diff --git a/playbooks/tox/pre-molecule.yaml b/playbooks/tox/pre-molecule.yaml
index 94be685cb..932aa2928 100644
--- a/playbooks/tox/pre-molecule.yaml
+++ b/playbooks/tox/pre-molecule.yaml
@@ -9,12 +9,12 @@
       with_first_found:
         - skip: true
           files:
-            - "molecule-vars/{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yaml"
-            - "molecule-vars/{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yaml"
-            - "molecule-vars/{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yaml"
-            - "molecule-vars/{{ ansible_distribution | lower }}.yaml"
-            - "molecule-vars/{{ ansible_os_family | lower }}-{{ ansible_distribution_version.split('.')[0] }}.yaml"
-            - "molecule-vars/{{ ansible_os_family | lower }}.yaml"
+            - "vars/molecule/{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yaml"
+            - "vars/molecule/{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yaml"
+            - "vars/molecule/{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yaml"
+            - "vars/molecule/{{ ansible_distribution | lower }}.yaml"
+            - "vars/molecule/{{ ansible_os_family | lower }}-{{ ansible_distribution_version.split('.')[0] }}.yaml"
+            - "vars/molecule/{{ ansible_os_family | lower }}.yaml"
       tags:
         - always
 
diff --git a/playbooks/tox/molecule-vars/redhat-7.yaml b/playbooks/tox/vars/molecule/redhat-7.yaml
similarity index 100%
rename from playbooks/tox/molecule-vars/redhat-7.yaml
rename to playbooks/tox/vars/molecule/redhat-7.yaml
diff --git a/playbooks/tox/molecule-vars/redhat-8.yaml b/playbooks/tox/vars/molecule/redhat-8.yaml
similarity index 100%
rename from playbooks/tox/molecule-vars/redhat-8.yaml
rename to playbooks/tox/vars/molecule/redhat-8.yaml
diff --git a/roles/ensure-openshift/tasks/main.yaml b/roles/ensure-openshift/tasks/main.yaml
index f176a3daf..ea2b7a3eb 100644
--- a/roles/ensure-openshift/tasks/main.yaml
+++ b/roles/ensure-openshift/tasks/main.yaml
@@ -22,6 +22,7 @@
       gpgcheck=1
       gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-PaaS
     dest: /etc/yum.repos.d/origin-pass.repo
+    mode: 0644
 
 # https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-PaaS
 - name: "Install RPM-GPG-KEY-CentOS-SIG-PaaS"
@@ -49,6 +50,7 @@
       =CVSF
       -----END PGP PUBLIC KEY BLOCK-----
     dest: /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-PaaS
+    mode: 0644
 
 - name: Install requirements
   yum:
diff --git a/roles/ensure-zookeeper/tasks/setup_tls.yaml b/roles/ensure-zookeeper/tasks/setup_tls.yaml
index 791bef158..29d7f30c1 100644
--- a/roles/ensure-zookeeper/tasks/setup_tls.yaml
+++ b/roles/ensure-zookeeper/tasks/setup_tls.yaml
@@ -8,6 +8,7 @@
     path: "{{ zookeeper_ca_dir }}"
     state: directory
     owner: "{{ ansible_user }}"
+    mode: 0755
   become: true
 
 - name: Copy zk-ca script