Comment 8 for bug 1591962

The actual way in which this would be implemented would be a binding for the Juju Controller into a given space.
There are a few considerations:
1) "juju" the client also talks to the controller from your laptop. So only exposing OS-MGMT addresses may mean that you could no-longer run Juju commands. We could try to split the values into GUI vs Client vs Agent APIs.

It may be that we advertise all of the values, but give preference to the ones that fit a given subset? (Or at least always listen on all addresses, if we don't advertise them.)

2) For the other question about Controller reaching Agents, agents other than the Controller don't actually listen on a port. Its possible we would try to SSH, but the last checks we've seen said that Agents do the right thing and watch for actions/juju run requests rather than needing to be dialed from the controller.
It seems there might still be a bug there, but it should be considered independent from this bug.