I think this goes beyond the Fernet issues - on a single node Train (Centos7) deploy I see the same issue. It is sporadic - sometimes for example a keystone endpoint list works and others not. As soon as I restart Keystone the issue is gone.

It appears to be related to two keystone calls in close proximity. A keystone token issue never fails. An endpoint list always gets a token, but then the GET/v3/endpoints fails. An example:

```====  # openstack endpoint list (FAILS) ==================



	==> keystone-apache-admin-access.log <==                                                                                                                      
	192.168.33.2 - - [29/Jun/2020:16:29:15 +0000] "GET /v3 HTTP/1.1" 200 253 3251 "-" "openstacksdk/0.36.3 keystoneauth1/3.17.2 python-requests/2.22.0 CPython/2.7
	.5"                                                                                                                                                           
	192.168.33.2 - - [29/Jun/2020:16:29:15 +0000] "POST /v3/auth/tokens HTTP/1.1" 201 2347 331455 "-" "openstacksdk/0.36.3 keystoneauth1/3.17.2 python-requests/2.
	22.0 CPython/2.7.5"                                                                                                                                           
	192.168.33.2 - - [29/Jun/2020:16:29:16 +0000] "POST /v3/auth/tokens HTTP/1.1" 201 2347 341851 "-" "openstacksdk/0.36.3 keystoneauth1/3.17.2 python-requests/2.
	22.0 CPython/2.7.5"                                                                                                                                           
		                                                                                                                                                      
	==> keystone-apache-public-access.log <==                                                                                                                     
	192.168.33.2 - - [29/Jun/2020:16:29:16 +0000] "GET / HTTP/1.1" 300 267 2879 "-" "openstacksdk/0.36.3 keystoneauth1/3.17.2 python-requests/2.22.0 CPython/2.7.5
	"                                                                                                                                                             
	192.168.33.2 - - [29/Jun/2020:16:29:16 +0000] "GET /v3/endpoints HTTP/1.1" 200 2926 37411 "-" "python-keystoneclient"                                         
		                                                                                                                                                      
	==> keystone-apache-public-error.log <==                                                                                                                      
	2020-06-29 16:29:16.734104 mod_wsgi (pid=23): Target WSGI script '/usr/bin/keystone-wsgi-public' cannot be loaded as Python module.                           
	2020-06-29 16:29:16.734150 mod_wsgi (pid=23): Exception occurred processing WSGI script '/usr/bin/keystone-wsgi-public'.                                      
	2020-06-29 16:29:16.734195 Traceback (most recent call last):                                                                                                 
	2020-06-29 16:29:16.734240   File "/usr/bin/keystone-wsgi-public", line 52, in <module>                                                                       
	2020-06-29 16:29:16.734312     application = initialize_public_application()                                                                                  
	2020-06-29 16:29:16.734336   File "/usr/lib/python2.7/site-packages/keystone/server/wsgi.py", line 24, in initialize_public_application                       
	2020-06-29 16:29:16.734364     name='public', config_files=flask_core._get_config_files())                                                                    
	2020-06-29 16:29:16.734382   File "/usr/lib/python2.7/site-packages/keystone/server/flask/core.py", line 157, in initialize_application                       
	2020-06-29 16:29:16.734414     keystone.server.configure(config_files=config_files)                                                                           
	2020-06-29 16:29:16.734434   File "/usr/lib/python2.7/site-packages/keystone/server/__init__.py", line 28, in configure                                       
	2020-06-29 16:29:16.734471     keystone.conf.configure()                                                                                                      
	2020-06-29 16:29:16.734489   File "/usr/lib/python2.7/site-packages/keystone/conf/__init__.py", line 137, in configure                                        
	2020-06-29 16:29:16.734512     deprecated_since=versionutils.deprecated.STEIN))                                                                               
	2020-06-29 16:29:16.734530   File "/usr/lib/python2.7/site-packages/oslo_config/cfg.py", line 2055, in __inner                                                
	2020-06-29 16:29:16.734553     result = f(self, *args, **kwargs)                                                                                              
	2020-06-29 16:29:16.734570   File "/usr/lib/python2.7/site-packages/oslo_config/cfg.py", line 2333, in register_cli_opt                                       
	2020-06-29 16:29:16.734602     raise ArgsAlreadyParsedError("cannot register CLI option")                                                                     
	2020-06-29 16:29:16.734637 ArgsAlreadyParsedError: arguments already parsed: cannot register CLI option                                                       
		                                                                                                                                                      
	==> keystone-apache-public-access.log <==                                                                                                                     
	192.168.33.2 - - [29/Jun/2020:16:29:16 +0000] "GET /v3/services HTTP/1.1" 500 527 1924 "-" "python-keystoneclient"                           

====  # openstack endpoint list (WORKS) ==================       
                                                                                                                                                              
	==> keystone-apache-admin-access.log <==                                                                                                                      
	192.168.33.2 - - [29/Jun/2020:16:29:21 +0000] "GET /v3 HTTP/1.1" 200 253 2769 "-" "openstacksdk/0.36.3 keystoneauth1/3.17.2 python-requests/2.22.0 CPython/2.7
	.5"                                                                                                                                                           
	192.168.33.2 - - [29/Jun/2020:16:29:21 +0000] "POST /v3/auth/tokens HTTP/1.1" 201 2347 330306 "-" "openstacksdk/0.36.3 keystoneauth1/3.17.2 python-requests/2.
	22.0 CPython/2.7.5"                                                                                                                                           
	192.168.33.2 - - [29/Jun/2020:16:29:21 +0000] "POST /v3/auth/tokens HTTP/1.1" 201 2347 361409 "-" "openstacksdk/0.36.3 keystoneauth1/3.17.2 python-requests/2.
	22.0 CPython/2.7.5"                                                                                                                                           
		                                                                                                                                                      
	==> keystone-apache-public-access.log <==                                                                                                                     
	192.168.33.2 - - [29/Jun/2020:16:29:22 +0000] "GET / HTTP/1.1" 300 267 3450 "-" "openstacksdk/0.36.3 keystoneauth1/3.17.2 python-requests/2.22.0 CPython/2.7.5
	"                                                                                                                                                             
	192.168.33.2 - - [29/Jun/2020:16:29:22 +0000] "GET /v3/endpoints HTTP/1.1" 200 2926 49522 "-" "python-keystoneclient"                                         
		                                                                                                                                                      
	==> keystone.log <==                                                                                                                                          
	2020-06-29 16:29:22.144 24 WARNING py.warnings [req-258fde27-f856-48af-b666-76782cf29da0 eb8fe17826af43bcba56b16f942364df b55a100fe0e548ca9ae39a5a2c2e908c - d
	efault default] /usr/lib/python2.7/site-packages/oslo_policy/policy.py:970: UserWarning: Policy identity:list_services failed scope check. The token used to m
	ake the request was project scoped but the policy requires ['system'] scope. This behavior may change in the future where using the intended scope is required
	  warnings.warn(msg)                                                                                                                                          
		                                                                                                                                                      
		                                                                                                                                                      
	==> keystone-apache-public-error.log <==                                                                                                                      
	2020-06-29 16:29:22.145436 2020-06-29 16:29:22.144 24 WARNING py.warnings [req-258fde27-f856-48af-b666-76782cf29da0 eb8fe17826af43bcba56b16f942364df b55a100fe
	0e548ca9ae39a5a2c2e908c - default default] /usr/lib/python2.7/site-packages/oslo_policy/policy.py:970: UserWarning: Policy identity:list_services failed scope
	 check. The token used to make the request was project scoped but the policy requires ['system'] scope. This behavior may change in the future where using the
	 intended scope is required                                                                                                                                   
	2020-06-29 16:29:22.145476   warnings.warn(msg)                                                                                                               
	2020-06-29 16:29:22.145507 \x1b[00m                                                                                                                           
		                                                                                                                                                      
	==> keystone-apache-public-access.log <==                                                                                                                     
	192.168.33.2 - - [29/Jun/2020:16:29:22 +0000] "GET /v3/services HTTP/1.1" 200 793 36592 "-" "python-keystoneclient"                                           
```