update single controller role to include separate keystone roles and cinder roles