...
2- Where can we create those roles?
root@super4:~# keystone role-list
The keystone CLI is deprecated in favor of python-openstackclient. For a Python library, continue using python-keystoneclient. 'python-keystoneclient.', DeprecationWarning)
+----------------------------------+-----------------+
| id | name |
+----------------------------------+-----------------+
| 0d7d26cab3914c01b3696d0fcf3426e3 | ResellerAdmin |
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |
| 03be779481894d9196cb94ec77c17234 | admin |
| 47f70b9bacd74ce6885c9dd9efa3b9da | heat_stack_user |
+----------------------------------+-----------------+