heat-container-agent fails to communicate with Keystone.

We should check and support configuring deploy_auth_url to public
Just for reference deploy_auth_url is being taken from here:- https://github.com/openstack/heat/blob/bdddeee60212627b3beed41ca5ef5be56fd05b50/heat/common/context.py#L222-L233

I had the same problem with a k8s cluster.

These two helped me fix the problem:
https://ask.openstack.org/en/question/102214/software-deployment-in-heat-problem-with-os-collect-config/
https://bugs.launchpad.net/kolla-ansible/+bug/1762754

The problem was actually in heat config, not magnum.

This was fixed in here:

https://review.openstack.org/#/c/615916/

The root cause of the issue is hostname/DNS resolution fails for auth-URLs & few other service URLS (magnum,heat etc).
Generally while configuring the OpenStack services we use "controller" instead of the IP, like example:

For Keystone:
keystone-manage bootstrap --bootstrap-password ADMIN_PASS \
  --bootstrap-admin-url http://controller:5000/v3/ \
  --bootstrap-internal-url http://controller:5000/v3/ \
  --bootstrap-public-url http://controller:5000/v3/ \
  --bootstrap-region-id RegionOne

For Magnum:
openstack endpoint create --region RegionOne \
  container-infra public http://controller:9511/v1

So when the k8s master node gets provisioned (as VM) it creates couple of containers, "heat-container-agent" which interns use those able mentioned configs to get the k8s registered & configured with the OpenStack. As the container can't resolve the "controller" DNS entry, so all communications with OpenStack API fails. So there are couple of fixes for this:
1. Configure an internal DNS so resolute the "controller" URLs or
2. Use IP instead of "controller" in those able mentioned configs.

Option 2 is for POC & #1 should be considered for the production or HA OpenStack clusters.

I have same issue but on different heat (during kube master deployment it stuck in CREATE_IN_PROGRESS).

In my case i have HAProxy running on privet IP range which is not routable and magnum kubernetes trying to deploy master and its trying to talk to keystone and failing because its not on public network where it can talk to keystone. Is there a way to disable keystone dependency from kubernetes?