diff --git a/keystone/server/eventlet.py b/keystone/server/eventlet.py
index 243f0234d6..f016b7f9f4 100644
--- a/keystone/server/eventlet.py
+++ b/keystone/server/eventlet.py
@@ -37,7 +37,7 @@ from keystone.common import utils
 from keystone import config
 from keystone.i18n import _
 from keystone.server import common
-from keystone import service as keystone_service
+from keystone.version import service as keystone_service
 
 
 CONF = cfg.CONF
diff --git a/keystone/server/wsgi.py b/keystone/server/wsgi.py
index 31948330ad..ea12fc19cb 100644
--- a/keystone/server/wsgi.py
+++ b/keystone/server/wsgi.py
@@ -30,7 +30,7 @@ from keystone.common import environment
 from keystone import config
 import keystone.middleware.core as middleware_core
 from keystone.server import common
-from keystone import service as keystone_service
+from keystone.version import service as keystone_service
 
 
 CONF = cfg.CONF
diff --git a/keystone/service.py b/keystone/service.py
index 35b548fa6d..2086973183 100644
--- a/keystone/service.py
+++ b/keystone/service.py
@@ -12,120 +12,50 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import functools
-import sys
+from oslo_log import versionutils
+import six
 
-from oslo_config import cfg
-from oslo_log import log
-from paste import deploy
-import routes
-
-from keystone import assignment
-from keystone import auth
-from keystone import catalog
-from keystone.common import wsgi
-from keystone import controllers
-from keystone import credential
-from keystone import endpoint_policy
-from keystone import identity
-from keystone import policy
-from keystone import resource
-from keystone import routers
-from keystone import token
-from keystone import trust
+from keystone.version import service
 
 
-CONF = cfg.CONF
-LOG = log.getLogger(__name__)
+def deprecated_to_version(f):
+    """Specialized deprecation wrapper for service module.
+
+    This wraps the standard deprecation wrapper and fills in the method
+    names automatically.
+
+    """
+    @six.wraps(f)
+    def wrapper(*args, **kwargs):
+        x = versionutils.deprecated(
+            what='keystone.service.' + f.__name__ + '()',
+            as_of=versionutils.deprecated.MITAKA,
+            remove_in=+2,
+            in_favor_of='keystone.version.service.' + f.__name__ + '()')
+        return x(f)
+    return wrapper()
 
 
-def loadapp(conf, name):
-    # NOTE(blk-u): Save the application being loaded in the controllers module.
-    # This is similar to how public_app_factory() and v3_app_factory()
-    # register the version with the controllers module.
-    controllers.latest_app = deploy.loadapp(conf, name=name)
-    return controllers.latest_app
-
-
-def fail_gracefully(f):
-    """Logs exceptions and aborts."""
-    @functools.wraps(f)
-    def wrapper(*args, **kw):
-        try:
-            return f(*args, **kw)
-        except Exception as e:
-            LOG.debug(e, exc_info=True)
-
-            # exception message is printed to all logs
-            LOG.critical(e)
-            sys.exit(1)
-
-    return wrapper
-
-
-@fail_gracefully
+@deprecated_to_version
 def public_app_factory(global_conf, **local_conf):
-    controllers.register_version('v2.0')
-    return wsgi.ComposingRouter(routes.Mapper(),
-                                [assignment.routers.Public(),
-                                 token.routers.Router(),
-                                 routers.VersionV2('public'),
-                                 routers.Extension(False)])
+    return service.public_app_factory(global_conf, **local_conf)
 
 
-@fail_gracefully
+@deprecated_to_version
 def admin_app_factory(global_conf, **local_conf):
-    controllers.register_version('v2.0')
-    return wsgi.ComposingRouter(routes.Mapper(),
-                                [identity.routers.Admin(),
-                                 assignment.routers.Admin(),
-                                    token.routers.Router(),
-                                    resource.routers.Admin(),
-                                    routers.VersionV2('admin'),
-                                    routers.Extension()])
+    return service.admin_app_factory(global_conf, **local_conf)
 
 
-@fail_gracefully
+@deprecated_to_version
 def public_version_app_factory(global_conf, **local_conf):
-    return wsgi.ComposingRouter(routes.Mapper(),
-                                [routers.Versions('public')])
+    return service.public_version_app_factory(global_conf, **local_conf)
 
 
-@fail_gracefully
+@deprecated_to_version
 def admin_version_app_factory(global_conf, **local_conf):
-    return wsgi.ComposingRouter(routes.Mapper(),
-                                [routers.Versions('admin')])
+    return service.admin_app_factory(global_conf, **local_conf)
 
 
-@fail_gracefully
+@deprecated_to_version
 def v3_app_factory(global_conf, **local_conf):
-    controllers.register_version('v3')
-    mapper = routes.Mapper()
-    sub_routers = []
-    _routers = []
-
-    # NOTE(dstanek): Routers should be ordered by their frequency of use in
-    # a live system. This is due to the routes implementation. The most
-    # frequently used routers should appear first.
-    router_modules = [auth,
-                      assignment,
-                      catalog,
-                      credential,
-                      identity,
-                      policy,
-                      resource]
-
-    if CONF.trust.enabled:
-        router_modules.append(trust)
-
-    if CONF.endpoint_policy.enabled:
-        router_modules.append(endpoint_policy)
-
-    for module in router_modules:
-        routers_instance = module.routers.Routers()
-        _routers.append(routers_instance)
-        routers_instance.append_v3_routers(mapper, sub_routers)
-
-    # Add in the v3 version api
-    sub_routers.append(routers.VersionV3('public', _routers))
-    return wsgi.ComposingRouter(mapper, sub_routers)
+    return service.v3_app_factory(global_conf, **local_conf)
diff --git a/keystone/tests/unit/common/test_utils.py b/keystone/tests/unit/common/test_utils.py
index d52eb72925..0b906683a5 100644
--- a/keystone/tests/unit/common/test_utils.py
+++ b/keystone/tests/unit/common/test_utils.py
@@ -19,9 +19,9 @@ from oslo_serialization import jsonutils
 
 from keystone.common import utils as common_utils
 from keystone import exception
-from keystone import service
 from keystone.tests import unit
 from keystone.tests.unit import utils
+from keystone.version import service
 
 
 CONF = cfg.CONF
diff --git a/keystone/tests/unit/core.py b/keystone/tests/unit/core.py
index eb8b9f65b8..cdbd5316e2 100644
--- a/keystone/tests/unit/core.py
+++ b/keystone/tests/unit/core.py
@@ -51,13 +51,13 @@ from keystone.common import kvs
 from keystone.common.kvs import core as kvs_core
 from keystone.common import sql
 from keystone import config
-from keystone import controllers
 from keystone import exception
 from keystone import notifications
 from keystone.policy.backends import rules
 from keystone.server import common
-from keystone import service
 from keystone.tests.unit import ksfixtures
+from keystone.version import controllers
+from keystone.version import service
 
 
 config.configure()
diff --git a/keystone/tests/unit/test_singular_plural.py b/keystone/tests/unit/test_singular_plural.py
index b07ea8d5ee..e086d9c9a1 100644
--- a/keystone/tests/unit/test_singular_plural.py
+++ b/keystone/tests/unit/test_singular_plural.py
@@ -18,7 +18,7 @@ from keystone.contrib.admin_crud import core as admin_crud_core
 from keystone.contrib.s3 import core as s3_core
 from keystone.contrib.user_crud import core as user_crud_core
 from keystone.identity import core as identity_core
-from keystone import service
+from keystone.version import service
 
 
 class TestSingularPlural(object):
diff --git a/keystone/tests/unit/test_versions.py b/keystone/tests/unit/test_versions.py
index fc8051b26f..9ed16f49a4 100644
--- a/keystone/tests/unit/test_versions.py
+++ b/keystone/tests/unit/test_versions.py
@@ -25,9 +25,9 @@ from testtools import matchers as tt_matchers
 import webob
 
 from keystone.common import json_home
-from keystone import controllers
 from keystone.tests import unit
 from keystone.tests.unit import utils
+from keystone.version import controllers
 
 
 CONF = cfg.CONF
diff --git a/keystone/version/__init__.py b/keystone/version/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/keystone/controllers.py b/keystone/version/controllers.py
similarity index 97%
rename from keystone/controllers.py
rename to keystone/version/controllers.py
index 085c1fb007..aa19a6aeb3 100644
--- a/keystone/controllers.py
+++ b/keystone/version/controllers.py
@@ -28,8 +28,8 @@ MEDIA_TYPE_JSON = 'application/vnd.openstack.identity-%s+json'
 
 _VERSIONS = []
 
-# NOTE(blk-u): latest_app will be set by keystone.service.loadapp(). It gets
-# set to the application that was just loaded. In the case of keystone-all,
+# NOTE(blk-u): latest_app will be set by keystone.version.service.loadapp(). It
+# gets set to the application that was just loaded. In the case of keystone-all
 # loadapp() gets called twice, once for the public app and once for the admin
 # app. In the case of httpd/keystone, loadapp() gets called once for the public
 # app if this is the public instance or loadapp() gets called for the admin app
diff --git a/keystone/routers.py b/keystone/version/routers.py
similarity index 98%
rename from keystone/routers.py
rename to keystone/version/routers.py
index a0f9ed22c1..5da4951c0f 100644
--- a/keystone/routers.py
+++ b/keystone/version/routers.py
@@ -23,7 +23,7 @@ For example, the ``ComposableRouter`` for ``identity`` belongs in::
 
 
 from keystone.common import wsgi
-from keystone import controllers
+from keystone.version import controllers
 
 
 class Extension(wsgi.ComposableRouter):
diff --git a/keystone/version/service.py b/keystone/version/service.py
new file mode 100644
index 0000000000..40256522d9
--- /dev/null
+++ b/keystone/version/service.py
@@ -0,0 +1,131 @@
+# Copyright 2012 OpenStack Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import functools
+import sys
+
+from oslo_config import cfg
+from oslo_log import log
+from paste import deploy
+import routes
+
+from keystone import assignment
+from keystone import auth
+from keystone import catalog
+from keystone.common import wsgi
+from keystone import credential
+from keystone import endpoint_policy
+from keystone import identity
+from keystone import policy
+from keystone import resource
+from keystone import token
+from keystone import trust
+from keystone.version import controllers
+from keystone.version import routers
+
+
+CONF = cfg.CONF
+LOG = log.getLogger(__name__)
+
+
+def loadapp(conf, name):
+    # NOTE(blk-u): Save the application being loaded in the controllers module.
+    # This is similar to how public_app_factory() and v3_app_factory()
+    # register the version with the controllers module.
+    controllers.latest_app = deploy.loadapp(conf, name=name)
+    return controllers.latest_app
+
+
+def fail_gracefully(f):
+    """Logs exceptions and aborts."""
+    @functools.wraps(f)
+    def wrapper(*args, **kw):
+        try:
+            return f(*args, **kw)
+        except Exception as e:
+            LOG.debug(e, exc_info=True)
+
+            # exception message is printed to all logs
+            LOG.critical(e)
+            sys.exit(1)
+
+    return wrapper
+
+
+@fail_gracefully
+def public_app_factory(global_conf, **local_conf):
+    controllers.register_version('v2.0')
+    return wsgi.ComposingRouter(routes.Mapper(),
+                                [assignment.routers.Public(),
+                                 token.routers.Router(),
+                                 routers.VersionV2('public'),
+                                 routers.Extension(False)])
+
+
+@fail_gracefully
+def admin_app_factory(global_conf, **local_conf):
+    controllers.register_version('v2.0')
+    return wsgi.ComposingRouter(routes.Mapper(),
+                                [identity.routers.Admin(),
+                                 assignment.routers.Admin(),
+                                 token.routers.Router(),
+                                 resource.routers.Admin(),
+                                 routers.VersionV2('admin'),
+                                 routers.Extension()])
+
+
+@fail_gracefully
+def public_version_app_factory(global_conf, **local_conf):
+    return wsgi.ComposingRouter(routes.Mapper(),
+                                [routers.Versions('public')])
+
+
+@fail_gracefully
+def admin_version_app_factory(global_conf, **local_conf):
+    return wsgi.ComposingRouter(routes.Mapper(),
+                                [routers.Versions('admin')])
+
+
+@fail_gracefully
+def v3_app_factory(global_conf, **local_conf):
+    controllers.register_version('v3')
+    mapper = routes.Mapper()
+    sub_routers = []
+    _routers = []
+
+    # NOTE(dstanek): Routers should be ordered by their frequency of use in
+    # a live system. This is due to the routes implementation. The most
+    # frequently used routers should appear first.
+    router_modules = [auth,
+                      assignment,
+                      catalog,
+                      credential,
+                      identity,
+                      policy,
+                      resource]
+
+    if CONF.trust.enabled:
+        router_modules.append(trust)
+
+    if CONF.endpoint_policy.enabled:
+        router_modules.append(endpoint_policy)
+
+    for module in router_modules:
+        routers_instance = module.routers.Routers()
+        _routers.append(routers_instance)
+        routers_instance.append_v3_routers(mapper, sub_routers)
+
+    # Add in the v3 version api
+    sub_routers.append(routers.VersionV3('public', _routers))
+    return wsgi.ComposingRouter(mapper, sub_routers)
diff --git a/setup.cfg b/setup.cfg
index 12fed8abee..dde0ea49dc 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -196,8 +196,8 @@ paste.filter_factory =
     user_crud_extension = keystone.contrib.user_crud:CrudExtension.factory
 
 paste.app_factory =
-    admin_service = keystone.service:admin_app_factory
-    admin_version_service = keystone.service:admin_version_app_factory
-    public_service = keystone.service:public_app_factory
-    public_version_service = keystone.service:public_version_app_factory
-    service_v3 = keystone.service:v3_app_factory
+    admin_service = keystone.version.service:admin_app_factory
+    admin_version_service = keystone.version.service:admin_version_app_factory
+    public_service = keystone.version.service:public_app_factory
+    public_version_service = keystone.version.service:public_version_app_factory
+    service_v3 = keystone.version.service:v3_app_factory