bind_host is deprecated use admin_bind_host

If admin_bind_host is restricted the something else
then 0.0.0.0 or 127.0.0.1, the keystone manifest fails
since the client tries to connect to 127.0.0.0 -
which is not bound:

(/Stage[main]/Keystone::Roles::Admin/Keystone_role[_member_]) Could not evaluate: Execution of '/usr/bin/keystone --os-endpoint http://127.0.0.1:35357/v2.0/ role-list' returned 1: Unable to establish connection to http://127.0.0.1:35357/v2.0/OS-KSADM/roles