diff --git a/cinder/files/pike/cinder.conf.controller.Debian b/cinder/files/pike/cinder.conf.controller.Debian
index 247109a..5e99f27 100644
--- a/cinder/files/pike/cinder.conf.controller.Debian
+++ b/cinder/files/pike/cinder.conf.controller.Debian
@@ -220,6 +220,12 @@
   {%- endif %}
 {%- endif %}
 auth_version = v3
+{%- if controller.identity.service_token_roles is defined %}
+service_token_roles = {{ controller.identity.service_token_roles }}
+{%- endif %}
+{%- if controller.identity.service_token_roles_required is defined %}
+service_token_roles_required = {{ controller.identity.service_token_roles_required }}
+{%- endif %}
 
 {%- if controller.get('barbican', {}).get('enabled', False) %}
 [key_manager]
diff --git a/cinder/files/pike/cinder.conf.volume.Debian b/cinder/files/pike/cinder.conf.volume.Debian
index 499cc77..dda4ae5 100644
--- a/cinder/files/pike/cinder.conf.volume.Debian
+++ b/cinder/files/pike/cinder.conf.volume.Debian
@@ -203,6 +203,12 @@
   {%- endif %}
 {%- endif %}
 auth_version = v3
+{%- if volume.identity.service_token_roles is defined %}
+service_token_roles = {{ volume.identity.service_token_roles }}
+{%- endif %}
+{%- if volume.identity.service_token_roles_required is defined %}
+service_token_roles_required = {{ volume.identity.service_token_roles_required }}
+{%- endif %}
 
 {%- if volume.get('barbican', {}).get('enabled', False) %}
 [key_manager]