`roles` in config renamed to `defaultRoles`. These are used if no `roles` are provided in production.yaml