Comment 5 for bug 1639996

Reviewed: https://review.openstack.org/493937
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=5222b8d920d5b5b2e87004c10808b6bea597720a
Submitter: Jenkins
Branch: master

commit 5222b8d920d5b5b2e87004c10808b6bea597720a
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Tue Aug 15 19:02:42 2017 +0300

    Remove extra keystone admin haproxy listen and allow TLS

    The current code exposes an unused public listen directive in HAProxy
    for the keystone admin endpoint. This is not ideal and should be
    removed, as it exposes the service unnecessarily. We should stick to
    just exposing it to the ctlplane network as is the default.

    If folks really need to expose it to the public network, they can do so
    by modifying the ServiceNetMap through t-h-t and setting the keystone
    admin endpoint's network to external.

    Now, for "single" or "internal" haproxy endpoints, this adds the ability
    to detect if they're using the external network, and thus use TLS on it.
    Which is something a deployer would want if they exposed the keystone
    admin endpoint in such a way.

    Change-Id: I79563f62fd49a4f7654779157ebda3c239d6dd22
    Closes-Bug: #1710909
    Closes-Bug: #1639996