@
       - "{{ role_path }}/templates/tempest.conf.j2"
       - "{{ node_custom_config }}/tempest.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/tempest.conf"
+    mode: "0660"
   register: tempest_confs
   when:
     - inventory_hostname in groups[item.value.group]

ansible/roles/trove/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -13,6 +16,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: trove_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -25,6 +30,8 @@
   template:
     src: "{{ item.key }}.conf.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ item.key }}.conf"
+    mode: "0660"
+  become: true
   register: trove_conf_file
   when:
     - item.key in [ "trove-conductor", "trove-taskmanager" ]
@@ -46,6 +53,8 @@
       - "{{ node_custom_config }}/trove/{{ item.key }}.conf"
       - "{{ node_custom_config }}/trove/{{ inventory_hostname }}/trove.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/trove.conf"
+    mode: "0660"
+  become: true
   register: trove_confs
   when:
     - inventory_hostname in groups[item.value.group]

ansible/roles/vmtp/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -28,6 +31,8 @@
       - "{{ node_custom_config }}/{{ item }}"
       - "{{ node_custom_config }}/vmtp/{{ item }}"
     dest: "{{ python_path }}/vmtp/{{ item }}"
+    mode: "0660"
+  become: true
   register: vmtp_confs
   when:
     - inventory_hostname in groups[service.group]

ansible/roles/watcher/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when:
     - inventory_hostname in groups[item.value.group]
     - item.value.enabled | bool
@@ -30,6 +33,7 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
   register: watcher_config_jsons
   when:
     - inventory_hostname in groups[item.value.group]
@@ -51,6 +55,7 @@
       - "{{ node_custom_config }}/watcher/{{ item.key }}.conf"
       - "{{ node_custom_config }}/watcher/{{ inventory_hostname }}/watcher.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/watcher.conf"
+    mode: "0660"
   register: watcher_confs
   when:
     - inventory_hostname in groups[item.value.group]

ansible/roles/zun/tasks/config.yml

@@ -3,7 +3,10 @@
   file:
     path: "{{ node_config_directory }}/{{ item.key }}"
     state: "directory"
-    recurse: yes
+    owner: "{{ config_owner_user }}"
+    group: "{{ config_owner_group }}"
+    mode: "0770"
+  become: true
   when: inventory_hostname in groups[item.value.group]
   with_dict: "{{ zun_services }}"
 
@@ -28,6 +31,8 @@
   template:
     src: "{{ item.key }}.json.j2"
     dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
+    mode: "0660"
+  become: true
   register: zun_config_jsons
   when:
     - item.value.enabled | bool
@@ -48,6 +53,8 @@
       - "{{ node_custom_config }}/zun/{{ item.key }}.conf"
       - "{{ node_custom_config }}/zun/{{ inventory_hostname }}/zun.conf"
     dest: "{{ node_config_directory }}/{{ item.key }}/zun.conf"
+    mode: "0660"
+  become: true
   register: zun_confs
   when:
     - item.value.enabled | bool
@@ -63,6 +70,8 @@
   template:
     src: "wsgi-zun.conf.j2"
     dest: "{{ node_config_directory }}/zun-api/wsgi-zun.conf"
+    mode: "0660"
+  become: true
   register: zun_conf_wsgi
   when:
     - inventory_hostname in groups[service.group]
@@ -74,6 +83,8 @@
   template:
     src: "{{ zun_policy_file_path }}"
     dest: "{{ node_config_directory }}/{{ item.key }}/{{ zun_policy_file }}"
+    mode: "0660"
+  become: true
   register: zun_policy_overwriting
   when:
     - zun_policy_file is defined

releasenotes/notes/specify-task-become-84f83707f612bcf3.yaml

@@ -2,5 +2,5 @@
 prelude: >
     Specify Ansible "become" for only necessary tasks.
 features:
-  - Add "become" to necessary tasks of general roles.
-  - Add "become" to necessary tasks of default roles.
+  - Increase security by add "become" to only
+    necessary Ansible tasks.