okd/roles/openshift_logging/tasks/generate_clusterrolebindings.yaml

---
- name: Generate ClusterRoleBindings
  template: src=clusterrolebinding.j2 dest={{mktemp.stdout}}/templates/logging-15-{{obj_name}}-clusterrolebinding.yaml
  vars:
    acct_name: aggregated-logging-elasticsearch
    obj_name: rolebinding-reader
    crb_usernames: ["system:serviceaccount:{{openshift_logging_namespace}}:{{acct_name}}"]
    subjects:
      - kind: ServiceAccount
        name: "{{acct_name}}"
        namespace: "{{openshift_logging_namespace}}"
  check_mode: no
  changed_when: no