We ought to be able to restart keystone with

# systemctl restart keystone keystone-admin

But a lot of the time one or more keystone processes survive the stop, and continue to respond to API calls. This can result in us having keystone running with two different configs at the same time on a given host, which is a disaster for debugging.

My current silly workaround is to only ever

# systemctl stop keystone keystone-admin
# ps -ef | grep keystone
# kill -9 <parent process of whatever's left>
# ps -ef | grep keystone # are they really all gone?
# systemctl start keystone-keystone-admin

I have no idea what's going wrong; possibly the systemd def is wrong, or possibly keystone is ignoring signals other than -9. In any case, this is VERY annoying.