> - deferred_auth_method = trusts is the default (since kilo)
> - heat_stack_owner is no longer required because by default we delegate
> all roles, since Launchpad bug #1376562 was fixed.
You also need to configure heat to use keystone v3. Packstack, at least as
of Kilo, was still configuring keystone v2.0 by default, see
https://bugs.launchpad.net/packstack/+bug/1464371 (my bug report) Trust
delegation requires the v3 API, unless I've missed something.
I found from one of my coworkers that the v2.0 API supports trusts,
but only from the external API endpoint, not the internal. If the VM has
a route to the external API, you can use v2.0, but otherwise need v3.
So, I did miss something.
Regards,
John Haller