Merging upstream version 10.0.0+dfsg.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

19 files changed, 2166 insertions, 2170 deletions

diff --git a/ansible_collections/community/okd/molecule/default/converge.yml b/ansible_collections/community/okd/molecule/default/converge.yml
index 7fe9e8209..fb45006c3 100644
--- a/ansible_collections/community/okd/molecule/default/converge.yml
+++ b/ansible_collections/community/okd/molecule/default/converge.yml
@@ -21,16 +21,13 @@
       debug:
         var: output
 
-    - name: Create deployment config
+    - name: Create deployment
       community.okd.k8s:
         state: present
         name: hello-world
         namespace: testing
         definition: '{{ okd_dc_template }}'
         wait: yes
-        wait_condition:
-          type: Available
-          status: True
       vars:
         k8s_pod_name: hello-world
         k8s_pod_image: python
@@ -71,19 +68,12 @@
             namespace: '{{ namespace }}'
             definition: '{{ okd_imagestream_template }}'
 
-        - name: Create DeploymentConfig to reference ImageStream
-          community.okd.k8s:
-            name: '{{ k8s_pod_name }}'
-            namespace: '{{ namespace }}'
-            definition: '{{ okd_dc_template }}'
-          vars:
-            k8s_pod_name: is-idempotent-dc
-
         - name: Create Deployment to reference ImageStream
           community.okd.k8s:
             name: '{{ k8s_pod_name }}'
             namespace: '{{ namespace }}'
             definition: '{{ k8s_deployment_template | combine(metadata)  }}'
+            wait: true
           vars:
             k8s_pod_annotations:
               "alpha.image.policy.openshift.io/resolve-names": "*"
diff --git a/ansible_collections/community/okd/molecule/default/files/pod-template.yaml b/ansible_collections/community/okd/molecule/default/files/pod-template.yaml
index ac388ad67..3a1c8f1b8 100644
--- a/ansible_collections/community/okd/molecule/default/files/pod-template.yaml
+++ b/ansible_collections/community/okd/molecule/default/files/pod-template.yaml
@@ -10,14 +10,14 @@ objects:
       name: "Pod-${{ NAME }}"
     spec:
       containers:
-      - args:
-        - /bin/sh
-        - -c
-        - while true; do echo $(date); sleep 15; done
-        image: python:3.7-alpine
-        imagePullPolicy: Always
-        name: python
+        - args:
+            - /bin/sh
+            - -c
+            - while true; do echo $(date); sleep 15; done
+          image: python:3.7-alpine
+          imagePullPolicy: Always
+          name: python
 parameters:
-  - name: NAME 
+  - name: NAME
     description: trailing name of the pod
     required: true
diff --git a/ansible_collections/community/okd/molecule/default/files/simple-template.yaml b/ansible_collections/community/okd/molecule/default/files/simple-template.yaml
index 29c85b9cd..c8270f776 100644
--- a/ansible_collections/community/okd/molecule/default/files/simple-template.yaml
+++ b/ansible_collections/community/okd/molecule/default/files/simple-template.yaml
@@ -13,22 +13,22 @@ metadata:
     tags: quickstart,examples
   name: simple-example
 objects:
-- apiVersion: v1
-  kind: ConfigMap
-  metadata:
-    annotations:
-      description: Big example
-    name: ${NAME}
-  data:
-    content: "${CONTENT}"
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      annotations:
+        description: Big example
+      name: ${NAME}
+    data:
+      content: "${CONTENT}"
 parameters:
-- description: The name assigned to the ConfigMap
-  displayName: Name
-  name: NAME
-  required: true
-  value: example
-- description: The value for the content key of the configmap
-  displayName: Content
-  name: CONTENT
-  required: true
-  value: ''
+  - description: The name assigned to the ConfigMap
+    displayName: Name
+    name: NAME
+    required: true
+    value: example
+  - description: The value for the content key of the configmap
+    displayName: Content
+    name: CONTENT
+    required: true
+    value: ''
diff --git a/ansible_collections/community/okd/molecule/default/molecule.yml b/ansible_collections/community/okd/molecule/default/molecule.yml
index 43407bd26..7ca7e2c5b 100644
--- a/ansible_collections/community/okd/molecule/default/molecule.yml
+++ b/ansible_collections/community/okd/molecule/default/molecule.yml
@@ -4,7 +4,7 @@ dependency:
   options:
     requirements-file: requirements.yml
 driver:
-  name: delegated
+  name: default
 platforms:
   - name: cluster
     groups:
@@ -17,9 +17,6 @@ provisioner:
   config_options:
     inventory:
       enable_plugins: community.okd.openshift
-  lint: |
-    set -e
-    ansible-lint
   inventory:
     hosts:
       plugin: community.okd.openshift
@@ -34,14 +31,10 @@ provisioner:
     ANSIBLE_COLLECTIONS_PATHS: ${OVERRIDE_COLLECTION_PATH:-$MOLECULE_PROJECT_DIRECTORY}
 verifier:
   name: ansible
-  lint: |
-    set -e
-    ansible-lint
 scenario:
   name: default
   test_sequence:
     - dependency
-    - lint
     - syntax
     - prepare
     - converge
diff --git a/ansible_collections/community/okd/molecule/default/prepare.yml b/ansible_collections/community/okd/molecule/default/prepare.yml
index f155ec1d4..0d0361ab2 100644
--- a/ansible_collections/community/okd/molecule/default/prepare.yml
+++ b/ansible_collections/community/okd/molecule/default/prepare.yml
@@ -37,12 +37,12 @@
             name: cluster
           spec:
             identityProviders:
-            - name: htpasswd_provider
-              mappingMethod: claim
-              type: HTPasswd
-              htpasswd:
-                fileData:
-                  name: htpass-secret
+              - name: htpasswd_provider
+                mappingMethod: claim
+                type: HTPasswd
+                htpasswd:
+                  fileData:
+                    name: htpass-secret
 
     - name: Create ClusterRoleBinding for test user
       community.okd.k8s:
diff --git a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/library/openshift_ldap_entry_info.py b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/library/openshift_ldap_entry_info.py
index ba49f724d..c5bde3e5f 100644
--- a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/library/openshift_ldap_entry_info.py
+++ b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/library/openshift_ldap_entry_info.py
@@ -89,6 +89,7 @@ def execute():
 
     ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
     connection = ldap.initialize(module.params['server_uri'])
+    connection.set_option(ldap.OPT_REFERRALS, 0)
     try:
         connection.simple_bind_s(module.params['bind_dn'], module.params['bind_pw'])
     except ldap.LDAPError as e:
diff --git a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/activeDirectory.yml b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/activeDirectory.yml
index da99f324e..78131a876 100644
--- a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/activeDirectory.yml
+++ b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/activeDirectory.yml
@@ -1,227 +1,227 @@
+---
 - block:
-  - name: Get LDAP definition
-    set_fact:
-      ldap_entries: "{{ lookup('template', 'ad/definition.j2') | from_yaml }}"
-
-  - name: Delete openshift groups if existing
-    community.okd.k8s:
-      state: absent
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: "{{ item }}"
-    with_items:
-      - admins
-      - developers
-
-  - name: Delete existing LDAP Entries
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ item.dn }}"
-      state: absent
-    with_items: "{{ ldap_entries.users + ldap_entries.units | reverse | list }}"
-
-  - name: Create LDAP Entries
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ item.dn }}"
-      attributes: "{{ item.attr }}"
-      objectClass: "{{ item.class }}"
-    with_items: "{{ ldap_entries.units + ldap_entries.users }}"
-
-  - name: Load test configurations
-    set_fact:
-      sync_config: "{{ lookup('template', 'ad/sync-config.j2') | from_yaml }}"
-
-  - name: Synchronize Groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ sync_config }}"
-    check_mode: yes
-    register: result
-
-  - name: Validate Group going to be created
-    assert:
-      that:
-        - result is changed
-        - admins_group
-        - devs_group
-        - '"jane.smith@ansible.org" in {{ admins_group.users }}'
-        - '"jim.adams@ansible.org" in {{ admins_group.users }}'
-        - '"jordanbulls@ansible.org" in {{ devs_group.users }}'
-        - admins_group.users | length == 2
-        - devs_group.users | length == 1
-    vars:
-      admins_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'admins') | first }}"
-      devs_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'developers') | first }}"
-
-
-  - name: Synchronize Groups (Remove check_mode)
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ sync_config }}"
-    register: result
-
-  - name: Validate Group going to be created
-    assert:
-      that:
-        - result is changed
-
-  - name: Read admins group
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: admins
-    register: result
-
-  - name: Validate group was created
-    assert:
-      that:
-        - result.resources | length == 1
-        - '"jane.smith@ansible.org" in {{ result.resources.0.users }}'
-        - '"jim.adams@ansible.org" in {{ result.resources.0.users }}'
-
-  - name: Read developers group
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: developers
-    register: result
-
-  - name: Validate group was created
-    assert:
-      that:
-        - result.resources | length == 1
-        - '"jordanbulls@ansible.org" in {{ result.resources.0.users }}'
-
-  - name: Define user dn to delete
-    set_fact:
-      user_to_delete: "cn=Jane,ou=engineers,ou=activeD,{{ ldap_root }}"
-
-  - name: Delete 1 admin user
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ user_to_delete }}"
-      state: absent
-
-  - name: Synchronize Openshift groups using allow_groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ sync_config }}"
-      allow_groups:
-        - developers
-      type: openshift
-    register: openshift_sync
-
-  - name: Validate that only developers group was sync
-    assert:
-      that:
-        - openshift_sync is changed
-        - openshift_sync.groups | length == 1
-        - openshift_sync.groups.0.metadata.name == "developers"
-
-  - name: Read admins group
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: admins
-    register: result
-
-  - name: Validate admins group content has not changed
-    assert:
-      that:
-        - result.resources | length == 1
-        - '"jane.smith@ansible.org" in {{ result.resources.0.users }}'
-        - '"jim.adams@ansible.org" in {{ result.resources.0.users }}'
-
-  - name: Synchronize Openshift groups using deny_groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ sync_config }}"
-      deny_groups:
+    - name: Get LDAP definition
+      set_fact:
+        ldap_entries: "{{ lookup('template', 'ad/definition.j2') | from_yaml }}"
+
+    - name: Delete openshift groups if existing
+      community.okd.k8s:
+        state: absent
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: "{{ item }}"
+      with_items:
+        - admins
         - developers
-      type: openshift
-    register: openshift_sync
-
-  - name: Validate that only admins group was sync
-    assert:
-      that:
-        - openshift_sync is changed
-        - openshift_sync.groups | length == 1
-        - openshift_sync.groups.0.metadata.name == "admins"
-
-  - name: Read admins group
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: admins
-    register: result
-
-  - name: Validate admins group contains only 1 user now
-    assert:
-      that:
-        - result.resources | length == 1
-        - result.resources.0.users == ["jim.adams@ansible.org"]
-
-  - name: Set users to delete (delete all developers users)
-    set_fact:
-      user_to_delete: "cn=Jordan,ou=engineers,ou=activeD,{{ ldap_root }}"
-
-  - name: Delete 1 admin user
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ user_to_delete }}"
-      state: absent
-
-  - name: Prune groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ sync_config }}"
-      state: absent
-    register: result
-
-  - name: Validate result is changed (only developers group be deleted)
-    assert:
-      that:
-        - result is changed
-        - result.groups | length == 1
-
-  - name: Get developers group info
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: developers
-    register: result
-
-  - name: assert group was deleted
-    assert:
-      that:
-        - result.resources | length == 0
-
-  - name: Get admins group info
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: admins
-    register: result
-
-  - name: assert group was not deleted
-    assert:
-      that:
-        - result.resources | length == 1
-
-  - name: Prune groups once again (idempotency)
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ sync_config }}"
-      state: absent
-    register: result
-
-  - name: Assert nothing was changed
-    assert:
-      that:
-        - result is not changed
+
+    - name: Delete existing LDAP Entries
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ item.dn }}"
+        state: absent
+      with_items: "{{ ldap_entries.users + ldap_entries.units | reverse | list }}"
+
+    - name: Create LDAP Entries
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ item.dn }}"
+        attributes: "{{ item.attr }}"
+        objectClass: "{{ item.class }}"
+      with_items: "{{ ldap_entries.units + ldap_entries.users }}"
+
+    - name: Load test configurations
+      set_fact:
+        sync_config: "{{ lookup('template', 'ad/sync-config.j2') | from_yaml }}"
+
+    - name: Synchronize Groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ sync_config }}"
+      check_mode: yes
+      register: result
+
+    - name: Validate Group going to be created
+      assert:
+        that:
+          - result is changed
+          - admins_group
+          - devs_group
+          - '"jane.smith@ansible.org" in {{ admins_group.users }}'
+          - '"jim.adams@ansible.org" in {{ admins_group.users }}'
+          - '"jordanbulls@ansible.org" in {{ devs_group.users }}'
+          - admins_group.users | length == 2
+          - devs_group.users | length == 1
+      vars:
+        admins_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'admins') | first }}"
+        devs_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'developers') | first }}"
+
+    - name: Synchronize Groups (Remove check_mode)
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ sync_config }}"
+      register: result
+
+    - name: Validate Group going to be created
+      assert:
+        that:
+          - result is changed
+
+    - name: Read admins group
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: admins
+      register: result
+
+    - name: Validate group was created
+      assert:
+        that:
+          - result.resources | length == 1
+          - '"jane.smith@ansible.org" in {{ result.resources.0.users }}'
+          - '"jim.adams@ansible.org" in {{ result.resources.0.users }}'
+
+    - name: Read developers group
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: developers
+      register: result
+
+    - name: Validate group was created
+      assert:
+        that:
+          - result.resources | length == 1
+          - '"jordanbulls@ansible.org" in {{ result.resources.0.users }}'
+
+    - name: Define user dn to delete
+      set_fact:
+        user_to_delete: "cn=Jane,ou=engineers,ou=activeD,{{ ldap_root }}"
+
+    - name: Delete 1 admin user
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ user_to_delete }}"
+        state: absent
+
+    - name: Synchronize Openshift groups using allow_groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ sync_config }}"
+        allow_groups:
+          - developers
+        type: openshift
+      register: openshift_sync
+
+    - name: Validate that only developers group was sync
+      assert:
+        that:
+          - openshift_sync is changed
+          - openshift_sync.groups | length == 1
+          - openshift_sync.groups.0.metadata.name == "developers"
+
+    - name: Read admins group
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: admins
+      register: result
+
+    - name: Validate admins group content has not changed
+      assert:
+        that:
+          - result.resources | length == 1
+          - '"jane.smith@ansible.org" in {{ result.resources.0.users }}'
+          - '"jim.adams@ansible.org" in {{ result.resources.0.users }}'
+
+    - name: Synchronize Openshift groups using deny_groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ sync_config }}"
+        deny_groups:
+          - developers
+        type: openshift
+      register: openshift_sync
+
+    - name: Validate that only admins group was sync
+      assert:
+        that:
+          - openshift_sync is changed
+          - openshift_sync.groups | length == 1
+          - openshift_sync.groups.0.metadata.name == "admins"
+
+    - name: Read admins group
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: admins
+      register: result
+
+    - name: Validate admins group contains only 1 user now
+      assert:
+        that:
+          - result.resources | length == 1
+          - result.resources.0.users == ["jim.adams@ansible.org"]
+
+    - name: Set users to delete (delete all developers users)
+      set_fact:
+        user_to_delete: "cn=Jordan,ou=engineers,ou=activeD,{{ ldap_root }}"
+
+    - name: Delete 1 admin user
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ user_to_delete }}"
+        state: absent
+
+    - name: Prune groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ sync_config }}"
+        state: absent
+      register: result
+
+    - name: Validate result is changed (only developers group be deleted)
+      assert:
+        that:
+          - result is changed
+          - result.groups | length == 1
+
+    - name: Get developers group info
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: developers
+      register: result
+
+    - name: assert group was deleted
+      assert:
+        that:
+          - result.resources | length == 0
+
+    - name: Get admins group info
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: admins
+      register: result
+
+    - name: assert group was not deleted
+      assert:
+        that:
+          - result.resources | length == 1
+
+    - name: Prune groups once again (idempotency)
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ sync_config }}"
+        state: absent
+      register: result
+
+    - name: Assert nothing was changed
+      assert:
+        that:
+          - result is not changed
 
   always:
     - name: Delete openshift groups if existing
diff --git a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/augmentedActiveDirectory.yml b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/augmentedActiveDirectory.yml
index f70d3bd8e..f089b33ad 100644
--- a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/augmentedActiveDirectory.yml
+++ b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/augmentedActiveDirectory.yml
@@ -1,166 +1,165 @@
+---
 - block:
-  - name: Get LDAP definition
-    set_fact:
-      ldap_entries: "{{ lookup('template', 'augmented-ad/definition.j2') | from_yaml }}"
-
-  - name: Delete openshift groups if existing
-    community.okd.k8s:
-      state: absent
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: "{{ item }}"
-    with_items:
-      - banking
-      - insurance
-
-  - name: Delete existing LDAP entries
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ item.dn }}"
-      state: absent
-    with_items: "{{ ldap_entries.users + ldap_entries.groups + ldap_entries.units | reverse | list }}"
-
-  - name: Create LDAP Entries
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ item.dn }}"
-      attributes: "{{ item.attr }}"
-      objectClass: "{{ item.class }}"
-    with_items: "{{ ldap_entries.units + ldap_entries.groups + ldap_entries.users }}"
-
-  - name: Load test configurations
-    set_fact:
-      sync_config: "{{ lookup('template', 'augmented-ad/sync-config.j2') | from_yaml }}"
-
-  - name: Synchronize Groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ sync_config }}"
-    check_mode: yes
-    register: result
-
-  - name: Validate that 'banking' and 'insurance' groups were created
-    assert:
-      that:
-        - result is changed
-        - banking_group
-        - insurance_group
-        - '"james-allan@ansible.org" in {{ banking_group.users }}'
-        - '"gordon-kane@ansible.org" in {{ banking_group.users }}'
-        - '"alice-courtney@ansible.org" in {{ insurance_group.users }}'
-        - banking_group.users | length == 2
-        - insurance_group.users | length == 1
-    vars:
-      banking_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'banking') | first }}"
-      insurance_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'insurance') | first }}"
-
-
-  - name: Synchronize Groups (Remove check_mode)
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ sync_config }}"
-    register: result
-
-  - name: Validate Group going to be created
-    assert:
-      that:
-        - result is changed
-
-  - name: Define facts for group to create
-    set_fact:
-      ldap_groups:
-        - name: banking
-          users:
-            - "james-allan@ansible.org"
-            - "gordon-kane@ansible.org"
-        - name: insurance
-          users:
-            - "alice-courtney@ansible.org"
-
-
-  - name: Read 'banking' openshift group
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: banking
-    register: result
-
-  - name: Validate group info
-    assert:
-      that:
-        - result.resources | length == 1
-        - '"james-allan@ansible.org" in {{ result.resources.0.users }}'
-        - '"gordon-kane@ansible.org" in {{ result.resources.0.users }}'
-
-  - name: Read 'insurance' openshift group
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: insurance
-    register: result
-
-  - name: Validate group info
-    assert:
-      that:
-        - result.resources | length == 1
-        - 'result.resources.0.users == ["alice-courtney@ansible.org"]'
-
-  - name: Delete employee from 'insurance' group
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "cn=Alice,ou=employee,ou=augmentedAD,{{ ldap_root }}"
-      state: absent
-
-  - name: Prune groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ sync_config }}"
-      state: absent
-    register: result
-
-  - name: Validate result is changed (only insurance group be deleted)
-    assert:
-      that:
-        - result is changed
-        - result.groups | length == 1
-
-  - name: Get 'insurance' openshift group info
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: insurance
-    register: result
-
-  - name: assert group was deleted
-    assert:
-      that:
-        - result.resources | length == 0
-
-  - name: Get 'banking' openshift group info
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: banking
-    register: result
-
-  - name: assert group was not deleted
-    assert:
-      that:
-        - result.resources | length == 1
-
-  - name: Prune groups once again (idempotency)
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ sync_config }}"
-      state: absent
-    register: result
-
-  - name: Assert no change was made
-    assert:
-      that:
-        - result is not changed
+    - name: Get LDAP definition
+      set_fact:
+        ldap_entries: "{{ lookup('template', 'augmented-ad/definition.j2') | from_yaml }}"
+
+    - name: Delete openshift groups if existing
+      community.okd.k8s:
+        state: absent
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: "{{ item }}"
+      with_items:
+        - banking
+        - insurance
+
+    - name: Delete existing LDAP entries
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ item.dn }}"
+        state: absent
+      with_items: "{{ ldap_entries.users + ldap_entries.groups + ldap_entries.units | reverse | list }}"
+
+    - name: Create LDAP Entries
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ item.dn }}"
+        attributes: "{{ item.attr }}"
+        objectClass: "{{ item.class }}"
+      with_items: "{{ ldap_entries.units + ldap_entries.groups + ldap_entries.users }}"
+
+    - name: Load test configurations
+      set_fact:
+        sync_config: "{{ lookup('template', 'augmented-ad/sync-config.j2') | from_yaml }}"
+
+    - name: Synchronize Groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ sync_config }}"
+      check_mode: yes
+      register: result
+
+    - name: Validate that 'banking' and 'insurance' groups were created
+      assert:
+        that:
+          - result is changed
+          - banking_group
+          - insurance_group
+          - '"james-allan@ansible.org" in {{ banking_group.users }}'
+          - '"gordon-kane@ansible.org" in {{ banking_group.users }}'
+          - '"alice-courtney@ansible.org" in {{ insurance_group.users }}'
+          - banking_group.users | length == 2
+          - insurance_group.users | length == 1
+      vars:
+        banking_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'banking') | first }}"
+        insurance_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'insurance') | first }}"
+
+    - name: Synchronize Groups (Remove check_mode)
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ sync_config }}"
+      register: result
+
+    - name: Validate Group going to be created
+      assert:
+        that:
+          - result is changed
+
+    - name: Define facts for group to create
+      set_fact:
+        ldap_groups:
+          - name: banking
+            users:
+              - "james-allan@ansible.org"
+              - "gordon-kane@ansible.org"
+          - name: insurance
+            users:
+              - "alice-courtney@ansible.org"
+
+    - name: Read 'banking' openshift group
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: banking
+      register: result
+
+    - name: Validate group info
+      assert:
+        that:
+          - result.resources | length == 1
+          - '"james-allan@ansible.org" in {{ result.resources.0.users }}'
+          - '"gordon-kane@ansible.org" in {{ result.resources.0.users }}'
+
+    - name: Read 'insurance' openshift group
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: insurance
+      register: result
+
+    - name: Validate group info
+      assert:
+        that:
+          - result.resources | length == 1
+          - 'result.resources.0.users == ["alice-courtney@ansible.org"]'
+
+    - name: Delete employee from 'insurance' group
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "cn=Alice,ou=employee,ou=augmentedAD,{{ ldap_root }}"
+        state: absent
+
+    - name: Prune groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ sync_config }}"
+        state: absent
+      register: result
+
+    - name: Validate result is changed (only insurance group be deleted)
+      assert:
+        that:
+          - result is changed
+          - result.groups | length == 1
+
+    - name: Get 'insurance' openshift group info
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: insurance
+      register: result
+
+    - name: assert group was deleted
+      assert:
+        that:
+          - result.resources | length == 0
+
+    - name: Get 'banking' openshift group info
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: banking
+      register: result
+
+    - name: assert group was not deleted
+      assert:
+        that:
+          - result.resources | length == 1
+
+    - name: Prune groups once again (idempotency)
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ sync_config }}"
+        state: absent
+      register: result
+
+    - name: Assert no change was made
+      assert:
+        that:
+          - result is not changed
 
   always:
     - name: Delete openshift groups if existing
diff --git a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/main.yml b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/main.yml
index 88bfd67f8..5dc79c1f0 100644
--- a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/main.yml
+++ b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/main.yml
@@ -1,5 +1,5 @@
 ---
-- name: Get cluster information 
+- name: Get cluster information
   kubernetes.core.k8s_cluster_info:
   register: info
 
@@ -16,30 +16,29 @@
           app: ldap
       spec:
         containers:
-        - name: ldap
-          image: bitnami/openldap
-          env:
-            - name: LDAP_ADMIN_USERNAME
-              value: "{{ ldap_admin_user }}"
-            - name: LDAP_ADMIN_PASSWORD
-              value: "{{ ldap_admin_password }}"
-            - name: LDAP_USERS
-              value: "ansible"
-            - name: LDAP_PASSWORDS
-              value: "ansible123"
-            - name: LDAP_ROOT
-              value: "{{ ldap_root }}"
-          ports:
-          - containerPort: 1389
+          - name: ldap
+            image: bitnami/openldap
+            env:
+              - name: LDAP_ADMIN_USERNAME
+                value: "{{ ldap_admin_user }}"
+              - name: LDAP_ADMIN_PASSWORD
+                value: "{{ ldap_admin_password }}"
+              - name: LDAP_USERS
+                value: "ansible"
+              - name: LDAP_PASSWORDS
+                value: "ansible123"
+              - name: LDAP_ROOT
+                value: "{{ ldap_root }}"
+            ports:
+              - containerPort: 1389
+                name: ldap-server
   register: pod_info
 
-- name: Set Pod Internal IP
-  set_fact:
-    podIp: "{{ pod_info.result.status.podIP }}"
-
 - name: Set LDAP Common facts
   set_fact:
-    ldap_server_uri: "ldap://{{ podIp }}:1389"
+    # we can use the Pod IP directly because the integration are running inside a Pod in the
+    # same openshift cluster
+    ldap_server_uri: "ldap://{{ pod_info.result.status.podIP }}:1389"
     ldap_bind_dn: "cn={{ ldap_admin_user }},{{ ldap_root }}"
     ldap_bind_pw: "{{ ldap_admin_password }}"
 
@@ -53,8 +52,10 @@
     bind_pw: "{{ ldap_bind_pw }}"
     dn: "ou=users,{{ ldap_root }}"
     server_uri: "{{ ldap_server_uri }}"
-  # ignore_errors: true
-  # register: ping_ldap
+  register: test_ldap
+  retries: 10
+  delay: 5
+  until: test_ldap is not failed
 
 - include_tasks: "tasks/python-ldap-not-installed.yml"
 - include_tasks: "tasks/rfc2307.yml"
diff --git a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/python-ldap-not-installed.yml b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/python-ldap-not-installed.yml
index a79af51c2..857ff4903 100644
--- a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/python-ldap-not-installed.yml
+++ b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/python-ldap-not-installed.yml
@@ -1,3 +1,4 @@
+---
 - block:
     - name: Create temp directory
       tempfile:
diff --git a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/rfc2307.yml b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/rfc2307.yml
index 7660bf625..749dfdae3 100644
--- a/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/rfc2307.yml
+++ b/ansible_collections/community/okd/molecule/default/roles/openshift_adm_groups/tasks/rfc2307.yml
@@ -1,459 +1,460 @@
+---
 - block:
-  - name: Get LDAP definition
-    set_fact:
-      ldap_resources: "{{ lookup('template', 'rfc2307/definition.j2') | from_yaml }}"
-
-  - name: Delete openshift groups if existing
-    community.okd.k8s:
-      state: absent
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: "{{ item }}"
-    with_items:
-      - admins
-      - engineers
-      - developers
-
-  - name: Delete existing LDAP entries
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ item.dn }}"
-      state: absent
-    with_items: "{{ ldap_resources.users + ldap_resources.groups + ldap_resources.units | reverse | list }}"
-
-  - name: Create LDAP units
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ item.dn }}"
-      attributes: "{{ item.attr }}"
-      objectClass: "{{ item.class }}"
-    with_items: "{{ ldap_resources.units }}"
-
-  - name: Create LDAP Groups
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ item.dn }}"
-      attributes: "{{ item.attr }}"
-      objectClass: "{{ item.class }}"
-    with_items: "{{ ldap_resources.groups }}"
-
-  - name: Create LDAP users
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ item.dn }}"
-      attributes: "{{ item.attr }}"
-      objectClass: "{{ item.class }}"
-    with_items: "{{ ldap_resources.users }}"
-
-  - name: Load test configurations
-    set_fact:
-      configs: "{{ lookup('template', 'rfc2307/sync-config.j2') | from_yaml }}"
-
-  - name: Synchronize Groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ configs.simple }}"
-    check_mode: yes
-    register: result
-
-  - name: Validate Group going to be created
-    assert:
-      that:
-        - result is changed
-        - admins_group
-        - devs_group
-        - '"jane.smith@ansible.org" in {{ admins_group.users }}'
-        - '"jim.adams@ansible.org" in {{ devs_group.users }}'
-        - '"jordanbulls@ansible.org" in {{ devs_group.users }}'
-        - admins_group.users | length == 1
-        - devs_group.users | length == 2
-    vars:
-      admins_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'admins') | first }}"
-      devs_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'developers') | first }}"
-
-  - name: Synchronize Groups - User defined mapping
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ configs.user_defined }}"
-    check_mode: yes
-    register: result
-
-  - name: Validate Group going to be created
-    assert:
-      that:
-        - result is changed
-        - admins_group
-        - devs_group
-        - '"jane.smith@ansible.org" in {{ admins_group.users }}'
-        - '"jim.adams@ansible.org" in {{ devs_group.users }}'
-        - '"jordanbulls@ansible.org" in {{ devs_group.users }}'
-        - admins_group.users | length == 1
-        - devs_group.users | length == 2
-    vars:
-      admins_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'ansible-admins') | first }}"
-      devs_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'ansible-devs') | first }}"
-
-  - name: Synchronize Groups - Using dn for every query
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ configs.dn_everywhere }}"
-    check_mode: yes
-    register: result
-
-  - name: Validate Group going to be created
-    assert:
-      that:
-        - result is changed
-        - admins_group
-        - devs_group
-        - '"cn=Jane,ou=people,ou=rfc2307,{{ ldap_root }}" in {{ admins_group.users }}'
-        - '"cn=Jim,ou=people,ou=rfc2307,{{ ldap_root }}" in {{ devs_group.users }}'
-        - '"cn=Jordan,ou=people,ou=rfc2307,{{ ldap_root }}" in {{ devs_group.users }}'
-        - admins_group.users | length == 1
-        - devs_group.users | length == 2
-    vars:
-      admins_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'cn=admins,ou=groups,ou=rfc2307,' + ldap_root ) | first }}"
-      devs_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'cn=developers,ou=groups,ou=rfc2307,' + ldap_root ) | first }}"
-
-  - name: Synchronize Groups - Partially user defined mapping
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ configs.partially_user_defined }}"
-    check_mode: yes
-    register: result
-
-  - name: Validate Group going to be created
-    assert:
-      that:
-        - result is changed
-        - admins_group
-        - devs_group
-        - '"jane.smith@ansible.org" in {{ admins_group.users }}'
-        - '"jim.adams@ansible.org" in {{ devs_group.users }}'
-        - '"jordanbulls@ansible.org" in {{ devs_group.users }}'
-        - admins_group.users | length == 1
-        - devs_group.users | length == 2
-    vars:
-      admins_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'ansible-admins') | first }}"
-      devs_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'developers') | first }}"
-
-  - name: Delete Group 'engineers' if created before
-    community.okd.k8s:
-      state: absent
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: 'engineers'
-      wait: yes
-    ignore_errors: yes
-
-  - name: Synchronize Groups - Partially user defined mapping
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ configs.out_scope }}"
-    check_mode: yes
-    register: result
-    ignore_errors: yes
-
-  - name: Assert group sync failed due to non-existent member
-    assert:
-      that:
-        - result is failed
-        - result.msg.startswith("Entry not found for base='cn=Matthew,ou=people,ou=outrfc2307,{{ ldap_root }}'")
-
-  - name: Define sync configuration with tolerateMemberNotFoundErrors
-    set_fact:
-      config_out_of_scope_tolerate_not_found: "{{ configs.out_scope | combine({'rfc2307': merge_rfc2307 })}}"
-    vars:
-      merge_rfc2307: "{{ configs.out_scope.rfc2307 | combine({'tolerateMemberNotFoundErrors': 'true'}) }}"
-
-  - name: Synchronize Groups - Partially user defined mapping (tolerateMemberNotFoundErrors=true)
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ config_out_of_scope_tolerate_not_found }}"
-    check_mode: yes
-    register: result
-
-  - name: Assert group sync did not fail (tolerateMemberNotFoundErrors=true)
-    assert:
-      that:
-        - result is changed
-        - result.groups | length == 1
-        - result.groups.0.metadata.name == 'engineers'
-        - result.groups.0.users == ['Abraham']
-
-  - name: Create Group 'engineers'
-    community.okd.k8s:
-      state: present
-      wait: yes
-      definition:
+    - name: Get LDAP definition
+      set_fact:
+        ldap_resources: "{{ lookup('template', 'rfc2307/definition.j2') | from_yaml }}"
+
+    - name: Delete openshift groups if existing
+      community.okd.k8s:
+        state: absent
         kind: Group
-        apiVersion: "user.openshift.io/v1"
-        metadata:
-          name: engineers
-        users: []
-
-  - name: Try to sync LDAP group with Openshift existing group not created using sync should failed
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ config_out_of_scope_tolerate_not_found }}"
-    check_mode: yes
-    register: result
-    ignore_errors: yes
-
-  - name: Validate group sync failed
-    assert:
-      that:
-        - result is failed
-        - '"openshift.io/ldap.host label did not match sync host" in result.msg'
-
-  - name: Define allow_groups and deny_groups groups
-    set_fact:
-      allow_groups:
-        - "cn=developers,ou=groups,ou=rfc2307,{{ ldap_root }}"
-      deny_groups:
-        - "cn=admins,ou=groups,ou=rfc2307,{{ ldap_root }}"
-
-  - name: Synchronize Groups using allow_groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ configs.simple }}"
-      allow_groups: "{{ allow_groups }}"
-    register: result
-    check_mode: yes
-
-  - name: Validate Group going to be created
-    assert:
-      that:
-        - result is changed
-        - result.groups | length == 1
-        - result.groups.0.metadata.name == "developers"
-
-  - name: Synchronize Groups using deny_groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ configs.simple }}"
-      deny_groups: "{{ deny_groups }}"
-    register: result
-    check_mode: yes
-
-  - name: Validate Group going to be created
-    assert:
-      that:
-        - result is changed
-        - result.groups | length == 1
-        - result.groups.0.metadata.name == "developers"
-
-  - name: Synchronize groups, remove check_mode
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ configs.simple }}"
-    register: result
-
-  - name: Validate result is changed
-    assert:
-      that:
-        - result is changed
-
-  - name: Read Groups
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: admins
-    register: result
-
-  - name: Validate group was created
-    assert:
-      that:
-        - result.resources | length == 1
-        - '"jane.smith@ansible.org" in {{ result.resources.0.users }}'
-
-  - name: Read Groups
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: developers
-    register: result
-
-  - name: Validate group was created
-    assert:
-      that:
-        - result.resources | length == 1
-        - '"jim.adams@ansible.org" in {{ result.resources.0.users }}'
-        - '"jordanbulls@ansible.org" in {{ result.resources.0.users }}'
-
-  - name: Set users to delete (no admins users anymore and only 1 developer kept)
-    set_fact:
-      users_to_delete:
-        - "cn=Jane,ou=people,ou=rfc2307,{{ ldap_root }}"
-        - "cn=Jim,ou=people,ou=rfc2307,{{ ldap_root }}"
-
-  - name: Delete users from LDAP servers
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ item }}"
-      state: absent
-    with_items: "{{ users_to_delete }}"
-
-  - name: Define sync configuration with tolerateMemberNotFoundErrors
-    set_fact:
-      config_simple_tolerate_not_found: "{{ configs.simple | combine({'rfc2307': merge_rfc2307 })}}"
-    vars:
-      merge_rfc2307: "{{ configs.simple.rfc2307 | combine({'tolerateMemberNotFoundErrors': 'true'}) }}"
-
-  - name: Synchronize groups once again after users deletion
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ config_simple_tolerate_not_found }}"
-    register: result
-
-  - name: Validate result is changed
-    assert:
-      that:
-        - result is changed
-
-  - name: Read Groups
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: admins
-    register: result
-
-  - name: Validate admins group does not contains users anymore
-    assert:
-      that:
-        - result.resources | length == 1
-        - result.resources.0.users == []
-
-  - name: Read Groups
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: developers
-    register: result
-
-  - name: Validate group was created
-    assert:
-      that:
-        - result.resources | length == 1
-        - '"jordanbulls@ansible.org" in {{ result.resources.0.users }}'
-
-  - name: Set group to delete
-    set_fact:
-      groups_to_delete:
-        - "cn=developers,ou=groups,ou=rfc2307,{{ ldap_root }}"
-
-  - name: Delete Group from LDAP servers
-    openshift_ldap_entry:
-      bind_dn: "{{ ldap_bind_dn }}"
-      bind_pw: "{{ ldap_bind_pw }}"
-      server_uri: "{{ ldap_server_uri }}"
-      dn: "{{ item }}"
-      state: absent
-    with_items: "{{ groups_to_delete }}"
-
-  - name: Prune groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ config_simple_tolerate_not_found }}"
-      state: absent
-    register: result
-    check_mode: yes
-
-  - name: Validate that only developers group is candidate for Prune
-    assert:
-      that:
-        - result is changed
-        - result.groups | length == 1
-        - result.groups.0.metadata.name == "developers"
-
-  - name: Read Group (validate that check_mode did not performed update in the cluster)
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: developers
-    register: result
-
-  - name: Assert group was found
-    assert:
-      that:
-        - result.resources | length == 1
-
-  - name: Prune using allow_groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ config_simple_tolerate_not_found }}"
-      allow_groups:
-        - developers
-      state: absent
-    register: result
-    check_mode: yes
-
-  - name: assert developers group was candidate for prune
-    assert:
-      that:
-        - result is changed
-        - result.groups | length == 1
-        - result.groups.0.metadata.name == "developers"
-
-  - name: Prune using deny_groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ config_simple_tolerate_not_found }}"
-      deny_groups:
+        version: "user.openshift.io/v1"
+        name: "{{ item }}"
+      with_items:
+        - admins
+        - engineers
         - developers
-      state: absent
-    register: result
-    check_mode: yes
-
-  - name: assert nothing found candidate for prune
-    assert:
-      that:
-        - result is not changed
-        - result.groups | length == 0
-
-  - name: Prune groups
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ config_simple_tolerate_not_found }}"
-      state: absent
-    register: result
-
-  - name: Validate result is changed
-    assert:
-      that:
-        - result is changed
-        - result.groups | length == 1
-
-  - name: Get developers group info
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: developers
-    register: result
-
-  - name: assert group was deleted
-    assert:
-      that:
-        - result.resources | length == 0
-
-  - name: Get admins group info
-    kubernetes.core.k8s_info:
-      kind: Group
-      version: "user.openshift.io/v1"
-      name: admins
-    register: result
-
-  - name: assert group was not deleted
-    assert:
-      that:
-        - result.resources | length == 1
-
-  - name: Prune groups once again (idempotency)
-    community.okd.openshift_adm_groups_sync:
-      config: "{{ config_simple_tolerate_not_found }}"
-      state: absent
-    register: result
-
-  - name: Assert nothing changed
-    assert:
-      that:
-        - result is not changed
-        - result.groups | length == 0
+
+    - name: Delete existing LDAP entries
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ item.dn }}"
+        state: absent
+      with_items: "{{ ldap_resources.users + ldap_resources.groups + ldap_resources.units | reverse | list }}"
+
+    - name: Create LDAP units
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ item.dn }}"
+        attributes: "{{ item.attr }}"
+        objectClass: "{{ item.class }}"
+      with_items: "{{ ldap_resources.units }}"
+
+    - name: Create LDAP Groups
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ item.dn }}"
+        attributes: "{{ item.attr }}"
+        objectClass: "{{ item.class }}"
+      with_items: "{{ ldap_resources.groups }}"
+
+    - name: Create LDAP users
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ item.dn }}"
+        attributes: "{{ item.attr }}"
+        objectClass: "{{ item.class }}"
+      with_items: "{{ ldap_resources.users }}"
+
+    - name: Load test configurations
+      set_fact:
+        configs: "{{ lookup('template', 'rfc2307/sync-config.j2') | from_yaml }}"
+
+    - name: Synchronize Groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ configs.simple }}"
+      check_mode: yes
+      register: result
+
+    - name: Validate Group going to be created
+      assert:
+        that:
+          - result is changed
+          - admins_group
+          - devs_group
+          - '"jane.smith@ansible.org" in {{ admins_group.users }}'
+          - '"jim.adams@ansible.org" in {{ devs_group.users }}'
+          - '"jordanbulls@ansible.org" in {{ devs_group.users }}'
+          - admins_group.users | length == 1
+          - devs_group.users | length == 2
+      vars:
+        admins_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'admins') | first }}"
+        devs_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'developers') | first }}"
+
+    - name: Synchronize Groups - User defined mapping
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ configs.user_defined }}"
+      check_mode: yes
+      register: result
+
+    - name: Validate Group going to be created
+      assert:
+        that:
+          - result is changed
+          - admins_group
+          - devs_group
+          - '"jane.smith@ansible.org" in {{ admins_group.users }}'
+          - '"jim.adams@ansible.org" in {{ devs_group.users }}'
+          - '"jordanbulls@ansible.org" in {{ devs_group.users }}'
+          - admins_group.users | length == 1
+          - devs_group.users | length == 2
+      vars:
+        admins_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'ansible-admins') | first }}"
+        devs_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'ansible-devs') | first }}"
+
+    - name: Synchronize Groups - Using dn for every query
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ configs.dn_everywhere }}"
+      check_mode: yes
+      register: result
+
+    - name: Validate Group going to be created
+      assert:
+        that:
+          - result is changed
+          - admins_group
+          - devs_group
+          - '"cn=Jane,ou=people,ou=rfc2307,{{ ldap_root }}" in {{ admins_group.users }}'
+          - '"cn=Jim,ou=people,ou=rfc2307,{{ ldap_root }}" in {{ devs_group.users }}'
+          - '"cn=Jordan,ou=people,ou=rfc2307,{{ ldap_root }}" in {{ devs_group.users }}'
+          - admins_group.users | length == 1
+          - devs_group.users | length == 2
+      vars:
+        admins_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'cn=admins,ou=groups,ou=rfc2307,' + ldap_root ) | first }}"
+        devs_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'cn=developers,ou=groups,ou=rfc2307,' + ldap_root ) | first }}"
+
+    - name: Synchronize Groups - Partially user defined mapping
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ configs.partially_user_defined }}"
+      check_mode: yes
+      register: result
+
+    - name: Validate Group going to be created
+      assert:
+        that:
+          - result is changed
+          - admins_group
+          - devs_group
+          - '"jane.smith@ansible.org" in {{ admins_group.users }}'
+          - '"jim.adams@ansible.org" in {{ devs_group.users }}'
+          - '"jordanbulls@ansible.org" in {{ devs_group.users }}'
+          - admins_group.users | length == 1
+          - devs_group.users | length == 2
+      vars:
+        admins_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'ansible-admins') | first }}"
+        devs_group: "{{ result.groups | selectattr('metadata.name', 'equalto', 'developers') | first }}"
+
+    - name: Delete Group 'engineers' if created before
+      community.okd.k8s:
+        state: absent
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: 'engineers'
+        wait: yes
+      ignore_errors: yes
+
+    - name: Synchronize Groups - Partially user defined mapping
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ configs.out_scope }}"
+      check_mode: yes
+      register: result
+      ignore_errors: yes
+
+    - name: Assert group sync failed due to non-existent member
+      assert:
+        that:
+          - result is failed
+          - result.msg.startswith("Entry not found for base='cn=Matthew,ou=people,ou=outrfc2307,{{ ldap_root }}'")
+
+    - name: Define sync configuration with tolerateMemberNotFoundErrors
+      set_fact:
+        config_out_of_scope_tolerate_not_found: "{{ configs.out_scope | combine({'rfc2307': merge_rfc2307 })}}"
+      vars:
+        merge_rfc2307: "{{ configs.out_scope.rfc2307 | combine({'tolerateMemberNotFoundErrors': 'true'}) }}"
+
+    - name: Synchronize Groups - Partially user defined mapping (tolerateMemberNotFoundErrors=true)
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ config_out_of_scope_tolerate_not_found }}"
+      check_mode: yes
+      register: result
+
+    - name: Assert group sync did not fail (tolerateMemberNotFoundErrors=true)
+      assert:
+        that:
+          - result is changed
+          - result.groups | length == 1
+          - result.groups.0.metadata.name == 'engineers'
+          - result.groups.0.users == ['Abraham']
+
+    - name: Create Group 'engineers'
+      community.okd.k8s:
+        state: present
+        wait: yes
+        definition:
+          kind: Group
+          apiVersion: "user.openshift.io/v1"
+          metadata:
+            name: engineers
+          users: []
+
+    - name: Try to sync LDAP group with Openshift existing group not created using sync should failed
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ config_out_of_scope_tolerate_not_found }}"
+      check_mode: yes
+      register: result
+      ignore_errors: yes
+
+    - name: Validate group sync failed
+      assert:
+        that:
+          - result is failed
+          - '"openshift.io/ldap.host label did not match sync host" in result.msg'
+
+    - name: Define allow_groups and deny_groups groups
+      set_fact:
+        allow_groups:
+          - "cn=developers,ou=groups,ou=rfc2307,{{ ldap_root }}"
+        deny_groups:
+          - "cn=admins,ou=groups,ou=rfc2307,{{ ldap_root }}"
+
+    - name: Synchronize Groups using allow_groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ configs.simple }}"
+        allow_groups: "{{ allow_groups }}"
+      register: result
+      check_mode: yes
+
+    - name: Validate Group going to be created
+      assert:
+        that:
+          - result is changed
+          - result.groups | length == 1
+          - result.groups.0.metadata.name == "developers"
+
+    - name: Synchronize Groups using deny_groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ configs.simple }}"
+        deny_groups: "{{ deny_groups }}"
+      register: result
+      check_mode: yes
+
+    - name: Validate Group going to be created
+      assert:
+        that:
+          - result is changed
+          - result.groups | length == 1
+          - result.groups.0.metadata.name == "developers"
+
+    - name: Synchronize groups, remove check_mode
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ configs.simple }}"
+      register: result
+
+    - name: Validate result is changed
+      assert:
+        that:
+          - result is changed
+
+    - name: Read Groups
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: admins
+      register: result
+
+    - name: Validate group was created
+      assert:
+        that:
+          - result.resources | length == 1
+          - '"jane.smith@ansible.org" in {{ result.resources.0.users }}'
+
+    - name: Read Groups
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: developers
+      register: result
+
+    - name: Validate group was created
+      assert:
+        that:
+          - result.resources | length == 1
+          - '"jim.adams@ansible.org" in {{ result.resources.0.users }}'
+          - '"jordanbulls@ansible.org" in {{ result.resources.0.users }}'
+
+    - name: Set users to delete (no admins users anymore and only 1 developer kept)
+      set_fact:
+        users_to_delete:
+          - "cn=Jane,ou=people,ou=rfc2307,{{ ldap_root }}"
+          - "cn=Jim,ou=people,ou=rfc2307,{{ ldap_root }}"
+
+    - name: Delete users from LDAP servers
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ item }}"
+        state: absent
+      with_items: "{{ users_to_delete }}"
+
+    - name: Define sync configuration with tolerateMemberNotFoundErrors
+      set_fact:
+        config_simple_tolerate_not_found: "{{ configs.simple | combine({'rfc2307': merge_rfc2307 })}}"
+      vars:
+        merge_rfc2307: "{{ configs.simple.rfc2307 | combine({'tolerateMemberNotFoundErrors': 'true'}) }}"
+
+    - name: Synchronize groups once again after users deletion
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ config_simple_tolerate_not_found }}"
+      register: result
+
+    - name: Validate result is changed
+      assert:
+        that:
+          - result is changed
+
+    - name: Read Groups
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: admins
+      register: result
+
+    - name: Validate admins group does not contains users anymore
+      assert:
+        that:
+          - result.resources | length == 1
+          - result.resources.0.users == []
+
+    - name: Read Groups
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: developers
+      register: result
+
+    - name: Validate group was created
+      assert:
+        that:
+          - result.resources | length == 1
+          - '"jordanbulls@ansible.org" in {{ result.resources.0.users }}'
+
+    - name: Set group to delete
+      set_fact:
+        groups_to_delete:
+          - "cn=developers,ou=groups,ou=rfc2307,{{ ldap_root }}"
+
+    - name: Delete Group from LDAP servers
+      openshift_ldap_entry:
+        bind_dn: "{{ ldap_bind_dn }}"
+        bind_pw: "{{ ldap_bind_pw }}"
+        server_uri: "{{ ldap_server_uri }}"
+        dn: "{{ item }}"
+        state: absent
+      with_items: "{{ groups_to_delete }}"
+
+    - name: Prune groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ config_simple_tolerate_not_found }}"
+        state: absent
+      register: result
+      check_mode: yes
+
+    - name: Validate that only developers group is candidate for Prune
+      assert:
+        that:
+          - result is changed
+          - result.groups | length == 1
+          - result.groups.0.metadata.name == "developers"
+
+    - name: Read Group (validate that check_mode did not performed update in the cluster)
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: developers
+      register: result
+
+    - name: Assert group was found
+      assert:
+        that:
+          - result.resources | length == 1
+
+    - name: Prune using allow_groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ config_simple_tolerate_not_found }}"
+        allow_groups:
+          - developers
+        state: absent
+      register: result
+      check_mode: yes
+
+    - name: assert developers group was candidate for prune
+      assert:
+        that:
+          - result is changed
+          - result.groups | length == 1
+          - result.groups.0.metadata.name == "developers"
+
+    - name: Prune using deny_groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ config_simple_tolerate_not_found }}"
+        deny_groups:
+          - developers
+        state: absent
+      register: result
+      check_mode: yes
+
+    - name: assert nothing found candidate for prune
+      assert:
+        that:
+          - result is not changed
+          - result.groups | length == 0
+
+    - name: Prune groups
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ config_simple_tolerate_not_found }}"
+        state: absent
+      register: result
+
+    - name: Validate result is changed
+      assert:
+        that:
+          - result is changed
+          - result.groups | length == 1
+
+    - name: Get developers group info
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: developers
+      register: result
+
+    - name: assert group was deleted
+      assert:
+        that:
+          - result.resources | length == 0
+
+    - name: Get admins group info
+      kubernetes.core.k8s_info:
+        kind: Group
+        version: "user.openshift.io/v1"
+        name: admins
+      register: result
+
+    - name: assert group was not deleted
+      assert:
+        that:
+          - result.resources | length == 1
+
+    - name: Prune groups once again (idempotency)
+      community.okd.openshift_adm_groups_sync:
+        config: "{{ config_simple_tolerate_not_found }}"
+        state: absent
+      register: result
+
+    - name: Assert nothing changed
+      assert:
+        that:
+          - result is not changed
+          - result.groups | length == 0
 
   always:
     - name: Delete openshift groups if existing
diff --git a/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_auth_clusterroles.yml b/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_auth_clusterroles.yml
index 4de4894e2..edf0e17c4 100644
--- a/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_auth_clusterroles.yml
+++ b/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_auth_clusterroles.yml
@@ -1,293 +1,294 @@
+---
 - block:
-  - set_fact:
-      test_sa: "clusterrole-sa"
-      test_ns: "clusterrole-ns"
-
-  - name: Ensure namespace
-    kubernetes.core.k8s:
-      kind: Namespace
-      name: "{{ test_ns }}"
-
-  - name: Get cluster information
-    kubernetes.core.k8s_cluster_info:
-    register: cluster_info
-    no_log: true
-
-  - set_fact:
-      cluster_host: "{{ cluster_info['connection']['host'] }}"
-
-  - name: Create Service account
-    kubernetes.core.k8s:
-      definition:
-        apiVersion: v1
+    - set_fact:
+        test_sa: "clusterrole-sa"
+        test_ns: "clusterrole-ns"
+
+    - name: Ensure namespace
+      kubernetes.core.k8s:
+        kind: Namespace
+        name: "{{ test_ns }}"
+
+    - name: Get cluster information
+      kubernetes.core.k8s_cluster_info:
+      register: cluster_info
+      no_log: true
+
+    - set_fact:
+        cluster_host: "{{ cluster_info['connection']['host'] }}"
+
+    - name: Create Service account
+      kubernetes.core.k8s:
+        definition:
+          apiVersion: v1
+          kind: ServiceAccount
+          metadata:
+            name: "{{ test_sa }}"
+            namespace: "{{ test_ns }}"
+
+    - name: Read Service Account
+      kubernetes.core.k8s_info:
         kind: ServiceAccount
-        metadata:
-          name: "{{ test_sa }}"
-          namespace: "{{ test_ns }}"
-
-  - name: Read Service Account
-    kubernetes.core.k8s_info:
-      kind: ServiceAccount
-      namespace: "{{ test_ns }}"
-      name: "{{ test_sa }}"
-    register: result
-
-  - set_fact:
-      secret_token: "{{ result.resources[0]['secrets'][0]['name'] }}"
-
-  - name: Get secret details
-    kubernetes.core.k8s_info:
-      kind: Secret
-      namespace: '{{ test_ns }}'
-      name: '{{ secret_token }}'
-    register: _secret
-    retries: 10
-    delay: 10
-    until:
-      - ("'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']") or ("'token' in _secret.resources[0]['data']")
-
-  - set_fact:
-      api_token: "{{ _secret.resources[0]['metadata']['annotations']['openshift.io/token-secret.value'] }}"
-    when: "'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']"
-
-  - set_fact:
-      api_token: "{{ _secret.resources[0]['data']['token'] | b64decode }}"
-    when: "'token' in _secret.resources[0]['data']"
-
-  - name: list Node should failed (forbidden user)
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Node
-    register: error
-    ignore_errors: true
-
-  - assert:
-      that:
-        - '"nodes is forbidden: User" in error.msg'
-
-  - name: list Pod for all namespace should failed
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Pod
-    register: error
-    ignore_errors: true
-
-  - assert:
-      that:
-        - '"pods is forbidden: User" in error.msg'
-
-  - name: list Pod for test namespace should failed
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Pod
-      namespace: "{{ test_ns }}"
-    register: error
-    ignore_errors: true
-
-  - assert:
-      that:
-        - '"pods is forbidden: User" in error.msg'
-
-  - set_fact:
-      test_labels:
-        phase: dev
-      cluster_roles:
-        - name: pod-manager
-          resources:
-            - pods
-          verbs:
-            - list
-          api_version_binding: "authorization.openshift.io/v1"
-        - name: node-manager
-          resources:
-            - nodes
-          verbs:
-            - list
-          api_version_binding: "rbac.authorization.k8s.io/v1"
-
-  - name: Create cluster roles
-    kubernetes.core.k8s:
-      definition:
-        kind: ClusterRole
-        apiVersion: "rbac.authorization.k8s.io/v1"
-        metadata:
-          name: "{{ item.name }}"
-          labels: "{{ test_labels }}"
-        rules:
-          - apiGroups: [""]
-            resources: "{{ item.resources }}"
-            verbs: "{{ item.verbs }}"
-    with_items: '{{ cluster_roles }}'
-
-  - name: Create Role Binding (namespaced)
-    kubernetes.core.k8s:
-      definition:
-        kind: RoleBinding
-        apiVersion: "rbac.authorization.k8s.io/v1"
-        metadata:
-          name: "{{ cluster_roles[0].name }}-binding"
-          namespace: "{{ test_ns }}"
-          labels: "{{ test_labels }}"
-        subjects:
-        - kind: ServiceAccount
-          name: "{{ test_sa }}"
-          namespace: "{{ test_ns }}"
-          apiGroup: ""
-        roleRef:
-          kind: ClusterRole
-          name: "{{ cluster_roles[0].name }}"
-          apiGroup: ""
-
-  - name: list Pod for all namespace should failed
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Pod
-    register: error
-    ignore_errors: true
-
-  - assert:
-      that:
-        - '"pods is forbidden: User" in error.msg'
-
-  - name: list Pod for test namespace should succeed
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Pod
-      namespace: "{{ test_ns }}"
-    no_log: true
-
-  - name: Create Cluster role Binding
-    kubernetes.core.k8s:
-      definition:
-        kind: ClusterRoleBinding
-        apiVersion: "{{ item.api_version_binding }}"
-        metadata:
-          name: "{{ item.name }}-binding"
-          labels: "{{ test_labels }}"
-        subjects:
-        - kind: ServiceAccount
-          name: "{{ test_sa }}"
-          namespace: "{{ test_ns }}"
-          apiGroup: ""
-        roleRef:
+        namespace: "{{ test_ns }}"
+        name: "{{ test_sa }}"
+      register: result
+
+    - set_fact:
+        secret_token: "{{ result.resources[0]['secrets'][0]['name'] }}"
+
+    - name: Get secret details
+      kubernetes.core.k8s_info:
+        kind: Secret
+        namespace: '{{ test_ns }}'
+        name: '{{ secret_token }}'
+      register: _secret
+      retries: 10
+      delay: 10
+      until:
+        - ("'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']") or ("'token' in _secret.resources[0]['data']")
+
+    - set_fact:
+        api_token: "{{ _secret.resources[0]['metadata']['annotations']['openshift.io/token-secret.value'] }}"
+      when: "'openshift.io/token-secret.value' in _secret.resources[0]['metadata']['annotations']"
+
+    - set_fact:
+        api_token: "{{ _secret.resources[0]['data']['token'] | b64decode }}"
+      when: "'token' in _secret.resources[0]['data']"
+
+    - name: list Node should failed (forbidden user)
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Node
+      register: error
+      ignore_errors: true
+
+    - assert:
+        that:
+          - '"nodes is forbidden: User" in error.msg'
+
+    - name: list Pod for all namespace should failed
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Pod
+      register: error
+      ignore_errors: true
+
+    - assert:
+        that:
+          - '"pods is forbidden: User" in error.msg'
+
+    - name: list Pod for test namespace should failed
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Pod
+        namespace: "{{ test_ns }}"
+      register: error
+      ignore_errors: true
+
+    - assert:
+        that:
+          - '"pods is forbidden: User" in error.msg'
+
+    - set_fact:
+        test_labels:
+          phase: dev
+        cluster_roles:
+          - name: pod-manager
+            resources:
+              - pods
+            verbs:
+              - list
+            api_version_binding: "authorization.openshift.io/v1"
+          - name: node-manager
+            resources:
+              - nodes
+            verbs:
+              - list
+            api_version_binding: "rbac.authorization.k8s.io/v1"
+
+    - name: Create cluster roles
+      kubernetes.core.k8s:
+        definition:
           kind: ClusterRole
-          name: "{{ item.name }}"
-          apiGroup: ""
-    with_items: "{{ cluster_roles }}"
-
-  - name: list Pod for all namespace should succeed
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Pod
-    no_log: true
-
-  - name: list Pod for test namespace should succeed
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Pod
-      namespace: "{{ test_ns }}"
-    no_log: true
-
-  - name: list Node using ServiceAccount
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Node
-      namespace: "{{ test_ns }}"
-    no_log: true
-
-  - name: Prune clusterroles (check mode)
-    community.okd.openshift_adm_prune_auth:
-      resource: clusterroles
-      label_selectors:
-        - phase=dev
-    register: check
-    check_mode: true
-
-  - name: validate clusterrole binding candidates for prune
-    assert:
-      that: 
-        - '"{{ item.name }}-binding" in check.cluster_role_binding'
-        - '"{{ test_ns }}/{{ cluster_roles[0].name }}-binding" in check.role_binding'
-    with_items: "{{ cluster_roles }}"
-
-  - name: Prune Cluster Role for managing Pod
-    community.okd.openshift_adm_prune_auth:
-      resource: clusterroles
-      name: "{{ cluster_roles[0].name }}"
-
-  - name: list Pod for all namespace should failed
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Pod
-    register: error
-    no_log: true
-    ignore_errors: true
-
-  - assert:
-      that:
-        - '"pods is forbidden: User" in error.msg'
-
-  - name: list Pod for test namespace should failed
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Pod
-      namespace: "{{ test_ns }}"
-    register: error
-    no_log: true
-    ignore_errors: true
-
-  - assert:
-      that:
-        - '"pods is forbidden: User" in error.msg'
-
-  - name: list Node using ServiceAccount
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Node
-      namespace: "{{ test_ns }}"
-    no_log: true
-
-  - name: Prune clusterroles (remaining)
-    community.okd.openshift_adm_prune_auth:
-      resource: clusterroles
-      label_selectors:
-        - phase=dev
-
-  - name: list Node using ServiceAccount should fail
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      kind: Node
-      namespace: "{{ test_ns }}"
-    register: error
-    ignore_errors: true
-
-  - assert:
-      that:
-        - '"nodes is forbidden: User" in error.msg'
+          apiVersion: "rbac.authorization.k8s.io/v1"
+          metadata:
+            name: "{{ item.name }}"
+            labels: "{{ test_labels }}"
+          rules:
+            - apiGroups: [""]
+              resources: "{{ item.resources }}"
+              verbs: "{{ item.verbs }}"
+      with_items: '{{ cluster_roles }}'
+
+    - name: Create Role Binding (namespaced)
+      kubernetes.core.k8s:
+        definition:
+          kind: RoleBinding
+          apiVersion: "rbac.authorization.k8s.io/v1"
+          metadata:
+            name: "{{ cluster_roles[0].name }}-binding"
+            namespace: "{{ test_ns }}"
+            labels: "{{ test_labels }}"
+          subjects:
+            - kind: ServiceAccount
+              name: "{{ test_sa }}"
+              namespace: "{{ test_ns }}"
+              apiGroup: ""
+          roleRef:
+            kind: ClusterRole
+            name: "{{ cluster_roles[0].name }}"
+            apiGroup: ""
+
+    - name: list Pod for all namespace should failed
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Pod
+      register: error
+      ignore_errors: true
+
+    - assert:
+        that:
+          - '"pods is forbidden: User" in error.msg'
+
+    - name: list Pod for test namespace should succeed
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Pod
+        namespace: "{{ test_ns }}"
+      no_log: true
+
+    - name: Create Cluster role Binding
+      kubernetes.core.k8s:
+        definition:
+          kind: ClusterRoleBinding
+          apiVersion: "{{ item.api_version_binding }}"
+          metadata:
+            name: "{{ item.name }}-binding"
+            labels: "{{ test_labels }}"
+          subjects:
+            - kind: ServiceAccount
+              name: "{{ test_sa }}"
+              namespace: "{{ test_ns }}"
+              apiGroup: ""
+          roleRef:
+            kind: ClusterRole
+            name: "{{ item.name }}"
+            apiGroup: ""
+      with_items: "{{ cluster_roles }}"
+
+    - name: list Pod for all namespace should succeed
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Pod
+      no_log: true
+
+    - name: list Pod for test namespace should succeed
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Pod
+        namespace: "{{ test_ns }}"
+      no_log: true
+
+    - name: list Node using ServiceAccount
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Node
+        namespace: "{{ test_ns }}"
+      no_log: true
+
+    - name: Prune clusterroles (check mode)
+      community.okd.openshift_adm_prune_auth:
+        resource: clusterroles
+        label_selectors:
+          - phase=dev
+      register: check
+      check_mode: true
+
+    - name: validate clusterrole binding candidates for prune
+      assert:
+        that:
+          - '"{{ item.name }}-binding" in check.cluster_role_binding'
+          - '"{{ test_ns }}/{{ cluster_roles[0].name }}-binding" in check.role_binding'
+      with_items: "{{ cluster_roles }}"
+
+    - name: Prune Cluster Role for managing Pod
+      community.okd.openshift_adm_prune_auth:
+        resource: clusterroles
+        name: "{{ cluster_roles[0].name }}"
+
+    - name: list Pod for all namespace should failed
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Pod
+      register: error
+      no_log: true
+      ignore_errors: true
+
+    - assert:
+        that:
+          - '"pods is forbidden: User" in error.msg'
+
+    - name: list Pod for test namespace should failed
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Pod
+        namespace: "{{ test_ns }}"
+      register: error
+      no_log: true
+      ignore_errors: true
+
+    - assert:
+        that:
+          - '"pods is forbidden: User" in error.msg'
+
+    - name: list Node using ServiceAccount
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Node
+        namespace: "{{ test_ns }}"
+      no_log: true
+
+    - name: Prune clusterroles (remaining)
+      community.okd.openshift_adm_prune_auth:
+        resource: clusterroles
+        label_selectors:
+          - phase=dev
+
+    - name: list Node using ServiceAccount should fail
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        kind: Node
+        namespace: "{{ test_ns }}"
+      register: error
+      ignore_errors: true
+
+    - assert:
+        that:
+          - '"nodes is forbidden: User" in error.msg'
 
   always:
     - name: Ensure namespace is deleted
diff --git a/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_auth_roles.yml b/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_auth_roles.yml
index 1724a1938..7b75a0cfe 100644
--- a/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_auth_roles.yml
+++ b/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_auth_roles.yml
@@ -1,335 +1,336 @@
+---
 - block:
-  - set_fact:
-      test_ns: "prune-roles"
-      sa_name: "roles-sa"
-      pod_name: "pod-prune"
-      role_definition:
-        - name: pod-list
-          labels:
-            action: list
-          verbs:
-            - list
-          role_binding:
-            api_version: rbac.authorization.k8s.io/v1
-        - name: pod-create
-          labels:
-            action: create
-          verbs:
-            - create
-            - get
-          role_binding:
-            api_version: authorization.openshift.io/v1
-        - name: pod-delete
-          labels:
-            action: delete
-          verbs:
-            - delete
-          role_binding:
-            api_version: rbac.authorization.k8s.io/v1
-
-  - name: Ensure namespace
-    kubernetes.core.k8s:
-      kind: Namespace
-      name: '{{ test_ns }}'
-
-  - name: Get cluster information
-    kubernetes.core.k8s_cluster_info:
-    register: cluster_info
-    no_log: true
-
-  - set_fact:
-      cluster_host: "{{ cluster_info['connection']['host'] }}"
-
-  - name: Create Service account
-    kubernetes.core.k8s:
-      definition:
-        apiVersion: v1
+    - set_fact:
+        test_ns: "prune-roles"
+        sa_name: "roles-sa"
+        pod_name: "pod-prune"
+        role_definition:
+          - name: pod-list
+            labels:
+              action: list
+            verbs:
+              - list
+            role_binding:
+              api_version: rbac.authorization.k8s.io/v1
+          - name: pod-create
+            labels:
+              action: create
+            verbs:
+              - create
+              - get
+            role_binding:
+              api_version: authorization.openshift.io/v1
+          - name: pod-delete
+            labels:
+              action: delete
+            verbs:
+              - delete
+            role_binding:
+              api_version: rbac.authorization.k8s.io/v1
+
+    - name: Ensure namespace
+      kubernetes.core.k8s:
+        kind: Namespace
+        name: '{{ test_ns }}'
+
+    - name: Get cluster information
+      kubernetes.core.k8s_cluster_info:
+      register: cluster_info
+      no_log: true
+
+    - set_fact:
+        cluster_host: "{{ cluster_info['connection']['host'] }}"
+
+    - name: Create Service account
+      kubernetes.core.k8s:
+        definition:
+          apiVersion: v1
+          kind: ServiceAccount
+          metadata:
+            name: '{{ sa_name }}'
+            namespace: '{{ test_ns }}'
+
+    - name: Read Service Account
+      kubernetes.core.k8s_info:
         kind: ServiceAccount
-        metadata:
-          name: '{{ sa_name }}'
-          namespace: '{{ test_ns }}'
-
-  - name: Read Service Account
-    kubernetes.core.k8s_info:
-      kind: ServiceAccount
-      namespace: '{{ test_ns }}'
-      name: '{{ sa_name }}'
-    register: sa_out
-
-  - set_fact:
-      secret_token: "{{ sa_out.resources[0]['secrets'][0]['name'] }}"
-
-  - name: Get secret details
-    kubernetes.core.k8s_info:
-      kind: Secret
-      namespace: '{{ test_ns }}'
-      name: '{{ secret_token }}'
-    register: r_secret
-    retries: 10
-    delay: 10
-    until:
-      - ("'openshift.io/token-secret.value' in r_secret.resources[0]['metadata']['annotations']") or ("'token' in r_secret.resources[0]['data']")
-
-  - set_fact:
-      api_token: "{{ r_secret.resources[0]['metadata']['annotations']['openshift.io/token-secret.value'] }}"
-    when: "'openshift.io/token-secret.value' in r_secret.resources[0]['metadata']['annotations']"
-  
-  - set_fact:
-      api_token: "{{ r_secret.resources[0]['data']['token'] | b64decode }}"
-    when: "'token' in r_secret.resources[0]['data']"
-
-  - name: list resources using service account
-    kubernetes.core.k8s_info:
-      api_key: '{{ api_token }}'
-      host: '{{ cluster_host }}'
-      validate_certs: no
-      kind: Pod
-      namespace: '{{ test_ns }}'
-    register: error
-    ignore_errors: true
-  
-  - assert:
-      that:
-        - '"pods is forbidden: User" in error.msg'
-
-  - name: Create a role to manage Pod from namespace "{{ test_ns }}"
-    kubernetes.core.k8s:
-      definition:
-        kind: Role
-        apiVersion: rbac.authorization.k8s.io/v1
-        metadata:
-          namespace: "{{ test_ns }}"
-          name: "{{ item.name }}"
-          labels: "{{ item.labels }}"
-        rules:
-          - apiGroups: [""]
-            resources: ["pods"]
-            verbs: "{{ item.verbs }}"
-    with_items: "{{ role_definition }}"
-
-  - name: Create Role Binding
-    kubernetes.core.k8s:
-      definition:
-        kind: RoleBinding
-        apiVersion: "{{ item.role_binding.api_version }}"
-        metadata:
-          name: "{{ item.name }}-bind"
-          namespace: "{{ test_ns }}"
-        subjects:
-        - kind: ServiceAccount
-          name: "{{ sa_name }}"
-          namespace: "{{ test_ns }}"
-          apiGroup: ""
-        roleRef:
+        namespace: '{{ test_ns }}'
+        name: '{{ sa_name }}'
+      register: sa_out
+
+    - set_fact:
+        secret_token: "{{ sa_out.resources[0]['secrets'][0]['name'] }}"
+
+    - name: Get secret details
+      kubernetes.core.k8s_info:
+        kind: Secret
+        namespace: '{{ test_ns }}'
+        name: '{{ secret_token }}'
+      register: r_secret
+      retries: 10
+      delay: 10
+      until:
+        - ("'openshift.io/token-secret.value' in r_secret.resources[0]['metadata']['annotations']") or ("'token' in r_secret.resources[0]['data']")
+
+    - set_fact:
+        api_token: "{{ r_secret.resources[0]['metadata']['annotations']['openshift.io/token-secret.value'] }}"
+      when: "'openshift.io/token-secret.value' in r_secret.resources[0]['metadata']['annotations']"
+
+    - set_fact:
+        api_token: "{{ r_secret.resources[0]['data']['token'] | b64decode }}"
+      when: "'token' in r_secret.resources[0]['data']"
+
+    - name: list resources using service account
+      kubernetes.core.k8s_info:
+        api_key: '{{ api_token }}'
+        host: '{{ cluster_host }}'
+        validate_certs: no
+        kind: Pod
+        namespace: '{{ test_ns }}'
+      register: error
+      ignore_errors: true
+
+    - assert:
+        that:
+          - '"pods is forbidden: User" in error.msg'
+
+    - name: Create a role to manage Pod from namespace "{{ test_ns }}"
+      kubernetes.core.k8s:
+        definition:
           kind: Role
-          name: "{{ item.name }}"
-          namespace: "{{ test_ns }}"
-          apiGroup: ""
-    with_items: "{{ role_definition }}"
-
-  - name: Create Pod should succeed
-    kubernetes.core.k8s:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      namespace: "{{ test_ns }}"
-      definition:
+          apiVersion: rbac.authorization.k8s.io/v1
+          metadata:
+            namespace: "{{ test_ns }}"
+            name: "{{ item.name }}"
+            labels: "{{ item.labels }}"
+          rules:
+            - apiGroups: [""]
+              resources: ["pods"]
+              verbs: "{{ item.verbs }}"
+      with_items: "{{ role_definition }}"
+
+    - name: Create Role Binding
+      kubernetes.core.k8s:
+        definition:
+          kind: RoleBinding
+          apiVersion: "{{ item.role_binding.api_version }}"
+          metadata:
+            name: "{{ item.name }}-bind"
+            namespace: "{{ test_ns }}"
+          subjects:
+            - kind: ServiceAccount
+              name: "{{ sa_name }}"
+              namespace: "{{ test_ns }}"
+              apiGroup: ""
+          roleRef:
+            kind: Role
+            name: "{{ item.name }}"
+            namespace: "{{ test_ns }}"
+            apiGroup: ""
+      with_items: "{{ role_definition }}"
+
+    - name: Create Pod should succeed
+      kubernetes.core.k8s:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        namespace: "{{ test_ns }}"
+        definition:
+          kind: Pod
+          metadata:
+            name: "{{ pod_name }}"
+          spec:
+            containers:
+              - name: python
+                image: python:3.7-alpine
+                command:
+                  - /bin/sh
+                  - -c
+                  - while true; do echo $(date); sleep 15; done
+                imagePullPolicy: IfNotPresent
+      register: result
+
+    - name: assert pod creation succeed
+      assert:
+        that:
+          - result is successful
+
+    - name: List Pod
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        namespace: "{{ test_ns }}"
         kind: Pod
-        metadata:
-          name: "{{ pod_name }}"
-        spec:
-          containers:
-          - name: python
-            image: python:3.7-alpine
-            command:
-            - /bin/sh
-            - -c
-            - while true; do echo $(date); sleep 15; done
-            imagePullPolicy: IfNotPresent
-    register: result
-
-  - name: assert pod creation succeed
-    assert:
-      that:
-        - result is successful
-
-  - name: List Pod
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      namespace: "{{ test_ns }}"
-      kind: Pod
-    register: result
-
-  - name: assert user is still authorize to list pods
-    assert:
-      that:
-        - result is successful
-
-  - name: Prune auth roles (check mode)
-    community.okd.openshift_adm_prune_auth:
-      resource: roles
-      namespace: "{{ test_ns }}"
-    register: check
-    check_mode: true
-
-  - name: validate that list role binding are candidates for prune
-    assert:
-      that: '"{{ test_ns }}/{{ item.name }}-bind" in check.role_binding'
-    with_items: "{{ role_definition }}"
-
-  - name: Prune resource using label_selectors option
-    community.okd.openshift_adm_prune_auth:
-      resource: roles
-      namespace: "{{ test_ns }}"
-      label_selectors:
-        - action=delete
-    register: prune
-
-  - name: assert that role binding 'delete' was pruned
-    assert:
-      that:
-        - prune is changed
-        - '"{{ test_ns }}/{{ role_definition[2].name }}-bind" in check.role_binding'
-
-  - name: assert that user could not delete pod anymore
-    kubernetes.core.k8s:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      state: absent
-      namespace: "{{ test_ns }}"
-      kind: Pod
-      name: "{{ pod_name }}"
-    register: result
-    ignore_errors: true
-
-  - name: assert pod deletion failed due to forbidden user
-    assert:
-      that:
-        - '"forbidden: User" in error.msg'
-
-  - name: List Pod
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      namespace: "{{ test_ns }}"
-      kind: Pod
-    register: result
-
-  - name: assert user is still able to list pods
-    assert:
-      that:
-        - result is successful
-  
-  - name: Create Pod should succeed
-    kubernetes.core.k8s:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      namespace: "{{ test_ns }}"
-      definition:
+      register: result
+
+    - name: assert user is still authorize to list pods
+      assert:
+        that:
+          - result is successful
+
+    - name: Prune auth roles (check mode)
+      community.okd.openshift_adm_prune_auth:
+        resource: roles
+        namespace: "{{ test_ns }}"
+      register: check
+      check_mode: true
+
+    - name: validate that list role binding are candidates for prune
+      assert:
+        that: '"{{ test_ns }}/{{ item.name }}-bind" in check.role_binding'
+      with_items: "{{ role_definition }}"
+
+    - name: Prune resource using label_selectors option
+      community.okd.openshift_adm_prune_auth:
+        resource: roles
+        namespace: "{{ test_ns }}"
+        label_selectors:
+          - action=delete
+      register: prune
+
+    - name: assert that role binding 'delete' was pruned
+      assert:
+        that:
+          - prune is changed
+          - '"{{ test_ns }}/{{ role_definition[2].name }}-bind" in check.role_binding'
+
+    - name: assert that user could not delete pod anymore
+      kubernetes.core.k8s:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        state: absent
+        namespace: "{{ test_ns }}"
         kind: Pod
-        metadata:
-          name: "{{ pod_name }}-1"
-        spec:
-          containers:
-          - name: python
-            image: python:3.7-alpine
-            command:
-            - /bin/sh
-            - -c
-            - while true; do echo $(date); sleep 15; done
-            imagePullPolicy: IfNotPresent
-    register: result
-
-  - name: assert user is still authorize to create pod
-    assert:
-      that:
-        - result is successful
-
-  - name: Prune role using name
-    community.okd.openshift_adm_prune_auth:
-      resource: roles
-      namespace: "{{ test_ns }}"
-      name: "{{ role_definition[1].name }}"
-    register: prune
-
-  - name: assert that role binding 'create' was pruned
-    assert:
-      that:
-        - prune is changed
-        - '"{{ test_ns }}/{{ role_definition[1].name }}-bind" in check.role_binding'
-
-  - name: Create Pod (should failed)
-    kubernetes.core.k8s:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      namespace: "{{ test_ns }}"
-      definition:
+        name: "{{ pod_name }}"
+      register: result
+      ignore_errors: true
+
+    - name: assert pod deletion failed due to forbidden user
+      assert:
+        that:
+          - '"forbidden: User" in error.msg'
+
+    - name: List Pod
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        namespace: "{{ test_ns }}"
         kind: Pod
-        metadata:
-          name: "{{ pod_name }}-2"
-        spec:
-          containers:
-          - name: python
-            image: python:3.7-alpine
-            command:
-            - /bin/sh
-            - -c
-            - while true; do echo $(date); sleep 15; done
-            imagePullPolicy: IfNotPresent
-    register: result
-    ignore_errors: true
-
-  - name: assert user is not authorize to create pod anymore
-    assert:
-      that:
-        - '"forbidden: User" in error.msg'
-
-  - name: List Pod
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      namespace: "{{ test_ns }}"
-      kind: Pod
-    register: result
-
-  - name: assert user is still able to list pods
-    assert:
-      that:
-        - result is successful
-
-  - name: Prune all role for namespace (neither name nor label_selectors are specified)
-    community.okd.openshift_adm_prune_auth:
-      resource: roles
-      namespace: "{{ test_ns }}"
-    register: prune
-
-  - name: assert that role binding 'list' was pruned
-    assert:
-      that:
-        - prune is changed
-        - '"{{ test_ns }}/{{ role_definition[0].name }}-bind" in check.role_binding'
-
-  - name: List Pod
-    kubernetes.core.k8s_info:
-      api_key: "{{ api_token }}"
-      host: "{{ cluster_host }}"
-      validate_certs: no
-      namespace: "{{ test_ns }}"
-      kind: Pod
-    register: result
-    ignore_errors: true
-
-  - name: assert user is not authorize to list pod anymore
-    assert:
-      that:
-        - '"forbidden: User" in error.msg'
+      register: result
+
+    - name: assert user is still able to list pods
+      assert:
+        that:
+          - result is successful
+
+    - name: Create Pod should succeed
+      kubernetes.core.k8s:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        namespace: "{{ test_ns }}"
+        definition:
+          kind: Pod
+          metadata:
+            name: "{{ pod_name }}-1"
+          spec:
+            containers:
+              - name: python
+                image: python:3.7-alpine
+                command:
+                  - /bin/sh
+                  - -c
+                  - while true; do echo $(date); sleep 15; done
+                imagePullPolicy: IfNotPresent
+      register: result
+
+    - name: assert user is still authorize to create pod
+      assert:
+        that:
+          - result is successful
+
+    - name: Prune role using name
+      community.okd.openshift_adm_prune_auth:
+        resource: roles
+        namespace: "{{ test_ns }}"
+        name: "{{ role_definition[1].name }}"
+      register: prune
+
+    - name: assert that role binding 'create' was pruned
+      assert:
+        that:
+          - prune is changed
+          - '"{{ test_ns }}/{{ role_definition[1].name }}-bind" in check.role_binding'
+
+    - name: Create Pod (should failed)
+      kubernetes.core.k8s:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        namespace: "{{ test_ns }}"
+        definition:
+          kind: Pod
+          metadata:
+            name: "{{ pod_name }}-2"
+          spec:
+            containers:
+              - name: python
+                image: python:3.7-alpine
+                command:
+                  - /bin/sh
+                  - -c
+                  - while true; do echo $(date); sleep 15; done
+                imagePullPolicy: IfNotPresent
+      register: result
+      ignore_errors: true
+
+    - name: assert user is not authorize to create pod anymore
+      assert:
+        that:
+          - '"forbidden: User" in error.msg'
+
+    - name: List Pod
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        namespace: "{{ test_ns }}"
+        kind: Pod
+      register: result
+
+    - name: assert user is still able to list pods
+      assert:
+        that:
+          - result is successful
+
+    - name: Prune all role for namespace (neither name nor label_selectors are specified)
+      community.okd.openshift_adm_prune_auth:
+        resource: roles
+        namespace: "{{ test_ns }}"
+      register: prune
+
+    - name: assert that role binding 'list' was pruned
+      assert:
+        that:
+          - prune is changed
+          - '"{{ test_ns }}/{{ role_definition[0].name }}-bind" in check.role_binding'
+
+    - name: List Pod
+      kubernetes.core.k8s_info:
+        api_key: "{{ api_token }}"
+        host: "{{ cluster_host }}"
+        validate_certs: no
+        namespace: "{{ test_ns }}"
+        kind: Pod
+      register: result
+      ignore_errors: true
+
+    - name: assert user is not authorize to list pod anymore
+      assert:
+        that:
+          - '"forbidden: User" in error.msg'
 
   always:
     - name: Ensure namespace is deleted
diff --git a/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_deployments.yml b/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_deployments.yml
index baa024188..ca48f7327 100644
--- a/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_deployments.yml
+++ b/ansible_collections/community/okd/molecule/default/tasks/openshift_adm_prune_deployments.yml
@@ -1,255 +1,255 @@
+---
 - name: Prune deployments
   block:
-  - set_fact:
-      dc_name: "hello"
-      deployment_ns: "prune-deployments"
-      deployment_ns_2: "prune-deployments-2"
-      
+    - set_fact:
+        dc_name: "hello"
+        deployment_ns: "prune-deployments"
+        deployment_ns_2: "prune-deployments-2"
 
-  - name: Ensure namespace
-    community.okd.k8s:
-      kind: Namespace
-      name: '{{ deployment_ns }}'
+    - name: Ensure namespace
+      community.okd.k8s:
+        kind: Namespace
+        name: '{{ deployment_ns }}'
 
-  - name: Create deployment config
-    community.okd.k8s:
-      namespace: '{{ deployment_ns }}'
-      definition:
-        kind: DeploymentConfig
-        apiVersion: apps.openshift.io/v1
-        metadata:
-          name: '{{ dc_name }}'
-        spec:
-          replicas: 1
-          selector:
+    - name: Create deployment config
+      community.okd.k8s:
+        namespace: '{{ deployment_ns }}'
+        definition:
+          kind: DeploymentConfig
+          apiVersion: apps.openshift.io/v1
+          metadata:
             name: '{{ dc_name }}'
-          template:
-            metadata:
-              labels:
-                name: '{{ dc_name }}'
-            spec:
-              containers:
-                - name: hello-openshift
-                  imagePullPolicy: IfNotPresent
-                  image: python:3.7-alpine
-                  command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
-      wait: yes
+          spec:
+            replicas: 1
+            selector:
+              name: '{{ dc_name }}'
+            template:
+              metadata:
+                labels:
+                  name: '{{ dc_name }}'
+              spec:
+                containers:
+                  - name: hello-openshift
+                    imagePullPolicy: IfNotPresent
+                    image: python:3.7-alpine
+                    command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
+        wait: yes
 
-  - name: prune deployments (no candidate DeploymentConfig)
-    community.okd.openshift_adm_prune_deployments:
-      namespace: "{{ deployment_ns }}"
-    register: test_prune
+    - name: prune deployments (no candidate DeploymentConfig)
+      community.okd.openshift_adm_prune_deployments:
+        namespace: "{{ deployment_ns }}"
+      register: test_prune
 
-  - assert:
-      that:
-        - test_prune is not changed
-        - test_prune.replication_controllers | length == 0
+    - assert:
+        that:
+          - test_prune is not changed
+          - test_prune.replication_controllers | length == 0
 
-  - name: Update DeploymentConfig - set replicas to 0
-    community.okd.k8s:
-      namespace: "{{ deployment_ns }}"
-      definition:
-        kind: DeploymentConfig
-        apiVersion: "apps.openshift.io/v1"
-        metadata:
-          name: "{{ dc_name }}"
-        spec:
-          replicas: 0
-          selector:
+    - name: Update DeploymentConfig - set replicas to 0
+      community.okd.k8s:
+        namespace: "{{ deployment_ns }}"
+        definition:
+          kind: DeploymentConfig
+          apiVersion: "apps.openshift.io/v1"
+          metadata:
             name: "{{ dc_name }}"
-          template:
-            metadata:
-              labels:
-                name: "{{ dc_name }}"
-            spec:
-              containers:
-                - name: hello-openshift
-                  imagePullPolicy: IfNotPresent
-                  image: python:3.7-alpine
-                  command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
-      wait: yes
+          spec:
+            replicas: 0
+            selector:
+              name: "{{ dc_name }}"
+            template:
+              metadata:
+                labels:
+                  name: "{{ dc_name }}"
+              spec:
+                containers:
+                  - name: hello-openshift
+                    imagePullPolicy: IfNotPresent
+                    image: python:3.7-alpine
+                    command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
+        wait: yes
 
-  - name: Wait for ReplicationController candidate for pruning
-    kubernetes.core.k8s_info:
-      kind: ReplicationController
-      namespace: "{{ deployment_ns }}"
-    register: result
-    retries: 10
-    delay: 30
-    until: 
-      - result.resources.0.metadata.annotations["openshift.io/deployment.phase"] in ("Failed", "Complete")
+    - name: Wait for ReplicationController candidate for pruning
+      kubernetes.core.k8s_info:
+        kind: ReplicationController
+        namespace: "{{ deployment_ns }}"
+      register: result
+      retries: 10
+      delay: 30
+      until:
+        - result.resources.0.metadata.annotations["openshift.io/deployment.phase"] in ("Failed", "Complete")
 
-  - name: Prune deployments - should delete 1 ReplicationController
-    community.okd.openshift_adm_prune_deployments:
-      namespace: "{{ deployment_ns }}"
-    check_mode: yes
-    register: test_prune
+    - name: Prune deployments - should delete 1 ReplicationController
+      community.okd.openshift_adm_prune_deployments:
+        namespace: "{{ deployment_ns }}"
+      check_mode: yes
+      register: test_prune
 
-  - name: Read ReplicationController
-    kubernetes.core.k8s_info:
-      kind: ReplicationController
-      namespace: "{{ deployment_ns }}"
-    register: replications
+    - name: Read ReplicationController
+      kubernetes.core.k8s_info:
+        kind: ReplicationController
+        namespace: "{{ deployment_ns }}"
+      register: replications
 
-  - name: Assert that Replication controller was not deleted
-    assert:
-      that:
-        - replications.resources | length == 1
-        - 'replications.resources.0.metadata.name is match("{{ dc_name }}-*")'
+    - name: Assert that Replication controller was not deleted
+      assert:
+        that:
+          - replications.resources | length == 1
+          - 'replications.resources.0.metadata.name is match("{{ dc_name }}-*")'
 
-  - name: Assure that candidate ReplicationController was found for pruning
-    assert:
-      that:
-        - test_prune is changed
-        - test_prune.replication_controllers | length == 1
-        - test_prune.replication_controllers.0.metadata.name == replications.resources.0.metadata.name
-        - test_prune.replication_controllers.0.metadata.namespace == replications.resources.0.metadata.namespace
+    - name: Assure that candidate ReplicationController was found for pruning
+      assert:
+        that:
+          - test_prune is changed
+          - test_prune.replication_controllers | length == 1
+          - test_prune.replication_controllers.0.metadata.name == replications.resources.0.metadata.name
+          - test_prune.replication_controllers.0.metadata.namespace == replications.resources.0.metadata.namespace
 
-  - name: Prune deployments - keep younger than 45min (check_mode)
-    community.okd.openshift_adm_prune_deployments:
-      keep_younger_than: 45
-      namespace: "{{ deployment_ns }}"
-    check_mode: true
-    register: keep_younger
+    - name: Prune deployments - keep younger than 45min (check_mode)
+      community.okd.openshift_adm_prune_deployments:
+        keep_younger_than: 45
+        namespace: "{{ deployment_ns }}"
+      check_mode: true
+      register: keep_younger
 
-  - name: assert no candidate was found
-    assert:
-      that:
-        - keep_younger is not changed
-        - keep_younger.replication_controllers == []
+    - name: assert no candidate was found
+      assert:
+        that:
+          - keep_younger is not changed
+          - keep_younger.replication_controllers == []
 
-  - name: Ensure second namespace is created
-    community.okd.k8s:
-      kind: Namespace
-      name: '{{ deployment_ns_2 }}'
+    - name: Ensure second namespace is created
+      community.okd.k8s:
+        kind: Namespace
+        name: '{{ deployment_ns_2 }}'
 
-  - name: Create deployment config from 2nd namespace
-    community.okd.k8s:
-      namespace: '{{ deployment_ns_2 }}'
-      definition:
-        kind: DeploymentConfig
-        apiVersion: apps.openshift.io/v1
-        metadata:
-          name: '{{ dc_name }}2'
-        spec:
-          replicas: 1
-          selector:
+    - name: Create deployment config from 2nd namespace
+      community.okd.k8s:
+        namespace: '{{ deployment_ns_2 }}'
+        definition:
+          kind: DeploymentConfig
+          apiVersion: apps.openshift.io/v1
+          metadata:
             name: '{{ dc_name }}2'
-          template:
-            metadata:
-              labels:
-                name: '{{ dc_name }}2'
-            spec:
-              containers:
-                - name: hello-openshift
-                  imagePullPolicy: IfNotPresent
-                  image: python:3.7-alpine
-                  command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
-      wait: yes
+          spec:
+            replicas: 1
+            selector:
+              name: '{{ dc_name }}2'
+            template:
+              metadata:
+                labels:
+                  name: '{{ dc_name }}2'
+              spec:
+                containers:
+                  - name: hello-openshift
+                    imagePullPolicy: IfNotPresent
+                    image: python:3.7-alpine
+                    command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
+        wait: yes
 
-  - name: Stop deployment config - replicas = 0
-    community.okd.k8s:
-      namespace: '{{ deployment_ns_2 }}'
-      definition:
-        kind: DeploymentConfig
-        apiVersion: apps.openshift.io/v1
-        metadata:
-          name: '{{ dc_name }}2'
-        spec:
-          replicas: 0
-          selector:
+    - name: Stop deployment config - replicas = 0
+      community.okd.k8s:
+        namespace: '{{ deployment_ns_2 }}'
+        definition:
+          kind: DeploymentConfig
+          apiVersion: apps.openshift.io/v1
+          metadata:
             name: '{{ dc_name }}2'
-          template:
-            metadata:
-              labels:
-                name: '{{ dc_name }}2'
-            spec:
-              containers:
-                - name: hello-openshift
-                  imagePullPolicy: IfNotPresent
-                  image: python:3.7-alpine
-                  command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
-      wait: yes
+          spec:
+            replicas: 0
+            selector:
+              name: '{{ dc_name }}2'
+            template:
+              metadata:
+                labels:
+                  name: '{{ dc_name }}2'
+              spec:
+                containers:
+                  - name: hello-openshift
+                    imagePullPolicy: IfNotPresent
+                    image: python:3.7-alpine
+                    command: [ "/bin/sh", "-c", "while true;do date;sleep 2s; done"]
+        wait: yes
+
+    - name: Wait for ReplicationController candidate for pruning
+      kubernetes.core.k8s_info:
+        kind: ReplicationController
+        namespace: "{{ deployment_ns_2 }}"
+      register: result
+      retries: 10
+      delay: 30
+      until:
+        - result.resources.0.metadata.annotations["openshift.io/deployment.phase"] in ("Failed", "Complete")
 
-  - name: Wait for ReplicationController candidate for pruning
-    kubernetes.core.k8s_info:
-      kind: ReplicationController
-      namespace: "{{ deployment_ns_2 }}"
-    register: result
-    retries: 10
-    delay: 30
-    until: 
-      - result.resources.0.metadata.annotations["openshift.io/deployment.phase"] in ("Failed", "Complete")
+    # Prune from one namespace should not have any effect on others namespaces
+    - name: Prune deployments from 2nd namespace
+      community.okd.openshift_adm_prune_deployments:
+        namespace: "{{ deployment_ns_2 }}"
+      check_mode: yes
+      register: test_prune
 
-  # Prune from one namespace should not have any effect on others namespaces
-  - name: Prune deployments from 2nd namespace
-    community.okd.openshift_adm_prune_deployments:
-      namespace: "{{ deployment_ns_2 }}"
-    check_mode: yes
-    register: test_prune
+    - name: Assure that candidate ReplicationController was found for pruning
+      assert:
+        that:
+          - test_prune is changed
+          - test_prune.replication_controllers | length == 1
+          - "test_prune.replication_controllers.0.metadata.namespace == deployment_ns_2"
 
-  - name: Assure that candidate ReplicationController was found for pruning
-    assert:
-      that:
-        - test_prune is changed
-        - test_prune.replication_controllers | length == 1
-        - "test_prune.replication_controllers.0.metadata.namespace == deployment_ns_2"
+    # Prune without namespace option
+    - name: Prune from all namespace should update more deployments
+      community.okd.openshift_adm_prune_deployments:
+      check_mode: yes
+      register: no_namespace_prune
 
-  # Prune without namespace option
-  - name: Prune from all namespace should update more deployments
-    community.okd.openshift_adm_prune_deployments:
-    check_mode: yes
-    register: no_namespace_prune
+    - name: Assure multiple ReplicationController were found for pruning
+      assert:
+        that:
+          - no_namespace_prune is changed
+          - no_namespace_prune.replication_controllers | length == 2
 
-  - name: Assure multiple ReplicationController were found for pruning
-    assert:
-      that:
-        - no_namespace_prune is changed
-        - no_namespace_prune.replication_controllers | length == 2
-  
-  # Execute Prune from 2nd namespace
-  - name: Read ReplicationController before Prune operation
-    kubernetes.core.k8s_info:
-      kind: ReplicationController
-      namespace: "{{ deployment_ns_2 }}"
-    register: replications
+    # Execute Prune from 2nd namespace
+    - name: Read ReplicationController before Prune operation
+      kubernetes.core.k8s_info:
+        kind: ReplicationController
+        namespace: "{{ deployment_ns_2 }}"
+      register: replications
 
-  - assert:
-      that:
-        - replications.resources | length == 1
+    - assert:
+        that:
+          - replications.resources | length == 1
 
-  - name: Prune DeploymentConfig from 2nd namespace
-    community.okd.openshift_adm_prune_deployments:
-      namespace: "{{ deployment_ns_2 }}"
-    register: _prune
+    - name: Prune DeploymentConfig from 2nd namespace
+      community.okd.openshift_adm_prune_deployments:
+        namespace: "{{ deployment_ns_2 }}"
+      register: _prune
 
-  - name: Assert DeploymentConfig was deleted
-    assert:
-      that:
-        - _prune is changed
-        - _prune.replication_controllers | length == 1
-        - _prune.replication_controllers.0.details.name == replications.resources.0.metadata.name
+    - name: Assert DeploymentConfig was deleted
+      assert:
+        that:
+          - _prune is changed
+          - _prune.replication_controllers | length == 1
+          - _prune.replication_controllers.0.details.name == replications.resources.0.metadata.name
 
-  # Execute Prune without namespace option
-  - name: Read ReplicationController before Prune operation
-    kubernetes.core.k8s_info:
-      kind: ReplicationController
-      namespace: "{{ deployment_ns }}"
-    register: replications
+    # Execute Prune without namespace option
+    - name: Read ReplicationController before Prune operation
+      kubernetes.core.k8s_info:
+        kind: ReplicationController
+        namespace: "{{ deployment_ns }}"
+      register: replications
 
-  - assert:
-      that:
-        - replications.resources | length == 1
+    - assert:
+        that:
+          - replications.resources | length == 1
 
-  - name: Prune from all namespace should update more deployments
-    community.okd.openshift_adm_prune_deployments:
-    register: _prune
+    - name: Prune from all namespace should update more deployments
+      community.okd.openshift_adm_prune_deployments:
+      register: _prune
 
-  - name: Assure multiple ReplicationController were found for pruning
-    assert:
-      that:
-        - _prune is changed
-        - _prune.replication_controllers | length > 0
+    - name: Assure multiple ReplicationController were found for pruning
+      assert:
+        that:
+          - _prune is changed
+          - _prune.replication_controllers | length > 0
 
   always:
     - name: Delete 1st namespace
diff --git a/ansible_collections/community/okd/molecule/default/tasks/openshift_builds.yml b/ansible_collections/community/okd/molecule/default/tasks/openshift_builds.yml
index b564f8bcd..2acbac45e 100644
--- a/ansible_collections/community/okd/molecule/default/tasks/openshift_builds.yml
+++ b/ansible_collections/community/okd/molecule/default/tasks/openshift_builds.yml
@@ -1,240 +1,245 @@
+---
 - block:
-  - set_fact:
-      build_ns: "builds"
-      build_config: "start-build"
-      is_name: "ruby"
-      prune_build: "prune-build"
-
-  - name: Ensure namespace
-    kubernetes.core.k8s:
-      kind: Namespace
-      name: "{{ build_ns }}"
-
-  - name: Create ImageStream
-    community.okd.k8s:
-      namespace: "{{ build_ns }}"
-      definition:
-        apiVersion: image.openshift.io/v1
-        kind: ImageStream
-        metadata:
-          name: "{{ is_name }}"
-        spec:
-          lookupPolicy:
-            local: false
-          tags: []
-
-  - name: Create build configuration
-    community.okd.k8s:
-      namespace: "{{ build_ns }}"
-      definition:
-        kind: BuildConfig
-        apiVersion: build.openshift.io/v1
-        metadata:
-          name: "{{ build_config }}"
-        spec:
-          source:
-            dockerfile: |
-              FROM openshift/ruby-22-centos7
-              RUN sleep 60s
-              USER ansible
-          strategy:
-            type: Docker
-          output: 
-            to:
-              kind: "ImageStreamTag"
-              name: "{{ is_name }}:latest"
-
-  - name: Start Build from Build configuration
-    community.okd.openshift_build:
-      namespace: "{{ build_ns }}"
-      build_config_name: "{{ build_config }}"
-    register: new_build
-
-  - name: Assert that a build has been created
-    assert:
-      that:
-        - new_build is changed
-        - new_build.builds.0.metadata.name == "{{ build_config }}-1"
-
-  - name: Start a new Build from previous Build
-    community.okd.openshift_build:
-      namespace: "{{ build_ns }}"
-      build_name: "{{ new_build.builds.0.metadata.name }}"
-    register: rerun_build
-
-  - name: Assert that another build has been created
-    assert:
-      that:
-        - rerun_build is changed
-        - rerun_build.builds.0.metadata.name == "{{ build_config }}-2"
-
-  - name: Cancel first build created
-    community.okd.openshift_build:
-      namespace: "{{ build_ns }}"
-      build_name: "{{ build_config }}-1"
-      state: cancelled
-      wait: yes
-    register: cancel
-
-  - name: Assert that the Build was cancelled
-    assert:
-      that:
-        - cancel is changed
-        - cancel.builds | length == 1
-        - cancel.builds.0.metadata.name == "{{ build_config }}-1"
-        - cancel.builds.0.metadata.namespace == "{{ build_ns }}"
-        - cancel.builds.0.status.cancelled
-
-  - name: Get Build info
-    kubernetes.core.k8s_info:
-      version: build.openshift.io/v1
-      kind: Build
-      namespace: "{{ build_ns }}"
-      name: "{{ cancel.builds.0.metadata.name }}"
-    register: build
-
-  - name: Assert that build phase is cancelled
-    assert:
-      that:
-        - build.resources | length == 1
-        - build.resources.0.status.cancelled
-        - build.resources.0.status.phase == 'Cancelled'
-
-  - name: Cancel and restart Build using build config name
-    community.okd.openshift_build:
-      namespace: "{{ build_ns }}"
-      build_config_name: "{{ build_config }}"
-      state: restarted
-      build_phases:
-        - Running
-        - New
-    register: restart
-
-  - name: assert that new build was created
-    assert:
-      that:
-      - restart is changed
-      - restart.builds | length == 1
-      - 'restart.builds.0.metadata.name == "{{ build_config }}-3"'
-  
-  - name: Get Build 2 info
-    kubernetes.core.k8s_info:
-      version: build.openshift.io/v1
-      kind: Build
-      namespace: "{{ build_ns }}"
-      name: "{{ build_config }}-2"
-    register: build
-
-  - name: Assert that build phase is cancelled
-    assert:
-      that:
-        - build.resources | length == 1
-        - build.resources.0.status.cancelled
-        - build.resources.0.status.phase == 'Cancelled'
-
-  - name: Get Build info
-    kubernetes.core.k8s_info:
-      version: build.openshift.io/v1
-      kind: Build
-      namespace: "{{ build_ns }}"
-      name: "{{ build_config }}-3"
-    register: build
-
-  - name: Assert that Build is not cancelled
-    assert:
-      that:
-        - build.resources | length == 1
-        - '"cancelled" not in build.resources.0.status'
-        - "build.resources.0.status.phase in ('New', 'Pending', 'Running')"
-
-  - name: Prune Builds keep younger than 30min
-    community.okd.openshift_adm_prune_builds:
-      keep_younger_than: 30
-      namespace: "{{ build_ns }}"
-    register: prune
-    check_mode: yes
-
-  - name: Assert that no Builds were found
-    assert:
-      that:
-        - not prune.changed
-        - prune.builds | length == 0
-
-  - name: Prune Builds without namespace
-    community.okd.openshift_adm_prune_builds:
-    register: prune_without_ns
-    check_mode: yes
-
-  - name: Assert that completed build are candidate for prune
-    assert:
-      that:
-        - prune_without_ns is changed
-        - prune_without_ns.builds | length > 0
-        - '"{{ build_config }}-1" in build_names'
-        - '"{{ build_config }}-2" in build_names'
-    vars:
-      build_names: '{{ prune_without_ns.builds | map(attribute="metadata") | flatten | map(attribute="name") | list }}'
-
-  - name: Prune Builds using namespace
-    community.okd.openshift_adm_prune_builds:
-      namespace: "{{ build_ns }}"
-    register: prune_with_ns
-    check_mode: yes
-
-  - name: Assert that prune operation found the completed build
-    assert:
-      that:
-        - prune_with_ns is changed
-        - prune_with_ns.builds | length == 2
-
-  - name: Check Build before prune
-    kubernetes.core.k8s_info:
-      kind: Build
-      api_version: build.openshift.io/v1
-      name: "{{ build_config }}-1"
-      namespace: "{{ build_ns }}"
-    register: resource
-
-  - name: Validate that any previous build operation executed with check_mode did not deleted the build
-    assert:
-      that:
-        - resource.resources | length == 1
-
-  - name: Execute prune operation
-    community.okd.openshift_adm_prune_builds:
-      namespace: "{{ build_ns }}"
-    register: prune
-
-  - name: assert prune is changed
-    assert:
-      that:
-        - prune is changed
-
-  - name: Check Build
-    kubernetes.core.k8s_info:
-      kind: Build
-      api_version: build.openshift.io/v1
-      name: "{{ build_config }}-1"
-      namespace: "{{ build_ns }}"
-    register: resource
-
-  - name: Assert that the Build does not exist anymore
-    assert:
-      that:
-        - resource.resources | length == 0
-
-  - name: Check Build
-    kubernetes.core.k8s_info:
-      kind: Build
-      api_version: build.openshift.io/v1
-      name: "{{ build_config }}-2"
-      namespace: "{{ build_ns }}"
-    register: resource
-
-  - name: Assert that the Build does not exist anymore
-    assert:
-      that:
-        - resource.resources | length == 0
+    - set_fact:
+        build_ns: "builds"
+        build_config: "start-build"
+        is_name: "ruby"
+        prune_build: "prune-build"
+
+    - name: Ensure namespace
+      kubernetes.core.k8s:
+        kind: Namespace
+        name: "{{ build_ns }}"
+
+    - name: Create ImageStream
+      community.okd.k8s:
+        namespace: "{{ build_ns }}"
+        definition:
+          apiVersion: image.openshift.io/v1
+          kind: ImageStream
+          metadata:
+            name: "{{ is_name }}"
+          spec:
+            lookupPolicy:
+              local: false
+            tags: []
+
+    - name: Create build configuration
+      community.okd.k8s:
+        namespace: "{{ build_ns }}"
+        definition:
+          kind: BuildConfig
+          apiVersion: build.openshift.io/v1
+          metadata:
+            name: "{{ build_config }}"
+          spec:
+            source:
+              dockerfile: |
+                FROM openshift/ruby-22-centos7
+                RUN sleep 60s
+                USER ansible
+            strategy:
+              type: Docker
+            output:
+              to:
+                kind: "ImageStreamTag"
+                name: "{{ is_name }}:latest"
+
+    - name: Start Build from Build configuration
+      community.okd.openshift_build:
+        namespace: "{{ build_ns }}"
+        build_config_name: "{{ build_config }}"
+      register: new_build
+
+    - name: Assert that a build has been created
+      assert:
+        that:
+          - new_build is changed
+          - new_build.builds.0.metadata.name == "{{ build_config }}-1"
+
+    - name: Start a new Build from previous Build
+      community.okd.openshift_build:
+        namespace: "{{ build_ns }}"
+        build_name: "{{ new_build.builds.0.metadata.name }}"
+      register: rerun_build
+
+    - name: Assert that another build has been created
+      assert:
+        that:
+          - rerun_build is changed
+          - rerun_build.builds.0.metadata.name == "{{ build_config }}-2"
+
+    - name: Cancel first build created
+      community.okd.openshift_build:
+        namespace: "{{ build_ns }}"
+        build_name: "{{ build_config }}-1"
+        state: cancelled
+        wait: yes
+      register: cancel
+
+    - name: Assert that the Build was cancelled
+      assert:
+        that:
+          - cancel is changed
+          - cancel.builds | length == 1
+          - cancel.builds.0.metadata.name == "{{ build_config }}-1"
+          - cancel.builds.0.metadata.namespace == "{{ build_ns }}"
+          - '"cancelled" in cancel.builds.0.status'
+          - cancel.builds.0.status.cancelled
+
+    - name: Get info for 1st Build
+      kubernetes.core.k8s_info:
+        version: build.openshift.io/v1
+        kind: Build
+        namespace: "{{ build_ns }}"
+        name: "{{ cancel.builds.0.metadata.name }}"
+      register: build
+
+    - name: Assert that build phase is cancelled
+      assert:
+        that:
+          - build.resources | length == 1
+          - '"cancelled" in build.resources.0.status'
+          - build.resources.0.status.cancelled
+          - build.resources.0.status.phase == 'Cancelled'
+
+    - name: Cancel and restart Build using build config name
+      community.okd.openshift_build:
+        namespace: "{{ build_ns }}"
+        build_config_name: "{{ build_config }}"
+        state: restarted
+        build_phases:
+          - Pending
+          - Running
+          - New
+      register: restart
+
+    - name: assert that new build was created
+      assert:
+        that:
+          - restart is changed
+          - restart.builds | length == 1
+          - 'restart.builds.0.metadata.name == "{{ build_config }}-3"'
+
+    - name: Get info for 2nd Build
+      kubernetes.core.k8s_info:
+        version: build.openshift.io/v1
+        kind: Build
+        namespace: "{{ build_ns }}"
+        name: "{{ build_config }}-2"
+      register: build
+
+    - name: Assert that build phase is cancelled
+      assert:
+        that:
+          - build.resources | length == 1
+          - '"cancelled" in build.resources.0.status'
+          - build.resources.0.status.cancelled
+          - build.resources.0.status.phase == 'Cancelled'
+
+    - name: Get info for 3rd build
+      kubernetes.core.k8s_info:
+        version: build.openshift.io/v1
+        kind: Build
+        namespace: "{{ build_ns }}"
+        name: "{{ build_config }}-3"
+      register: build
+
+    - name: Assert that Build is not cancelled
+      assert:
+        that:
+          - build.resources | length == 1
+          - '"cancelled" not in build.resources.0.status'
+          - "build.resources.0.status.phase in ('New', 'Pending', 'Running')"
+
+    - name: Prune Builds keep younger than 30min
+      community.okd.openshift_adm_prune_builds:
+        keep_younger_than: 30
+        namespace: "{{ build_ns }}"
+      register: prune
+      check_mode: yes
+
+    - name: Assert that no Builds were found
+      assert:
+        that:
+          - not prune.changed
+          - prune.builds | length == 0
+
+    - name: Prune Builds without namespace
+      community.okd.openshift_adm_prune_builds:
+      register: prune_without_ns
+      check_mode: yes
+
+    - name: Assert that completed build are candidate for prune
+      assert:
+        that:
+          - prune_without_ns is changed
+          - prune_without_ns.builds | length > 0
+          - '"{{ build_config }}-1" in build_names'
+          - '"{{ build_config }}-2" in build_names'
+      vars:
+        build_names: '{{ prune_without_ns.builds | map(attribute="metadata") | flatten | map(attribute="name") | list }}'
+
+    - name: Prune Builds using namespace
+      community.okd.openshift_adm_prune_builds:
+        namespace: "{{ build_ns }}"
+      register: prune_with_ns
+      check_mode: yes
+
+    - name: Assert that prune operation found the completed build
+      assert:
+        that:
+          - prune_with_ns is changed
+          - prune_with_ns.builds | length == 2
+
+    - name: Check Build before prune
+      kubernetes.core.k8s_info:
+        kind: Build
+        api_version: build.openshift.io/v1
+        name: "{{ build_config }}-1"
+        namespace: "{{ build_ns }}"
+      register: resource
+
+    - name: Validate that any previous build operation executed with check_mode did not deleted the build
+      assert:
+        that:
+          - resource.resources | length == 1
+
+    - name: Execute prune operation
+      community.okd.openshift_adm_prune_builds:
+        namespace: "{{ build_ns }}"
+      register: prune
+
+    - name: assert prune is changed
+      assert:
+        that:
+          - prune is changed
+
+    - name: Check Build
+      kubernetes.core.k8s_info:
+        kind: Build
+        api_version: build.openshift.io/v1
+        name: "{{ build_config }}-1"
+        namespace: "{{ build_ns }}"
+      register: resource
+
+    - name: Assert that the Build does not exist anymore
+      assert:
+        that:
+          - resource.resources | length == 0
+
+    - name: Check Build
+      kubernetes.core.k8s_info:
+        kind: Build
+        api_version: build.openshift.io/v1
+        name: "{{ build_config }}-2"
+        namespace: "{{ build_ns }}"
+      register: resource
+
+    - name: Assert that the Build does not exist anymore
+      assert:
+        that:
+          - resource.resources | length == 0
 
   always:
     - name: Ensure namespace is deleted
diff --git a/ansible_collections/community/okd/molecule/default/tasks/openshift_import_images.yml b/ansible_collections/community/okd/molecule/default/tasks/openshift_import_images.yml
index 04392bb26..76c49f0a1 100644
--- a/ansible_collections/community/okd/molecule/default/tasks/openshift_import_images.yml
+++ b/ansible_collections/community/okd/molecule/default/tasks/openshift_import_images.yml
@@ -1,174 +1,175 @@
+---
 - name: Openshift import image testing
   block:
 
-  - set_fact:
-      test_ns: "import-images"
-
-  - name: Ensure namespace
-    community.okd.k8s:
-      kind: Namespace
-      name: '{{ test_ns }}'
-
-  - name: Import image using tag (should import latest tag only)
-    community.okd.openshift_import_image:
-      namespace: "{{ test_ns }}"
-      name: "ansible/awx"
-    check_mode: yes
-    register: import_tag
-
-  - name: Assert only latest was imported
-    assert:
-      that:
-        - import_tag is changed
-        - import_tag.result | length == 1
-        - import_tag.result.0.spec.import
-        - import_tag.result.0.spec.images.0.from.kind == "DockerImage"
-        - import_tag.result.0.spec.images.0.from.name == "ansible/awx"
-
-  - name: check image stream
-    kubernetes.core.k8s_info:
-      kind: ImageStream
-      namespace: "{{ test_ns }}"
-      name: awx
-    register: resource
-
-  - name: assert that image stream is not created when using check_mode=yes
-    assert:
-      that:
-        - resource.resources == []
-
-  - name: Import image using tag (should import latest tag only)
-    community.okd.openshift_import_image:
-      namespace: "{{ test_ns }}"
-      name: "ansible/awx"
-    register: import_tag
-
-  - name: Assert only latest was imported
-    assert:
-      that:
-        - import_tag is changed
-
-  - name: check image stream
-    kubernetes.core.k8s_info:
-      kind: ImageStream
-      namespace: "{{ test_ns }}"
-      name: awx
-    register: resource
-
-  - name: assert that image stream contains only tag latest
-    assert:
-      that:
-        - resource.resources | length == 1
-        - resource.resources.0.status.tags.0.tag == 'latest'
-  
-  - name: Import once again the latest tag
-    community.okd.openshift_import_image:
-      namespace: "{{ test_ns }}"
-      name: "ansible/awx"
-    register: import_tag
-
-  - name: assert change was performed
-    assert:
-      that:
-        - import_tag is changed
-
-  - name: check image stream
-    kubernetes.core.k8s_info:
-      kind: ImageStream
-      version: image.openshift.io/v1
-      namespace: "{{ test_ns }}"
-      name: awx
-    register: resource
-
-  - name: assert that image stream still contains unique tag
-    assert:
-      that:
-        - resource.resources | length == 1
-        - resource.resources.0.status.tags.0.tag == 'latest'
-
-  - name: Import another tags
-    community.okd.openshift_import_image:
-      namespace: "{{ test_ns }}"
-      name: "ansible/awx:17.1.0"
-    register: import_another_tag
-    ignore_errors: yes
-
-  - name: assert that another tag was imported
-    assert:
-      that:
-        - import_another_tag is failed
-        - '"the tag 17.1.0 does not exist on the image stream" in import_another_tag.msg'
-
-  - name: Create simple ImageStream (without docker external container)
-    community.okd.k8s:
-      namespace: "{{ test_ns }}"
-      name: "local-is"
-      definition:
-        apiVersion: image.openshift.io/v1
+    - set_fact:
+        test_ns: "import-images"
+
+    - name: Ensure namespace
+      community.okd.k8s:
+        kind: Namespace
+        name: '{{ test_ns }}'
+
+    - name: Import image using tag (should import latest tag only)
+      community.okd.openshift_import_image:
+        namespace: "{{ test_ns }}"
+        name: "ansible/awx"
+      check_mode: yes
+      register: import_tag
+
+    - name: Assert only latest was imported
+      assert:
+        that:
+          - import_tag is changed
+          - import_tag.result | length == 1
+          - import_tag.result.0.spec.import
+          - import_tag.result.0.spec.images.0.from.kind == "DockerImage"
+          - import_tag.result.0.spec.images.0.from.name == "ansible/awx"
+
+    - name: check image stream
+      kubernetes.core.k8s_info:
+        kind: ImageStream
+        namespace: "{{ test_ns }}"
+        name: awx
+      register: resource
+
+    - name: assert that image stream is not created when using check_mode=yes
+      assert:
+        that:
+          - resource.resources == []
+
+    - name: Import image using tag (should import latest tag only)
+      community.okd.openshift_import_image:
+        namespace: "{{ test_ns }}"
+        name: "ansible/awx"
+      register: import_tag
+
+    - name: Assert only latest was imported
+      assert:
+        that:
+          - import_tag is changed
+
+    - name: check image stream
+      kubernetes.core.k8s_info:
+        kind: ImageStream
+        namespace: "{{ test_ns }}"
+        name: awx
+      register: resource
+
+    - name: assert that image stream contains only tag latest
+      assert:
+        that:
+          - resource.resources | length == 1
+          - resource.resources.0.status.tags.0.tag == 'latest'
+
+    - name: Import once again the latest tag
+      community.okd.openshift_import_image:
+        namespace: "{{ test_ns }}"
+        name: "ansible/awx"
+      register: import_tag
+
+    - name: assert change was performed
+      assert:
+        that:
+          - import_tag is changed
+
+    - name: check image stream
+      kubernetes.core.k8s_info:
+        kind: ImageStream
+        version: image.openshift.io/v1
+        namespace: "{{ test_ns }}"
+        name: awx
+      register: resource
+
+    - name: assert that image stream still contains unique tag
+      assert:
+        that:
+          - resource.resources | length == 1
+          - resource.resources.0.status.tags.0.tag == 'latest'
+
+    - name: Import another tags
+      community.okd.openshift_import_image:
+        namespace: "{{ test_ns }}"
+        name: "ansible/awx:17.1.0"
+      register: import_another_tag
+      ignore_errors: yes
+
+    - name: assert that another tag was imported
+      assert:
+        that:
+          - import_another_tag is failed
+          - '"the tag 17.1.0 does not exist on the image stream" in import_another_tag.msg'
+
+    - name: Create simple ImageStream (without docker external container)
+      community.okd.k8s:
+        namespace: "{{ test_ns }}"
+        name: "local-is"
+        definition:
+          apiVersion: image.openshift.io/v1
+          kind: ImageStream
+          spec:
+            lookupPolicy:
+              local: false
+            tags: []
+
+    - name: Import all tag for image stream not pointing on external container image should failed
+      community.okd.openshift_import_image:
+        namespace: "{{ test_ns }}"
+        name: "local-is"
+        all: true
+      register: error_tag
+      ignore_errors: true
+      check_mode: yes
+
+    - name: Assert module cannot import from non-existing tag from ImageStream
+      assert:
+        that:
+          - error_tag is failed
+          - 'error_tag.msg == "image stream {{ test_ns }}/local-is does not have tags pointing to external container images"'
+
+    - name: import all tags for container image ibmcom/pause and specific tag for redhat/ubi8-micro
+      community.okd.openshift_import_image:
+        namespace: "{{ test_ns }}"
+        name:
+          - "ibmcom/pause"
+          - "redhat/ubi8-micro:8.5-437"
+        all: true
+      register: multiple_import
+
+    - name: Assert that import succeed
+      assert:
+        that:
+          - multiple_import is changed
+          - multiple_import.result | length == 2
+
+    - name: Read ibmcom/pause ImageStream
+      kubernetes.core.k8s_info:
+        version: image.openshift.io/v1
+        kind: ImageStream
+        namespace: "{{ test_ns }}"
+        name: pause
+      register: pause
+
+    - name: assert that ibmcom/pause has multiple tags
+      assert:
+        that:
+          - pause.resources | length == 1
+          - pause.resources.0.status.tags | length > 1
+
+    - name: Read redhat/ubi8-micro ImageStream
+      kubernetes.core.k8s_info:
+        version: image.openshift.io/v1
         kind: ImageStream
-        spec:
-          lookupPolicy:
-            local: false
-          tags: []
-
-  - name: Import all tag for image stream not pointing on external container image should failed
-    community.okd.openshift_import_image:
-      namespace: "{{ test_ns }}"
-      name: "local-is"
-      all: true
-    register: error_tag
-    ignore_errors: true
-    check_mode: yes
-
-  - name: Assert module cannot import from non-existing tag from ImageStream
-    assert:
-      that:
-        - error_tag is failed
-        - 'error_tag.msg == "image stream {{ test_ns }}/local-is does not have tags pointing to external container images"'
-
-  - name: import all tags for container image ibmcom/pause and specific tag for redhat/ubi8-micro
-    community.okd.openshift_import_image:
-      namespace: "{{ test_ns }}"
-      name:
-        - "ibmcom/pause"
-        - "redhat/ubi8-micro:8.5-437"
-      all: true
-    register: multiple_import
-
-  - name: Assert that import succeed
-    assert:
-      that:
-        - multiple_import is changed
-        - multiple_import.result | length == 2
-
-  - name: Read ibmcom/pause ImageStream
-    kubernetes.core.k8s_info:
-      version: image.openshift.io/v1
-      kind: ImageStream
-      namespace: "{{ test_ns }}"
-      name: pause
-    register: pause
-
-  - name: assert that ibmcom/pause has multiple tags
-    assert:
-      that:
-        - pause.resources | length == 1
-        - pause.resources.0.status.tags | length > 1
-
-  - name: Read redhat/ubi8-micro ImageStream
-    kubernetes.core.k8s_info:
-      version: image.openshift.io/v1
-      kind: ImageStream
-      namespace: "{{ test_ns }}"
-      name: ubi8-micro
-    register: resource
-
-  - name: assert that redhat/ubi8-micro has only one tag
-    assert:
-      that:
-        - resource.resources | length == 1
-        - resource.resources.0.status.tags | length == 1
-        - 'resource.resources.0.status.tags.0.tag == "8.5-437"'
+        namespace: "{{ test_ns }}"
+        name: ubi8-micro
+      register: resource
+
+    - name: assert that redhat/ubi8-micro has only one tag
+      assert:
+        that:
+          - resource.resources | length == 1
+          - resource.resources.0.status.tags | length == 1
+          - 'resource.resources.0.status.tags.0.tag == "8.5-437"'
 
   always:
     - name: Delete testing namespace
diff --git a/ansible_collections/community/okd/molecule/default/tasks/openshift_prune_images.yml b/ansible_collections/community/okd/molecule/default/tasks/openshift_prune_images.yml
index 86630da69..1748522ec 100644
--- a/ansible_collections/community/okd/molecule/default/tasks/openshift_prune_images.yml
+++ b/ansible_collections/community/okd/molecule/default/tasks/openshift_prune_images.yml
@@ -38,12 +38,12 @@
             name: "{{ pod_name }}"
           spec:
             containers:
-            - name: test-container
-              image: "{{ prune_registry }}/{{ prune_ns }}/{{ container.name }}:latest"
-              command:
-                - /bin/sh
-                - -c
-                - while true;do date;sleep 5; done
+              - name: test-container
+                image: "{{ prune_registry }}/{{ prune_ns }}/{{ container.name }}:latest"
+                command:
+                  - /bin/sh
+                  - -c
+                  - while true;do date;sleep 5; done
 
     - name: Create limit range for images size
       community.okd.k8s:
@@ -57,7 +57,7 @@
               - type: openshift.io/Image
                 max:
                   storage: 1Gi
-        
+
     - name: Prune images from namespace
       community.okd.openshift_adm_prune_images:
         registry_url: "{{ prune_registry }}"
diff --git a/ansible_collections/community/okd/molecule/default/tasks/openshift_route.yml b/ansible_collections/community/okd/molecule/default/tasks/openshift_route.yml
index 50056b7e4..b3043cb7e 100644
--- a/ansible_collections/community/okd/molecule/default/tasks/openshift_route.yml
+++ b/ansible_collections/community/okd/molecule/default/tasks/openshift_route.yml
@@ -19,10 +19,10 @@
               app: hello-kubernetes
           spec:
             containers:
-            - name: hello-kubernetes
-              image: docker.io/openshift/hello-openshift
-              ports:
-              - containerPort: 8080
+              - name: hello-kubernetes
+                image: docker.io/openshift/hello-openshift
+                ports:
+                  - containerPort: 8080
 
 - name: Create Service
   community.okd.k8s:
@@ -35,8 +35,8 @@
         namespace: default
       spec:
         ports:
-        - port: 80
-          targetPort: 8080
+          - port: 80
+            targetPort: 8080
         selector:
           app: hello-kubernetes
 
diff --git a/ansible_collections/community/okd/molecule/default/vars/main.yml b/ansible_collections/community/okd/molecule/default/vars/main.yml
index 66fb0d33c..22e227c1f 100644
--- a/ansible_collections/community/okd/molecule/default/vars/main.yml
+++ b/ansible_collections/community/okd/molecule/default/vars/main.yml
@@ -64,14 +64,16 @@ okd_dc_triggers:
 
 okd_dc_spec:
   template: '{{ k8s_pod_template }}'
-  triggers: '{{ okd_dc_triggers }}'
+  selector:
+    matchLabels:
+      app: "{{ k8s_pod_name }}"
   replicas: 1
   strategy:
     type: Recreate
 
 okd_dc_template:
-  apiVersion: v1
-  kind: DeploymentConfig
+  apiVersion: apps/v1
+  kind: Deployment
   spec: '{{ okd_dc_spec }}'
 
 okd_imagestream_template:
@@ -83,12 +85,12 @@ okd_imagestream_template:
     lookupPolicy:
       local: true
     tags:
-    - annotations: null
-      from:
-        kind: DockerImage
-        name: '{{ image }}'
-      name: '{{ image_tag }}'
-      referencePolicy:
-        type: Source
+      - annotations: null
+        from:
+          kind: DockerImage
+          name: '{{ image }}'
+        name: '{{ image_tag }}'
+        referencePolicy:
+          type: Source
 
 image_tag: latest