update keystone roles to reflect the roles used in ha-controller roles