Comment 1 for bug 1630949

This is not how Keystone V3 is supposed to be disabled. The auth configuration for service users is generated during puppet run, and presumably all components in all their config files have auth_url or such pointing to Keystone v2.

The only way this could possibly work is if all components used keystoneauth lib and its auth_plugins, with dynamic auth_plugin "password" configured, which will choose V2/V3 depending on their availability. AFAIK not all components do this, and I am actually not sure this would work at all.

BTW, AFAIK in upstream there is no integration job (testing multiple components at once) that has Keystone V2 completely disabled, so re actual support for running the whole cloud on Keystone V3 only we are in a bit grey area for now.