Comment 1 for bug 1664334

The other issue is the choices in the config option are too restrictive. keystoneauth1 doesn't actually validate the interface values, and 'auth' is a valid value meaning, don't lookup the endpoint in the service catalog, use the configured auth_url instead.

Keystone v3 API validates the endpoint interfaces to be one of admin/public/internal:

https://github.com/openstack/keystone/commit/8ef267c3ee3f0f1e6bdb74da7ed68aeb958e5567

But keystone v2 doesn't, and the keystone v3 schema validation could theoretically change over time so we shouldn't encode that list in nova too when it's already in keystone when you create the endpoint.