USHIFT-7499: Ansible: fix service-account lookup

[sjug]

MicroShift deployment fails when microshift-start copies metrics-sa.yaml: #7185 moved the manifest into the create-service-account role's files/ directory, but the caller still includes its task file directly, retaining the parent role's file lookup context.

Invoke create-service-account through ansible.builtin.include_role so Ansible finds the manifest in that role's own directory.

Validation: a local Ansible harness reproduced the original missing-file failure and passed with the corrected include using the real role and a mocked oc. The playbook syntax check, focused ansible-lint --profile min, and git diff --check passed. Live VM and CI rehearsal validation remain outstanding; the scratch VM was shut off when checked.

Jira: https://redhat.atlassian.net/browse/USHIFT-7499

Summary by CodeRabbit

• Chores
  • Updated service account setup handling during MicroShift startup.
  • No changes to exported interfaces or end-user functionality.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@sjug: This pull request references USHIFT-7499 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.1.0" version, but no target version was set.

Details

In response to this:

MicroShift deployment fails when microshift-start copies metrics-sa.yaml: #7185 moved the manifest into the create-service-account role's files/ directory, but the caller still includes its task file directly, retaining the parent role's file lookup context.

Invoke create-service-account through ansible.builtin.include_role so Ansible finds the manifest in that role's own directory.

Validation: a local Ansible harness reproduced the original missing-file failure and passed with the corrected include using the real role and a mocked oc. The playbook syntax check, focused ansible-lint --profile min, and git diff --check passed. Live VM and CI rehearsal validation remain outstanding; the scratch VM was shut off when checked.

Jira: https://redhat.atlassian.net/browse/USHIFT-7499

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sjug
Once this PR has been reviewed and has the lgtm label, please assign jerpeter1 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Team

Run ID: 71e902f1-4c8c-4934-ba0b-b63427ca2cae

📥 Commits

Reviewing files that changed from the base of the PR and between 93ac195 and a10734a.

📒 Files selected for processing (1)

• ansible/roles/microshift-start/tasks/main.yml

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

Walkthrough

The service account setup task now invokes the create-service-account role with ansible.builtin.include_role instead of directly including its task file.

Changes

Service account setup

Layer / File(s)	Summary
Role inclusion ansible/roles/microshift-start/tasks/main.yml	The task uses ansible.builtin.include_role with name: create-service-account instead of include_tasks.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to a1073

The role invocation now preserves role-relative manifest lookup for service-account setup. No concrete merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Ansible service-account lookup fix and matches the main change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only ansible/roles/microshift-start/tasks/main.yml. The diff replaces include_tasks with ansible.builtin.include_role and adds no Ginkgo test declarations or test …
Test Structure And Quality	✅ Passed	PASS — The pull request changes only ansible/roles/microshift-start/tasks/main.yml and contains no Ginkgo test code. The Test Structure and Quality requirements are therefore not applicable. The cha…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only ansible/roles/microshift-start/tasks/main.yml, replacing a direct task-file include with ansible.builtin.include_role. The parent-to-HEAD diff contains no new G…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only ansible/roles/microshift-start/tasks/main.yml. It replaces include_tasks with ansible.builtin.include_role; it adds no Ginkgo e2e tests or other test code. Therefor…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only the Ansible task invocation from include_tasks to ansible.builtin.include_role in ansible/roles/microshift-start/tasks/main.yml. The exact patch modifies no d…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only ansible/roles/microshift-start/tasks/main.yml, replacing a direct task-file include with ansible.builtin.include_role. It adds no OTE binary code, Go process-le…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS. The pull request changes only ansible/roles/microshift-start/tasks/main.yml, replacing include_tasks with ansible.builtin.include_role. It adds no Ginkgo e2e tests, IPv4 assumptions, or ex…
No-Weak-Crypto	✅ Passed	PASS: The pull request changes only the Ansible invocation from direct task inclusion to ansible.builtin.include_role. The exact diff adds no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom crypto,…
Container-Privileges	✅ Passed	PASS. The PR changes only the task invocation from direct include_tasks to ansible.builtin.include_role. The commit adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or `allo…
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The pull request only changes include_tasks to ansible.builtin.include_role. It adds no logging and does not expose sensitive data. The included role already protects the service-account tok…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@sjug: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.