postgresql: how do I dump and restore roles for a cluster?
From the CREATE ROLE documentation:


  Note that roles are defined at the database cluster level, and so are valid in all databases in the cluster.


Since pg_dump dumps a single database, you can't extract roles with that utility.  The pg_dumpall --roles-only command you proposed will do the work - however you may need to filter its output so that only desired roles will be created in the new cluster.

Roles are stored in the pg_authid catalog, which is physically stored in the data/global/ subfolder of a PostgreSQL installation, together with the other cluster-wide tables. You can query the contents of pg_authid through the pg_roles view. 

NOTE: you will need superuser rights to dump the roles.  Otherwise, you'd get a permission denied on SELECT on pg_authid - and even when a superuser grants SELECT rights, you'd get the same error.  In this case, however, you can list the roles by querying pg_authid directly, COPY it to a file and roll some magic to create the necessary CREATE ROLE and ALTER ROLE statements.