Oki, I could reproduce the exact same error using:

    include ::openstack_integration
    include ::openstack_integration::repos
    include ::openstack_integration::mysql
    class { '::openstack_integration::keystone':
      using_domain_config => true,
    }
    
    ::keystone::resource::service_identity { 'beaker-ci':
      service_type        => 'beaker',
      service_description => 'beaker service',
      service_name        => 'beaker',
      password            => 'secret',
      public_url          => 'http://127.0.0.1:1234',
      admin_url           => 'http://127.0.0.1:1234',
      internal_url        => 'http://127.0.0.1:1234',
    }
    # v3 admin 
    # we don't use ::keystone::roles::admin but still create resources manually: 
    keystone_domain { 'admin_domain':
      ensure      => present,
      enabled     => true,
      description => 'Domain for admin v3 users',
    }
    keystone_domain { 'service_domain':
      ensure      => present,
      enabled     => true,
      description => 'Domain for admin v3 users',
    }
    keystone_tenant { 'servicesv3::service_domain':
      ensure      => present,
      enabled     => true,
      description => 'Tenant for the openstack services',
    }
    keystone_tenant { 'openstackv3::admin_domain':
      ensure      => present,
      enabled     => true,
      description => 'admin tenant',
    }
    keystone_user { 'adminv3::admin_domain':
      ensure      => present,
      enabled     => true,
      email       => '<email address hidden>',
      password    => 'a_big_secret',
    }
    keystone_user_role { 'adminv3::admin_domain@openstackv3::admin_domain':
      ensure => present,
      roles  => ['admin'],
    }
    # service user exists only in the service_domain - must 
    # use v3 api 
    ::keystone::resource::service_identity { 'beaker-civ3::service_domain':
      service_type        => 'beakerv3',
      service_description => 'beakerv3 service',
      service_name        => 'beakerv3',
      password            => 'secret',
      tenant              => 'servicesv3::service_domain',
      public_url          => 'http://127.0.0.1:1234/v3',
      admin_url           => 'http://127.0.0.1:1234/v3',
      internal_url        => 'http://127.0.0.1:1234/v3',
      user_domain         => 'service_domain',
      project_domain      => 'service_domain',
    }


The (first?) problem here, is that the prefetch of the user resource
comes before the creation of the /root/openrc and (for the first
initial run) uses the admin_token authentication like this:

    #<Puppet::Provider::Openstack::CredentialsV3:0x000000045373d0 @identity_api_version="3", @token="admin_token", @url="http://127.0.0.1:35357/v3">

This fails with a "401" error on the keystone server side.
Prefetching service and domain is not an issue though, as can be seen
on this log:

    Info: /Stage[main]/Apache::Service/Service[httpd]: Unscheduling refresh on Service[httpd]
    Debug: Class[Apache::Service]: The container Stage[main] will propagate my refresh event
    Debug: Prefetching openstack resources for keystone_service
    Debug: Executing '/bin/openstack service list --quiet --format csv --long'
    Debug: Prefetching openstack resources for keystone_domain
    Debug: Executing '/bin/openstack domain list --quiet --format csv'
    Debug: Prefetching openstack resources for keystone_user
    Debug: Executing '/bin/openstack user list --quiet --format csv --long'
    Error: Could not prefetch keystone_user provider 'openstack': Could not authenticate
    Error: Not managing Keystone_user[beaker-civ3] due to earlier Keystone API failures.
    Error: /Stage[main]/Main/Keystone::Resource::Service_identity[beaker-civ3::service_domain]/Keystone_user[beaker-civ3::service_domain]/ensure: change from absent to present failed: Not managing Keystone_user[beake
    r-civ3] due to earlier Keystone API failures.
    Debug: Prefetching openstack resources for keystone_endpoint
    Debug: Executing '/bin/openstack endpoint list --quiet --format csv'
    Debug: Prefetching openstack resources for keystone_tenant
    Debug: Executing '/bin/openstack project list --quiet --format csv --long'
    Debug: Executing '/bin/openstack domain list --quiet --format csv'
    Debug: Prefetching openstack resources for keystone_role
    Debug: Executing '/bin/openstack role list --quiet --format csv'
    Error: Not managing Keystone_user[admin] due to earlier Keystone API failures.
    Error: /Stage[main]/Keystone::Roles::Admin/Keystone_user[admin]/ensure: change from absent to present failed: Not managing Keystone_user[admin] due to earlier Keystone API failures.
    Notice: /Stage[main]/Main/Keystone::Resource::Service_identity[beaker-civ3::service_domain]/Keystone_user_role[beaker-civ3::service_domain@servicesv3::service_domain]: Dependency Keystone_user[beaker-civ3::servic
    e_domain] has failures: true
    Warning: /Stage[main]/Main/Keystone::Resource::Service_identity[beaker-civ3::service_domain]/Keystone_user_role[beaker-civ3::service_domain@servicesv3::service_domain]: Skipping because of failed dependencies
    Error: Not managing Keystone_user[beaker-ci] due to earlier Keystone API failures.
    Error: /Stage[main]/Main/Keystone::Resource::Service_identity[beaker-ci]/Keystone_user[beaker-ci]/ensure: change from absent to present failed: Not managing Keystone_user[beaker-ci] due to earlier Keystone API fa
    ilures.
    Notice: /Stage[main]/Main/Keystone::Resource::Service_identity[beaker-ci]/Keystone_user_role[beaker-ci@services]: Dependency Keystone_user[beaker-ci] has failures: true
    Warning: /Stage[main]/Main/Keystone::Resource::Service_identity[beaker-ci]/Keystone_user_role[beaker-ci@services]: Skipping because of failed dependencies
    Error: Not managing Keystone_user[adminv3] due to earlier Keystone API failures.
    Error: /Stage[main]/Main/Keystone_user[adminv3::admin_domain]/ensure: change from absent to present failed: Not managing Keystone_user[adminv3] due to earlier Keystone API failures.
    Notice: /Stage[main]/Main/Keystone_user_role[adminv3::admin_domain@openstackv3::admin_domain]: Dependency Keystone_user[adminv3::admin_domain] has failures: true
    Warning: /Stage[main]/Main/Keystone_user_role[adminv3::admin_domain@openstackv3::admin_domain]: Skipping because of failed dependencies
    Notice: /Stage[main]/Keystone::Roles::Admin/Keystone_user_role[admin@openstack]: Dependency Keystone_user[admin] has failures: true
    Warning: /Stage[main]/Keystone::Roles::Admin/Keystone_user_role[admin@openstack]: Skipping because of failed dependencies
    Notice: /Stage[main]/Keystone::Disable_admin_token_auth/Ini_subsetting[public_api/admin_token_auth]: Dependency Keystone_user[admin] has failures: true
    Warning: /Stage[main]/Keystone::Disable_admin_token_auth/Ini_subsetting[public_api/admin_token_auth]: Skipping because of failed dependencies
    Notice: /Stage[main]/Keystone::Disable_admin_token_auth/Ini_subsetting[api_v3/admin_token_auth]: Dependency Keystone_user[admin] has failures: true
    Warning: /Stage[main]/Keystone::Disable_admin_token_auth/Ini_subsetting[api_v3/admin_token_auth]: Skipping because of failed dependencies
    Notice: /Stage[main]/Openstack_extras::Auth_file/File[/root/openrc]: Dependency Keystone_user[admin] has failures: true
    Warning: /Stage[main]/Openstack_extras::Auth_file/File[/root/openrc]: Skipping because of failed dependencies
    Notice: /Stage[main]/Keystone::Disable_admin_token_auth/Ini_subsetting[admin_api/admin_token_auth]: Dependency Keystone_user[admin] has failures: true
    Warning: /Stage[main]/Keystone::Disable_admin_token_auth/Ini_subsetting[admin_api/admin_token_auth]: Skipping because of failed dependencies
    Notice: /Stage[main]/Keystone/Exec[restart_keystone]: Dependency Keystone_user[admin] has failures: true
    Warning: /Stage[main]/Keystone/Exec[restart_keystone]: Skipping because of failed dependencies
    Debug: Class[Keystone]: The container Stage[main] will propagate my refresh event
    Debug: Finishing transaction 40131060