Skip to content
ENExplore Calculators

OpenStack Keystone Resource Calculator

Estimate Keystone identity load: users, role assignments, service catalog endpoints and token validations per second.

About OpenStack Keystone Resource Calculator

Keystone load is driven by validation, not by login: every other OpenStack service revalidates the token on each request, so the busiest path is the read side. Fernet tokens are cryptographically verifiable and therefore not stored in the database, but the service catalog is still embedded in the token response, which is why endpoint count directly inflates every payload. Keystone is on the critical path of every API call in the cloud, so a Keystone that cannot keep up makes Nova, Neutron and Cinder all appear broken at once.

Formula

OpenStack Keystone Resource

validations per second = users × API calls per hour ÷ 3600; live tokens = users × logins per hour × token lifetime; catalog endpoints = services × regions × interfaces.

validations per second
Every authenticated API call revalidates its token with Keystone
live tokens
Concurrently valid tokens, a function of issuance rate and lifetime
catalog endpoints
Rows returned in every token response, so they inflate payload size

Worked example

With the default values below, OpenStack Keystone Resource Calculator returns Token Validations per Second of 16.00. Change any input above and every figure here is recalculated in your browser.

Inputs used

Projects (tenants)accepts 1–20,000 projects
40 projects
Users per projectaccepts 1–5,000 users
12 users
Role assignments per useraccepts 1–20 roles
2 roles
Services in the catalogaccepts 1–60 services
12 services
Regionsaccepts 1–20 regions
2 regions
Endpoint interfaces per serviceaccepts 1–3 interfaces
3 interfaces
API calls per user per houraccepts 1–100,000 calls
120 calls
New token requests per user per houraccepts 0–1,000 logins
6 logins
Token lifetimeaccepts 0.25–24 hours
1 hours

Results

Token Validations per Second
16.00 req/s
Total Users
480 users
Role Assignment Rows
960 assignments
Catalog Endpoints
72 endpoints
Tokens Valid at Any Moment
2,880 tokens
Keystone Sizing Verdict
Light load — a standard three-worker Keystone deployment is sufficient

Step by step

  1. 1Values used
  2. 2OpenStack Keystone Resource
  3. 3Token Validations per Second= 16.00 req/s
  4. 4Total Users= 480 users
  5. 5Role Assignment Rows= 960 assignments
  6. 6Catalog Endpoints= 72 endpoints
  7. 7Tokens Valid at Any Moment= 2,880 tokens
  8. 8Keystone Sizing Verdict= Light load — a standard three-worker Keystone deployment is sufficient

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is OpenStack Keystone Resource calculated?

validations per second = users × API calls per hour ÷ 3600; live tokens = users × logins per hour × token lifetime; catalog endpoints = services × regions × interfaces. Keystone load is driven by validation, not by login: every other OpenStack service revalidates the token on each request, so the busiest path is the read side. Fernet tokens are cryptographically verifiable and therefore not stored in the database, but the service catalog is still embedded in the token response, which is why endpoint count directly inflates every payload.

Why does OpenStack Keystone Resource matter?

Keystone is on the critical path of every API call in the cloud, so a Keystone that cannot keep up makes Nova, Neutron and Cinder all appear broken at once.

What values do I need to enter?

This calculator takes 9 inputs: Projects (tenants), Users per project, Role assignments per user, Services in the catalog, Regions, Endpoint interfaces per service, API calls per user per hour, New token requests per user per hour, Token lifetime. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does the endpoint count affect performance?

A scoped token response embeds the whole service catalog. With twelve services across two regions and three interfaces that is 72 endpoint entries in every response, which is why large multi-region clouds enable catalog filtering or cut back the interfaces they publish.

Related Calculators

OpenStack Keystone Resource Calculator | Calcrivo