creating a keystone_domain can make it the default even though is_default is false

We're trying to create a new domain, for Heat, for our OpenStack deployment. In this catalog we are not defining the default_domain variable in keystone's init.pp. That seems to be relevant but is perhaps not.

Here is our manifest:

...
  $heat_api_cfn_enabled = hiera('heat_api_cfn_enabled', false),
  $heat_domain_enabled = hiera('heat_domain_enabled', false),
  $heat_domain_name = 'heat',
  $heat_domain_admin = 'heat_admin',
  $heat_domain_admin_email = 'heat_admin@localhost',
  $heat_domain_password = hiera('heat_domain_password', undef),
...

    ensure_resource('keystone_domain', $heat_domain_name, {
      'ensure' => 'present',
      'enabled' => true,
    })
    ensure_resource('keystone_user', "${heat_domain_admin}::${heat_domain_name}", {
      'ensure' => 'present',
      'enabled' => true,
      'email' => $heat_domain_admin_email,
      'password' => $heat_domain_password,
    })
    ensure_resource('keystone_user_role', "${heat_domain_admin}::${heat_domain_name}@::${heat_domain_name}", {
      'roles' => ['admin'],
    })

Here is the output, note the last line warning and note how what puppet thinks the default_domain_id is:

DEBUG[default_domain_id/in]:
DEBUG[default_domain_from_ini_file]: default
DEBUG[default_domain_id/out]: default
Debug: Executing '/usr/bin/openstack project list --quiet --format csv --long'
Debug: Executing '/usr/bin/openstack domain list --quiet --format csv'
Debug: Prefetching openstack resources for keystone_role
Debug: Executing '/usr/bin/openstack role list --quiet --format csv'
Debug: Prefetching openstack resources for keystone_domain
Debug: Executing '/usr/bin/openstack domain list --quiet --format csv'
DEBUG[default_domain_id/in]: default
DEBUG[default_domain_id/out]: default
Debug: Executing '/usr/bin/openstack domain create --format shell heat --enable'
DEBUG[default_domain_id/in]: default
DEBUG[default_domain_id/out]: default
Notice: /Stage[main]/Cirrus::Profile::Keystone/Keystone_domain[heat]/ensure: created
Debug: /Stage[main]/Cirrus::Profile::Keystone/Keystone_domain[heat]: The container Class[Cirrus::Profile::Keystone] will propagate my refresh event
Debug: Prefetching openstack resources for keystone_user
DEBUG[default_domain_id/in]: 637c781d30714a2aa5eefbf437ce738e
DEBUG[default_domain_id/out]: 637c781d30714a2aa5eefbf437ce738e
DEBUG[./lib/puppet/provider/keystone_user/openstack.rb]
DEBUG[default_domain_id/in]: 637c781d30714a2aa5eefbf437ce738e
DEBUG[default_domain_id/out]: 637c781d30714a2aa5eefbf437ce738e
Warning: Puppet::Type::Keystone_user::ProviderOpenstack: Support for a resource without the domain set is deprecated in Liberty cycle. It will be dropped in the M-cycle. Currently using 'Default' as default domain name while the default domain id is '637c781d30714a2aa5eefbf437ce738e'.