Tenant, Provider and External Neutron Networks

To this day I see confusion surrounding the terms: Tenant, provider and external networks. No doubt countless words have been spent trying to tease apart these concepts, so I thought that it’d be a good use of my time to write 470 more.

At a Glance

Creator Model Segmentation External router interfaces
Tenant User Self service Selected by Neutron
Provider Administrator Pre created & shared Selected by the creator
External Administrator Pre created & shared Selected by the creator Yes

A Closer Look

Tenant networks are created by users, and Neutron is configured to automatically select a network segmentation type like VXLAN or VLAN. The user cannot select the segmentation type.

Provider networks are created by administrators, that can set one or more of the following attributes:

  1. Segmentation type (flat, VLAN, Geneve, VXLAN, GRE)
  2. Segmentation ID (VLAN ID, tunnel ID)
  3. Physical network tag

Any attributes not specified will be filled in by Neutron.

OpenStack Neutron supports self service networking – the notion that a user in a project can articulate their own networking topology, completely isolated from other projects in the same cloud, via the support of overlapping IPs and other technologies. A user can create their own network and subnets without the need to open a support ticket or the involvement of an administrator. The user creates a Neutron router, connects it to the internal and external networks (defined below) and off they go. Using the built-in ML2/OVS solution, this implies using the L3 agent, tunnel networks, floating IPs and liberal use of NAT techniques.

Provider networks (read: pre-created networks) is an entirely different networking architecture for your cloud. You’d forgo the L3 agent, tunneling, floating IPs and NAT. Instead, the administrator creates one or more provider networks, typically using VLANs, shares them with users of the cloud, and disables the ability of users to create networks, routers and floating IPs. When a new user signs up for the cloud, the pre-created networks are already there for them to use. In this model, the provider networks are typically routable – They are advertised to the public internet via physical routers via BGP. Therefor, provider networks are often said to be mapped to pre-existing data center networks, both in terms of VLAN IDs and subnet properties.

External networks are a subset of provider networks with an extra flag enabled (aptly named ‘external’). The ‘external’ attribute of a network signals that virtual routers can connect their external facing interface to the network. When you use the UI to give your router external connectivity, only external networks will show up on the list.

To summarize, I think that the confusion is due to a naming issue. Had the network types been called: self-service networks, data center networks and external networks, this blog post would not have been necessary and the world would have been even more exquisite.


When violently opposing persuasion styles coincide

Leadership to me seems largely revolving around the topic of persuasion.

  • How do you get people to do something important but not exciting? (e.g. documenting a feature). How do you reposition the unattractive activity in to a norm, and make people want to do it?
  • How do you nudge people’s mentality or attitude? Spotting an overarching problem with an employee (e.g. snubs his/her nose at writing end to end tests), how do you get them to come around and eventually even lobby others?
  • How do you communicate a significant decision? (e.g. going with one technology over the other). You won’t be able to please everyone, but you can minimize pushback and resentment with some.
  • How do you handle yourself when the person you are talking with has a polar opposite interest to you, and a decision has to be made nevertheless? (e.g. you’re trying to decide which team will on board a new hire).

All people naturally fall somewhere on the scale. Even looking at an individual, you may come down harder on one side at any given day depending on how well you slept, if you have indigestion, or if you just happen to feel impatient. People respond to these persuasion styles differently, and like with anything I’ve found that people gravitate towards others like them, and this is when adjusting to your audience comes in to play. Culture also factors in to this. Coming in to an international organization, ignoring outliers, the difference between, say, an Israeli and an English employee is almost comically apparent.

Defining the aggressive and measured persuasion styles

To elaborate on the aggressive and measured approaches, let’s use an example of a manager involved in a technical decision. The manager in this scenario is exposed to information earlier than his team members, and a decision has to be made regarding the high level architecture of a future project: Which technology stack should be used: Tried and true A or new and exciting B? To drive home the point, in this scenario the manager develops a strong opinion favoring A, based on thorough exploration, past experience and strong expertise in the problem domain. Now the question is – How do you as a manager gain deep acceptance of A and minimize pushback within the team?

The aggressive approach would be to expose the manager’s opinion early in the process, fully embracing an inherent managerial influence, and highlighting the benefits of option A. An even more aggressive approach would be to avoid presenting B as an option in the first place, or not framing the conversation as a discussion but as an announcement.

The measured approach, even in the case of the manager’s strong preference for option A, is to allow a full and honest discussion to take place. The manager would present their opinion late in the process or perhaps never at all. The manager would either stay out of the discussion entirely, or help facilitate an investigation led by the team itself, looking in to the benefits and drawbacks of options A and B. The manager would be presenting both options in a completely neutral way, as if the manager holds no opinion on the matter. The manager does not present A and B, rather the options present themselves by an external quasi-Buddhist selfless conscious creature. The advantage of course is that a decision that comes from within the team has a much stronger stickiness. From the perspective of the manager, a possible risk is that the team can land on B. At that point the manager has to choose their next move, especially in the case that the manager is convinced that choosing B will cause real and irreversible harm to the organization.

Different but equal?

This is when I tell you that while both approaches are different, one is not better than the other. Well, no. What wasn’t obvious to me is that it is not merely a matter of style. The measured approach is in fact common to all senior and effective members of my organization and is therefore implicitly encouraged, to the extent that this topic becomes relevant when it is time to talk about bonuses and promotions. While the lack of tolerance for a different tendency was surprising to me, it is easy to understand why in an Engineering organization, a measured approach would be beneficial. To explain why I think that an organization rewarding measured persuasion might not be fully optimized, I claim that it is reasonable to draw a line from persuasion style to a wider discussion about personality traits. For example, the ability to regulate emotions like passion or agitation, or even something like a person’s tolerance to disagree in public forums.

Point being, if you tell me that a person has an extremely measured persuasion style, I will be able to tell you with reasonable certainty about other character traits that that person may possess.

  • A natural tendency to avoid stating their opinion on controversial issues
  • Shying away from being the sole and visible decision maker (and in extreme cases: cover your tush syndrome)
  • Not being willing to cut a discussion short when it becomes clear that further debate will not change anything

When an unscientific method is preferred in an Engineering organization

My claim is that at times, an aggressive decision maker is what you’re after. Sometimes timing is what will make a difference to your success and you cannot afford the unfortunate cost of inclusivity or the uncertainty the decision making process introduces to your organization. A team or organization filled with hot shots will be too quick to make mistakes or too slow to identify one. An organization filled with academic style deliberates will be too busy to ensure that the problem was looked at from all angles to notice that a more nimble competitor has already gained market share. An organization that explicitly favors this type of mentality may implicitly create a homogeneous echo chamber and conflate an attitude that uses disagreement as a tool to find truth [1] with those that are just unwittingly difficult. Sometimes it is unfair to decide by committee, or to involve people impacted by the decision, and to be unwilling to make a hard decision yourself. Sometimes we are too quick to consciously decide not to make a decision and let the scenario play itself out, rationalizing for inclusivity and transparency, thereby ignoring the human cost to the people involved by a persistent uncertainty. I would go further and say that the line between an overly measured demeanor and cowardice is thin.

I’d try and reframe this discussion from one where one approach is clearly superior to the other, to a discussion about diversity of thought. While as a rule of thumb I prefer measured persuasion, I’ve found that both approaches have their merits, and that a team flourishes with a healthy mixture of attitudes. I would encourage people in a position of influence to try and create an atmosphere where both approaches are ultimately tolerated, and in hiring stages I would be wary of biases that lead us to recruit people just like us.


Octavia Developer Wanted

Edit: The position has been filled, thank you everyone.

I’m looking for a Software Engineer to join the Red Hat OpenStack Networking team. I am presently looking to hire in Europe, Israel and US East. The candidate may work from home or from one of the Red Hat offices. The team is globally distributed and comprised of talented, autonomous, empowered and passionate individuals with a healthy work/life balance. The candidate will work on OpenStack Octavia and LBaaS. The candidate will write and review code while working with upstream community members and fellow Red Hatters. If you want to do open source, Red Hat is objectively where it’s at. We have an institutional culture of open source at all levels and this has a ripple effect on your day to day and your career at the company.

Please email me CVs at

The ideal candidate is familiar with some or all of the following subjects:

  • Networking knowledge and terms such as L2, L3, ARP and IP
  • Cloud networking knowledge. For example VXLAN tunneling, network namespaces, OVS and haproxy
  • Familiarity with virtualization technology, cloud and infrastructure as a service and OpenStack in particular
  • Python
  • Bonus points for familiarity with Octavia


  • Write a bunch o’ code
  • Review code
  • Resolve bugs
  • Draft design documents
  • Implement features
  • Lead and participate in design discussions
  • Attend conferences
  • Improve our testing infrastructure
  • RPM packaging
  • Resolve customer issues

Required skills:

  • Bachelors Degree in Computer Science or equivalent
  • 3 years of significant software development experience
  • Excellent English verbal and written communication skills
  • Comfortable communicating and collaborating with upstream community members outside of the team and company

When is it not cool to add a new OpenStack configuration option?

Adding new configuration options has a cost, and makes already complex projects (Hi Neutron!) even more so. Double so when we speak of architecture choices, it means that we have to test and document all permutations. Of course, we don’t always do that, nor do we test all interactions between deployment options and other advanced features, leaving users with fun surprises. With some projects seeing an increased rotation of contributors, we’re seeing wastelands of unmaintained code behind left behind, increasing the importance of being strategic about introducing new complexity.

I categorize the introduction of new OpenStack configuration options to two:

  1. There’s two or more classes of operators that have legitimate use cases and a configuration option would enable those use cases without hurting cloud interoperability
    • For example: Neutron DVR, is essentially a driver for router implementations, that changes your L3 architecture substantially while abstracting details via an API. DVR has various costs and benefits and letting operators make that choice, especially as the feature matures, makes sense to me.
  2. Developers that don’t fully understand the choice they are making and pass the complexity down to the operators to figure out. This results in options that are often never changed from their defaults because operators don’t have access to sufficient documentation that explains the rationale for choosing a specific value, as well as a misuse of time and energy because developers sometimes focus on use cases that are off center or don’t exist.
    • For example: neutron.conf:DEFAULT:send_events_interval: Number of seconds between sending events to nova if there are any events to send. Unless you grep through the code, how is an operator supposed to know if they should increase or decrease the value? Even then, shouldn’t developers take responsibility of that choice, and test for the best value? If problems are found under load, shouldn’t the value be calculated as a function of some variable? Instead of distributing the work to thousands of operators, wouldn’t we as a community like to to do the work in one place?

When contemplating adding a new option, ask yourself:

  1. Is it possible that you don’t fully understand the use case, and in lieu of making a choice, you’re letting the operator bear the burden?
  2. Are you, and your replacement, prepared to own the cost of the new option indefinitely?
OpenStack, Talks

Upstream Contribution – Give Up or Double Down? The Boston Edition

In continuation to a previous blog post, I presented a version with new content at the recent OpenStack Boston summit. The session had a fair amount of participation and discussions, where we talked about the journey of a new contributor in OpenStack through the lens of data gathered from Gerrit and Stackalytics. We even had members of the Technical Committee that were interested in concrete action items they could take on their part – How do we make it easier for new contributors? What behaviors work in the quest to get your patches merged quicker?

The video, slides and code used to generate the data are below:


Python Appreciation Day

Every once in a while I have to recognize the beauty that is a high level language.

Consider this code snippet:

def square(x):
 return x**2

l = [1, 2, 3, 4]
for x in map(square, l):

And this one:

from multiprocessing import Pool

def square(x):
 return x**2

l = [1, 2, 3, 4]
for x in Pool().map(square, l):

Discounting the import line (Because I’m trying to make a point here, dammit!), the diff is a total of 7 characters. Of course, if you recall your Computer Science operating systems 101, the complexity that is hidden here is breath taking. And yet, Python multiprocessing exposes an API that is identical to Python’s good old ‘map’. It does so and manages to keep it boring, without exposing the caller to messy internals and endless complications that are usually involved whenever we dive in to the world of multi processing.

Even more impressive is the fact that I exploited this abstraction in a real world app that does honest to Zeus useful things, and it “just worked”. The processing time was cut by half and I didn’t need to worry about forking, sockets, PIDs, creating and managing processes or any of that mess. All I had to do was focus on the subject matter and not the underlying code. That is the beauty of a high level language. You don’t have to use up cognitive load thinking about memory management, the syntax of templates meta programming, or the depth of pointer dereferencing required, instead you can focus on getting something useful done.

* Herein lies a vim vs. Emacs type disclaimer: Every tool has its place. I would never dream of using Python for a demanding mobile game (Or a cloud operating system, for that matter), but wow is Python fun when you’re parsing and processing tens of thousands of JSON files.


The OpenStack PTL Elections are Happening!

Tomorrow morning, February 1st, OpenStack contributors will receive emails to elect their new PTLs. OpenStack Networking is having an interesting election this cycle. Please, have some fun with your morning coffee, spend a few minutes and read Ihar and Kevin’s nomination emails.



Both are incredible developers and some of the finest Engineers I’ve had the pleasure of working with. I have immense respect for both, which if anything makes this a fascinating spectator sport.

Best of luck to both candidates, and as Gandalf so eloquently put in those X-Men movies of his: “May the force live long and prosper, Harry.”