To clarify for others reading... the fix ideas are concerned with allowing multiple services (e.g. glance and keystone) to share the same vip (whether it be admin, public or private).  I think it is still open to debate whether it is a good thing or not to allow that.  Having services on separate vip's allows for finer grained load-balancing on the frontend side (distributing the vips among the cluster nodes) so enforcing that might not be a bad thing.

There isn't an easy way to do 1 or 2 in this puppet manifest (maybe not a hard way either).  If we were to make this a puppet provider instead, then we could stick whatever logic we wanted in there.  If we stick with manifests, we could do number 2 by using exec's with "onlyif" logic instead of pacemaker::resource::ip (which right now are pretty much just exec's anyway).