patch keystone trusted_dashboard setting

we need to update keystone's trusted_dashboard setting post deployment
because puppet-keystone does not support multi-valued options

playbooks/postdeploy.yml

@@ -1,3 +1,7 @@
 ---
-- import_playbook: fetch-overcloud-credentials.yml
-- import_playbook: create-overcloud-resources.yml
+- hosts: controller
+  tasks:
+    - name: patch keystone trusted_dashboard
+      include_role:
+        name: patch_keystone
+        tasks_from: patch_trusted_dashboard.yml

playbooks/roles/patch_keystone/files/keystone-conf-trusted_dashboard.patch

@@ -0,0 +1,15 @@
+--- keystone.conf       2020-02-21 13:22:40.532273711 -0500
++++ /var/lib/config-data-backup/keystone/etc/keystone/keystone.conf     2020-02-14 11:16:36.848923953 -0500
+@@ -978,9 +978,11 @@
+ # configuration option may be repeated for multiple values. You must set this
+ # in order to use web-based SSO flows. For example:
+ # trusted_dashboard=https://acme.example.com/auth/websso
+-trusted_dashboard=http://onboarding.massopen.cloud/auth/websso/
+ # trusted_dashboard=https://beta.example.com/auth/websso (multi valued)
+ #trusted_dashboard =
++trusted_dashboard=http://onboarding.massopen.cloud/auth/websso/
++trusted_dashboard=https://onboarding.massopen.cloud/auth/websso/
++trusted_dashboard=https://kaizen.massopen.cloud/dashboard/auth/websso/
+
+ # Absolute path to an HTML file used as a Single Sign-On callback handler. This
+ # page is expected to redirect the user from keystone back to a trusted

playbooks/roles/patch_keystone/handlers/main.yml

@@ -0,0 +1,3 @@
+---
+- name: restart keystone
+  command: docker restart keystone

playbooks/roles/patch_keystone/tasks/patch_trusted_dashboard.yml

@@ -0,0 +1,15 @@
+---
+- name: patch keystone trusted_dashboard
+  tags: [keystone]
+  command: >-
+    patch {{ patch_args|default('') }} -r - --batch --forward {{ item }}
+  args:
+    stdin: >-
+      {{ lookup('file', 'keystone-conf-trusted_dashboard.patch') }}
+  register: result
+  changed_when: result.rc == 0
+  failed_when: result.rc != 0 and 'previously applied' not in result.stdout
+  loop:
+    - /var/lib/config-data/keystone/etc/keystone/keystone.conf
+    - /var/lib/config-data/puppet-generated/keystone/etc/keystone/keystone.conf
+  notify: restart keystone