Each openstack service has 3 endpoints interfaces by default(adminURL, internalURL and publicURL). It looks like fog is defaulting to the 'adminURL' over port 35357 on some actions. This can cause issues depending on network access from the foreman server. It would be helpful to be able to set the endpoint type when creating the compute resource. I'm know very little about ruby, but to work around this I have been setting the openstack_endpoint_type manually in the /usr/share/foreman/app/models/compute_resources/foreman/model/openstack.rb file. It used to default to publicURL in the past, but was recently removed all together.

example with foreman on an internally accessible network:

1. grep openstack_endpoint_type /usr/share/foreman/app/models/compute_resources/foreman/model/openstack.rb -B8

   def fog_credentials { :provider => :openstack,
   :openstack_api_key => password,
   :openstack_username => user,
   :openstack_auth_url => url_for_fog,
   :openstack_identity_endpoint => url_for_fog,
   :openstack_user_domain => domain,
   :openstack_endpoint_type => "internalURL",