def METHOD_NAME(root_vo, identity_key, id_type, email, issuer, default=False, password=None, vo='def', *, session: "Session"):
    """
    Adds a membership association between identity and the root account for given VO.
    :param root_vo: The VO whose root needs recovery
    :param identity_key: The identity key name. For example x509 DN, or a username.
    :param id_type: The type of the authentication (x509, gss, userpass, ssh, saml).
    :param email: The Email address associated with the identity.
    :param issuer: The issuer account.
    :param default: If True, the account should be used by default with the provided identity.
    :param password: Password if id_type is userpass.
    :param vo: the VO to act on.
    :param session: The database session in use.
    """
    kwargs = {}
    root_vo = vo_core.map_vo(root_vo)
    if not has_permission(issuer=issuer, vo=vo, action='recover_vo_root_identity', kwargs=kwargs, session=session):
        raise exception.AccessDenied('Account %s can not recover root identity' % (issuer))
    account = InternalAccount('root', vo=root_vo)
    return identity.add_account_identity(identity=identity_key, type_=IdentityType[id_type.upper()], default=default,
                                         email=email, account=account, password=password, session=session)