It's a common scenario that deployers change the keystone admin API from the ctlplane to the external network. They tend to do so by setting the appropriate value in the ServiceNetMap. With an environment that looks as follows:

parameter_defaults:
  ServiceNetMap:
    KeystoneAdminApiNetwork: external

When trying to do so, we get the following error:

overcloud.AllNodesDeploySteps.ControllerDeployment_Step1.0:
  resource_type: OS::Heat::StructuredDeployment
  physical_resource_id: 8a1a8376-07ba-43f8-8dba-8016176fd212
  status: CREATE_FAILED
  status_reason: |
    Error: resources[0]: Deployment to server failed: deploy_status_code : Deployment exited with non-zero status code: 2
  deploy_stdout: |

    PLAY [localhost] ***************************************************************

    TASK [Gathering Facts] *********************************************************
    ok: [localhost]

    TASK [Set host puppet debugging fact string] ***********************************
    ok: [localhost]

    TASK [Write the config_step hieradata] *****************************************
    changed: [localhost]

    TASK [Run puppet host configuration for step 1] ********************************
    ok: [localhost]

    TASK [debug] *******************************************************************
    fatal: [localhost]: FAILED! => {
        "(outputs.stderr|default('')).split('\n')|union(outputs.stdout_lines|default([]))": [
            "exception: connect failed",
            "erlexec: HOME must be set",
            "Warning: Facter: Fact resolution fact='systemd_internal_services', resolution='<anonymous>' resolved to an invalid value: Expected disabled to be one of [Integer, Float, TrueClass, FalseClass, NilCl
ass, String, Array, Hash], but was Symbol",
            "Warning: Undefined variable 'deploy_config_name'; ",
            " (file & line not available)",
            "Warning: ModuleLoader: module 'haproxy' has unresolved dependencies - it will only see those that are resolved. Use 'puppet module list --tree' to see information about modules",
            "Warning: ModuleLoader: module 'mysql' has unresolved dependencies - it will only see those that are resolved. Use 'puppet module list --tree' to see information about modules",
            "Error: Evaluation Error: Operator '[]' is not applicable to an Undef Value. at /etc/puppet/modules/tripleo/manifests/profile/base/keystone.pp:187:27 on node overcloud-controller-0.walrusdomain",
             ...