code: func (s *InstanceSecrets) GetRoles() []services.Role {
  	var roles []services.Role
  	for _, ca := range s.GetCAs() {
  		if ca.GetType() != services.UserCA {
  			continue
  		}
  		role := services.RoleForCertAuthority(ca)
  		role.SetLogins(services.Allow, s.AllowedLogins())
  		roles = append(roles, role)
  	}
  	return roles
  }
docs: // GetRoles returns a list of roles to initiate for this secret