---
# site.yml
#
# Applies the container_isolation role to every host in inventory.
# Scope: service accounts only (groups + users + jerick's group
# memberships). Run against your dynamic inventory as-is — no group
# targeting needed since every host gets the same treatment.

- name: Configure container service accounts
  hosts: all
  become: true
  roles:
    - container_isolation