add contrail ico roles