Behind the Scenes of OpenStack Microservice Architecture
OpenStack has evolved into one of the most powerful and flexible open-source cloud platforms available today. OpenStack offers a modular and scalable framework for building private, public, and hybrid clouds with lots of innovation and flexibility. Its modular, microservices-based architecture is one of the key reasons behind its scalability, flexibility, and widespread adoption across enterprises and service providers.
In this article, we’ll take a fresh look at the core components of OpenStack’s microservices architecture, how they interact, and why this design is essential for modern cloud environments.
If you’re new to OpenStack, you may want to start with our introductory guide in the OpenStack series 👉🏼here.
What Is Microservices Architecture?
Imagine trying to run an entire city from a single control room. Every decision—traffic lights, electricity, water supply—would depend on one massive, centralized system. If something goes wrong, everything goes down with it. That’s essentially how traditional monolithic architectures work.
Microservices architecture takes a very different approach. Instead of building one large, tightly connected system, it breaks everything down into smaller, independent services. Each of these services has a clear responsibility and communicates with others through APIs. Think of it more like a well-organized city where each department – transport, utilities, emergency services – operates independently but collaborates when needed.
This independence is what makes microservices so powerful. Each service can be developed, updated, deployed, and scaled on its own timeline without disrupting the rest of the system. Teams can work in parallel, improvements can be rolled out faster, and issues can be contained more effectively.
In the context of OpenStack, this means that instead of one giant cloud engine, OpenStack works as a collection of specialized services. Each core functionality – compute, networking, storage, identity, and more – is handled by its own dedicated service. Each service focuses on doing one job well, while APIs tie everything together into a cohesive cloud platform.
Why does Microservice Architecture matter?
A Microservice Architecture directly impacts how your infrastructure behaves under real-world conditions. When demand increases, you don’t need to scale the entire platform; you can scale only the services that are under pressure, i.e. compute or networking. When you want to introduce a new feature or upgrade a component, you can do so without risking downtime across the entire system. And if something fails, the impact is usually contained to a single service rather than cascading across your entire environment.
Another major advantage is extensibility. Because services communicate through well-defined APIs, it becomes much easier to integrate third-party tools, automation frameworks, or custom-built solutions. This is especially valuable in modern cloud environments, where flexibility and interoperability are key.
In short, microservices improve your system’s:
- Scalability: Services can scale independently based on demand
- Flexibility: Components can be replaced or upgraded without affecting the entire system
- Resilience: Failures are isolated to individual services
- Extensibility: Easier integration with third-party tools and custom solutions
Core OpenStack Services (Main Components)
Nova (Compute)
Nova serves as the compute engine of OpenStack, responsible for provisioning and managing virtual machines (VMs). It manages compute capacity by creating, scheduling, migrating and deleting resources. It enables the automation of resources that are responsible for the virtualization of services and high-performance computing. Nova supports multiple hypervisors (KVM, Xen, ESXi, Hyper-V) with most clouds relying on KVM.
Leveraging Nova, users can launch, terminate, and resize compute instances on-demand, while administrators gain granular control over compute resources, ensuring optimal performance and resource utilization with VM dynamic scheduling and live-migration capabilities.
Nova’s responsibilities in a 🌰:
- Hypervisor interaction
- Instance scheduling and VM lifecycle management
- Scaling compute workloads
- Migrating VMs between hypervisors
Neutron (Networking)
Neutron serves as the networking component of OpenStack, enabling creation and management of virtual networks, routers, and security groups. It is an API driven service that manages everything related to software defined networks, ports and Floating IP addresses allowing strong isolation between the tenants and projects inside of OpenStack cloud. It implements Virtual Routing and Forwarding (VRF), Distributed routing, supports Static & Dynamic routing, L2 Gateway and separate routing tables.
By abstracting network resources and providing APIs for network configuration, Neutron empowers users to build complex network topologies and establish secure connectivity between cloud instances and external networks.
Neutron’s Key features in a 🌰:
- Software-defined networking (SDN)
- Tenant Network isolation
- Firewall services
- Site-to-site VPN services
- IPAM and more
Cinder (Block Storage)
Cinder offers block storage services for OpenStack, delivering persistent storage volumes for VMs and containers. Storage that is made accessible using a self-service API and attaching/detaching volumes works “hot-plug”, meaning that you don’t need to stop a running VM in order to perform any operations including snapshots.
With Cinder, users can create, attach, detach, snapshot and backup block storage volumes independently of compute instances, providing scalable and reliable storage solutions for diverse workloads. Users are able to define and manage the amount of cloud storage required for their VMs.
Cinder supports more than 30 storage backends including Ceph, Dell Power Storage, Huawei, IBM Spectrum, LinBIT, NetApp ONTAP, Pure Storage, StorPool and more, meaning you can easily integrate any of existing storage into OpenStack cloud without the need to invest into new hardware or a software-defined storage solution.
Cinder’s Key features in a 🌰:
- Volume management
- Snapshot and backup capabilities
- Integration with various storage backends via drivers
Keystone (Identity)
Keystone acts as the identity service of OpenStack, providing authentication, authorization, and federation services for users, services, and resources. It is responsible for all types of authentications and authorizations in OpenStack and supports LDAP, 2-Factor authentication, Keycloak integration, JWS/JWT and Fernet tokens.
By centralizing identity management, Keystone enables secure access control and single sign-on across all OpenStack services, ensuring robust security and compliance of your cloud. A flexible policy engine is an essential part of each OpenStack service allowing a high degree of customization and implementation of RBAC (Role Based Access Control) policies according to your organization structure or security and audit requirements.
Keystone’s Key features in a 🌰:
- Token-based authentication for all API interactions
- User, role and group management
- Management of multi-tenancy hierarchy (Domains, Projects, Sub-Domains)
- Service catalog (list of available OpenStack services in cloud)
- Federation with other identity providers (e.g. Entra ID, LDAP, Keycloak, etc.)
Glance (Image Service)
Glance serves as the image service of OpenStack, facilitating the discovery, registration, and retrieval of virtual machine images through the network. These images are kept in a wide range of supported back-end systems with object storage such as Swift, S3 or Ceph RBD being the most popular ones.
By maintaining a catalog of pre-configured images, Glance streamlines the deployment process and allows launching instances from standardized images with ease. It allows users and admins to import and export images in different formats (Raw, VHD, VMDK, QCOW2, AMI) supporting all kinds of hypervisors including the most popular choice which is KVM.
Last, but not least – Glance supports image signing and does validation of signatures to ensure security of your cloud and prevent possible supply chain attacks.
Glance’s Key features in a 🌰:
- Image discovery and retrieval
- Image storage integration
- Versioning support
- Image metadata that helps Nova to apply special settings (e.g. for Windows VMs)
Horizon (Dashboard)
Horizon provides a web-based dashboard interface for OpenStack, offering administrators and users a unified place for managing and monitoring all cloud resources. With Horizon, users can visualize and control their OpenStack Projects by creating and managing VMs, Volumes, Networks and more.
Horizon is based on the popular Django web framework and it allows customization such as change of theme and use of own colors and logos to personalize Cloud experience for your organization.
Horizon’s Key features in a 🌰:
- User-friendly dashboard
- Administrative controls in a separate view
- Self-service provisioning of all resources (VMs, Block storage, Networks, Routers, etc.)
Barbican
(Key Management)
Barbican is OpenStack’s key management service, designed to manage and store security secrets such as encryption keys, certificates, and passwords. By providing a centralized, secure repository for managing sensitive information, Barbican enhances the security posture of OpenStack deployments, ensuring that cryptographic keys and other secrets are handled with the highest levels of security.
Barbican’s Key features in a 🌰:
- Secure storage of secrets (keys, certificates, credentials)
- Support for Hardware Security Modules (HSMs)
- Nova integrates with Barbican to do disk encryption
- Octavia (LBaaS) can fetch SSL certificates from Barbican for its load balancers
Heat (Orchestration)
Heat is OpenStack’s orchestration service, allowing users to define and manage infrastructure as code (IaC) through templates. By automating the deployment and scaling cloud resources, Heat streamlines the process of provisioning complex applications and services on OpenStack, enhancing agility and efficiency. Using IaC is considered industry best practice and promotes team collaboration, makes deployments faster and reduces human errors.
OpenStack Heat supports CloudFormation templates well-known to AWS users and thus making migration from AWS to OpenStack easier.
Heat’s Key features in a 🌰:
- Infrastructure as Code (IaC) using templates
- Automated provisioning of complex environments
- Dependency management between resources (e.g. VMs and Load Balancers)
Swift (Object Storage)
Swift is an object storage service that provides a horizontally scalable and durable object storage solution. It has high fault tolerance capabilities for storing and retrieving large volumes of unstructured data with the help of Restful API similar to Simple Storage Service (AWS S3) API that is the de-facto industry standard today.
Swift enables users to store data as objects in containers, facilitating seamless access and replication across distributed storage clusters. Being a distributed storage, it is also used to provide redundant storage within servers that are clustered together. It is perfectly capable of managing petabytes of data.
While Swift was one of the first OpenStack components and is production-ready, many companies prefer to use native S3 API for Object Storage provided by Ceph – an open source software defined storage solution often used together with OpenStack. It is also possible to enable AWS S3-compatibility middleware for Swift, however it tends to be slower compared to native Swift API.
Swift’s Key features are in a 🌰:
- Highly scalable storage
- Data redundancy and durability
- RESTful API access
How These Services Work Together
Each OpenStack service communicates via HTTP REST APIs and most of the services use AMQP queues based on RabbitMQ for communication within a single service. A MySQL or compatible database is necessary for keeping persistent information about the state of the cloud such as project names, users, roles, virtual machine names, network ip ranges, etc. This loose coupling is what enables OpenStack to function as a microservices-based platform. Schematically this architecture is shown on the diagram below:
Let’s check a typical VM provisioning scenario. A user or administrator logs into the web dashboard such as OpenStack Horizon or Skyline. The user must be authenticated via a supported method which is a username and password by default, but could also be an SSO with OIDC or LDAP as an example. (Alternatively, an OpenStack CLI or IaC tools such as OpenTofu or Ansible can be used to interact with OpenStack.)
Every API request in OpenStack has to be verified by the Keystone Identity. This happens not only during web UI login, but also when a user is requesting a new VM or lists existing VMs in the project. Behind the scenes, when a new VM is requested, the following happens:
- Keystone authenticates the request
- Nova schedules the instance according to requested AZ, flavor and finds an optimal hypervisor in the cloud depending on the current state
- Neutron provisions a virtual port and does port binding to the network requested
- Glance provides the base image for OS
- Cinder provisions and mounts block storage for the VM
- VM becomes active in OpenStack Nova and the dashboard
This orchestration happens seamlessly and takes on average 30-60 seconds. In case the process didn’t succeed at some stage, OpenStack Nova will retry 3 times (by default) to possibly provision a VM on another hypervisor. Should those attempts fail, the VM will go into an error state with an error message for troubleshooting.
OpenStack Use Cases: Where This Architecture Shines
While the architecture itself is powerful, its real value becomes clear in practical deployments. OpenStack is used across a wide range of industries and scenarios, including:
- Private cloud environments
- Public cloud environments
- Telecom and NFV
- Edge computing
- AI/ML/HPC infrastructure
- VMware alternative
To explore these in more detail, check out our dedicated article on OpenStack use cases and data center infrastructure.
How Cloudification Leverages OpenStack
At Cloudification, we build modern private cloud environments using OpenStack as a core technology. Our c12n platform combines OpenStack with other open-source tools like Kubernetes and Ceph to deliver a fully automated and production-ready cloud solution.
The microservices nature of OpenStack allows us to:
- Customize deployments to fit specific customer needs
- Integrate seamlessly with Kubernetes-based workloads
- Optimize performance and cost efficiency
- Avoid vendor lock-in
This approach enables organizations to transition away from proprietary platforms while maintaining full control over their infrastructure.
Conclusion
OpenStack’s microservices architecture is a key factor in its success as a cloud platform. By breaking down complex cloud functionality into independent, interoperable services, it provides unmatched flexibility, scalability, and resilience.
Whether you’re building a private cloud, modernizing your infrastructure, or exploring alternatives to traditional virtualization platforms, OpenStack offers a powerful foundation.
👉 Want to see how OpenStack can work for your organization?
Explore Cloudification’s c12n private cloud solution and discover how we can help you design, deploy, and operate a fully open, future-proof cloud environment.
