Relocate filter plugins to lib_utils

This commit relocates filter_plugings to lib_utils,
changes the namespacing to prevent unintended use of
older versions that may be present in filter_plugins/
directory on existing installs.

Add lib_utils to meta depends for roles

Also consolidate some plugins into lib_utils from
various other areas.

Update rpm spec, obsolete plugin rpms.

103 files changed, 1496 insertions, 188 deletions

diff --git a/roles/ansible_service_broker/meta/main.yml b/roles/ansible_service_broker/meta/main.yml
index ec4aafb79..65b736500 100644
--- a/roles/ansible_service_broker/meta/main.yml
+++ b/roles/ansible_service_broker/meta/main.yml
@@ -12,4 +12,5 @@ galaxy_info:
   categories:
   - cloud
 dependencies:
+- role: lib_utils
 - role: lib_openshift
diff --git a/roles/calico/meta/main.yml b/roles/calico/meta/main.yml
index 816c81369..e3997911b 100644
--- a/roles/calico/meta/main.yml
+++ b/roles/calico/meta/main.yml
@@ -13,5 +13,6 @@ galaxy_info:
   - cloud
   - system
 dependencies:
+- role: lib_utils
 - role: openshift_facts
 - role: openshift_master_facts
diff --git a/roles/calico_master/meta/main.yml b/roles/calico_master/meta/main.yml
index 4d70c79cf..73c94db4e 100644
--- a/roles/calico_master/meta/main.yml
+++ b/roles/calico_master/meta/main.yml
@@ -13,5 +13,6 @@ galaxy_info:
   - cloud
   - system
 dependencies:
+- role: lib_utils
 - role: calico
 - role: openshift_facts
diff --git a/roles/cockpit-ui/meta/main.yml b/roles/cockpit-ui/meta/main.yml
index 4d619fff6..2250fe4cb 100644
--- a/roles/cockpit-ui/meta/main.yml
+++ b/roles/cockpit-ui/meta/main.yml
@@ -12,4 +12,5 @@ galaxy_info:
   categories:
   - cloud
 dependencies:
+- role: lib_utils
 - role: lib_openshift
diff --git a/roles/cockpit/meta/main.yml b/roles/cockpit/meta/main.yml
index 8c0ed3cb8..07e466f04 100644
--- a/roles/cockpit/meta/main.yml
+++ b/roles/cockpit/meta/main.yml
@@ -12,4 +12,4 @@ galaxy_info:
   categories:
   - cloud
 dependencies:
-- role: lib_os_firewall
+- role: lib_utils
diff --git a/roles/container_runtime/defaults/main.yml b/roles/container_runtime/defaults/main.yml
index dd185cb38..6ab0456bc 100644
--- a/roles/container_runtime/defaults/main.yml
+++ b/roles/container_runtime/defaults/main.yml
@@ -59,7 +59,7 @@ docker_default_storage_path: /var/lib/docker
 # Set local versions of facts that must be in json format for container-daemon.json
 # NOTE: When jinja2.9+ is used the container-daemon.json file can move to using tojson
 l_docker_log_options: "{{ l2_docker_log_options | to_json }}"
-l_docker_log_options_dict: "{{ l2_docker_log_options | oo_list_to_dict | to_json }}"
+l_docker_log_options_dict: "{{ l2_docker_log_options | lib_utils_oo_list_to_dict | to_json }}"
 l_docker_additional_registries: "{{ l2_docker_additional_registries | to_json }}"
 l_docker_blocked_registries: "{{ l2_docker_blocked_registries | to_json }}"
 l_docker_insecure_registries: "{{ l2_docker_insecure_registries | to_json }}"
diff --git a/roles/container_runtime/meta/main.yml b/roles/container_runtime/meta/main.yml
index 02fceb745..5c4c569de 100644
--- a/roles/container_runtime/meta/main.yml
+++ b/roles/container_runtime/meta/main.yml
@@ -11,5 +11,4 @@ galaxy_info:
     - 7
 dependencies:
 - role: lib_openshift
-- role: lib_os_firewall
 - role: lib_utils
diff --git a/roles/container_runtime/tasks/package_docker.yml b/roles/container_runtime/tasks/package_docker.yml
index d9d4037dd..6604e6ad5 100644
--- a/roles/container_runtime/tasks/package_docker.yml
+++ b/roles/container_runtime/tasks/package_docker.yml
@@ -48,7 +48,7 @@
   lineinfile:
     dest: /etc/sysconfig/docker
     regexp: '^{{ item.reg_conf_var }}=.*$'
-    line: "{{ item.reg_conf_var }}='{{ item.reg_fact_val | oo_prepend_strings_in_list(item.reg_flag ~ ' ') | join(' ') }}'"
+    line: "{{ item.reg_conf_var }}='{{ item.reg_fact_val | lib_utils_oo_prepend_strings_in_list(item.reg_flag ~ ' ') | join(' ') }}'"
   when:
   - item.reg_fact_val != []
   - docker_check.stat.isreg is defined
@@ -101,7 +101,7 @@
     line: "OPTIONS='\
       {% if ansible_selinux.status | default(None) == 'enabled' and openshift_docker_selinux_enabled | default(true) | bool %} --selinux-enabled {% endif %} \
       {% if openshift_docker_log_driver | bool %} --log-driver {{ openshift_docker_log_driver }}{% endif %} \
-      {% if l2_docker_log_options != [] %} {{ l2_docker_log_options |  oo_split() | oo_prepend_strings_in_list('--log-opt ') | join(' ')}}{% endif %} \
+      {% if l2_docker_log_options != [] %} {{ l2_docker_log_options |  lib_utils_oo_split() | lib_utils_oo_prepend_strings_in_list('--log-opt ') | join(' ')}}{% endif %} \
       {% if openshift_docker_hosted_registry_insecure and (openshift_docker_hosted_registry_network | bool) %} --insecure-registry={{ openshift_docker_hosted_registry_network }} {% endif %} \
       {% if docker_options is defined %} {{ docker_options }}{% endif %} \
       {% if openshift_docker_options %} {{ openshift_docker_options }}{% endif %} \
diff --git a/roles/contiv/meta/main.yml b/roles/contiv/meta/main.yml
index 52b9d09dd..67fb23db8 100644
--- a/roles/contiv/meta/main.yml
+++ b/roles/contiv/meta/main.yml
@@ -13,6 +13,7 @@ galaxy_info:
   - cloud
   - system
 dependencies:
+- role: lib_utils
 - role: contiv_facts
 - role: etcd
   etcd_service: contiv-etcd
diff --git a/roles/etcd/meta/main.yml b/roles/etcd/meta/main.yml
index f2e1fc310..af58eff62 100644
--- a/roles/etcd/meta/main.yml
+++ b/roles/etcd/meta/main.yml
@@ -17,6 +17,5 @@ galaxy_info:
   - system
 dependencies:
 - role: lib_openshift
-- role: lib_os_firewall
 - role: lib_utils
 - role: openshift_facts
diff --git a/roles/etcd/tasks/certificates/fetch_client_certificates_from_ca.yml b/roles/etcd/tasks/certificates/fetch_client_certificates_from_ca.yml
index 119071a72..d4518554c 100644
--- a/roles/etcd/tasks/certificates/fetch_client_certificates_from_ca.yml
+++ b/roles/etcd/tasks/certificates/fetch_client_certificates_from_ca.yml
@@ -28,7 +28,7 @@
     etcd_client_certs_missing: "{{ true if etcd_certificates_redeploy | default(false) | bool
                                    else (False in (g_external_etcd_cert_stat_result.results
                                                    | default({})
-                                                   | oo_collect(attribute='stat.exists')
+                                                   | lib_utils_oo_collect(attribute='stat.exists')
                                                    | list)) }}"
 
 - name: Ensure generated_certs directory present
diff --git a/roles/etcd/tasks/certificates/fetch_server_certificates_from_ca.yml b/roles/etcd/tasks/certificates/fetch_server_certificates_from_ca.yml
index deb2301d7..59a6b6590 100644
--- a/roles/etcd/tasks/certificates/fetch_server_certificates_from_ca.yml
+++ b/roles/etcd/tasks/certificates/fetch_server_certificates_from_ca.yml
@@ -21,7 +21,7 @@
     etcd_server_certs_missing: "{{ true if etcd_certificates_redeploy | default(false) | bool
                                    else (False in (g_etcd_server_cert_stat_result.results
                                                    | default({})
-                                                   | oo_collect(attribute='stat.exists')
+                                                   | lib_utils_oo_collect(attribute='stat.exists')
                                                    | list)) }}"
 
 - name: Ensure generated_certs directory present
diff --git a/roles/flannel/meta/main.yml b/roles/flannel/meta/main.yml
index 51128dba6..7634b8192 100644
--- a/roles/flannel/meta/main.yml
+++ b/roles/flannel/meta/main.yml
@@ -12,4 +12,5 @@ galaxy_info:
   categories:
   - cloud
   - system
-dependencies: []
+dependencies:
+- role: lib_utils
diff --git a/roles/flannel_register/meta/main.yml b/roles/flannel_register/meta/main.yml
index 73bddcca4..1e44ff5ba 100644
--- a/roles/flannel_register/meta/main.yml
+++ b/roles/flannel_register/meta/main.yml
@@ -13,4 +13,5 @@ galaxy_info:
   - cloud
   - system
 dependencies:
-- { role: openshift_facts }
+- role: openshift_facts
+- role: lib_utils
diff --git a/roles/kuryr/meta/main.yml b/roles/kuryr/meta/main.yml
index 7fd5adf41..7eb8ed781 100644
--- a/roles/kuryr/meta/main.yml
+++ b/roles/kuryr/meta/main.yml
@@ -13,5 +13,6 @@ galaxy_info:
   - cloud
   - system
 dependencies:
-- { role: lib_openshift }
-- { role: openshift_facts }
+- role: lib_utils
+- role: lib_openshift
+- role: openshift_facts
diff --git a/roles/lib_os_firewall/README.md b/roles/lib_os_firewall/README.md
deleted file mode 100644
index ba8c84865..000000000
--- a/roles/lib_os_firewall/README.md
+++ /dev/null
@@ -1,63 +0,0 @@
-lib_os_firewall
-===========
-
-lib_os_firewall manages iptables firewall settings for a minimal use
-case (Adding/Removing rules based on protocol and port number).
-
-Note: firewalld is not supported on Atomic Host
-https://bugzilla.redhat.com/show_bug.cgi?id=1403331
-
-Requirements
-------------
-
-Ansible 2.2
-
-Role Variables
---------------
-
-| Name                      | Default |                                        |
-|---------------------------|---------|----------------------------------------|
-| os_firewall_allow         | []      | List of service,port mappings to allow |
-| os_firewall_deny          | []      | List of service, port mappings to deny |
-
-Dependencies
-------------
-
-None.
-
-Example Playbook
-----------------
-
-Use iptables and open tcp ports 80 and 443:
-```
----
-- hosts: servers
-  vars:
-    os_firewall_use_firewalld: false
-    os_firewall_allow:
-    - service: httpd
-      port: 80/tcp
-    - service: https
-      port: 443/tcp
-  tasks:
-  - include_role:
-      name: lib_os_firewall
-
-  - name: set allow rules
-    os_firewall_manage_iptables:
-      name: "{{ item.service }}"
-      action: add
-      protocol: "{{ item.port.split('/')[1] }}"
-      port: "{{ item.port.split('/')[0] }}"
-    with_items: "{{ os_firewall_allow }}"
-```
-
-
-License
--------
-
-Apache License, Version 2.0
-
-Author Information
-------------------
-Jason DeTiberus - jdetiber@redhat.com
diff --git a/roles/lib_utils/callback_plugins/aa_version_requirement.py b/roles/lib_utils/callback_plugins/aa_version_requirement.py
new file mode 100644
index 000000000..1093acdae
--- /dev/null
+++ b/roles/lib_utils/callback_plugins/aa_version_requirement.py
@@ -0,0 +1,60 @@
+#!/usr/bin/python
+
+"""
+This callback plugin verifies the required minimum version of Ansible
+is installed for proper operation of the OpenShift Ansible Installer.
+The plugin is named with leading `aa_` to ensure this plugin is loaded
+first (alphanumerically) by Ansible.
+"""
+import sys
+from ansible import __version__
+
+if __version__ < '2.0':
+    # pylint: disable=import-error,no-name-in-module
+    # Disabled because pylint warns when Ansible v2 is installed
+    from ansible.callbacks import display as pre2_display
+    CallbackBase = object
+
+    def display(*args, **kwargs):
+        """Set up display function for pre Ansible v2"""
+        pre2_display(*args, **kwargs)
+else:
+    from ansible.plugins.callback import CallbackBase
+    from ansible.utils.display import Display
+
+    def display(*args, **kwargs):
+        """Set up display function for Ansible v2"""
+        display_instance = Display()
+        display_instance.display(*args, **kwargs)
+
+
+# Set to minimum required Ansible version
+REQUIRED_VERSION = '2.4.1.0'
+DESCRIPTION = "Supported versions: %s or newer" % REQUIRED_VERSION
+
+
+def version_requirement(version):
+    """Test for minimum required version"""
+    return version >= REQUIRED_VERSION
+
+
+class CallbackModule(CallbackBase):
+    """
+    Ansible callback plugin
+    """
+
+    CALLBACK_VERSION = 1.0
+    CALLBACK_NAME = 'version_requirement'
+
+    def __init__(self):
+        """
+        Version verification is performed in __init__ to catch the
+        requirement early in the execution of Ansible and fail gracefully
+        """
+        super(CallbackModule, self).__init__()
+
+        if not version_requirement(__version__):
+            display(
+                'FATAL: Current Ansible version (%s) is not supported. %s'
+                % (__version__, DESCRIPTION), color='red')
+            sys.exit(1)
diff --git a/roles/lib_utils/callback_plugins/openshift_quick_installer.py b/roles/lib_utils/callback_plugins/openshift_quick_installer.py
new file mode 100644
index 000000000..c0fdbc650
--- /dev/null
+++ b/roles/lib_utils/callback_plugins/openshift_quick_installer.py
@@ -0,0 +1,360 @@
+# pylint: disable=invalid-name,protected-access,import-error,line-too-long,attribute-defined-outside-init
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""This file is a stdout callback plugin for the OpenShift Quick
+Installer. The purpose of this callback plugin is to reduce the amount
+of produced output for customers and enable simpler progress checking.
+
+What's different:
+
+* Playbook progress is expressed as: Play <current_play>/<total_plays> (Play Name)
+  Ex: Play 3/30 (Initialize Megafrobber)
+
+* The Tasks and Handlers in each play (and included roles) are printed
+  as a series of .'s following the play progress line.
+
+* Many of these methods include copy and paste code from the upstream
+  default.py callback. We do that to give us control over the stdout
+  output while allowing Ansible to handle the file logging
+  normally. The biggest changes here are that we are manually setting
+  `log_only` to True in the Display.display method and we redefine the
+  Display.banner method locally so we can set log_only on that call as
+  well.
+
+"""
+
+from __future__ import (absolute_import, print_function)
+import sys
+from ansible import constants as C
+from ansible.plugins.callback import CallbackBase
+from ansible.utils.color import colorize, hostcolor
+
+
+class CallbackModule(CallbackBase):
+
+    """
+    Ansible callback plugin
+    """
+    CALLBACK_VERSION = 2.2
+    CALLBACK_TYPE = 'stdout'
+    CALLBACK_NAME = 'openshift_quick_installer'
+    CALLBACK_NEEDS_WHITELIST = False
+    plays_count = 0
+    plays_total_ran = 0
+
+    def __init__(self):
+        """Constructor, ensure standard self.*s are set"""
+        self._play = None
+        self._last_task_banner = None
+        super(CallbackModule, self).__init__()
+
+    def banner(self, msg, color=None):
+        '''Prints a header-looking line with stars taking up to 80 columns
+        of width (3 columns, minimum)
+
+        Overrides the upstream banner method so that display is called
+        with log_only=True
+        '''
+        msg = msg.strip()
+        star_len = (79 - len(msg))
+        if star_len < 0:
+            star_len = 3
+        stars = "*" * star_len
+        self._display.display("\n%s %s" % (msg, stars), color=color, log_only=True)
+
+    def _print_task_banner(self, task):
+        """Imported from the upstream 'default' callback"""
+        # args can be specified as no_log in several places: in the task or in
+        # the argument spec.  We can check whether the task is no_log but the
+        # argument spec can't be because that is only run on the target
+        # machine and we haven't run it thereyet at this time.
+        #
+        # So we give people a config option to affect display of the args so
+        # that they can secure this if they feel that their stdout is insecure
+        # (shoulder surfing, logging stdout straight to a file, etc).
+        args = ''
+        if not task.no_log and C.DISPLAY_ARGS_TO_STDOUT:
+            args = ', '.join('%s=%s' % a for a in task.args.items())
+            args = ' %s' % args
+
+        self.banner(u"TASK [%s%s]" % (task.get_name().strip(), args))
+        if self._display.verbosity >= 2:
+            path = task.get_path()
+            if path:
+                self._display.display(u"task path: %s" % path, color=C.COLOR_DEBUG, log_only=True)
+
+        self._last_task_banner = task._uuid
+
+    def v2_playbook_on_start(self, playbook):
+        """This is basically the start of it all"""
+        self.plays_count = len(playbook.get_plays())
+        self.plays_total_ran = 0
+
+        if self._display.verbosity > 1:
+            from os.path import basename
+            self.banner("PLAYBOOK: %s" % basename(playbook._file_name))
+
+    def v2_playbook_on_play_start(self, play):
+        """Each play calls this once before running any tasks
+
+We could print the number of tasks here as well by using
+`play.get_tasks()` but that is not accurate when a play includes a
+role. Only the tasks directly assigned to a play are exposed in the
+`play` object.
+        """
+        self.plays_total_ran += 1
+        print("")
+        print("Play %s/%s (%s)" % (self.plays_total_ran, self.plays_count, play.get_name()))
+
+        name = play.get_name().strip()
+        if not name:
+            msg = "PLAY"
+        else:
+            msg = "PLAY [%s]" % name
+
+        self._play = play
+
+        self.banner(msg)
+
+    # pylint: disable=unused-argument,no-self-use
+    def v2_playbook_on_task_start(self, task, is_conditional):
+        """This prints out the task header. For example:
+
+TASK [openshift_facts : Ensure PyYaml is installed] ***...
+
+Rather than print out all that for every task, we print a dot
+character to indicate a task has been started.
+        """
+        sys.stdout.write('.')
+
+        args = ''
+        # args can be specified as no_log in several places: in the task or in
+        # the argument spec.  We can check whether the task is no_log but the
+        # argument spec can't be because that is only run on the target
+        # machine and we haven't run it thereyet at this time.
+        #
+        # So we give people a config option to affect display of the args so
+        # that they can secure this if they feel that their stdout is insecure
+        # (shoulder surfing, logging stdout straight to a file, etc).
+        if not task.no_log and C.DISPLAY_ARGS_TO_STDOUT:
+            args = ', '.join(('%s=%s' % a for a in task.args.items()))
+            args = ' %s' % args
+        self.banner("TASK [%s%s]" % (task.get_name().strip(), args))
+        if self._display.verbosity >= 2:
+            path = task.get_path()
+            if path:
+                self._display.display("task path: %s" % path, color=C.COLOR_DEBUG, log_only=True)
+
+    # pylint: disable=unused-argument,no-self-use
+    def v2_playbook_on_handler_task_start(self, task):
+        """Print out task header for handlers
+
+Rather than print out a header for every handler, we print a dot
+character to indicate a handler task has been started.
+"""
+        sys.stdout.write('.')
+
+        self.banner("RUNNING HANDLER [%s]" % task.get_name().strip())
+
+    # pylint: disable=unused-argument,no-self-use
+    def v2_playbook_on_cleanup_task_start(self, task):
+        """Print out a task header for cleanup tasks
+
+Rather than print out a header for every handler, we print a dot
+character to indicate a handler task has been started.
+"""
+        sys.stdout.write('.')
+
+        self.banner("CLEANUP TASK [%s]" % task.get_name().strip())
+
+    def v2_playbook_on_include(self, included_file):
+        """Print out paths to statically included files"""
+        msg = 'included: %s for %s' % (included_file._filename, ", ".join([h.name for h in included_file._hosts]))
+        self._display.display(msg, color=C.COLOR_SKIP, log_only=True)
+
+    def v2_runner_on_ok(self, result):
+        """This prints out task results in a fancy format
+
+The only thing we change here is adding `log_only=True` to the
+.display() call
+        """
+        delegated_vars = result._result.get('_ansible_delegated_vars', None)
+        self._clean_results(result._result, result._task.action)
+        if result._task.action in ('include', 'include_role'):
+            return
+        elif result._result.get('changed', False):
+            if delegated_vars:
+                msg = "changed: [%s -> %s]" % (result._host.get_name(), delegated_vars['ansible_host'])
+            else:
+                msg = "changed: [%s]" % result._host.get_name()
+            color = C.COLOR_CHANGED
+        else:
+            if delegated_vars:
+                msg = "ok: [%s -> %s]" % (result._host.get_name(), delegated_vars['ansible_host'])
+            else:
+                msg = "ok: [%s]" % result._host.get_name()
+            color = C.COLOR_OK
+
+        if result._task.loop and 'results' in result._result:
+            self._process_items(result)
+        else:
+
+            if (self._display.verbosity > 0 or '_ansible_verbose_always' in result._result) and '_ansible_verbose_override' not in result._result:
+                msg += " => %s" % (self._dump_results(result._result),)
+            self._display.display(msg, color=color, log_only=True)
+
+        self._handle_warnings(result._result)
+
+    def v2_runner_item_on_ok(self, result):
+        """Print out task results for items you're iterating over"""
+        delegated_vars = result._result.get('_ansible_delegated_vars', None)
+        if result._task.action in ('include', 'include_role'):
+            return
+        elif result._result.get('changed', False):
+            msg = 'changed'
+            color = C.COLOR_CHANGED
+        else:
+            msg = 'ok'
+            color = C.COLOR_OK
+
+        if delegated_vars:
+            msg += ": [%s -> %s]" % (result._host.get_name(), delegated_vars['ansible_host'])
+        else:
+            msg += ": [%s]" % result._host.get_name()
+
+        msg += " => (item=%s)" % (self._get_item(result._result),)
+
+        if (self._display.verbosity > 0 or '_ansible_verbose_always' in result._result) and '_ansible_verbose_override' not in result._result:
+            msg += " => %s" % self._dump_results(result._result)
+        self._display.display(msg, color=color, log_only=True)
+
+    def v2_runner_item_on_skipped(self, result):
+        """Print out task results when an item is skipped"""
+        if C.DISPLAY_SKIPPED_HOSTS:
+            msg = "skipping: [%s] => (item=%s) " % (result._host.get_name(), self._get_item(result._result))
+            if (self._display.verbosity > 0 or '_ansible_verbose_always' in result._result) and '_ansible_verbose_override' not in result._result:
+                msg += " => %s" % self._dump_results(result._result)
+            self._display.display(msg, color=C.COLOR_SKIP, log_only=True)
+
+    def v2_runner_on_skipped(self, result):
+        """Print out task results when a task (or something else?) is skipped"""
+        if C.DISPLAY_SKIPPED_HOSTS:
+            if result._task.loop and 'results' in result._result:
+                self._process_items(result)
+            else:
+                msg = "skipping: [%s]" % result._host.get_name()
+                if (self._display.verbosity > 0 or '_ansible_verbose_always' in result._result) and '_ansible_verbose_override' not in result._result:
+                    msg += " => %s" % self._dump_results(result._result)
+                self._display.display(msg, color=C.COLOR_SKIP, log_only=True)
+
+    def v2_playbook_on_notify(self, res, handler):
+        """What happens when a task result is 'changed' and the task has a
+'notify' list attached.
+        """
+        self._display.display("skipping: no hosts matched", color=C.COLOR_SKIP, log_only=True)
+
+    ######################################################################
+    # So we can bubble up errors to the top
+    def v2_runner_on_failed(self, result, ignore_errors=False):
+        """I guess this is when an entire task has failed?"""
+
+        if self._play.strategy == 'free' and self._last_task_banner != result._task._uuid:
+            self._print_task_banner(result._task)
+
+        delegated_vars = result._result.get('_ansible_delegated_vars', None)
+        if 'exception' in result._result:
+            if self._display.verbosity < 3:
+                # extract just the actual error message from the exception text
+                error = result._result['exception'].strip().split('\n')[-1]
+                msg = "An exception occurred during task execution. To see the full traceback, use -vvv. The error was: %s" % error
+            else:
+                msg = "An exception occurred during task execution. The full traceback is:\n" + result._result['exception']
+
+            self._display.display(msg, color=C.COLOR_ERROR)
+
+        if result._task.loop and 'results' in result._result:
+            self._process_items(result)
+
+        else:
+            if delegated_vars:
+                self._display.display("fatal: [%s -> %s]: FAILED! => %s" % (result._host.get_name(), delegated_vars['ansible_host'], self._dump_results(result._result)), color=C.COLOR_ERROR)
+            else:
+                self._display.display("fatal: [%s]: FAILED! => %s" % (result._host.get_name(), self._dump_results(result._result)), color=C.COLOR_ERROR)
+
+        if ignore_errors:
+            self._display.display("...ignoring", color=C.COLOR_SKIP)
+
+    def v2_runner_item_on_failed(self, result):
+        """When an item in a task fails."""
+        delegated_vars = result._result.get('_ansible_delegated_vars', None)
+        if 'exception' in result._result:
+            if self._display.verbosity < 3:
+                # extract just the actual error message from the exception text
+                error = result._result['exception'].strip().split('\n')[-1]
+                msg = "An exception occurred during task execution. To see the full traceback, use -vvv. The error was: %s" % error
+            else:
+                msg = "An exception occurred during task execution. The full traceback is:\n" + result._result['exception']
+
+            self._display.display(msg, color=C.COLOR_ERROR)
+
+        msg = "failed: "
+        if delegated_vars:
+            msg += "[%s -> %s]" % (result._host.get_name(), delegated_vars['ansible_host'])
+        else:
+            msg += "[%s]" % (result._host.get_name())
+
+        self._display.display(msg + " (item=%s) => %s" % (self._get_item(result._result), self._dump_results(result._result)), color=C.COLOR_ERROR)
+        self._handle_warnings(result._result)
+
+    ######################################################################
+    def v2_playbook_on_stats(self, stats):
+        """Print the final playbook run stats"""
+        self._display.display("", screen_only=True)
+        self.banner("PLAY RECAP")
+
+        hosts = sorted(stats.processed.keys())
+        for h in hosts:
+            t = stats.summarize(h)
+
+            self._display.display(
+                u"%s : %s %s %s %s" % (
+                    hostcolor(h, t),
+                    colorize(u'ok', t['ok'], C.COLOR_OK),
+                    colorize(u'changed', t['changed'], C.COLOR_CHANGED),
+                    colorize(u'unreachable', t['unreachable'], C.COLOR_UNREACHABLE),
+                    colorize(u'failed', t['failures'], C.COLOR_ERROR)),
+                screen_only=True
+            )
+
+            self._display.display(
+                u"%s : %s %s %s %s" % (
+                    hostcolor(h, t, False),
+                    colorize(u'ok', t['ok'], None),
+                    colorize(u'changed', t['changed'], None),
+                    colorize(u'unreachable', t['unreachable'], None),
+                    colorize(u'failed', t['failures'], None)),
+                log_only=True
+            )
+
+        self._display.display("", screen_only=True)
+        self._display.display("", screen_only=True)
+
+        # Some plays are conditional and won't run (such as load
+        # balancers) if they aren't required. Sometimes plays are
+        # conditionally included later in the run. Let the user know
+        # about this to avoid potential confusion.
+        if self.plays_total_ran != self.plays_count:
+            print("Installation Complete: Note: Play count is only an estimate, some plays may have been skipped or dynamically added")
+            self._display.display("", screen_only=True)
diff --git a/roles/lib_utils/filter_plugins/oo_filters.py b/roles/lib_utils/filter_plugins/oo_filters.py
new file mode 100644
index 000000000..a2ea287cf
--- /dev/null
+++ b/roles/lib_utils/filter_plugins/oo_filters.py
@@ -0,0 +1,621 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+# pylint: disable=too-many-lines
+"""
+Custom filters for use in openshift-ansible
+"""
+import os
+import pdb
+import random
+import re
+
+from base64 import b64encode
+from collections import Mapping
+# pylint no-name-in-module and import-error disabled here because pylint
+# fails to properly detect the packages when installed in a virtualenv
+from distutils.util import strtobool  # pylint:disable=no-name-in-module,import-error
+from operator import itemgetter
+
+import yaml
+
+from ansible import errors
+from ansible.parsing.yaml.dumper import AnsibleDumper
+
+# ansible.compat.six goes away with Ansible 2.4
+try:
+    from ansible.compat.six import string_types, u
+    from ansible.compat.six.moves.urllib.parse import urlparse
+except ImportError:
+    from ansible.module_utils.six import string_types, u
+    from ansible.module_utils.six.moves.urllib.parse import urlparse
+
+HAS_OPENSSL = False
+try:
+    import OpenSSL.crypto
+    HAS_OPENSSL = True
+except ImportError:
+    pass
+
+
+# pylint: disable=C0103
+
+def lib_utils_oo_pdb(arg):
+    """ This pops you into a pdb instance where arg is the data passed in
+        from the filter.
+        Ex: "{{ hostvars | lib_utils_oo_pdb }}"
+    """
+    pdb.set_trace()
+    return arg
+
+
+def get_attr(data, attribute=None):
+    """ This looks up dictionary attributes of the form a.b.c and returns
+        the value.
+
+        If the key isn't present, None is returned.
+        Ex: data = {'a': {'b': {'c': 5}}}
+            attribute = "a.b.c"
+            returns 5
+    """
+    if not attribute:
+        raise errors.AnsibleFilterError("|failed expects attribute to be set")
+
+    ptr = data
+    for attr in attribute.split('.'):
+        if attr in ptr:
+            ptr = ptr[attr]
+        else:
+            ptr = None
+            break
+
+    return ptr
+
+
+def oo_flatten(data):
+    """ This filter plugin will flatten a list of lists
+    """
+    if not isinstance(data, list):
+        raise errors.AnsibleFilterError("|failed expects to flatten a List")
+
+    return [item for sublist in data for item in sublist]
+
+
+def lib_utils_oo_collect(data_list, attribute=None, filters=None):
+    """ This takes a list of dict and collects all attributes specified into a
+        list. If filter is specified then we will include all items that
+        match _ALL_ of filters.  If a dict entry is missing the key in a
+        filter it will be excluded from the match.
+        Ex: data_list = [ {'a':1, 'b':5, 'z': 'z'}, # True, return
+                          {'a':2, 'z': 'z'},        # True, return
+                          {'a':3, 'z': 'z'},        # True, return
+                          {'a':4, 'z': 'b'},        # FAILED, obj['z'] != obj['z']
+                        ]
+            attribute = 'a'
+            filters   = {'z': 'z'}
+            returns [1, 2, 3]
+
+        This also deals with lists of lists with dict as elements.
+        Ex: data_list = [
+                          [ {'a':1, 'b':5, 'z': 'z'}, # True, return
+                            {'a':2, 'b':6, 'z': 'z'}  # True, return
+                          ],
+                          [ {'a':3, 'z': 'z'},        # True, return
+                            {'a':4, 'z': 'b'}         # FAILED, obj['z'] != obj['z']
+                          ],
+                          {'a':5, 'z': 'z'},          # True, return
+                        ]
+            attribute = 'a'
+            filters   = {'z': 'z'}
+            returns [1, 2, 3, 5]
+    """
+    if not isinstance(data_list, list):
+        raise errors.AnsibleFilterError("lib_utils_oo_collect expects to filter on a List")
+
+    if not attribute:
+        raise errors.AnsibleFilterError("lib_utils_oo_collect expects attribute to be set")
+
+    data = []
+    retval = []
+
+    for item in data_list:
+        if isinstance(item, list):
+            retval.extend(lib_utils_oo_collect(item, attribute, filters))
+        else:
+            data.append(item)
+
+    if filters is not None:
+        if not isinstance(filters, dict):
+            raise errors.AnsibleFilterError(
+                "lib_utils_oo_collect expects filter to be a dict")
+        retval.extend([get_attr(d, attribute) for d in data if (
+            all([d.get(key, None) == filters[key] for key in filters]))])
+    else:
+        retval.extend([get_attr(d, attribute) for d in data])
+
+    retval = [val for val in retval if val is not None]
+
+    return retval
+
+
+def lib_utils_oo_select_keys_from_list(data, keys):
+    """ This returns a list, which contains the value portions for the keys
+        Ex: data = { 'a':1, 'b':2, 'c':3 }
+            keys = ['a', 'c']
+            returns [1, 3]
+    """
+
+    if not isinstance(data, list):
+        raise errors.AnsibleFilterError("|lib_utils_oo_select_keys_from_list failed expects to filter on a list")
+
+    if not isinstance(keys, list):
+        raise errors.AnsibleFilterError("|lib_utils_oo_select_keys_from_list failed expects first param is a list")
+
+    # Gather up the values for the list of keys passed in
+    retval = [lib_utils_oo_select_keys(item, keys) for item in data]
+
+    return oo_flatten(retval)
+
+
+def lib_utils_oo_select_keys(data, keys):
+    """ This returns a list, which contains the value portions for the keys
+        Ex: data = { 'a':1, 'b':2, 'c':3 }
+            keys = ['a', 'c']
+            returns [1, 3]
+    """
+
+    if not isinstance(data, Mapping):
+        raise errors.AnsibleFilterError("|lib_utils_oo_select_keys failed expects to filter on a dict or object")
+
+    if not isinstance(keys, list):
+        raise errors.AnsibleFilterError("|lib_utils_oo_select_keys failed expects first param is a list")
+
+    # Gather up the values for the list of keys passed in
+    retval = [data[key] for key in keys if key in data]
+
+    return retval
+
+
+def lib_utils_oo_prepend_strings_in_list(data, prepend):
+    """ This takes a list of strings and prepends a string to each item in the
+        list
+        Ex: data = ['cart', 'tree']
+            prepend = 'apple-'
+            returns ['apple-cart', 'apple-tree']
+    """
+    if not isinstance(data, list):
+        raise errors.AnsibleFilterError("|failed expects first param is a list")
+    if not all(isinstance(x, string_types) for x in data):
+        raise errors.AnsibleFilterError("|failed expects first param is a list"
+                                        " of strings")
+    retval = [prepend + s for s in data]
+    return retval
+
+
+def lib_utils_oo_dict_to_list_of_dict(data, key_title='key', value_title='value'):
+    """Take a dict and arrange them as a list of dicts
+
+       Input data:
+       {'region': 'infra', 'test_k': 'test_v'}
+
+       Return data:
+       [{'key': 'region', 'value': 'infra'}, {'key': 'test_k', 'value': 'test_v'}]
+
+       Written for use of the oc_label module
+    """
+    if not isinstance(data, dict):
+        # pylint: disable=line-too-long
+        raise errors.AnsibleFilterError("|failed expects first param is a dict. Got %s. Type: %s" % (str(data), str(type(data))))
+
+    rval = []
+    for label in data.items():
+        rval.append({key_title: label[0], value_title: label[1]})
+
+    return rval
+
+
+def oo_ami_selector(data, image_name):
+    """ This takes a list of amis and an image name and attempts to return
+        the latest ami.
+    """
+    if not isinstance(data, list):
+        raise errors.AnsibleFilterError("|failed expects first param is a list")
+
+    if not data:
+        return None
+    else:
+        if image_name is None or not image_name.endswith('_*'):
+            ami = sorted(data, key=itemgetter('name'), reverse=True)[0]
+            return ami['ami_id']
+        else:
+            ami_info = [(ami, ami['name'].split('_')[-1]) for ami in data]
+            ami = sorted(ami_info, key=itemgetter(1), reverse=True)[0][0]
+            return ami['ami_id']
+
+
+def lib_utils_oo_split(string, separator=','):
+    """ This splits the input string into a list. If the input string is
+    already a list we will return it as is.
+    """
+    if isinstance(string, list):
+        return string
+    return string.split(separator)
+
+
+def lib_utils_oo_dict_to_keqv_list(data):
+    """Take a dict and return a list of k=v pairs
+
+        Input data:
+        {'a': 1, 'b': 2}
+
+        Return data:
+        ['a=1', 'b=2']
+    """
+    return ['='.join(str(e) for e in x) for x in data.items()]
+
+
+def lib_utils_oo_list_to_dict(lst, separator='='):
+    """ This converts a list of ["k=v"] to a dictionary {k: v}.
+    """
+    kvs = [i.split(separator) for i in lst]
+    return {k: v for k, v in kvs}
+
+
+def haproxy_backend_masters(hosts, port):
+    """ This takes an array of dicts and returns an array of dicts
+        to be used as a backend for the haproxy role
+    """
+    servers = []
+    for idx, host_info in enumerate(hosts):
+        server = dict(name="master%s" % idx)
+        server_ip = host_info['openshift']['common']['ip']
+        server['address'] = "%s:%s" % (server_ip, port)
+        server['opts'] = 'check'
+        servers.append(server)
+    return servers
+
+
+# pylint: disable=too-many-branches
+def lib_utils_oo_parse_named_certificates(certificates, named_certs_dir, internal_hostnames):
+    """ Parses names from list of certificate hashes.
+
+        Ex: certificates = [{ "certfile": "/root/custom1.crt",
+                              "keyfile": "/root/custom1.key",
+                               "cafile": "/root/custom-ca1.crt" },
+                            { "certfile": "custom2.crt",
+                              "keyfile": "custom2.key",
+                              "cafile": "custom-ca2.crt" }]
+
+            returns [{ "certfile": "/etc/origin/master/named_certificates/custom1.crt",
+                       "keyfile": "/etc/origin/master/named_certificates/custom1.key",
+                       "cafile": "/etc/origin/master/named_certificates/custom-ca1.crt",
+                       "names": [ "public-master-host.com",
+                                  "other-master-host.com" ] },
+                     { "certfile": "/etc/origin/master/named_certificates/custom2.crt",
+                       "keyfile": "/etc/origin/master/named_certificates/custom2.key",
+                       "cafile": "/etc/origin/master/named_certificates/custom-ca-2.crt",
+                       "names": [ "some-hostname.com" ] }]
+    """
+    if not isinstance(named_certs_dir, string_types):
+        raise errors.AnsibleFilterError("|failed expects named_certs_dir is str or unicode")
+
+    if not isinstance(internal_hostnames, list):
+        raise errors.AnsibleFilterError("|failed expects internal_hostnames is list")
+
+    if not HAS_OPENSSL:
+        raise errors.AnsibleFilterError("|missing OpenSSL python bindings")
+
+    for certificate in certificates:
+        if 'names' in certificate.keys():
+            continue
+        else:
+            certificate['names'] = []
+
+        if not os.path.isfile(certificate['certfile']) or not os.path.isfile(certificate['keyfile']):
+            raise errors.AnsibleFilterError("|certificate and/or key does not exist '%s', '%s'" %
+                                            (certificate['certfile'], certificate['keyfile']))
+
+        try:
+            st_cert = open(certificate['certfile'], 'rt').read()
+            cert = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, st_cert)
+            certificate['names'].append(str(cert.get_subject().commonName.decode()))
+            for i in range(cert.get_extension_count()):
+                if cert.get_extension(i).get_short_name() == 'subjectAltName':
+                    for name in str(cert.get_extension(i)).replace('DNS:', '').split(', '):
+                        certificate['names'].append(name)
+        except Exception:
+            raise errors.AnsibleFilterError(("|failed to parse certificate '%s', " % certificate['certfile'] +
+                                             "please specify certificate names in host inventory"))
+
+        certificate['names'] = list(set(certificate['names']))
+        if 'cafile' not in certificate:
+            certificate['names'] = [name for name in certificate['names'] if name not in internal_hostnames]
+            if not certificate['names']:
+                raise errors.AnsibleFilterError(("|failed to parse certificate '%s' or " % certificate['certfile'] +
+                                                 "detected a collision with internal hostname, please specify " +
+                                                 "certificate names in host inventory"))
+
+    for certificate in certificates:
+        # Update paths for configuration
+        certificate['certfile'] = os.path.join(named_certs_dir, os.path.basename(certificate['certfile']))
+        certificate['keyfile'] = os.path.join(named_certs_dir, os.path.basename(certificate['keyfile']))
+        if 'cafile' in certificate:
+            certificate['cafile'] = os.path.join(named_certs_dir, os.path.basename(certificate['cafile']))
+    return certificates
+
+
+def lib_utils_oo_generate_secret(num_bytes):
+    """ generate a session secret """
+
+    if not isinstance(num_bytes, int):
+        raise errors.AnsibleFilterError("|failed expects num_bytes is int")
+
+    return b64encode(os.urandom(num_bytes)).decode('utf-8')
+
+
+def lib_utils_to_padded_yaml(data, level=0, indent=2, **kw):
+    """ returns a yaml snippet padded to match the indent level you specify """
+    if data in [None, ""]:
+        return ""
+
+    try:
+        transformed = u(yaml.dump(data, indent=indent, allow_unicode=True,
+                                  default_flow_style=False,
+                                  Dumper=AnsibleDumper, **kw))
+        padded = "\n".join([" " * level * indent + line for line in transformed.splitlines()])
+        return "\n{0}".format(padded)
+    except Exception as my_e:
+        raise errors.AnsibleFilterError('Failed to convert: %s' % my_e)
+
+
+def lib_utils_oo_pods_match_component(pods, deployment_type, component):
+    """ Filters a list of Pods and returns the ones matching the deployment_type and component
+    """
+    if not isinstance(pods, list):
+        raise errors.AnsibleFilterError("failed expects to filter on a list")
+    if not isinstance(deployment_type, string_types):
+        raise errors.AnsibleFilterError("failed expects deployment_type to be a string")
+    if not isinstance(component, string_types):
+        raise errors.AnsibleFilterError("failed expects component to be a string")
+
+    image_prefix = 'openshift/origin-'
+    if deployment_type == 'openshift-enterprise':
+        image_prefix = 'openshift3/ose-'
+
+    matching_pods = []
+    image_regex = image_prefix + component + r'.*'
+    for pod in pods:
+        for container in pod['spec']['containers']:
+            if re.search(image_regex, container['image']):
+                matching_pods.append(pod)
+                break  # stop here, don't add a pod more than once
+
+    return matching_pods
+
+
+def lib_utils_oo_image_tag_to_rpm_version(version, include_dash=False):
+    """ Convert an image tag string to an RPM version if necessary
+        Empty strings and strings that are already in rpm version format
+        are ignored. Also remove non semantic version components.
+
+        Ex. v3.2.0.10 -> -3.2.0.10
+            v1.2.0-rc1 -> -1.2.0
+    """
+    if not isinstance(version, string_types):
+        raise errors.AnsibleFilterError("|failed expects a string or unicode")
+    if version.startswith("v"):
+        version = version[1:]
+        # Strip release from requested version, we no longer support this.
+        version = version.split('-')[0]
+
+    if include_dash and version and not version.startswith("-"):
+        version = "-" + version
+
+    return version
+
+
+def lib_utils_oo_hostname_from_url(url):
+    """ Returns the hostname contained in a URL
+
+        Ex: https://ose3-master.example.com/v1/api -> ose3-master.example.com
+    """
+    if not isinstance(url, string_types):
+        raise errors.AnsibleFilterError("|failed expects a string or unicode")
+    parse_result = urlparse(url)
+    if parse_result.netloc != '':
+        return parse_result.netloc
+    else:
+        # netloc wasn't parsed, assume url was missing scheme and path
+        return parse_result.path
+
+
+# pylint: disable=invalid-name, unused-argument
+def lib_utils_oo_loadbalancer_frontends(
+        api_port, servers_hostvars, use_nuage=False, nuage_rest_port=None):
+    """TODO: Document me."""
+    loadbalancer_frontends = [{'name': 'atomic-openshift-api',
+                               'mode': 'tcp',
+                               'options': ['tcplog'],
+                               'binds': ["*:{0}".format(api_port)],
+                               'default_backend': 'atomic-openshift-api'}]
+    if bool(strtobool(str(use_nuage))) and nuage_rest_port is not None:
+        loadbalancer_frontends.append({'name': 'nuage-monitor',
+                                       'mode': 'tcp',
+                                       'options': ['tcplog'],
+                                       'binds': ["*:{0}".format(nuage_rest_port)],
+                                       'default_backend': 'nuage-monitor'})
+    return loadbalancer_frontends
+
+
+# pylint: disable=invalid-name
+def lib_utils_oo_loadbalancer_backends(
+        api_port, servers_hostvars, use_nuage=False, nuage_rest_port=None):
+    """TODO: Document me."""
+    loadbalancer_backends = [{'name': 'atomic-openshift-api',
+                              'mode': 'tcp',
+                              'option': 'tcplog',
+                              'balance': 'source',
+                              'servers': haproxy_backend_masters(servers_hostvars, api_port)}]
+    if bool(strtobool(str(use_nuage))) and nuage_rest_port is not None:
+        # pylint: disable=line-too-long
+        loadbalancer_backends.append({'name': 'nuage-monitor',
+                                      'mode': 'tcp',
+                                      'option': 'tcplog',
+                                      'balance': 'source',
+                                      'servers': haproxy_backend_masters(servers_hostvars, nuage_rest_port)})
+    return loadbalancer_backends
+
+
+def lib_utils_oo_chomp_commit_offset(version):
+    """Chomp any "+git.foo" commit offset string from the given `version`
+    and return the modified version string.
+
+Ex:
+- chomp_commit_offset(None)                 => None
+- chomp_commit_offset(1337)                 => "1337"
+- chomp_commit_offset("v3.4.0.15+git.derp") => "v3.4.0.15"
+- chomp_commit_offset("v3.4.0.15")          => "v3.4.0.15"
+- chomp_commit_offset("v1.3.0+52492b4")     => "v1.3.0"
+    """
+    if version is None:
+        return version
+    else:
+        # Stringify, just in case it's a Number type. Split by '+' and
+        # return the first split. No concerns about strings without a
+        # '+', .split() returns an array of the original string.
+        return str(version).split('+')[0]
+
+
+def lib_utils_oo_random_word(length, source='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'):
+    """Generates a random string of given length from a set of alphanumeric characters.
+       The default source uses [a-z][A-Z][0-9]
+       Ex:
+       - lib_utils_oo_random_word(3)                => aB9
+       - lib_utils_oo_random_word(4, source='012')  => 0123
+    """
+    return ''.join(random.choice(source) for i in range(length))
+
+
+def lib_utils_oo_contains_rule(source, apiGroups, resources, verbs):
+    '''Return true if the specified rule is contained within the provided source'''
+
+    rules = source['rules']
+
+    if rules:
+        for rule in rules:
+            if set(rule['apiGroups']) == set(apiGroups):
+                if set(rule['resources']) == set(resources):
+                    if set(rule['verbs']) == set(verbs):
+                        return True
+
+    return False
+
+
+def lib_utils_oo_selector_to_string_list(user_dict):
+    """Convert a dict of selectors to a key=value list of strings
+
+Given input of {'region': 'infra', 'zone': 'primary'} returns a list
+of items as ['region=infra', 'zone=primary']
+    """
+    selectors = []
+    for key in user_dict:
+        selectors.append("{}={}".format(key, user_dict[key]))
+    return selectors
+
+
+def lib_utils_oo_filter_sa_secrets(sa_secrets, secret_hint='-token-'):
+    """Parse the Service Account Secrets list, `sa_secrets`, (as from
+oc_serviceaccount_secret:state=list) and return the name of the secret
+containing the `secret_hint` string. For example, by default this will
+return the name of the secret holding the SA bearer token.
+
+Only provide the 'results' object to this filter. This filter expects
+to receive a list like this:
+
+    [
+        {
+            "name": "management-admin-dockercfg-p31s2"
+        },
+        {
+            "name": "management-admin-token-bnqsh"
+        }
+    ]
+
+
+Returns:
+
+* `secret_name` [string] - The name of the secret matching the
+  `secret_hint` parameter. By default this is the secret holding the
+  SA's bearer token.
+
+Example playbook usage:
+
+Register a return value from oc_serviceaccount_secret with and pass
+that result to this filter plugin.
+
+    - name: Get all SA Secrets
+      oc_serviceaccount_secret:
+        state: list
+        service_account: management-admin
+        namespace: management-infra
+      register: sa
+
+    - name: Save the SA bearer token secret name
+      set_fact:
+        management_token: "{{ sa.results | lib_utils_oo_filter_sa_secrets }}"
+
+    - name: Get the SA bearer token value
+      oc_secret:
+        state: list
+        name: "{{ management_token }}"
+        namespace: management-infra
+        decode: true
+      register: sa_secret
+
+    - name: Print the bearer token value
+      debug:
+        var: sa_secret.results.decoded.token
+
+    """
+    secret_name = None
+
+    for secret in sa_secrets:
+        # each secret is a hash
+        if secret['name'].find(secret_hint) == -1:
+            continue
+        else:
+            secret_name = secret['name']
+            break
+
+    return secret_name
+
+
+class FilterModule(object):
+    """ Custom ansible filter mapping """
+
+    # pylint: disable=no-self-use, too-few-public-methods
+    def filters(self):
+        """ returns a mapping of filters to methods """
+        return {
+            "lib_utils_oo_select_keys": lib_utils_oo_select_keys,
+            "lib_utils_oo_select_keys_from_list": lib_utils_oo_select_keys_from_list,
+            "lib_utils_oo_chomp_commit_offset": lib_utils_oo_chomp_commit_offset,
+            "lib_utils_oo_collect": lib_utils_oo_collect,
+            "lib_utils_oo_pdb": lib_utils_oo_pdb,
+            "lib_utils_oo_prepend_strings_in_list": lib_utils_oo_prepend_strings_in_list,
+            "lib_utils_oo_dict_to_list_of_dict": lib_utils_oo_dict_to_list_of_dict,
+            "lib_utils_oo_split": lib_utils_oo_split,
+            "lib_utils_oo_dict_to_keqv_list": lib_utils_oo_dict_to_keqv_list,
+            "lib_utils_oo_list_to_dict": lib_utils_oo_list_to_dict,
+            "lib_utils_oo_parse_named_certificates": lib_utils_oo_parse_named_certificates,
+            "lib_utils_oo_generate_secret": lib_utils_oo_generate_secret,
+            "lib_utils_oo_pods_match_component": lib_utils_oo_pods_match_component,
+            "lib_utils_oo_image_tag_to_rpm_version": lib_utils_oo_image_tag_to_rpm_version,
+            "lib_utils_oo_hostname_from_url": lib_utils_oo_hostname_from_url,
+            "lib_utils_oo_loadbalancer_frontends": lib_utils_oo_loadbalancer_frontends,
+            "lib_utils_oo_loadbalancer_backends": lib_utils_oo_loadbalancer_backends,
+            "lib_utils_to_padded_yaml": lib_utils_to_padded_yaml,
+            "lib_utils_oo_random_word": lib_utils_oo_random_word,
+            "lib_utils_oo_contains_rule": lib_utils_oo_contains_rule,
+            "lib_utils_oo_selector_to_string_list": lib_utils_oo_selector_to_string_list,
+            "lib_utils_oo_filter_sa_secrets": lib_utils_oo_filter_sa_secrets,
+        }
diff --git a/roles/lib_utils/library/kubeclient_ca.py b/roles/lib_utils/library/kubeclient_ca.py
new file mode 100644
index 000000000..a89a5574f
--- /dev/null
+++ b/roles/lib_utils/library/kubeclient_ca.py
@@ -0,0 +1,88 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+''' kubeclient_ca ansible module '''
+
+import base64
+import yaml
+from ansible.module_utils.basic import AnsibleModule
+
+
+DOCUMENTATION = '''
+---
+module: kubeclient_ca
+short_description: Modify kubeclient certificate-authority-data
+author: Andrew Butcher
+requirements: [ ]
+'''
+EXAMPLES = '''
+- kubeclient_ca:
+    client_path: /etc/origin/master/admin.kubeconfig
+    ca_path: /etc/origin/master/ca-bundle.crt
+
+- slurp:
+    src: /etc/origin/master/ca-bundle.crt
+  register: ca_data
+- kubeclient_ca:
+    client_path: /etc/origin/master/admin.kubeconfig
+    ca_data: "{{ ca_data.content }}"
+'''
+
+
+def main():
+    ''' Modify kubeconfig located at `client_path`, setting the
+        certificate authority data to specified `ca_data` or contents of
+        `ca_path`.
+    '''
+
+    module = AnsibleModule(  # noqa: F405
+        argument_spec=dict(
+            client_path=dict(required=True),
+            ca_data=dict(required=False, default=None),
+            ca_path=dict(required=False, default=None),
+            backup=dict(required=False, default=True, type='bool'),
+        ),
+        supports_check_mode=True,
+        mutually_exclusive=[['ca_data', 'ca_path']],
+        required_one_of=[['ca_data', 'ca_path']]
+    )
+
+    client_path = module.params['client_path']
+    ca_data = module.params['ca_data']
+    ca_path = module.params['ca_path']
+    backup = module.params['backup']
+
+    try:
+        with open(client_path) as client_config_file:
+            client_config_data = yaml.safe_load(client_config_file.read())
+
+        if ca_data is None:
+            with open(ca_path) as ca_file:
+                ca_data = base64.standard_b64encode(ca_file.read())
+
+        changes = []
+        # Naively update the CA information for each cluster in the
+        # kubeconfig.
+        for cluster in client_config_data['clusters']:
+            if cluster['cluster']['certificate-authority-data'] != ca_data:
+                cluster['cluster']['certificate-authority-data'] = ca_data
+                changes.append(cluster['name'])
+
+        if not module.check_mode:
+            if len(changes) > 0 and backup:
+                module.backup_local(client_path)
+
+            with open(client_path, 'w') as client_config_file:
+                client_config_string = yaml.dump(client_config_data, default_flow_style=False)
+                client_config_string = client_config_string.replace('\'\'', '""')
+                client_config_file.write(client_config_string)
+
+        return module.exit_json(changed=(len(changes) > 0))
+
+    # ignore broad-except error to avoid stack trace to ansible user
+    # pylint: disable=broad-except
+    except Exception as error:
+        return module.fail_json(msg=str(error))
+
+
+if __name__ == '__main__':
+    main()
diff --git a/roles/lib_utils/library/modify_yaml.py b/roles/lib_utils/library/modify_yaml.py
new file mode 100644
index 000000000..9b8f9ba33
--- /dev/null
+++ b/roles/lib_utils/library/modify_yaml.py
@@ -0,0 +1,117 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+''' modify_yaml ansible module '''
+
+import yaml
+
+# ignore pylint errors related to the module_utils import
+# pylint: disable=redefined-builtin, unused-wildcard-import, wildcard-import
+from ansible.module_utils.basic import *  # noqa: F402,F403
+
+
+DOCUMENTATION = '''
+---
+module: modify_yaml
+short_description: Modify yaml key value pairs
+author: Andrew Butcher
+requirements: [ ]
+'''
+EXAMPLES = '''
+- modify_yaml:
+    dest: /etc/origin/master/master-config.yaml
+    yaml_key: 'kubernetesMasterConfig.masterCount'
+    yaml_value: 2
+'''
+
+
+def set_key(yaml_data, yaml_key, yaml_value):
+    ''' Updates a parsed yaml structure setting a key to a value.
+
+        :param yaml_data: yaml structure to modify.
+        :type yaml_data: dict
+        :param yaml_key: Key to modify.
+        :type yaml_key: mixed
+        :param yaml_value: Value use for yaml_key.
+        :type yaml_value: mixed
+        :returns: Changes to the yaml_data structure
+        :rtype: dict(tuple())
+    '''
+    changes = []
+    ptr = yaml_data
+    final_key = yaml_key.split('.')[-1]
+    for key in yaml_key.split('.'):
+        # Key isn't present and we're not on the final key. Set to empty dictionary.
+        if key not in ptr and key != final_key:
+            ptr[key] = {}
+            ptr = ptr[key]
+        # Current key is the final key. Update value.
+        elif key == final_key:
+            if (key in ptr and module.safe_eval(ptr[key]) != yaml_value) or (key not in ptr):  # noqa: F405
+                ptr[key] = yaml_value
+                changes.append((yaml_key, yaml_value))
+        else:
+            # Next value is None and we're not on the final key.
+            # Turn value into an empty dictionary.
+            if ptr[key] is None and key != final_key:
+                ptr[key] = {}
+            ptr = ptr[key]
+    return changes
+
+
+def main():
+    ''' Modify key (supplied in jinja2 dot notation) in yaml file, setting
+        the key to the desired value.
+    '''
+
+    # disabling pylint errors for global-variable-undefined and invalid-name
+    # for 'global module' usage, since it is required to use ansible_facts
+    # pylint: disable=global-variable-undefined, invalid-name,
+    # redefined-outer-name
+    global module
+
+    module = AnsibleModule(  # noqa: F405
+        argument_spec=dict(
+            dest=dict(required=True),
+            yaml_key=dict(required=True),
+            yaml_value=dict(required=True),
+            backup=dict(required=False, default=True, type='bool'),
+        ),
+        supports_check_mode=True,
+    )
+
+    dest = module.params['dest']
+    yaml_key = module.params['yaml_key']
+    yaml_value = module.safe_eval(module.params['yaml_value'])
+    backup = module.params['backup']
+
+    # Represent null values as an empty string.
+    # pylint: disable=missing-docstring, unused-argument
+    def none_representer(dumper, data):
+        return yaml.ScalarNode(tag=u'tag:yaml.org,2002:null', value=u'')
+
+    yaml.add_representer(type(None), none_representer)
+
+    try:
+        with open(dest) as yaml_file:
+            yaml_data = yaml.safe_load(yaml_file.read())
+
+        changes = set_key(yaml_data, yaml_key, yaml_value)
+
+        if len(changes) > 0:
+            if backup:
+                module.backup_local(dest)
+            with open(dest, 'w') as yaml_file:
+                yaml_string = yaml.dump(yaml_data, default_flow_style=False)
+                yaml_string = yaml_string.replace('\'\'', '""')
+                yaml_file.write(yaml_string)
+
+        return module.exit_json(changed=(len(changes) > 0), changes=changes)
+
+    # ignore broad-except error to avoid stack trace to ansible user
+    # pylint: disable=broad-except
+    except Exception as error:
+        return module.fail_json(msg=str(error))
+
+
+if __name__ == '__main__':
+    main()
diff --git a/roles/lib_os_firewall/library/os_firewall_manage_iptables.py b/roles/lib_utils/library/os_firewall_manage_iptables.py
index aeee3ede8..aeee3ede8 100755..100644
--- a/roles/lib_os_firewall/library/os_firewall_manage_iptables.py
+++ b/roles/lib_utils/library/os_firewall_manage_iptables.py
diff --git a/roles/lib_utils/library/rpm_q.py b/roles/lib_utils/library/rpm_q.py
new file mode 100644
index 000000000..3dec50fc2
--- /dev/null
+++ b/roles/lib_utils/library/rpm_q.py
@@ -0,0 +1,72 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# (c) 2015, Tobias Florek <tob@butter.sh>
+# Licensed under the terms of the MIT License
+"""
+An ansible module to query the RPM database. For use, when yum/dnf are not
+available.
+"""
+
+# pylint: disable=redefined-builtin,wildcard-import,unused-wildcard-import
+from ansible.module_utils.basic import *  # noqa: F403
+
+DOCUMENTATION = """
+---
+module: rpm_q
+short_description: Query the RPM database
+author: Tobias Florek
+options:
+  name:
+    description:
+    - The name of the package to query
+    required: true
+  state:
+    description:
+    - Whether the package is supposed to be installed or not
+    choices: [present, absent]
+    default: present
+"""
+
+EXAMPLES = """
+- rpm_q: name=ansible state=present
+- rpm_q: name=ansible state=absent
+"""
+
+RPM_BINARY = '/bin/rpm'
+
+
+def main():
+    """
+    Checks rpm -q for the named package and returns the installed packages
+    or None if not installed.
+    """
+    module = AnsibleModule(  # noqa: F405
+        argument_spec=dict(
+            name=dict(required=True),
+            state=dict(default='present', choices=['present', 'absent'])
+        ),
+        supports_check_mode=True
+    )
+
+    name = module.params['name']
+    state = module.params['state']
+
+    # pylint: disable=invalid-name
+    rc, out, err = module.run_command([RPM_BINARY, '-q', name])
+
+    installed = out.rstrip('\n').split('\n')
+
+    if rc != 0:
+        if state == 'present':
+            module.fail_json(msg="%s is not installed" % name, stdout=out, stderr=err, rc=rc)
+        else:
+            module.exit_json(changed=False)
+    elif state == 'present':
+        module.exit_json(changed=False, installed_versions=installed)
+    else:
+        module.fail_json(msg="%s is installed", installed_versions=installed)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/roles/nuage_ca/meta/main.yml b/roles/nuage_ca/meta/main.yml
index 36838debc..0d0b8d1a5 100644
--- a/roles/nuage_ca/meta/main.yml
+++ b/roles/nuage_ca/meta/main.yml
@@ -13,4 +13,4 @@ galaxy_info:
   - cloud
   - system
 dependencies:
-- { role: nuage_common }
+- role: nuage_common
diff --git a/roles/nuage_master/meta/main.yml b/roles/nuage_master/meta/main.yml
index e2f7af5ad..643800680 100644
--- a/roles/nuage_master/meta/main.yml
+++ b/roles/nuage_master/meta/main.yml
@@ -14,4 +14,4 @@ galaxy_info:
   - system
 dependencies:
 - role: lib_openshift
-- role: lib_os_firewall
+- role: lib_utils
diff --git a/roles/nuage_node/meta/main.yml b/roles/nuage_node/meta/main.yml
index 9b0315054..0480502b7 100644
--- a/roles/nuage_node/meta/main.yml
+++ b/roles/nuage_node/meta/main.yml
@@ -15,4 +15,4 @@ galaxy_info:
 dependencies:
 - role: nuage_common
 - role: nuage_ca
-- role: lib_os_firewall
+- role: lib_utils
diff --git a/roles/openshift_builddefaults/meta/main.yml b/roles/openshift_builddefaults/meta/main.yml
index 422d08400..60ac189a8 100644
--- a/roles/openshift_builddefaults/meta/main.yml
+++ b/roles/openshift_builddefaults/meta/main.yml
@@ -13,3 +13,4 @@ galaxy_info:
   - cloud
 dependencies:
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_buildoverrides/meta/main.yml b/roles/openshift_buildoverrides/meta/main.yml
index e9d2e8712..edca92e6f 100644
--- a/roles/openshift_buildoverrides/meta/main.yml
+++ b/roles/openshift_buildoverrides/meta/main.yml
@@ -13,3 +13,4 @@ galaxy_info:
   - cloud
 dependencies:
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_ca/meta/main.yml b/roles/openshift_ca/meta/main.yml
index 81b49ce60..b2081efc6 100644
--- a/roles/openshift_ca/meta/main.yml
+++ b/roles/openshift_ca/meta/main.yml
@@ -15,3 +15,4 @@ galaxy_info:
 dependencies:
 - role: openshift_cli
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_ca/tasks/main.yml b/roles/openshift_ca/tasks/main.yml
index ea4702248..358b8528f 100644
--- a/roles/openshift_ca/tasks/main.yml
+++ b/roles/openshift_ca/tasks/main.yml
@@ -9,7 +9,7 @@
 
 - name: Install the base package for admin tooling
   package:
-    name: "{{ openshift_service_type }}{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) }}"
+    name: "{{ openshift_service_type }}{{ openshift_pkg_version | default('') | lib_utils_oo_image_tag_to_rpm_version(include_dash=True) }}"
     state: present
   when: not openshift.common.is_containerized | bool
   register: install_result
@@ -41,7 +41,7 @@
 
 - set_fact:
     master_ca_missing: "{{ False in (g_master_ca_stat_result.results
-                                     | oo_collect(attribute='stat.exists')
+                                     | lib_utils_oo_collect(attribute='stat.exists')
                                      | list) }}"
   run_once: true
 
@@ -88,10 +88,10 @@
 - name: Create the master certificates if they do not already exist
   command: >
     {{ hostvars[openshift_ca_host].openshift.common.client_binary }} adm ca create-master-certs
-    {% for named_ca_certificate in openshift.master.named_certificates | default([]) | oo_collect('cafile') %}
+    {% for named_ca_certificate in openshift.master.named_certificates | default([]) | lib_utils_oo_collect('cafile') %}
     --certificate-authority {{ named_ca_certificate }}
     {% endfor %}
-    {% for legacy_ca_certificate in g_master_legacy_ca_result.files | default([]) | oo_collect('path') %}
+    {% for legacy_ca_certificate in g_master_legacy_ca_result.files | default([]) | lib_utils_oo_collect('path') %}
     --certificate-authority {{ legacy_ca_certificate }}
     {% endfor %}
     --hostnames={{ hostvars[openshift_ca_host].openshift.common.all_hostnames | join(',') }}
@@ -117,7 +117,7 @@
       src: "{{ item }}"
       dest: "{{ openshift_ca_clientconfig_tmpdir.stdout }}/"
       remote_src: true
-    with_items: "{{ g_master_legacy_ca_result.files | default([]) | oo_collect('path') }}"
+    with_items: "{{ g_master_legacy_ca_result.files | default([]) | lib_utils_oo_collect('path') }}"
     delegate_to: "{{ openshift_ca_host }}"
     run_once: true
   - copy:
@@ -156,7 +156,7 @@
     command: >
       {{ hostvars[openshift_ca_host].openshift.common.client_binary }} adm create-api-client-config
         --certificate-authority={{ openshift_ca_cert }}
-        {% for named_ca_certificate in openshift.master.named_certificates | default([]) | oo_collect('cafile') %}
+        {% for named_ca_certificate in openshift.master.named_certificates | default([]) | lib_utils_oo_collect('cafile') %}
         --certificate-authority {{ named_ca_certificate }}
         {% endfor %}
         --client-dir={{ openshift_ca_loopback_tmpdir.stdout }}
diff --git a/roles/openshift_certificate_expiry/meta/main.yml b/roles/openshift_certificate_expiry/meta/main.yml
index c13b29ba5..6758f5b36 100644
--- a/roles/openshift_certificate_expiry/meta/main.yml
+++ b/roles/openshift_certificate_expiry/meta/main.yml
@@ -13,4 +13,5 @@ galaxy_info:
   categories:
   - cloud
   - system
-dependencies: []
+dependencies:
+- role: lib_utils
diff --git a/roles/openshift_cli/meta/main.yml b/roles/openshift_cli/meta/main.yml
index 5d2b6abed..e531543b9 100644
--- a/roles/openshift_cli/meta/main.yml
+++ b/roles/openshift_cli/meta/main.yml
@@ -13,3 +13,4 @@ galaxy_info:
   - cloud
 dependencies:
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_cloud_provider/meta/main.yml b/roles/openshift_cloud_provider/meta/main.yml
index 8ab95bf5a..e49cc4430 100644
--- a/roles/openshift_cloud_provider/meta/main.yml
+++ b/roles/openshift_cloud_provider/meta/main.yml
@@ -13,3 +13,4 @@ galaxy_info:
   - cloud
 dependencies:
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_cluster_autoscaler/meta/main.yml b/roles/openshift_cluster_autoscaler/meta/main.yml
index d2bbd2576..543eb6fed 100644
--- a/roles/openshift_cluster_autoscaler/meta/main.yml
+++ b/roles/openshift_cluster_autoscaler/meta/main.yml
@@ -1,3 +1,4 @@
 ---
 dependencies:
 - lib_openshift
+- role: lib_utils
diff --git a/roles/openshift_default_storage_class/meta/main.yml b/roles/openshift_default_storage_class/meta/main.yml
index d7d57fe39..30671a59a 100644
--- a/roles/openshift_default_storage_class/meta/main.yml
+++ b/roles/openshift_default_storage_class/meta/main.yml
@@ -13,3 +13,4 @@ galaxy_info:
   - cloud
 dependencies:
 - role: lib_openshift
+- role: lib_utils
diff --git a/roles/openshift_docker_gc/meta/main.yml b/roles/openshift_docker_gc/meta/main.yml
index f88a7c533..c8472d8bc 100644
--- a/roles/openshift_docker_gc/meta/main.yml
+++ b/roles/openshift_docker_gc/meta/main.yml
@@ -11,3 +11,4 @@ galaxy_info:
     - 7
 dependencies:
 - role: lib_openshift
+- role: lib_utils
diff --git a/roles/openshift_etcd/meta/main.yml b/roles/openshift_etcd/meta/main.yml
index 0e28fec03..25ae6a936 100644
--- a/roles/openshift_etcd/meta/main.yml
+++ b/roles/openshift_etcd/meta/main.yml
@@ -14,3 +14,4 @@ galaxy_info:
 dependencies:
 - role: openshift_etcd_facts
 - role: etcd
+- role: lib_utils
diff --git a/roles/openshift_etcd_client_certificates/meta/main.yml b/roles/openshift_etcd_client_certificates/meta/main.yml
index fbc72c8a3..6c79d345c 100644
--- a/roles/openshift_etcd_client_certificates/meta/main.yml
+++ b/roles/openshift_etcd_client_certificates/meta/main.yml
@@ -11,4 +11,5 @@ galaxy_info:
     - 7
   categories:
   - cloud
-dependencies: []
+dependencies:
+- role: lib_utils
diff --git a/roles/openshift_etcd_facts/meta/main.yml b/roles/openshift_etcd_facts/meta/main.yml
index 925aa9f92..5e64a8596 100644
--- a/roles/openshift_etcd_facts/meta/main.yml
+++ b/roles/openshift_etcd_facts/meta/main.yml
@@ -13,3 +13,4 @@ galaxy_info:
   - cloud
 dependencies:
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_examples/meta/main.yml b/roles/openshift_examples/meta/main.yml
index f3fe2dcbe..1a34c85fc 100644
--- a/roles/openshift_examples/meta/main.yml
+++ b/roles/openshift_examples/meta/main.yml
@@ -11,4 +11,5 @@ galaxy_info:
     - 7
   categories:
   - cloud
-dependencies: []
+dependencies:
+- role: lib_utils
diff --git a/roles/openshift_excluder/tasks/install.yml b/roles/openshift_excluder/tasks/install.yml
index ad7c00d14..12fecaff5 100644
--- a/roles/openshift_excluder/tasks/install.yml
+++ b/roles/openshift_excluder/tasks/install.yml
@@ -8,7 +8,7 @@
 
   - name: Install docker excluder - yum
     package:
-      name: "{{ r_openshift_excluder_service_type }}-docker-excluder{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) +  '*' }}"
+      name: "{{ r_openshift_excluder_service_type }}-docker-excluder{{ openshift_pkg_version | default('') | lib_utils_oo_image_tag_to_rpm_version(include_dash=True) +  '*' }}"
       state: "{{ r_openshift_excluder_docker_package_state }}"
     when:
     - r_openshift_excluder_enable_docker_excluder | bool
@@ -23,7 +23,7 @@
   # https://bugzilla.redhat.com/show_bug.cgi?id=1199432
   - name: Install docker excluder - dnf
     package:
-      name: "{{ r_openshift_excluder_service_type }}-docker-excluder{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) }}"
+      name: "{{ r_openshift_excluder_service_type }}-docker-excluder{{ openshift_pkg_version | default('') | lib_utils_oo_image_tag_to_rpm_version(include_dash=True) }}"
       state: "{{ r_openshift_excluder_docker_package_state }}"
     when:
     - r_openshift_excluder_enable_docker_excluder | bool
@@ -33,7 +33,7 @@
 
   - name: Install openshift excluder - yum
     package:
-      name: "{{ r_openshift_excluder_service_type }}-excluder{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) + '*' }}"
+      name: "{{ r_openshift_excluder_service_type }}-excluder{{ openshift_pkg_version | default('') | lib_utils_oo_image_tag_to_rpm_version(include_dash=True) + '*' }}"
       state: "{{ r_openshift_excluder_package_state }}"
     when:
     - r_openshift_excluder_enable_openshift_excluder | bool
@@ -47,7 +47,7 @@
   # https://bugzilla.redhat.com/show_bug.cgi?id=1199432
   - name: Install openshift excluder - dnf
     package:
-      name: "{{ r_openshift_excluder_service_type }}-excluder{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) }}"
+      name: "{{ r_openshift_excluder_service_type }}-excluder{{ openshift_pkg_version | default('') | lib_utils_oo_image_tag_to_rpm_version(include_dash=True) }}"
       state: "{{ r_openshift_excluder_package_state }}"
     when:
     - r_openshift_excluder_enable_openshift_excluder | bool
diff --git a/roles/openshift_health_checker/meta/main.yml b/roles/openshift_health_checker/meta/main.yml
index bc8e7bdcf..b8a59ee14 100644
--- a/roles/openshift_health_checker/meta/main.yml
+++ b/roles/openshift_health_checker/meta/main.yml
@@ -1,3 +1,4 @@
 ---
 dependencies:
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_hosted/meta/main.yml b/roles/openshift_hosted/meta/main.yml
index ac9e241a5..ace2d15b0 100644
--- a/roles/openshift_hosted/meta/main.yml
+++ b/roles/openshift_hosted/meta/main.yml
@@ -14,4 +14,4 @@ galaxy_info:
 dependencies:
 - role: openshift_facts
 - role: lib_openshift
-- role: lib_os_firewall
+- role: lib_utils
diff --git a/roles/openshift_hosted/tasks/router.yml b/roles/openshift_hosted/tasks/router.yml
index 4e9219477..8ecaacb4a 100644
--- a/roles/openshift_hosted/tasks/router.yml
+++ b/roles/openshift_hosted/tasks/router.yml
@@ -25,10 +25,10 @@
     backup: True
     dest: "/etc/origin/master/{{ item | basename }}"
     src: "{{ item }}"
-  with_items: "{{ openshift_hosted_routers | oo_collect(attribute='certificate') |
-                  oo_select_keys_from_list(['keyfile', 'certfile', 'cafile']) }}"
+  with_items: "{{ openshift_hosted_routers | lib_utils_oo_collect(attribute='certificate') |
+                  lib_utils_oo_select_keys_from_list(['keyfile', 'certfile', 'cafile']) }}"
   when: ( not openshift_hosted_router_create_certificate | bool ) or openshift_hosted_router_certificate != {} or
-        (  openshift_hosted_routers | oo_collect(attribute='certificate') | oo_select_keys_from_list(['keyfile', 'certfile', 'cafile'])|length > 0 )
+        (  openshift_hosted_routers | lib_utils_oo_collect(attribute='certificate') | lib_utils_oo_select_keys_from_list(['keyfile', 'certfile', 'cafile'])|length > 0 )
 
 
 # This is for when we desire a cluster signed cert
@@ -55,7 +55,7 @@
   when:
   - openshift_hosted_router_create_certificate | bool
   - openshift_hosted_router_certificate == {}
-  - openshift_hosted_routers | oo_collect(attribute='certificate') | oo_select_keys_from_list(['keyfile', 'certfile', 'cafile'])|length == 0
+  - openshift_hosted_routers | lib_utils_oo_collect(attribute='certificate') | lib_utils_oo_select_keys_from_list(['keyfile', 'certfile', 'cafile'])|length == 0
 
 - name: Create the router service account(s)
   oc_serviceaccount:
diff --git a/roles/openshift_hosted/tasks/storage/glusterfs.yml b/roles/openshift_hosted/tasks/storage/glusterfs.yml
index 18b2edcc6..b39c44b01 100644
--- a/roles/openshift_hosted/tasks/storage/glusterfs.yml
+++ b/roles/openshift_hosted/tasks/storage/glusterfs.yml
@@ -17,7 +17,7 @@
   until:
   - "registry_pods.results.results[0]['items'] | count > 0"
   # There must be as many matching pods with 'Ready' status True as there are expected replicas
-  - "registry_pods.results.results[0]['items'] | oo_collect(attribute='status.conditions') | oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == openshift_hosted_registry_replicas | default(l_default_replicas) | int"
+  - "registry_pods.results.results[0]['items'] | lib_utils_oo_collect(attribute='status.conditions') | lib_utils_oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == openshift_hosted_registry_replicas | default(l_default_replicas) | int"
   delay: 10
   retries: "{{ (600 / 10) | int }}"
 
diff --git a/roles/openshift_hosted_templates/meta/main.yml b/roles/openshift_hosted_templates/meta/main.yml
index 4027f524b..fca3485fd 100644
--- a/roles/openshift_hosted_templates/meta/main.yml
+++ b/roles/openshift_hosted_templates/meta/main.yml
@@ -11,4 +11,5 @@ galaxy_info:
     - 7
   categories:
   - cloud
-dependencies: []
+dependencies:
+- role: lib_utils
diff --git a/roles/openshift_loadbalancer/meta/main.yml b/roles/openshift_loadbalancer/meta/main.yml
index 72298b599..3b5b45c5f 100644
--- a/roles/openshift_loadbalancer/meta/main.yml
+++ b/roles/openshift_loadbalancer/meta/main.yml
@@ -10,5 +10,5 @@ galaxy_info:
     versions:
     - 7
 dependencies:
-- role: lib_os_firewall
+- role: lib_utils
 - role: openshift_facts
diff --git a/roles/openshift_logging/meta/main.yaml b/roles/openshift_logging/meta/main.yaml
index 9c480f73a..01ed4918f 100644
--- a/roles/openshift_logging/meta/main.yaml
+++ b/roles/openshift_logging/meta/main.yaml
@@ -14,3 +14,4 @@ galaxy_info:
 dependencies:
 - role: lib_openshift
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_logging/tasks/generate_certs.yaml b/roles/openshift_logging/tasks/generate_certs.yaml
index 082c0128f..d5cfacae3 100644
--- a/roles/openshift_logging/tasks/generate_certs.yaml
+++ b/roles/openshift_logging/tasks/generate_certs.yaml
@@ -139,10 +139,10 @@
 
 # TODO: make idempotent
 - name: Generate proxy session
-  set_fact: session_secret={{ 200 | oo_random_word}}
+  set_fact: session_secret={{ 200 | lib_utils_oo_random_word}}
   check_mode: no
 
 # TODO: make idempotent
 - name: Generate oauth client secret
-  set_fact: oauth_secret={{ 64 | oo_random_word}}
+  set_fact: oauth_secret={{ 64 | lib_utils_oo_random_word}}
   check_mode: no
diff --git a/roles/openshift_logging_curator/meta/main.yaml b/roles/openshift_logging_curator/meta/main.yaml
index d4635aab0..9f7c6341c 100644
--- a/roles/openshift_logging_curator/meta/main.yaml
+++ b/roles/openshift_logging_curator/meta/main.yaml
@@ -14,3 +14,4 @@ galaxy_info:
 dependencies:
 - role: lib_openshift
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_logging_elasticsearch/meta/main.yaml b/roles/openshift_logging_elasticsearch/meta/main.yaml
index 6a9a6539c..e93d6b73e 100644
--- a/roles/openshift_logging_elasticsearch/meta/main.yaml
+++ b/roles/openshift_logging_elasticsearch/meta/main.yaml
@@ -14,3 +14,4 @@ galaxy_info:
 dependencies:
 - role: lib_openshift
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_logging_elasticsearch/tasks/main.yaml b/roles/openshift_logging_elasticsearch/tasks/main.yaml
index 5fe683ae5..e91248d08 100644
--- a/roles/openshift_logging_elasticsearch/tasks/main.yaml
+++ b/roles/openshift_logging_elasticsearch/tasks/main.yaml
@@ -352,7 +352,7 @@
         delete_after: true
 
 - set_fact:
-    es_deploy_name: "logging-{{ es_component }}-{{ openshift_logging_elasticsearch_deployment_type }}-{{ 8 | oo_random_word('abcdefghijklmnopqrstuvwxyz0123456789') }}"
+    es_deploy_name: "logging-{{ es_component }}-{{ openshift_logging_elasticsearch_deployment_type }}-{{ 8 | lib_utils_oo_random_word('abcdefghijklmnopqrstuvwxyz0123456789') }}"
   when: openshift_logging_elasticsearch_deployment_name == ""
 
 - set_fact:
diff --git a/roles/openshift_logging_elasticsearch/templates/es.j2 b/roles/openshift_logging_elasticsearch/templates/es.j2
index cf6ee36bb..4b189f255 100644
--- a/roles/openshift_logging_elasticsearch/templates/es.j2
+++ b/roles/openshift_logging_elasticsearch/templates/es.j2
@@ -50,7 +50,7 @@ spec:
            - -provider=openshift
            - -client-id={{openshift_logging_elasticsearch_prometheus_sa}}
            - -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
-           - -cookie-secret={{ 16 | oo_random_word | b64encode }}
+           - -cookie-secret={{ 16 | lib_utils_oo_random_word | b64encode }}
            - -upstream=https://localhost:9200
            - '-openshift-sar={"namespace": "{{ openshift_logging_elasticsearch_namespace}}", "verb": "view", "resource": "prometheus", "group": "metrics.openshift.io"}'
            - '-openshift-delegate-urls={"/": {"resource": "prometheus", "verb": "view", "group": "metrics.openshift.io", "namespace": "{{ openshift_logging_elasticsearch_namespace}}"}}'
diff --git a/roles/openshift_logging_eventrouter/meta/main.yaml b/roles/openshift_logging_eventrouter/meta/main.yaml
new file mode 100644
index 000000000..711bb8f22
--- /dev/null
+++ b/roles/openshift_logging_eventrouter/meta/main.yaml
@@ -0,0 +1,17 @@
+---
+galaxy_info:
+  author: OpenShift Red Hat
+  description: OpenShift Aggregated Logging Eventrouter
+  company: Red Hat, Inc.
+  license: Apache License, Version 2.0
+  min_ansible_version: 2.2
+  platforms:
+  - name: EL
+    versions:
+    - 7
+  categories:
+  - cloud
+dependencies:
+- role: lib_openshift
+- role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_logging_fluentd/meta/main.yaml b/roles/openshift_logging_fluentd/meta/main.yaml
index 89c98204f..62f076780 100644
--- a/roles/openshift_logging_fluentd/meta/main.yaml
+++ b/roles/openshift_logging_fluentd/meta/main.yaml
@@ -14,3 +14,4 @@ galaxy_info:
 dependencies:
 - role: lib_openshift
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml b/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml
index 12b4f5bfd..1cef6c25e 100644
--- a/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml
+++ b/roles/openshift_logging_fluentd/tasks/label_and_wait.yaml
@@ -4,7 +4,7 @@
     name: "{{ node }}"
     kind: node
     state: add
-    labels: "{{ openshift_logging_fluentd_nodeselector | oo_dict_to_list_of_dict }}"
+    labels: "{{ openshift_logging_fluentd_nodeselector | lib_utils_oo_dict_to_list_of_dict }}"
 
 # wait half a second between labels
 - local_action: command sleep {{ openshift_logging_fluentd_label_delay | default('.5') }}
diff --git a/roles/openshift_logging_kibana/meta/main.yaml b/roles/openshift_logging_kibana/meta/main.yaml
index d97586a37..d9d76dfe0 100644
--- a/roles/openshift_logging_kibana/meta/main.yaml
+++ b/roles/openshift_logging_kibana/meta/main.yaml
@@ -14,3 +14,4 @@ galaxy_info:
 dependencies:
 - role: lib_openshift
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_logging_kibana/tasks/main.yaml b/roles/openshift_logging_kibana/tasks/main.yaml
index 77bf8042a..a00248d11 100644
--- a/roles/openshift_logging_kibana/tasks/main.yaml
+++ b/roles/openshift_logging_kibana/tasks/main.yaml
@@ -69,7 +69,7 @@
 # gen session_secret if necessary
 - name: Generate session secret
   copy:
-    content: "{{ 200 | oo_random_word }}"
+    content: "{{ 200 | lib_utils_oo_random_word }}"
     dest: "{{ generated_certs_dir }}/session_secret"
   when:
     - not session_secret_file.stat.exists
@@ -77,7 +77,7 @@
 # gen oauth_secret if necessary
 - name: Generate oauth secret
   copy:
-    content: "{{ 64 | oo_random_word }}"
+    content: "{{ 64 | lib_utils_oo_random_word }}"
     dest: "{{ generated_certs_dir }}/oauth_secret"
   when:
     - not oauth_secret_file.stat.exists
diff --git a/roles/openshift_logging_mux/meta/main.yaml b/roles/openshift_logging_mux/meta/main.yaml
index f271d8d7d..969752f15 100644
--- a/roles/openshift_logging_mux/meta/main.yaml
+++ b/roles/openshift_logging_mux/meta/main.yaml
@@ -14,3 +14,4 @@ galaxy_info:
 dependencies:
 - role: lib_openshift
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_manage_node/meta/main.yml b/roles/openshift_manage_node/meta/main.yml
index d90cd28cf..a09808a39 100644
--- a/roles/openshift_manage_node/meta/main.yml
+++ b/roles/openshift_manage_node/meta/main.yml
@@ -13,3 +13,4 @@ galaxy_info:
   - cloud
 dependencies:
 - role: lib_openshift
+- role: lib_utils
diff --git a/roles/openshift_manage_node/tasks/main.yml b/roles/openshift_manage_node/tasks/main.yml
index af22a1a03..9f315b9af 100644
--- a/roles/openshift_manage_node/tasks/main.yml
+++ b/roles/openshift_manage_node/tasks/main.yml
@@ -50,7 +50,7 @@
     name: "{{ openshift.node.nodename }}"
     kind: node
     state: add
-    labels: "{{ openshift_node_labels | oo_dict_to_list_of_dict }}"
+    labels: "{{ openshift_node_labels | lib_utils_oo_dict_to_list_of_dict }}"
     namespace: default
   when:
     - "'nodename' in openshift.node"
diff --git a/roles/openshift_manageiq/meta/main.yml b/roles/openshift_manageiq/meta/main.yml
index 6c96a91bf..5c9481430 100644
--- a/roles/openshift_manageiq/meta/main.yml
+++ b/roles/openshift_manageiq/meta/main.yml
@@ -13,3 +13,4 @@ galaxy_info:
   - cloud
 dependencies:
 - role: lib_openshift
+- role: lib_utils
diff --git a/roles/openshift_management/tasks/add_container_provider.yml b/roles/openshift_management/tasks/add_container_provider.yml
index 24b2ce6ac..ca381b105 100644
--- a/roles/openshift_management/tasks/add_container_provider.yml
+++ b/roles/openshift_management/tasks/add_container_provider.yml
@@ -27,7 +27,7 @@
 
 - name: Ensure the management SA bearer token is identified
   set_fact:
-    management_token: "{{ sa.results | oo_filter_sa_secrets }}"
+    management_token: "{{ sa.results | lib_utils_oo_filter_sa_secrets }}"
 
 - name: Ensure the SA bearer token value is read
   oc_secret:
diff --git a/roles/openshift_master/meta/main.yml b/roles/openshift_master/meta/main.yml
index bf0cbbf18..3460efec9 100644
--- a/roles/openshift_master/meta/main.yml
+++ b/roles/openshift_master/meta/main.yml
@@ -14,5 +14,4 @@ galaxy_info:
 dependencies:
 - role: lib_openshift
 - role: lib_utils
-- role: lib_os_firewall
 - role: openshift_facts
diff --git a/roles/openshift_master/tasks/main.yml b/roles/openshift_master/tasks/main.yml
index 7bfc870d5..1c43d335f 100644
--- a/roles/openshift_master/tasks/main.yml
+++ b/roles/openshift_master/tasks/main.yml
@@ -16,7 +16,7 @@
 
 - name: Install Master package
   package:
-    name: "{{ openshift_service_type }}-master{{ openshift_pkg_version | default('') | oo_image_tag_to_rpm_version(include_dash=True) }}"
+    name: "{{ openshift_service_type }}-master{{ openshift_pkg_version | default('') | lib_utils_oo_image_tag_to_rpm_version(include_dash=True) }}"
     state: present
   when:
   - not openshift.common.is_containerized | bool
diff --git a/roles/openshift_master/templates/master.yaml.v1.j2 b/roles/openshift_master/templates/master.yaml.v1.j2
index f1a76e5f5..c224ad714 100644
--- a/roles/openshift_master/templates/master.yaml.v1.j2
+++ b/roles/openshift_master/templates/master.yaml.v1.j2
@@ -1,6 +1,6 @@
 admissionConfig:
 {% if 'admission_plugin_config' in openshift.master %}
-  pluginConfig:{{ openshift.master.admission_plugin_config | to_padded_yaml(level=2) }}
+  pluginConfig:{{ openshift.master.admission_plugin_config | lib_utils_to_padded_yaml(level=2) }}
 {% endif %}
 apiLevels:
 - v1
@@ -16,13 +16,13 @@ assetConfig:
   metricsPublicURL: {{ openshift_hosted_metrics_deploy_url }}
 {% endif %}
 {% if 'extension_scripts' in openshift.master %}
-  extensionScripts: {{ openshift.master.extension_scripts | to_padded_yaml(1, 2) }}
+  extensionScripts: {{ openshift.master.extension_scripts | lib_utils_to_padded_yaml(1, 2) }}
 {% endif %}
 {% if 'extension_stylesheets' in openshift.master %}
-  extensionStylesheets: {{ openshift.master.extension_stylesheets | to_padded_yaml(1, 2) }}
+  extensionStylesheets: {{ openshift.master.extension_stylesheets | lib_utils_to_padded_yaml(1, 2) }}
 {% endif %}
 {% if 'extensions' in openshift.master %}
-  extensions: {{ openshift.master.extensions | to_padded_yaml(1, 2) }}
+  extensions: {{ openshift.master.extensions | lib_utils_to_padded_yaml(1, 2) }}
 {% endif %}
   servingInfo:
     bindAddress: {{ openshift.master.bind_addr }}:{{ openshift.master.console_port }}
@@ -42,7 +42,7 @@ assetConfig:
 {% endfor %}
 {% endif %}
 {% if openshift.master.audit_config | default(none) is not none %}
-auditConfig:{{ openshift.master.audit_config | to_padded_yaml(level=1) }}
+auditConfig:{{ openshift.master.audit_config | lib_utils_to_padded_yaml(level=1) }}
 {% endif %}
 controllerConfig:
   election:
@@ -85,7 +85,7 @@ imageConfig:
   format: {{ openshift.master.registry_url }}
   latest: {{ openshift_master_image_config_latest }}
 {% if 'image_policy_config' in openshift.master %}
-imagePolicyConfig:{{ openshift.master.image_policy_config | to_padded_yaml(level=1) }}
+imagePolicyConfig:{{ openshift.master.image_policy_config | lib_utils_to_padded_yaml(level=1) }}
 {% endif %}
 kind: MasterConfig
 kubeletClientInfo:
@@ -96,21 +96,21 @@ kubeletClientInfo:
   port: 10250
 {% if openshift.master.embedded_kube | bool %}
 kubernetesMasterConfig:
-  apiServerArguments: {{ openshift.master.api_server_args | default(None) | to_padded_yaml( level=2 ) }}
+  apiServerArguments: {{ openshift.master.api_server_args | default(None) | lib_utils_to_padded_yaml( level=2 ) }}
 {% if r_openshift_master_etcd3_storage or ( r_openshift_master_clean_install and openshift.common.version_gte_3_6 ) %}
     storage-backend:
     - etcd3
     storage-media-type:
     - application/vnd.kubernetes.protobuf
 {% endif %}
-  controllerArguments: {{ openshift.master.controller_args | default(None) | to_padded_yaml( level=2 ) }}
+  controllerArguments: {{ openshift.master.controller_args | default(None) | lib_utils_to_padded_yaml( level=2 ) }}
   masterCount: {{ openshift.master.master_count }}
   masterIP: {{ openshift.common.ip }}
   podEvictionTimeout: {{ openshift.master.pod_eviction_timeout | default("") }}
   proxyClientInfo:
     certFile: master.proxy-client.crt
     keyFile: master.proxy-client.key
-  schedulerArguments: {{ openshift_master_scheduler_args | default(None) | to_padded_yaml( level=3 ) }}
+  schedulerArguments: {{ openshift_master_scheduler_args | default(None) | lib_utils_to_padded_yaml( level=3 ) }}
   schedulerConfigFile: {{ openshift_master_scheduler_conf }}
   servicesNodePortRange: "{{ openshift_node_port_range | default("") }}"
   servicesSubnet: {{ openshift.common.portal_net }}
@@ -144,7 +144,7 @@ networkConfig:
 {% endif %}
 # serviceNetworkCIDR must match kubernetesMasterConfig.servicesSubnet
   serviceNetworkCIDR: {{ openshift.common.portal_net }}
-  externalIPNetworkCIDRs: {{ openshift_master_external_ip_network_cidrs | default(["0.0.0.0/0"]) | to_padded_yaml(1,2) }}
+  externalIPNetworkCIDRs: {{ openshift_master_external_ip_network_cidrs | default(["0.0.0.0/0"]) | lib_utils_to_padded_yaml(1,2) }}
 {% if openshift_master_ingress_ip_network_cidr is defined %}
   ingressIPNetworkCIDR: {{ openshift_master_ingress_ip_network_cidr }}
 {% endif %}
@@ -153,7 +153,7 @@ oauthConfig:
   alwaysShowProviderSelection: {{ openshift.master.oauth_always_show_provider_selection }}
 {% endif %}
 {% if 'oauth_templates' in openshift.master %}
-  templates:{{ openshift.master.oauth_templates | to_padded_yaml(level=2) }}
+  templates:{{ openshift.master.oauth_templates | lib_utils_to_padded_yaml(level=2) }}
 {% endif %}
   assetPublicURL: {{ openshift.master.public_console_url }}/
   grantConfig:
diff --git a/roles/openshift_master_certificates/meta/main.yml b/roles/openshift_master_certificates/meta/main.yml
index 300b2cbff..e7d9f5bba 100644
--- a/roles/openshift_master_certificates/meta/main.yml
+++ b/roles/openshift_master_certificates/meta/main.yml
@@ -12,4 +12,5 @@ galaxy_info:
   categories:
   - cloud
   - system
-dependencies: []
+dependencies:
+- role: lib_utils
diff --git a/roles/openshift_master_certificates/tasks/main.yml b/roles/openshift_master_certificates/tasks/main.yml
index ec1fbb1ee..273414f8d 100644
--- a/roles/openshift_master_certificates/tasks/main.yml
+++ b/roles/openshift_master_certificates/tasks/main.yml
@@ -27,7 +27,7 @@
     master_certs_missing: "{{ true if openshift_certificates_redeploy | default(false) | bool
                               else (False in (g_master_cert_stat_result.results
                                               | default({})
-                                              | oo_collect(attribute='stat.exists')
+                                              | lib_utils_oo_collect(attribute='stat.exists')
                                               | list)) }}"
 
 - name: Ensure the generated_configs directory present
@@ -48,10 +48,10 @@
 - name: Create the master server certificate
   command: >
     {{ hostvars[openshift_ca_host].openshift.common.client_binary }} adm ca create-server-cert
-    {% for named_ca_certificate in openshift.master.named_certificates | default([]) | oo_collect('cafile') %}
+    {% for named_ca_certificate in openshift.master.named_certificates | default([]) | lib_utils_oo_collect('cafile') %}
     --certificate-authority {{ named_ca_certificate }}
     {% endfor %}
-    {% for legacy_ca_certificate in g_master_legacy_ca_result.files | default([]) | oo_collect('path') %}
+    {% for legacy_ca_certificate in g_master_legacy_ca_result.files | default([]) | lib_utils_oo_collect('path') %}
     --certificate-authority {{ legacy_ca_certificate }}
     {% endfor %}
     --hostnames={{ hostvars[item].openshift.common.all_hostnames | join(',') }}
@@ -64,8 +64,8 @@
     --overwrite=false
   when: item != openshift_ca_host
   with_items: "{{ hostvars
-                  | oo_select_keys(groups['oo_masters_to_config'])
-                  | oo_collect(attribute='inventory_hostname', filters={'master_certs_missing':True}) }}"
+                  | lib_utils_oo_select_keys(groups['oo_masters_to_config'])
+                  | lib_utils_oo_collect(attribute='inventory_hostname', filters={'master_certs_missing':True}) }}"
   delegate_to: "{{ openshift_ca_host }}"
   run_once: true
 
@@ -73,7 +73,7 @@
   command: >
     {{ hostvars[openshift_ca_host].openshift.common.client_binary }} adm create-api-client-config
       --certificate-authority={{ openshift_ca_cert }}
-      {% for named_ca_certificate in openshift.master.named_certificates | default([]) | oo_collect('cafile') %}
+      {% for named_ca_certificate in openshift.master.named_certificates | default([]) | lib_utils_oo_collect('cafile') %}
       --certificate-authority {{ named_ca_certificate }}
       {% endfor %}
       --client-dir={{ openshift_generated_configs_dir }}/master-{{ hostvars[item].openshift.common.hostname }}
@@ -89,8 +89,8 @@
   args:
     creates: "{{ openshift_generated_configs_dir }}/master-{{ hostvars[item].openshift.common.hostname }}/openshift-master.kubeconfig"
   with_items: "{{ hostvars
-                  | oo_select_keys(groups['oo_masters_to_config'])
-                  | oo_collect(attribute='inventory_hostname', filters={'master_certs_missing':True}) }}"
+                  | lib_utils_oo_select_keys(groups['oo_masters_to_config'])
+                  | lib_utils_oo_collect(attribute='inventory_hostname', filters={'master_certs_missing':True}) }}"
   when: item != openshift_ca_host
   delegate_to: "{{ openshift_ca_host }}"
   run_once: true
diff --git a/roles/openshift_master_facts/filter_plugins/oo_filters.py b/roles/openshift_master_facts/filter_plugins/oo_filters.py
deleted file mode 120000
index 6f9bc47c1..000000000
--- a/roles/openshift_master_facts/filter_plugins/oo_filters.py
+++ /dev/null
@@ -1 +0,0 @@
-../../../filter_plugins/oo_filters.py
\ No newline at end of file
diff --git a/roles/openshift_master_facts/meta/main.yml b/roles/openshift_master_facts/meta/main.yml
index 9dbf719f8..0ab2311d3 100644
--- a/roles/openshift_master_facts/meta/main.yml
+++ b/roles/openshift_master_facts/meta/main.yml
@@ -13,3 +13,4 @@ galaxy_info:
   - cloud
 dependencies:
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_master_facts/tasks/main.yml b/roles/openshift_master_facts/tasks/main.yml
index 418dcba67..4e925813b 100644
--- a/roles/openshift_master_facts/tasks/main.yml
+++ b/roles/openshift_master_facts/tasks/main.yml
@@ -15,7 +15,7 @@
   set_fact:
     g_metrics_hostname: "{{ openshift_hosted_metrics_public_url
                         | default('hawkular-metrics.' ~ openshift_master_default_subdomain)
-                        | oo_hostname_from_url }}"
+                        | lib_utils_oo_hostname_from_url }}"
 
 - set_fact:
     openshift_hosted_metrics_deploy_url: "https://{{ g_metrics_hostname }}/hawkular/metrics"
diff --git a/roles/openshift_metrics/meta/main.yaml b/roles/openshift_metrics/meta/main.yaml
index 50214135c..675ec112f 100644
--- a/roles/openshift_metrics/meta/main.yaml
+++ b/roles/openshift_metrics/meta/main.yaml
@@ -15,5 +15,6 @@ galaxy_info:
   categories:
   - openshift
 dependencies:
-- { role: lib_openshift }
-- { role: openshift_facts }
+- role: lib_openshift
+- role: lib_utils
+- role: openshift_facts
diff --git a/roles/openshift_metrics/tasks/generate_hawkular_certificates.yaml b/roles/openshift_metrics/tasks/generate_hawkular_certificates.yaml
index 0fd19c9f8..9395fceca 100644
--- a/roles/openshift_metrics/tasks/generate_hawkular_certificates.yaml
+++ b/roles/openshift_metrics/tasks/generate_hawkular_certificates.yaml
@@ -14,7 +14,7 @@
   changed_when: no
 
 - name: generate password for hawkular metrics
-  local_action: copy dest="{{ local_tmp.stdout }}/{{ item }}.pwd" content="{{ 15 | oo_random_word }}"
+  local_action: copy dest="{{ local_tmp.stdout }}/{{ item }}.pwd" content="{{ 15 | lib_utils_oo_random_word }}"
   with_items:
   - hawkular-metrics
   become: false
diff --git a/roles/openshift_metrics/tasks/setup_certificate.yaml b/roles/openshift_metrics/tasks/setup_certificate.yaml
index 2d880f4d6..e6081c0d3 100644
--- a/roles/openshift_metrics/tasks/setup_certificate.yaml
+++ b/roles/openshift_metrics/tasks/setup_certificate.yaml
@@ -23,7 +23,7 @@
 
 - name: generate random password for the {{ component }} keystore
   copy:
-    content: "{{ 15 | oo_random_word }}"
+    content: "{{ 15 | lib_utils_oo_random_word }}"
     dest: '{{ mktemp.stdout }}/{{ component }}-keystore.pwd'
 
 - slurp: src={{ mktemp.stdout | quote }}/{{ component|quote }}-keystore.pwd
@@ -39,5 +39,5 @@
 
 - name: generate random password for the {{ component }} truststore
   copy:
-    content: "{{ 15 | oo_random_word }}"
+    content: "{{ 15 | lib_utils_oo_random_word }}"
     dest: '{{ mktemp.stdout | quote }}/{{ component|quote }}-truststore.pwd'
diff --git a/roles/openshift_metrics/templates/hawkular_metrics_rc.j2 b/roles/openshift_metrics/templates/hawkular_metrics_rc.j2
index e976bc222..7c75b2f97 100644
--- a/roles/openshift_metrics/templates/hawkular_metrics_rc.j2
+++ b/roles/openshift_metrics/templates/hawkular_metrics_rc.j2
@@ -64,7 +64,7 @@ spec:
         - name: MASTER_URL
           value: "{{ openshift_metrics_master_url }}"
         - name: JGROUPS_PASSWORD
-          value: "{{ 17 | oo_random_word }}"
+          value: "{{ 17 | lib_utils_oo_random_word }}"
         - name: TRUSTSTORE_AUTHORITIES
           value: "/hawkular-metrics-certs/tls.truststore.crt"
         - name: ENABLE_PROMETHEUS_ENDPOINT
diff --git a/roles/openshift_named_certificates/meta/main.yml b/roles/openshift_named_certificates/meta/main.yml
index 2c6e12494..e7d81df53 100644
--- a/roles/openshift_named_certificates/meta/main.yml
+++ b/roles/openshift_named_certificates/meta/main.yml
@@ -14,3 +14,4 @@ galaxy_info:
   - system
 dependencies:
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_named_certificates/tasks/main.yml b/roles/openshift_named_certificates/tasks/main.yml
index 1bcf9ef67..ad5472445 100644
--- a/roles/openshift_named_certificates/tasks/main.yml
+++ b/roles/openshift_named_certificates/tasks/main.yml
@@ -1,6 +1,6 @@
 ---
 - set_fact:
-    parsed_named_certificates: "{{ named_certificates | oo_parse_named_certificates(named_certs_dir, internal_hostnames) }}"
+    parsed_named_certificates: "{{ named_certificates | lib_utils_oo_parse_named_certificates(named_certs_dir, internal_hostnames) }}"
   when: named_certificates | length > 0
   delegate_to: localhost
   become: no
@@ -43,4 +43,4 @@
     src: "{{ item }}"
     dest: "{{ named_certs_dir }}/{{ item | basename }}"
     mode: 0600
-  with_items: "{{ named_certificates | oo_collect('cafile') }}"
+  with_items: "{{ named_certificates | lib_utils_oo_collect('cafile') }}"
diff --git a/roles/openshift_nfs/meta/main.yml b/roles/openshift_nfs/meta/main.yml
index d7b5910f2..17c0cf33f 100644
--- a/roles/openshift_nfs/meta/main.yml
+++ b/roles/openshift_nfs/meta/main.yml
@@ -13,4 +13,4 @@ galaxy_info:
   - cloud
 dependencies:
 - role: lib_utils
-- role: lib_os_firewall
+- role: lib_utils
diff --git a/roles/openshift_node/defaults/main.yml b/roles/openshift_node/defaults/main.yml
index 08e45dda1..a90aad532 100644
--- a/roles/openshift_node/defaults/main.yml
+++ b/roles/openshift_node/defaults/main.yml
@@ -27,7 +27,7 @@ openshift_dns_ip: "{{ ansible_default_ipv4['address'] }}"
 openshift_node_env_vars: {}
 
 # Create list of 'k=v' pairs.
-l_node_kubelet_node_labels: "{{ openshift_node_labels | default({}) | oo_dict_to_keqv_list }}"
+l_node_kubelet_node_labels: "{{ openshift_node_labels | default({}) | lib_utils_oo_dict_to_keqv_list }}"
 
 openshift_node_kubelet_args_dict:
   aws:
diff --git a/roles/openshift_node/meta/main.yml b/roles/openshift_node/meta/main.yml
index b531d2dfe..86a2ca16f 100644
--- a/roles/openshift_node/meta/main.yml
+++ b/roles/openshift_node/meta/main.yml
@@ -13,9 +13,6 @@ galaxy_info:
   - cloud
 dependencies:
 - role: lib_openshift
-- role: lib_os_firewall
-  when: not (openshift_node_upgrade_in_progress | default(False))
 - role: openshift_cloud_provider
   when: not (openshift_node_upgrade_in_progress | default(False))
 - role: lib_utils
-  when: openshift_node_upgrade_in_progress | default(False)
diff --git a/roles/openshift_node/tasks/install.yml b/roles/openshift_node/tasks/install.yml
index 9f004e8dd..fb98b7550 100644
--- a/roles/openshift_node/tasks/install.yml
+++ b/roles/openshift_node/tasks/install.yml
@@ -3,14 +3,14 @@
   block:
   - name: Install Node package
     package:
-      name: "{{ openshift_service_type }}-node{{ (openshift_pkg_version | default('')) | oo_image_tag_to_rpm_version(include_dash=True) }}"
+      name: "{{ openshift_service_type }}-node{{ (openshift_pkg_version | default('')) | lib_utils_oo_image_tag_to_rpm_version(include_dash=True) }}"
       state: present
     register: result
     until: result is succeeded
 
   - name: Install sdn-ovs package
     package:
-      name: "{{ openshift_service_type }}-sdn-ovs{{ (openshift_pkg_version | default('')) | oo_image_tag_to_rpm_version(include_dash=True) }}"
+      name: "{{ openshift_service_type }}-sdn-ovs{{ (openshift_pkg_version | default('')) | lib_utils_oo_image_tag_to_rpm_version(include_dash=True) }}"
       state: present
     when:
     - openshift_node_use_openshift_sdn | bool
diff --git a/roles/openshift_node/templates/node.yaml.v1.j2 b/roles/openshift_node/templates/node.yaml.v1.j2
index 76e75297a..f091263f5 100644
--- a/roles/openshift_node/templates/node.yaml.v1.j2
+++ b/roles/openshift_node/templates/node.yaml.v1.j2
@@ -13,7 +13,7 @@ imageConfig:
   format: {{ oreg_url_node }}
   latest: {{ openshift_node_image_config_latest }}
 kind: NodeConfig
-kubeletArguments: {{ l2_openshift_node_kubelet_args | default(None) | to_padded_yaml(level=1) }}
+kubeletArguments: {{  l2_openshift_node_kubelet_args  | default(None) | lib_utils_to_padded_yaml(level=1) }}
 {% if openshift_use_crio %}
   container-runtime:
   - remote
diff --git a/roles/openshift_node_certificates/meta/main.yml b/roles/openshift_node_certificates/meta/main.yml
index 0440bf11a..4362c644a 100644
--- a/roles/openshift_node_certificates/meta/main.yml
+++ b/roles/openshift_node_certificates/meta/main.yml
@@ -12,4 +12,5 @@ galaxy_info:
   categories:
   - cloud
   - system
-dependencies: []
+dependencies:
+- role: lib_utils
diff --git a/roles/openshift_node_certificates/tasks/main.yml b/roles/openshift_node_certificates/tasks/main.yml
index 97f1fbbdd..1e5ebe98e 100644
--- a/roles/openshift_node_certificates/tasks/main.yml
+++ b/roles/openshift_node_certificates/tasks/main.yml
@@ -31,7 +31,7 @@
     node_certs_missing: "{{ true if openshift_certificates_redeploy | default(false) | bool
                             else (False in (g_node_cert_stat_result.results
                                             | default({})
-                                            | oo_collect(attribute='stat.exists')
+                                            | lib_utils_oo_collect(attribute='stat.exists')
                                             | list)) }}"
 
 - name: Create openshift_generated_configs_dir if it does not exist
@@ -52,10 +52,10 @@
 - name: Generate the node client config
   command: >
     {{ hostvars[openshift_ca_host].openshift.common.client_binary }} adm create-api-client-config
-    {% for named_ca_certificate in hostvars[openshift_ca_host].openshift.master.named_certificates | default([]) | oo_collect('cafile') %}
+    {% for named_ca_certificate in hostvars[openshift_ca_host].openshift.master.named_certificates | default([]) | lib_utils_oo_collect('cafile') %}
     --certificate-authority {{ named_ca_certificate }}
     {% endfor %}
-    {% for legacy_ca_certificate in g_master_legacy_ca_result.files | default([]) | oo_collect('path') %}
+    {% for legacy_ca_certificate in g_master_legacy_ca_result.files | default([]) | lib_utils_oo_collect('path') %}
     --certificate-authority {{ legacy_ca_certificate }}
     {% endfor %}
     --certificate-authority={{ openshift_ca_cert }}
@@ -70,8 +70,8 @@
   args:
     creates: "{{ openshift_generated_configs_dir }}/node-{{ hostvars[item].openshift.common.hostname }}"
   with_items: "{{ hostvars
-                  | oo_select_keys(groups['oo_nodes_to_config'])
-                  | oo_collect(attribute='inventory_hostname', filters={'node_certs_missing':True}) }}"
+                  | lib_utils_oo_select_keys(groups['oo_nodes_to_config'])
+                  | lib_utils_oo_collect(attribute='inventory_hostname', filters={'node_certs_missing':True}) }}"
   delegate_to: "{{ openshift_ca_host }}"
   run_once: true
 
@@ -89,8 +89,8 @@
   args:
     creates: "{{ openshift_generated_configs_dir }}/node-{{ hostvars[item].openshift.common.hostname }}/server.crt"
   with_items: "{{ hostvars
-                  | oo_select_keys(groups['oo_nodes_to_config'])
-                  | oo_collect(attribute='inventory_hostname', filters={'node_certs_missing':True}) }}"
+                  | lib_utils_oo_select_keys(groups['oo_nodes_to_config'])
+                  | lib_utils_oo_collect(attribute='inventory_hostname', filters={'node_certs_missing':True}) }}"
   delegate_to: "{{ openshift_ca_host }}"
   run_once: true
 
diff --git a/roles/openshift_persistent_volumes/meta/main.yml b/roles/openshift_persistent_volumes/meta/main.yml
index 48b0699ab..aea7616bf 100644
--- a/roles/openshift_persistent_volumes/meta/main.yml
+++ b/roles/openshift_persistent_volumes/meta/main.yml
@@ -11,3 +11,4 @@ galaxy_info:
     - 7
 dependencies:
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_persistent_volumes/templates/persistent-volume-claim.yml.j2 b/roles/openshift_persistent_volumes/templates/persistent-volume-claim.yml.j2
index d40417a9a..fac589a92 100644
--- a/roles/openshift_persistent_volumes/templates/persistent-volume-claim.yml.j2
+++ b/roles/openshift_persistent_volumes/templates/persistent-volume-claim.yml.j2
@@ -8,7 +8,7 @@ items:
   metadata:
     name: "{{ claim.name }}"
   spec:
-    accessModes: {{ claim.access_modes | to_padded_yaml(2, 2) }}
+    accessModes: {{ claim.access_modes | lib_utils_to_padded_yaml(2, 2) }}
     resources:
       requests:
         storage: "{{ claim.capacity }}"
diff --git a/roles/openshift_persistent_volumes/templates/persistent-volume.yml.j2 b/roles/openshift_persistent_volumes/templates/persistent-volume.yml.j2
index 9ec14208b..354561432 100644
--- a/roles/openshift_persistent_volumes/templates/persistent-volume.yml.j2
+++ b/roles/openshift_persistent_volumes/templates/persistent-volume.yml.j2
@@ -16,6 +16,6 @@ items:
   spec:
     capacity:
       storage: "{{ volume.capacity }}"
-    accessModes: {{ volume.access_modes | to_padded_yaml(2, 2) }}
-    {{ (volume.storage.keys() | list)[0] }}: {{ volume.storage[(volume.storage.keys() | list)[0]] | to_padded_yaml(3, 2) }}
+    accessModes: {{ volume.access_modes | lib_utils_to_padded_yaml(2, 2) }}
+    {{ (volume.storage.keys() | list)[0] }}: {{ volume.storage[(volume.storage.keys() | list)[0]] | lib_utils_to_padded_yaml(3, 2) }}
 {% endfor %}
diff --git a/roles/openshift_prometheus/meta/main.yaml b/roles/openshift_prometheus/meta/main.yaml
index 33188bb7e..69c5e0ee2 100644
--- a/roles/openshift_prometheus/meta/main.yaml
+++ b/roles/openshift_prometheus/meta/main.yaml
@@ -15,5 +15,6 @@ galaxy_info:
   categories:
   - openshift
 dependencies:
-- { role: lib_openshift }
-- { role: openshift_facts }
+- role: lib_openshift
+- role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_prometheus/tasks/install_prometheus.yaml b/roles/openshift_prometheus/tasks/install_prometheus.yaml
index abc5dd476..2fb1c08e5 100644
--- a/roles/openshift_prometheus/tasks/install_prometheus.yaml
+++ b/roles/openshift_prometheus/tasks/install_prometheus.yaml
@@ -5,7 +5,7 @@
   oc_project:
     state: present
     name: "{{ openshift_prometheus_namespace }}"
-    node_selector: "{{ openshift_prometheus_node_selector | oo_selector_to_string_list() }}"
+    node_selector: "{{ openshift_prometheus_node_selector | lib_utils_oo_selector_to_string_list() }}"
     description: Prometheus
 
 # secrets
@@ -16,7 +16,7 @@
     namespace: "{{ openshift_prometheus_namespace }}"
     contents:
       - path: session_secret
-        data: "{{ 43 | oo_random_word }}="
+        data: "{{ 43 | lib_utils_oo_random_word }}="
   with_items:
     - prometheus
     - alerts
diff --git a/roles/openshift_provisioners/meta/main.yaml b/roles/openshift_provisioners/meta/main.yaml
index cb9278eb7..5ef352bcd 100644
--- a/roles/openshift_provisioners/meta/main.yaml
+++ b/roles/openshift_provisioners/meta/main.yaml
@@ -14,3 +14,4 @@ galaxy_info:
 dependencies:
 - role: lib_openshift
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_sanitize_inventory/meta/main.yml b/roles/openshift_sanitize_inventory/meta/main.yml
index f5b37186e..324ba06d8 100644
--- a/roles/openshift_sanitize_inventory/meta/main.yml
+++ b/roles/openshift_sanitize_inventory/meta/main.yml
@@ -12,4 +12,5 @@ galaxy_info:
   categories:
   - cloud
   - system
-dependencies: []
+dependencies:
+- role: lib_utils
diff --git a/roles/openshift_service_catalog/tasks/install.yml b/roles/openshift_service_catalog/tasks/install.yml
index 41a6691c9..4b842c166 100644
--- a/roles/openshift_service_catalog/tasks/install.yml
+++ b/roles/openshift_service_catalog/tasks/install.yml
@@ -88,14 +88,14 @@
   vars:
     original_content: "{{ edit_yaml.results.results[0] | to_yaml }}"
   when:
-    - not edit_yaml.results.results[0] | oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['create', 'update', 'delete', 'get', 'list', 'watch', 'patch']) or not edit_yaml.results.results[0] | oo_contains_rule(['settings.k8s.io'], ['podpresets'], ['create', 'update', 'delete', 'get', 'list', 'watch'])
+    - not edit_yaml.results.results[0] | lib_utils_oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['create', 'update', 'delete', 'get', 'list', 'watch', 'patch']) or not edit_yaml.results.results[0] | lib_utils_oo_contains_rule(['settings.k8s.io'], ['podpresets'], ['create', 'update', 'delete', 'get', 'list', 'watch'])
 
 # only do this if we don't already have the updated role info
 - name: update edit role for service catalog and pod preset access
   command: >
     {{ openshift.common.client_binary }} --config=/etc/origin/master/admin.kubeconfig replace -f {{ mktemp.stdout }}/edit_sc_patch.yml
   when:
-    - not edit_yaml.results.results[0] | oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['create', 'update', 'delete', 'get', 'list', 'watch', 'patch']) or not edit_yaml.results.results[0] | oo_contains_rule(['settings.k8s.io'], ['podpresets'], ['create', 'update', 'delete', 'get', 'list', 'watch'])
+    - not edit_yaml.results.results[0] | lib_utils_oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['create', 'update', 'delete', 'get', 'list', 'watch', 'patch']) or not edit_yaml.results.results[0] | lib_utils_oo_contains_rule(['settings.k8s.io'], ['podpresets'], ['create', 'update', 'delete', 'get', 'list', 'watch'])
 
 - oc_obj:
     name: admin
@@ -111,14 +111,14 @@
   vars:
     original_content: "{{ admin_yaml.results.results[0] | to_yaml }}"
   when:
-    - not admin_yaml.results.results[0] | oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['create', 'update', 'delete', 'get', 'list', 'watch', 'patch']) or not admin_yaml.results.results[0] | oo_contains_rule(['settings.k8s.io'], ['podpresets'], ['create', 'update', 'delete', 'get', 'list', 'watch'])
+    - not admin_yaml.results.results[0] | lib_utils_oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['create', 'update', 'delete', 'get', 'list', 'watch', 'patch']) or not admin_yaml.results.results[0] | lib_utils_oo_contains_rule(['settings.k8s.io'], ['podpresets'], ['create', 'update', 'delete', 'get', 'list', 'watch'])
 
 # only do this if we don't already have the updated role info
 - name: update admin role for service catalog and pod preset access
   command: >
     {{ openshift.common.client_binary }} --config=/etc/origin/master/admin.kubeconfig replace -f {{ mktemp.stdout }}/admin_sc_patch.yml
   when:
-    - not admin_yaml.results.results[0] | oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['create', 'update', 'delete', 'get', 'list', 'watch', 'patch']) or not admin_yaml.results.results[0] | oo_contains_rule(['settings.k8s.io'], ['podpresets'], ['create', 'update', 'delete', 'get', 'list', 'watch'])
+    - not admin_yaml.results.results[0] | lib_utils_oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['create', 'update', 'delete', 'get', 'list', 'watch', 'patch']) or not admin_yaml.results.results[0] | lib_utils_oo_contains_rule(['settings.k8s.io'], ['podpresets'], ['create', 'update', 'delete', 'get', 'list', 'watch'])
 
 - oc_obj:
     name: view
@@ -134,14 +134,14 @@
   vars:
     original_content: "{{ view_yaml.results.results[0] | to_yaml }}"
   when:
-    - not view_yaml.results.results[0] | oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['get', 'list', 'watch'])
+    - not view_yaml.results.results[0] | lib_utils_oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['get', 'list', 'watch'])
 
 # only do this if we don't already have the updated role info
 - name: update view role for service catalog access
   command: >
     {{ openshift.common.client_binary }} --config=/etc/origin/master/admin.kubeconfig replace -f {{ mktemp.stdout }}/view_sc_patch.yml
   when:
-    - not view_yaml.results.results[0] | oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['get', 'list', 'watch'])
+    - not view_yaml.results.results[0] | lib_utils_oo_contains_rule(['servicecatalog.k8s.io'], ['serviceinstances', 'servicebindings'], ['get', 'list', 'watch'])
 
 - oc_adm_policy_user:
     namespace: kube-service-catalog
diff --git a/roles/openshift_service_catalog/tasks/start_api_server.yml b/roles/openshift_service_catalog/tasks/start_api_server.yml
index b143292b6..84e542eaf 100644
--- a/roles/openshift_service_catalog/tasks/start_api_server.yml
+++ b/roles/openshift_service_catalog/tasks/start_api_server.yml
@@ -5,7 +5,7 @@
     name: "{{ openshift.node.nodename }}"
     kind: node
     state: add
-    labels: "{{ openshift_service_catalog_nodeselector | default ({'openshift-infra': 'apiserver'}) | oo_dict_to_list_of_dict }}"
+    labels: "{{ openshift_service_catalog_nodeselector | default ({'openshift-infra': 'apiserver'}) | lib_utils_oo_dict_to_list_of_dict }}"
 
 # wait to see that the apiserver is available
 - name: wait for api server to be ready
diff --git a/roles/openshift_storage_glusterfs/meta/main.yml b/roles/openshift_storage_glusterfs/meta/main.yml
index 6a4ef942b..aa20245d5 100644
--- a/roles/openshift_storage_glusterfs/meta/main.yml
+++ b/roles/openshift_storage_glusterfs/meta/main.yml
@@ -12,4 +12,4 @@ galaxy_info:
 dependencies:
 - role: openshift_facts
 - role: lib_openshift
-- role: lib_os_firewall
+- role: lib_utils
diff --git a/roles/openshift_storage_glusterfs/tasks/gluster_s3_deploy.yml b/roles/openshift_storage_glusterfs/tasks/gluster_s3_deploy.yml
index 1664ecc1e..5b4c16740 100644
--- a/roles/openshift_storage_glusterfs/tasks/gluster_s3_deploy.yml
+++ b/roles/openshift_storage_glusterfs/tasks/gluster_s3_deploy.yml
@@ -63,7 +63,7 @@
   until:
   - "gluster_s3_pvcs.results.results[0]['items'] | count > 0"
   # Pod's 'Bound' status must be True
-  - "gluster_s3_pvcs.results.results[0]['items'] | oo_collect(attribute='status.conditions') | oo_collect(attribute='status', filters={'type': 'Bound'}) | map('bool') | select | list | count == 2"
+  - "gluster_s3_pvcs.results.results[0]['items'] | lib_utils_oo_collect(attribute='status.conditions') | lib_utils_oo_collect(attribute='status', filters={'type': 'Bound'}) | map('bool') | select | list | count == 2"
   delay: 10
   retries: "{{ (glusterfs_timeout | int / 10) | int }}"
 
@@ -108,6 +108,6 @@
   until:
   - "gluster_s3_pod.results.results[0]['items'] | count > 0"
   # Pod's 'Ready' status must be True
-  - "gluster_s3_pod.results.results[0]['items'] | oo_collect(attribute='status.conditions') | oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == 1"
+  - "gluster_s3_pod.results.results[0]['items'] | lib_utils_oo_collect(attribute='status.conditions') | lib_utils_oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == 1"
   delay: 10
   retries: "{{ (glusterfs_timeout | int / 10) | int }}"
diff --git a/roles/openshift_storage_glusterfs/tasks/glusterblock_deploy.yml b/roles/openshift_storage_glusterfs/tasks/glusterblock_deploy.yml
index d6be8c726..e5dcdcab7 100644
--- a/roles/openshift_storage_glusterfs/tasks/glusterblock_deploy.yml
+++ b/roles/openshift_storage_glusterfs/tasks/glusterblock_deploy.yml
@@ -61,6 +61,6 @@
   until:
   - "glusterblock_pod.results.results[0]['items'] | count > 0"
   # Pod's 'Ready' status must be True
-  - "glusterblock_pod.results.results[0]['items'] | oo_collect(attribute='status.conditions') | oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == 1"
+  - "glusterblock_pod.results.results[0]['items'] | lib_utils_oo_collect(attribute='status.conditions') | lib_utils_oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == 1"
   delay: 10
   retries: "{{ (glusterfs_timeout | int / 10) | int }}"
diff --git a/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml b/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml
index d11023a39..9307cb957 100644
--- a/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml
+++ b/roles/openshift_storage_glusterfs/tasks/glusterfs_common.yml
@@ -126,7 +126,7 @@
   - "glusterfs_heketi_is_native"
   - "deploy_heketi_pod.results.results[0]['items'] | count > 0"
   # deploy-heketi is not missing when there are one or more pods with matching labels whose 'Ready' status is True
-  - "deploy_heketi_pod.results.results[0]['items'] | oo_collect(attribute='status.conditions') | oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count > 0"
+  - "deploy_heketi_pod.results.results[0]['items'] | lib_utils_oo_collect(attribute='status.conditions') | lib_utils_oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count > 0"
 
 - name: Check for existing heketi pod
   oc_obj:
@@ -144,7 +144,7 @@
   - "glusterfs_heketi_is_native"
   - "heketi_pod.results.results[0]['items'] | count > 0"
   # heketi is not missing when there are one or more pods with matching labels whose 'Ready' status is True
-  - "heketi_pod.results.results[0]['items'] | oo_collect(attribute='status.conditions') | oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count > 0"
+  - "heketi_pod.results.results[0]['items'] | lib_utils_oo_collect(attribute='status.conditions') | lib_utils_oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count > 0"
 
 - name: Generate topology file
   template:
@@ -177,14 +177,14 @@
 
 - name: Generate heketi admin key
   set_fact:
-    glusterfs_heketi_admin_key: "{{ 32 | oo_generate_secret }}"
+    glusterfs_heketi_admin_key: "{{ 32 | lib_utils_oo_generate_secret }}"
   when:
   - glusterfs_heketi_is_native
   - glusterfs_heketi_admin_key is undefined
 
 - name: Generate heketi user key
   set_fact:
-    glusterfs_heketi_user_key: "{{ 32 | oo_generate_secret }}"
+    glusterfs_heketi_user_key: "{{ 32 | lib_utils_oo_generate_secret }}"
   until: "glusterfs_heketi_user_key != glusterfs_heketi_admin_key"
   delay: 1
   retries: 10
@@ -228,7 +228,7 @@
   until:
   - "deploy_heketi_pod.results.results[0]['items'] | count > 0"
   # Pod's 'Ready' status must be True
-  - "deploy_heketi_pod.results.results[0]['items'] | oo_collect(attribute='status.conditions') | oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == 1"
+  - "deploy_heketi_pod.results.results[0]['items'] | lib_utils_oo_collect(attribute='status.conditions') | lib_utils_oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == 1"
   delay: 10
   retries: "{{ (glusterfs_timeout | int / 10) | int }}"
   when:
diff --git a/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml b/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml
index 0c2fcb2c5..4cc82f1ad 100644
--- a/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml
+++ b/roles/openshift_storage_glusterfs/tasks/glusterfs_deploy.yml
@@ -21,7 +21,7 @@
     name: "{{ hostvars[item].openshift.node.nodename }}"
     kind: node
     state: absent
-    labels: "{{ glusterfs_nodeselector | oo_dict_to_list_of_dict }}"
+    labels: "{{ glusterfs_nodeselector | lib_utils_oo_dict_to_list_of_dict }}"
   with_items: "{{ groups.all }}"
   when: "'openshift' in hostvars[item] and glusterfs_wipe"
 
@@ -60,7 +60,7 @@
     name: "{{ hostvars[item].openshift.node.nodename }}"
     kind: node
     state: add
-    labels: "{{ glusterfs_nodeselector | oo_dict_to_list_of_dict }}"
+    labels: "{{ glusterfs_nodeselector | lib_utils_oo_dict_to_list_of_dict }}"
   with_items: "{{ glusterfs_nodes | default([]) }}"
 
 - name: Copy GlusterFS DaemonSet template
@@ -109,6 +109,6 @@
   until:
   - "glusterfs_pods.results.results[0]['items'] | count > 0"
   # There must be as many pods with 'Ready' staus  True as there are nodes expecting those pods
-  - "glusterfs_pods.results.results[0]['items'] | oo_collect(attribute='status.conditions') | oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == glusterfs_nodes | count"
+  - "glusterfs_pods.results.results[0]['items'] | lib_utils_oo_collect(attribute='status.conditions') | lib_utils_oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == glusterfs_nodes | count"
   delay: 10
   retries: "{{ (glusterfs_timeout | int / 10) | int }}"
diff --git a/roles/openshift_storage_glusterfs/tasks/heketi_deploy_part2.yml b/roles/openshift_storage_glusterfs/tasks/heketi_deploy_part2.yml
index d23bd42b9..60b9ca497 100644
--- a/roles/openshift_storage_glusterfs/tasks/heketi_deploy_part2.yml
+++ b/roles/openshift_storage_glusterfs/tasks/heketi_deploy_part2.yml
@@ -28,14 +28,14 @@
   until:
   - "'results' in heketi_job.results and heketi_job.results.results | count > 0"
   # Pod's 'Complete' status must be True
-  - "heketi_job.results.results | oo_collect(attribute='status.conditions') | oo_collect(attribute='status', filters={'type': 'Complete'}) | map('bool') | select | list | count == 1"
+  - "heketi_job.results.results | lib_utils_oo_collect(attribute='status.conditions') | lib_utils_oo_collect(attribute='status', filters={'type': 'Complete'}) | map('bool') | select | list | count == 1"
   delay: 10
   retries: "{{ (glusterfs_timeout | int / 10) | int }}"
   failed_when:
   - "'results' in heketi_job.results"
   - "heketi_job.results.results | count > 0"
   # Fail when pod's 'Failed' status is True
-  - "heketi_job.results.results | oo_collect(attribute='status.conditions') | oo_collect(attribute='status', filters={'type': 'Failed'}) | map('bool') | select | list | count == 1"
+  - "heketi_job.results.results | lib_utils_oo_collect(attribute='status.conditions') | lib_utils_oo_collect(attribute='status', filters={'type': 'Failed'}) | map('bool') | select | list | count == 1"
   when: setup_storage.rc == 0
 
 - name: Delete deploy resources
@@ -120,7 +120,7 @@
   until:
   - "heketi_pod.results.results[0]['items'] | count > 0"
   # Pod's 'Ready' status must be True
-  - "heketi_pod.results.results[0]['items'] | oo_collect(attribute='status.conditions') | oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == 1"
+  - "heketi_pod.results.results[0]['items'] | lib_utils_oo_collect(attribute='status.conditions') | lib_utils_oo_collect(attribute='status', filters={'type': 'Ready'}) | map('bool') | select | list | count == 1"
   delay: 10
   retries: "{{ (glusterfs_timeout | int / 10) | int }}"
 
diff --git a/roles/openshift_storage_nfs/meta/main.yml b/roles/openshift_storage_nfs/meta/main.yml
index d61e6873a..3ae04e59f 100644
--- a/roles/openshift_storage_nfs/meta/main.yml
+++ b/roles/openshift_storage_nfs/meta/main.yml
@@ -10,5 +10,5 @@ galaxy_info:
     versions:
     - 7
 dependencies:
-- role: lib_os_firewall
+- role: lib_utils
 - role: openshift_facts
diff --git a/roles/openshift_storage_nfs_lvm/meta/main.yml b/roles/openshift_storage_nfs_lvm/meta/main.yml
index 50d94f6a3..de47708a5 100644
--- a/roles/openshift_storage_nfs_lvm/meta/main.yml
+++ b/roles/openshift_storage_nfs_lvm/meta/main.yml
@@ -16,3 +16,4 @@ galaxy_info:
   - openshift
 dependencies:
 - role: openshift_facts
+- role: lib_utils
diff --git a/roles/openshift_version/tasks/set_version_containerized.yml b/roles/openshift_version/tasks/set_version_containerized.yml
index 71f957b78..e02a75eab 100644
--- a/roles/openshift_version/tasks/set_version_containerized.yml
+++ b/roles/openshift_version/tasks/set_version_containerized.yml
@@ -62,4 +62,4 @@
 # dangly +c0mm1t-offset tags in the version. See also,
 # openshift_facts.py
 - set_fact:
-    openshift_version: "{{ openshift_version | oo_chomp_commit_offset }}"
+    openshift_version: "{{ openshift_version | lib_utils_oo_chomp_commit_offset }}"
diff --git a/roles/template_service_broker/meta/main.yml b/roles/template_service_broker/meta/main.yml
index ab5a0cf08..f1b56b771 100644
--- a/roles/template_service_broker/meta/main.yml
+++ b/roles/template_service_broker/meta/main.yml
@@ -11,3 +11,5 @@ galaxy_info:
     - 7
   categories:
   - cloud
+dependencies:
+- role: lib_utils