We are using keystone as a global service and hence its centre of universe .
Any api calls internal or via customer for the OpenStack cloud has to go via keystone for auth which internally calls ldap and ,etc.
Also keystone is running on a seperate box , seperate from other OpenStack components.
Need some approvals to post architecture related data and hence just briefed as above to give some insight.