now keystone support create a domain-specific role, we can use keystone to do the following operations:
identity: get_domain_ role GET /v3/roles/{role_id} where role.domain_id is not null
identity: list_domain_ roles GET /v3/roles?domain_id where role.domain_id is not null
identity: create_ domain_ role POST /v3/roles where role.domain_id is not null
identity: update_ domain_ role PATCH /v3/roles/{role_id} where role.domain_id is not null
identity: delete_ domain_ role DELETE /v3/roles/{role_id} where role.domain_id is not null

but, now openstackclient cli is not support to create role with domain argument. we should add the domain argument to do this