search for keystone-api role rather than keystone to get correct keystone endpoint