diff --git a/README.rst b/README.rst
index 549b68d..aae1c04 100644
--- a/README.rst
+++ b/README.rst
@@ -52,6 +52,9 @@
           user: nova
           password: pwd
           tenant: service
+          interface: internal
+          valid_interfaces:
+          - internal
         message_queue:
           engine: rabbitmq
           host: 127.0.0.1
diff --git a/nova/files/pike/nova-controller.conf.Debian b/nova/files/pike/nova-controller.conf.Debian
index eb4ef50..f92a2bf 100644
--- a/nova/files/pike/nova-controller.conf.Debian
+++ b/nova/files/pike/nova-controller.conf.Debian
@@ -5790,6 +5790,15 @@
 #reauthenticate=true
 
 
+[keystone]
+interface = {{ controller.identity.get('interface', 'internal') }}
+{%- if controller.identity.valid_interfaces is defined %}
+{%-   set valid_interfaces = controller.identity.valid_interfaces|join(',') %}
+{%- else %}
+{%-   set valid_interfaces = 'internal' %}
+{%- endif %}
+valid_interfaces = {{ valid_interfaces }}
+
 [keystone_authtoken]
 
 #
diff --git a/nova/files/queens/nova-controller.conf.Debian b/nova/files/queens/nova-controller.conf.Debian
index 24c1404..af8f7f9 100644
--- a/nova/files/queens/nova-controller.conf.Debian
+++ b/nova/files/queens/nova-controller.conf.Debian
@@ -6092,6 +6092,9 @@
 # List of interfaces, in order of preference, for endpoint URL. (list
 # value)
 #valid_interfaces = internal,public
+{%- if controller.identity.valid_interfaces is defined %}
+valid_interfaces = {{ controller.identity.valid_interfaces|join(',') }}
+{%- endif %}
 
 # The default region_name for endpoint URL discovery. (string value)
 #region_name = <None>