Roles synchronisation

[przemkalit]

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
I've discovered that while restoring the roles, they are not in sync.

For example, if there is no role set as Admin for project X in the A controller, but there is an Admin role for project X in the B controller, the Admin role should be removed from the B controller when an import is requested, as it is not included in the export created by filetree_create.

Describe alternatives you've considered

I've tested a solution to fetch the entire list of roles and compare it to the provided list, but it takes too much time to be reliable. Therefore, I am opening this request in case you have an idea on how to approach this. If there is something I didn't notice in the collection, please let me know.

Additional context
N/A

[ivarmu]

@przemkalit should this issue be closed? I see the associated PR was discarded.

[djdanielsson]

it was closed in the aap_configuration repo because filetree lives here now

[ivarmu]

Hi, just to make things clear in this issue:

The delete function is the responsibility of the object_diff role. Basically, the main three functions here are:

• filetree_create: Export the config from an AAP instance to Configuration as Code.
• filetree_create: Applies a given Configuration as Code to an AAP instance using the infra.aap_configuration.dispatch role.
• object_diff: Gets the configuration from the AAP API, compares it with the given Configuration as Code, and then removes from the API all the objects not defined by the Configuration as Code.

So, if you want the non-existing roles to be removed, you should use the object_diff role. For the roles object type, the amount of instances is insane, as you already acknowledged, so the full process is very slow and resource intensive. When I started working towards object_diff, I decided that it was a good approach to treat only the roles that wasn't automatically created by Tower/AAP.