Configuring container groups using credentials fails on initial run

[homeski]

Summary

When configuring an instance group referencing a credential, the `dispatch`` role will fail on the initial run because the credential does not exist.

Instance groups tied to custom OCP container groups rely on credentials of `OpenShift or Kubernetes API Bearer Token`` type. So this will pop up more as adoption of this role against AAP on OCP increases.

Issue Type

• Bug Report

Desired Behavior

The instance group should be created without failure with the proper credential attached.

Actual Behavior

e.g.

controller_instance_groups:
  - name: default
    is_container_group: true
    credential: Container Groups Credential
    ...

Will fail on the initial run because the order of creation is:

controller_configuration_dispatcher_roles:
  - role: settings
    var: controller_settings
    tags: settings
  - role: instances
    var: controller_instances
    tags: instances
  - role: instance_groups
    var: controller_instance_groups
    tags: instance_groups
  - role: organizations
    var: controller_organizations
    tags: organizations
    assign_galaxy_credentials_to_org: false
    assign_default_ee_to_org: false
    assign_notification_templates_to_org: false
  - role: labels
    var: controller_labels
    tags: labels
  - role: users
    var: controller_user_accounts
    tags: users
  - role: teams
    var: controller_teams
    tags: teams
  - role: credential_types
    var: controller_credential_types
    tags: credential_types
  - role: credentials
    var: controller_credentials
    tags: credentials
  - role: credential_input_sources
    var: controller_credential_input_sources
    tags: credential_input_sources

STEPS TO REPRODUCE

• Create a instance_group using a credential
• Run the dispatch role for the first time
• The dispatch role will fail because the credential does not exist at the time of instance_group creation

[djdanielsson]

so the question is do we change where instance_groups get called to after creds which would require us to be able to skip instance_groups when creating orgs or do we need to keep where it is being created and skip adding creds and apply the creds to them after they are created similarly like we have to do for orgs. I am not sure if there are any other dependencies to instance_groups