So my previous was a red-herring (the public_endpoint and admin_endpoint don't actually affect the where keystone wsgi listens).

The config is correct:

apache2/sites-enabled/wsgi-openstack-api.conf:

# Configuration file maintained by Juju. Local changes may be overwritten.

Listen 35347
Listen 4990
<VirtualHost *:35347>
... etc

However, actual keystone units are listening on those ports:

# lsof | grep 5000
keystone-  2126               keystone   10u     IPv4              23414       0t0        TCP *:5000 (LISTEN)
keystone-  3128               keystone   10u     IPv4              23414       0t0        TCP *:5000 (LISTEN)
keystone-  3129               keystone   10u     IPv4              23414       0t0        TCP *:5000 (LISTEN)

# lsof | grep 35357

keystone-  2126               keystone    9u     IPv4              23413       0t0        TCP *:35357 (LISTEN)
keystone-  3126               keystone    9u     IPv4              23413       0t0        TCP *:35357 (LISTEN)
keystone-  3126               keystone   15u     IPv4             150493       0t0        TCP juju-6afeea-mojo-16.project.serverstack:35357->juju-6afeea-mojo-25.project.serverstack:51114 (ESTABLISHED)
keystone-  3127               keystone    9u     IPv4              23413       0t0        TCP *:35357 (LISTEN)
keystone-  3127               keystone   10u     IPv4             147044       0t0        TCP juju-6afeea-mojo-16.project.serverstack:35357->juju-6afeea-mojo-26.project.serverstack:33835 (ESTABLISHED)
keystone-  3127               keystone   13u     IPv4             155157       0t0        TCP juju-6afeea-mojo-16.project.serverstack:35357->juju-6afeea-mojo-24.project.serverstack:56627 (ESTABLISHED)
keystone-  3127               keystone   16u     IPv4             155159       0t0        TCP juju-6afeea-mojo-16.project.serverstack:35357->juju-6afeea-mojo-25.project.serverstack:52961 (ESTABLISHED)
keystone-  3128               keystone    9u     IPv4              23413       0t0        TCP *:35357 (LISTEN)
keystone-  3129               keystone    9u     IPv4              23413       0t0        TCP *:35357 (LISTEN)


However, it's also listening on the other ports as well (4990 and 35347).

Thus, one hypothesis is that the former are apache processes that weren't shutdown and are left over after a restart.

However, it seems that the keystone.service is starting some services on 5000 and 35357:

root@juju-6afeea-mojo-16:/etc# lsof | egrep keystone.*5000
keystone- 11047               keystone   10u     IPv4             160995       0t0        TCP *:5000 (LISTEN)
keystone- 11062               keystone   10u     IPv4             160995       0t0        TCP *:5000 (LISTEN)
keystone- 11063               keystone   10u     IPv4             160995       0t0        TCP *:5000 (LISTEN)
root@juju-6afeea-mojo-16:/etc# lsof | egrep keystone.*4990
root@juju-6afeea-mojo-16:/etc# lsof | egrep keystone.*35357
keystone- 11047               keystone    9u     IPv4             160994       0t0        TCP *:35357 (LISTEN)
keystone- 11060               keystone    9u     IPv4             160994       0t0        TCP *:35357 (LISTEN)
keystone- 11061               keystone    9u     IPv4             160994       0t0        TCP *:35357 (LISTEN)
keystone- 11062               keystone    9u     IPv4             160994       0t0        TCP *:35357 (LISTEN)
keystone- 11063               keystone    9u     IPv4             160994       0t0        TCP *:35357 (LISTEN)

lsof | egrep keystone.*35347

processes:

keystone 11047  2.5  4.3 142600 65980 ?        Ss   13:42   0:06 /usr/bin/python /usr/bin/keystone-all --config-file=/etc/keystone/keystone.conf --log-file=/var/log/keystone/keystone.log
keystone 11060  0.0  3.9 142600 61172 ?        S    13:42   0:00  \_ /usr/bin/python /usr/bin/keystone-all --config-file=/etc/keystone/keystone.conf --log-file=/var/log/keystone/keystone.log
keystone 11061  0.0  3.9 142600 61172 ?        S    13:42   0:00  \_ /usr/bin/python /usr/bin/keystone-all --config-file=/etc/keystone/keystone.conf --log-file=/var/log/keystone/keystone.log
keystone 11062  0.0  3.9 142600 61176 ?        S    13:42   0:00  \_ /usr/bin/python /usr/bin/keystone-all --config-file=/etc/keystone/keystone.conf --log-file=/var/log/keystone/keystone.log
keystone 11063  0.0  3.9 142600 61176 ?        S    13:42   0:00  \_ /usr/bin/python /usr/bin/keystone-all --config-file=/etc/keystone/keystone.conf --log-file=/var/log/keystone/keystone.log


Which is very confusing.