Add constraint about clusters to keystone-server role