code: func (c *TrustedClusterV2) CheckAndSetDefaults() error {
  	// make sure we have defaults for all fields
  	if err := c.Metadata.CheckAndSetDefaults(); err != nil {
  		return trace.Wrap(err)
  	}
  	// This is to force users to migrate
  	if len(c.Spec.Roles) != 0 && len(c.Spec.RoleMap) != 0 {
  		return trace.BadParameter("should set either 'roles' or 'role_map', not both")
  	}
  	// we are not mentioning Roles parameter because we are deprecating it
  	if len(c.Spec.Roles) == 0 && len(c.Spec.RoleMap) == 0 {
  		if err := modules.GetModules().EmptyRolesHandler(); err != nil {
  			return trace.Wrap(err)
  		}
  		// OSS teleport uses 'admin' by default:
  		c.Spec.RoleMap = RoleMap{
  			RoleMapping{
  				Remote: teleport.AdminRoleName,
  				Local:  []string{teleport.AdminRoleName},
  			},
  		}
  	}
  	// Imply that by default proxy listens on the same port for
  	// web and reverse tunnel connections
  	if c.Spec.ReverseTunnelAddress == "" {
  		c.Spec.ReverseTunnelAddress = c.Spec.ProxyAddress
  	}
  	if err := c.Spec.RoleMap.Check(); err != nil {
  		return trace.Wrap(err)
  	}
  	return nil
  }
docs: // Check checks validity of all parameters and sets defaults