OpenStack Keystone Resource Calculator

validations per second = users × API calls per hour ÷ 3600; live tokens = users × logins per hour × token lifetime; catalog endpoints = services × regions × interfaces. Keystone load is driven by validation, not by login: every other OpenStack service revalidates the token on each request, so the busiest path is the read side. Fernet tokens are cryptographically verifiable and therefore not stored in the database, but the service catalog is still embedded in the token response, which is why endpoint count directly inflates every payload.

Keystone is on the critical path of every API call in the cloud, so a Keystone that cannot keep up makes Nova, Neutron and Cinder all appear broken at once.

This calculator takes 9 inputs: Projects (tenants), Users per project, Role assignments per user, Services in the catalog, Regions, Endpoint interfaces per service, API calls per user per hour, New token requests per user per hour, Token lifetime. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

A scoped token response embeds the whole service catalog. With twelve services across two regions and three interfaces that is 72 endpoint entries in every response, which is why large multi-region clouds enable catalog filtering or cut back the interfaces they publish.