# "controller\_roles" role in "infra.aap\_configuration" adds but does not remove roles

**URL:** <https://forum.ansible.com/t/controller-roles-role-in-infra-aap-configuration-adds-but-does-not-remove-roles/41396>\
**Category:** Get Help\
**Tags:** infra-config-as-code\
**Created:** [March 28, 2025, 1:35pm UTC](https://forum.ansible.com/t/controller-roles-role-in-infra-aap-configuration-adds-but-does-not-remove-roles/41396 "2025-03-28T13:35:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [March 28, 2025, 1:35pm UTC](https://forum.ansible.com/t/controller-roles-role-in-infra-aap-configuration-adds-but-does-not-remove-roles/41396/1 "2025-03-28T13:35:29Z")

</div>

I have been playing with the “controller\_roles” role in the “infra.aap\_configuration” collection ([GitHub - redhat-cop/infra.aap\_configuration: A collection of roles to manage Ansible Automation Platform 2.5+ with code](https://github.com/redhat-cop/infra.aap_configuration) & [Ansible Galaxy](https://galaxy.ansible.com/ui/repo/published/infra/aap_configuration/)) to associate roles with teams. It does a nice job to add them. I’m wondering how to remove a role when it’s removed from the data structure. Any ideas?

---

<div class="post-metadata">

**Author:** ![iwt-cmd](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iwt-cmd/32/9120_2.png) [@iwt-cmd](https://forum.ansible.com/u/iwt-cmd)\
**Post date:** [March 31, 2025, 5:44pm UTC](https://forum.ansible.com/t/controller-roles-role-in-infra-aap-configuration-adds-but-does-not-remove-roles/41396/2 "2025-03-31T17:44:30Z")

</div>

Hi @iamroddo

Try using `state: absent`. Based on the awx.awx./ansible.controller module doc (which I believe underpins the infra.aap\_controller collection/roles), that will remove the role if present. It mentioned users but I’d be curious if that also works on teams.

 ![image](https://us1.discourse-cdn.com/ansible/original/2X/8/8696c83cde0127835fe3650482d4b6ca97b91757.png)  
[controller - Red Hat Ecosystem Catalog](https://catalog.redhat.com/software/collection/ansible/controller?tab=documentation&docGroup=module&docName=role)

Best regards,

Joe

---

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [April 1, 2025, 1:59am UTC](https://forum.ansible.com/t/controller-roles-role-in-infra-aap-configuration-adds-but-does-not-remove-roles/41396/3 "2025-04-01T01:59:01Z")

</div>

Thanks @iwt-cmd for the response. I was hoping that there’d be a mechanism like that in `awx.awx` and `ansible.controller` with the `export` module to determine the difference between the data structure or desired state and the actual state of the controller for roles.

---

<div class="post-metadata">

**Author:** ![iwt-cmd](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iwt-cmd/32/9120_2.png) [@iwt-cmd](https://forum.ansible.com/u/iwt-cmd)\
**Post date:** [April 1, 2025, 2:04pm UTC](https://forum.ansible.com/t/controller-roles-role-in-infra-aap-configuration-adds-but-does-not-remove-roles/41396/4 "2025-04-01T14:04:09Z")

</div>

I think I’m following, more of a declarative approach rather than imperative? If that’s the case, the object\_diff role may be worth looking into ( [Ansible Galaxy - infra.controller\_configuration](https://galaxy.ansible.com/ui/repo/published/infra/controller_configuration/content/role/object_diff/)). I haven’t used it but appears to apply a git-based config to the AAP controller and deletes objects not in the config. I don’t have an AAP-based sandbox with the new API to test it though (insert “Real men test in production” meme here).

There is also a controller\_export\_diff module that seems to be more of a reporting option but could probably also be exported and used for create/delete tasks. [Ansible Galaxy - infra.controller\_configuration](https://galaxy.ansible.com/ui/repo/published/infra/controller_configuration/content/module/controller_export_diff/)

We’re moving into more of the Config as Code realm and the new AAP 2.5 paradigm so curious to see what you find.

Best regards,

Joe

---

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [April 7, 2025, 1:32pm UTC](https://forum.ansible.com/t/controller-roles-role-in-infra-aap-configuration-adds-but-does-not-remove-roles/41396/5 "2025-04-07T13:32:26Z")

</div>

Thanks for the response @iwt-cmd and sorry the delayed response.

I’m working to get my head around the various sets of collections that had similar function. I certainly want to be in config as code, I have been using `infra.controller_configuration.controller_export_diff` to make a diff for projects, job\_template etc, but there was no role support.

I see that [Ansible Galaxy - infra.controller\_configuration](https://galaxy.ansible.com/ui/repo/published/infra/controller_configuration/) doesn’t support AAP above 2.4 and the collection that is referred to, for AAP 2.5+ [redhat-cop/infra.aap\_configuration](https://github.com/redhat-cop/infra.aap_configuration) doesn’t have the same structure of roles/modules. I’m wondering how to deal with data model conversation, assuming I get something with [object\_diff](https://galaxy.ansible.com/ui/repo/published/infra/controller_configuration/content/role/object_diff/) working.

Is this the sort of thing that could be discussed at the AAP Config as Code monthly meeting?

---

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [April 8, 2025, 7:10am UTC](https://forum.ansible.com/t/controller-roles-role-in-infra-aap-configuration-adds-but-does-not-remove-roles/41396/6 "2025-04-08T07:10:35Z")

</div>

I have a test AAP instance which has an org called “Org 1” and a team called “Team 1” which has the role “project\_admin”. I have defined this via the GUI and also a data model as below.

```yaml
---
# host_vars/aap-test/roles.yml
role_list:
  - team: 'Team 1'
    organizations:
      - 'Org 1'
    role: project_admin

```

I have a tasks using the role `infra.controller_configuration.object_diff` which I expect to find no diff between the data model and the configuration as below.

```yaml
- name: 'Get role diff'
  ansible.builtin.include_role:
    name: 'infra.controller_configuration.object_diff'
  vars:
    controller_configuration_object_diff_tasks:
      - name: roles
        var: role_list
        tags: roles

```

However the output of the var `controller_roles` includes that below.

```yaml
- organizations:
  - Org 1
  role: project_admin
  state: absent
  team: Team 1

```

This suggests that the task is not picking up the contents of the variable `role_list`, perhaps because I haven’t got the structure right. Any suggestions on how I can fix this?