diff --git a/xos/admin.py b/xos/admin.py
index b743a15..4d1de3a 100644
--- a/xos/admin.py
+++ b/xos/admin.py
@@ -1,4 +1,3 @@
-
 # Copyright 2017-present Open Networking Foundation
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,7 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-
 from django.contrib import admin
 
 from services.veg.models import *
@@ -26,7 +24,7 @@
 from django.utils import timezone
 from django.contrib.contenttypes import generic
 from suit.widgets import LinkedSelect
-from core.admin import ServiceAppAdmin,SliceInline,ServiceAttrAsTabInline, ReadOnlyAwareAdmin, XOSTabularInline, ServicePrivilegeInline, TenantRootTenantInline, TenantRootPrivilegeInline
+from core.admin import ServiceAppAdmin,SliceInline,ServiceAttrAsTabInline, ReadOnlyAwareAdmin, XOSTabularInline, ServicePrivilegeInline, SubscriberLinkInline, ProviderLinkInline, ProviderDependencyInline,SubscriberDependencyInline
 from core.middleware import get_request
 
 from functools import update_wrapper
@@ -42,12 +40,12 @@
     list_display_links = ('backend_status_icon', 'name', )
     fieldsets = [(None,             {'fields': ['backend_status_text', 'name','enabled','versionNumber', 'description', "view_url", "icon_url", "service_specific_attribute", "node_label"],
                                      'classes':['suit-tab suit-tab-general']}),
-                 ("backend config", {'fields': ["url_filter_kind"],
+                 ("backend config", {'fields': [ "url_filter_kind" ],
                                      'classes':['suit-tab suit-tab-backend']}),
                  ("vEG config", {'fields': ["dns_servers", "docker_image_name", "docker_insecure_registry"],
                                      'classes':['suit-tab suit-tab-veg']}) ]
     readonly_fields = ('backend_status_text', "service_specific_attribute")
-    inlines = [SliceInline,ServiceAttrAsTabInline,ServicePrivilegeInline]
+    inlines = [SliceInline,ServiceAttrAsTabInline,ServicePrivilegeInline, ProviderDependencyInline,SubscriberDependencyInline]
 
     extracontext_registered_admins = True
 
@@ -60,6 +58,7 @@
         #('tools', 'Tools'),
         ('slices','Slices'),
         ('serviceattrs','Additional Attributes'),
+        ('servicetenants', 'Dependencies'),
         ('serviceprivileges','Privileges') ,
     )
 
@@ -67,7 +66,7 @@
                            ) #('hpctools.html', 'top', 'tools') )
 
     def get_queryset(self, request):
-        return VEGService.get_service_objects_by_user(request.user)
+        return VEGService.select_by_user(request.user)
 
 class VEGTenantForm(forms.ModelForm):
     last_ansible_hash = forms.CharField(required=False)
@@ -76,8 +75,7 @@
 
     def __init__(self,*args,**kwargs):
         super (VEGTenantForm,self ).__init__(*args,**kwargs)
-        self.fields['kind'].widget.attrs['readonly'] = True
-        self.fields['provider_service'].queryset = VEGService.objects.all()
+        self.fields['owner'].queryset = VEGService.objects.all()
         if self.instance:
             # fields for the attributes
             self.fields['last_ansible_hash'].initial = self.instance.last_ansible_hash
@@ -85,10 +83,9 @@
             self.fields['wan_container_mac'].initial = self.instance.wan_container_mac
         if (not self.instance) or (not self.instance.pk):
             # default fields for an 'add' form
-            self.fields['kind'].initial = VEG_KIND
             self.fields['creator'].initial = get_request().user
             if VEGService.objects.exists():
-               self.fields["provider_service"].initial = VEGService.objects.all()[0]
+               self.fields["owner"].initial = VEGService.objects.all()[0]
 
     def save(self, commit=True):
         self.instance.creator = self.cleaned_data.get("creator")
@@ -101,18 +98,20 @@
         fields = '__all__'
 
 class VEGTenantAdmin(ReadOnlyAwareAdmin):
-    list_display = ('backend_status_icon', 'id', 'subscriber_tenant' )
+    list_display = ('backend_status_icon', 'id', )
     list_display_links = ('backend_status_icon', 'id')
-    fieldsets = [ (None, {'fields': ['backend_status_text', 'kind', 'provider_service', 'subscriber_tenant', 'service_specific_id',
+    fieldsets = [ (None, {'fields': ['backend_status_text', 'owner', 'service_specific_id',
                                      'wan_container_ip', 'wan_container_mac', 'creator', 'instance', 'last_ansible_hash'],
                           'classes':['suit-tab suit-tab-general']})]
     readonly_fields = ('backend_status_text', 'service_specific_attribute', 'wan_container_ip', 'wan_container_mac')
+    inlines = (ProviderLinkInline, SubscriberLinkInline)
     form = VEGTenantForm
 
-    suit_form_tabs = (('general','Details'),)
+    suit_form_tabs = (('general','Details'),
+                      ('servicelinks','Links'),)
 
     def get_queryset(self, request):
-        return VEGTenant.get_tenant_objects_by_user(request.user)
+        return VEGTenant.select_by_user(request.user)
 
 
 admin.site.register(VEGService, VEGServiceAdmin)
diff --git a/xos/api/service/veg/vegservice.py b/xos/api/service/veg/vegservice.py
deleted file mode 100644
index 3977841..0000000
--- a/xos/api/service/veg/vegservice.py
+++ /dev/null
@@ -1,94 +0,0 @@
-
-# Copyright 2017-present Open Networking Foundation
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-from rest_framework.decorators import api_view
-from rest_framework.response import Response
-from rest_framework.reverse import reverse
-from rest_framework import serializers
-from rest_framework import generics
-from rest_framework import viewsets
-from rest_framework import status
-from rest_framework.decorators import detail_route, list_route
-from rest_framework.views import APIView
-from core.models import *
-from django.forms import widgets
-from django.conf.urls import patterns, url
-from services.veg.models import VEGService
-from api.xosapi_helpers import PlusModelSerializer, XOSViewSet, ReadOnlyField
-from django.shortcuts import get_object_or_404
-from xos.apibase import XOSListCreateAPIView, XOSRetrieveUpdateDestroyAPIView, XOSPermissionDenied
-from xos.exceptions import *
-import json
-import subprocess
-from django.views.decorators.csrf import ensure_csrf_cookie
-
-class VEGServiceForApi(VEGService):
-    class Meta:
-        proxy = True
-        app_label = "cord"
-
-    def __init__(self, *args, **kwargs):
-        super(VEGServiceForApi, self).__init__(*args, **kwargs)
-
-    def save(self, *args, **kwargs):
-        super(VEGServiceForApi, self).save(*args, **kwargs)
-
-    def __init__(self, *args, **kwargs):
-        super(VEGService, self).__init__(*args, **kwargs)
-
-class VEGServiceSerializer(PlusModelSerializer):
-        id = ReadOnlyField()
-        humanReadableName = serializers.SerializerMethodField("getHumanReadableName")
-        wan_container_gateway_ip = serializers.CharField(required=False)
-        wan_container_gateway_mac = serializers.CharField(required=False)
-        dns_servers = serializers.CharField(required=False)
-        url_filter_kind = serializers.CharField(required=False)
-        node_label = serializers.CharField(required=False)
-
-        class Meta:
-            model = VEGServiceForApi
-            fields = ('humanReadableName',
-                      'id',
-                      'wan_container_gateway_ip',
-                      'wan_container_gateway_mac',
-                      'dns_servers',
-                      'url_filter_kind',
-                      'node_label')
-
-        def getHumanReadableName(self, obj):
-            return obj.__unicode__()
-
-# @ensure_csrf_cookie
-class VEGServiceViewSet(XOSViewSet):
-    base_name = "VEGservice"
-    method_name = None # use the api endpoint /api/service/veg/
-    method_kind = "viewset"
-    queryset = VEGService.get_service_objects().select_related().all()
-    serializer_class = VEGServiceSerializer
-
-    @classmethod
-    def get_urlpatterns(self, api_path="^"):
-        patterns = super(VEGServiceViewSet, self).get_urlpatterns(api_path=api_path)
-
-        return patterns
-
-    def list(self, request):
-        object_list = self.filter_queryset(self.get_queryset())
-
-        serializer = self.get_serializer(object_list, many=True)
-
-        return Response(serializer.data)
-
diff --git a/xos/api/tenant/cord/veg.py b/xos/api/tenant/cord/veg.py
deleted file mode 100644
index a2dd29a..0000000
--- a/xos/api/tenant/cord/veg.py
+++ /dev/null
@@ -1,78 +0,0 @@
-
-# Copyright 2017-present Open Networking Foundation
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-from rest_framework.decorators import api_view
-from rest_framework.response import Response
-from rest_framework.reverse import reverse
-from rest_framework import serializers
-from rest_framework import generics
-from rest_framework import status
-from core.models import *
-from django.forms import widgets
-from services.veg.models import VEGTenant, VEGService
-from xos.apibase import XOSListCreateAPIView, XOSRetrieveUpdateDestroyAPIView, XOSPermissionDenied
-from api.xosapi_helpers import PlusModelSerializer, XOSViewSet, ReadOnlyField
-
-def get_default_veg_service():
-    VEG_services = VEGService.get_service_objects().all()
-    if VEG_services:
-        return VEG_services[0].id
-    return None
-
-class VEGTenantForAPI(VEGTenant):
-    class Meta:
-        proxy = True
-        app_label = "cord"
-
-    @property
-    def related(self):
-        related = {}
-        if self.instance:
-            related["instance_id"] = self.instance.id
-        return related
-
-class VEGTenantSerializer(PlusModelSerializer):
-    id = ReadOnlyField()
-    wan_container_ip = serializers.CharField()
-    wan_container_mac = ReadOnlyField()
-    related = serializers.DictField(required=False)
-
-    humanReadableName = serializers.SerializerMethodField("getHumanReadableName")
-    class Meta:
-        model = VEGTenantForAPI
-        fields = ('humanReadableName', 'id', 'wan_container_ip', 'wan_container_mac', 'related' )
-
-    def getHumanReadableName(self, obj):
-        return obj.__unicode__()
-
-class VEGTenantViewSet(XOSViewSet):
-    base_name = "veg"
-    method_name = "veg"
-    method_kind = "viewset"
-    queryset = VEGTenantForAPI.get_tenant_objects().all()
-    serializer_class = VEGTenantSerializer
-
-    @classmethod
-    def get_urlpatterns(self, api_path="^"):
-        patterns = super(VEGTenantViewSet, self).get_urlpatterns(api_path=api_path)
-
-        return patterns
-
-
-
-
-
-
diff --git a/xos/attic/header.py b/xos/attic/header.py
index b512cb0..2c1b707 100644
--- a/xos/attic/header.py
+++ b/xos/attic/header.py
@@ -1,4 +1,3 @@
-
 # Copyright 2017-present Open Networking Foundation
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -12,27 +11,24 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
-
 from django.db import models
-from core.models import Service, PlCoreBase, Slice, Instance, Tenant, TenantWithContainer, Node, Image, User, Flavor, NetworkParameter, NetworkParameterType, Port, AddressPool, User
-from core.models.plcorebase import StrippedCharField
+from core.models import Service, XOSBase, Slice, Instance, TenantWithContainer, Node, Image, User, Flavor, NetworkParameter, NetworkParameterType, Port, AddressPool, User
+from core.models.xosbase import StrippedCharField
 import os
 from django.db import models, transaction
-from django.db.models import *
-
 from django.forms.models import model_to_dict
-from django.db.models import Q
+from django.db.models import *
 from operator import itemgetter, attrgetter, methodcaller
 from core.models import Tag
 from core.models.service import LeastLoadedNodeScheduler
-from services.vrouter.models import VRouterService, VRouterTenant
+from services.addressmanager.models import AddressManagerService, AddressManagerServiceInstance
 import traceback
 from xos.exceptions import *
-from xos.config import Config
+from django.contrib.contenttypes.models import ContentType
 
 class ConfigurationError(Exception):
     pass
 
 VEG_KIND = "vEG"
 CORD_SUBSCRIBER_KIND = "CordSubscriberRoot"
+
diff --git a/xos/attic/vegtenant_model.py b/xos/attic/vegtenant_model.py
index 253d0d2..1c1d15a 100644
--- a/xos/attic/vegtenant_model.py
+++ b/xos/attic/vegtenant_model.py
@@ -21,25 +21,24 @@
 
 def __init__(self, *args, **kwargs):
     super(VEGTenant, self).__init__(*args, **kwargs)
-    self.cached_vrouter=None
-
+    self.cached_address_service_instance = None
 @property
-def vrouter(self):
-    vrouter = self.get_newest_subscribed_tenant(VRouterTenant)
-    if not vrouter:
+def address_service_instance(self):
+    address_service_instance = self.get_newest_subscribed_tenant(AddressManagerServiceInstance)
+    if not address_service_instance:
         return None
 
     # always return the same object when possible
-    if (self.cached_vrouter) and (self.cached_vrouter.id == vrouter.id):
-        return self.cached_vrouter
+    if (self.cached_address_service_instance) and (self.cached_address_service_instance.id == address_service_instance.id):
+        return self.cached_address_service_instance
 
-    vrouter.caller = self.creator
-    self.cached_vrouter = vrouter
-    return vrouter
+    address_service_instance.caller = self.creator
+    self.cached_address_service_instance = address_service_instance
+    return address_service_instance
 
-@vrouter.setter
-def vrouter(self, value):
-    raise XOSConfigurationError("vEGTenant.vrouter setter is not implemented")
+@address_service_instance.setter
+def address_service_instance(self, value):
+    raise XOSConfigurationError("VEGTenant.address_service_instance setter is not implemented")
 
 @property
 def volt(self):
@@ -62,46 +61,46 @@
     else:
         return "no-instance"
 
-def get_vrouter_field(self, name, default=None):
-    if self.vrouter:
-        return getattr(self.vrouter, name, default)
+def get_address_service_instance_field(self, name, default=None):
+    if self.address_service_instance:
+        return getattr(self.address_service_instance, name, default)
     else:
         return default
 
 @property
 def wan_container_ip(self):
-    return self.get_vrouter_field("public_ip", None)
+    return self.get_address_service_instance_field("public_ip", None)
 
 @property
 def wan_container_mac(self):
-    return self.get_vrouter_field("public_mac", None)
+    return self.get_address_service_instance_field("public_mac", None)
 
 @property
 def wan_container_netbits(self):
-    return self.get_vrouter_field("netbits", None)
+    return self.get_address_service_instance_field("netbits", None)
 
 @property
 def wan_container_gateway_ip(self):
-    return self.get_vrouter_field("gateway_ip", None)
+    return self.get_address_service_instance_field("gateway_ip", None)
 
 @property
 def wan_container_gateway_mac(self):
-    return self.get_vrouter_field("gateway_mac", None)
+    return self.get_address_service_instance_field("gateway_mac", None)
 
 @property
 def wan_vm_ip(self):
-    tags = Tag.select_by_content_object(self.instance).filter(name="vm_vrouter_tenant")
+    tags = Tag.objects.filter(content_type=self.instance.get_content_type_key(), object_id=self.instance.id, name="vm_vrouter_tenant")
     if tags:
-        tenant = VRouterTenant.objects.get(id=tags[0].value)
+        tenant = AddressManagerServiceInstance.objects.get(id=tags[0].value)
         return tenant.public_ip
     else:
         raise Exception("no vm_vrouter_tenant tag for instance %s" % o.instance)
 
 @property
 def wan_vm_mac(self):
-    tags = Tag.select_by_content_object(self.instance).filter(name="vm_vrouter_tenant")
+    tags = Tag.objects.filter(content_type=self.instance.get_content_type_key(), object_id=self.instance.id, name="vm_vrouter_tenant")
     if tags:
-        tenant = VRouterTenant.objects.get(id=tags[0].value)
+        tenant = AddressManagerServiceInstance.objects.get(id=tags[0].value)
         return tenant.public_mac
     else:
         raise Exception("no vm_vrouter_tenant tag for instance %s" % o.instance)
@@ -113,191 +112,7 @@
 @is_synced.setter
 def is_synced(self, value):
     pass
-
-def get_vrouter_service(self):
-    vrouterServices = VRouterService.get_service_objects().all()
-    if not vrouterServices:
-        raise XOSConfigurationError("No VROUTER Services available")
-    return vrouterServices[0]
-
-def manage_vrouter(self):
-    # Each vEG object owns exactly one vRouterTenant object
-
-    if self.deleted:
-        return
-
-    if self.vrouter is None:
-        vrouter = self.get_vrouter_service().get_tenant(address_pool_name="addresses_veg", subscriber_tenant = self)
-        vrouter.caller = self.creator
-        vrouter.save()
-
-def cleanup_vrouter(self):
-    if self.vrouter:
-        # print "XXX cleanup vrouter", self.vrouter
-        self.vrouter.delete()
-
-def cleanup_orphans(self):
-    # ensure vEG only has one vRouter
-    cur_vrouter = self.vrouter
-    for vrouter in list(self.get_subscribed_tenants(VRouterTenant)):
-        if (not cur_vrouter) or (vrouter.id != cur_vrouter.id):
-            # print "XXX clean up orphaned vrouter", vrouter
-            vrouter.delete()
-
-    if self.orig_instance_id and (self.orig_instance_id != self.get_attribute("instance_id")):
-        instances=Instance.objects.filter(id=self.orig_instance_id)
-        if instances:
-            # print "XXX clean up orphaned instance", instances[0]
-            instances[0].delete()
-
-def get_slice(self):
-    if not self.provider_service.slices.count():
-        print self, "dio porco"
-        raise XOSConfigurationError("The service has no slices")
-    slice = self.provider_service.slices.all()[0]
-    return slice
-
-def get_veg_service(self):
-    return VEGService.get_service_objects().get(id=self.provider_service.id)
-
-def find_instance_for_s_tag(self, s_tag):
-    #s_tags = STagBlock.objects.find(s_s_tag)
-    #if s_tags:
-    #    return s_tags[0].instance
-
-    tags = Tag.objects.filter(name="s_tag", value=s_tag)
-    if tags:
-        return tags[0].content_object
-
-    return None
-
-def find_or_make_instance_for_s_tag(self, s_tag):
-    instance = self.find_instance_for_s_tag(self.volt.s_tag)
-    if instance:
-        return instance
-
-    flavors = Flavor.objects.filter(name="m1.small")
-    if not flavors:
-        raise XOSConfigurationError("No m1.small flavor")
-
-    slice = self.provider_service.slices.all()[0]
-
-    if slice.default_isolation == "container_vm":
-        (node, parent) = ContainerVmScheduler(slice).pick()
-    else:
-        (node, parent) = LeastLoadedNodeScheduler(slice, label=self.get_veg_service().node_label).pick()
-
-    instance = Instance(slice = slice,
-                    node = node,
-                    image = self.image,
-                    creator = self.creator,
-                    deployment = node.site_deployment.deployment,
-                    flavor = flavors[0],
-                    isolation = slice.default_isolation,
-                    parent = parent)
-
-    self.save_instance(instance)
-
-    return instance
-
-def manage_container(self):
-    from core.models import Instance, Flavor
-
-    if self.deleted:
-        return
-
-    # For container or container_vm isolation, use what TenantWithCotnainer
-    # provides us
-    slice = self.get_slice()
-    if slice.default_isolation in ["container_vm", "container"]:
-        super(VEGTenant,self).manage_container()
-        return
-
-    if not self.volt:
-        raise XOSConfigurationError("This vEG container has no volt")
-
-    if self.instance:
-        # We're good.
-        return
-
-    instance = self.find_or_make_instance_for_s_tag(self.volt.s_tag)
-    self.instance = instance
-    super(TenantWithContainer, self).save()
-
-def cleanup_container(self):
-    if self.get_slice().default_isolation in ["container_vm", "container"]:
-        super(VEGTenant,self).cleanup_container()
-
-    # To-do: cleanup unused instances
-    pass
-
-def find_or_make_port(self, instance, network, **kwargs):
-    port = Port.objects.filter(instance=instance, network=network)
-    if port:
-        port = port[0]
-    else:
-        port = Port(instance=instance, network=network, **kwargs)
-        port.save()
-    return port
-
-def get_lan_network(self, instance):
-    slice = self.provider_service.slices.all()[0]
-    # there should only be one network private network, and its template should not be the management template
-    lan_networks = [x for x in slice.networks.all() if x.template.visibility == "private" and (not "management" in x.template.name)]
-    if len(lan_networks) > 1:
-        raise XOSProgrammingError("The vEG slice should only have one non-management private network")
-    if not lan_networks:
-        raise XOSProgrammingError("No lan_network")
-    return lan_networks[0]
-
-def save_instance(self, instance):
-    with transaction.atomic():
-        instance.volumes = "/etc/dnsmasq.d,/etc/ufw"
-        super(VEGTenant, self).save_instance(instance)
-
-        if instance.isolation in ["container", "container_vm"]:
-            lan_network = self.get_lan_network(instance)
-            port = self.find_or_make_port(instance, lan_network, ip="192.168.0.1", port_id="unmanaged")
-            port.set_parameter("c_tag", self.volt.c_tag)
-            port.set_parameter("s_tag", self.volt.s_tag)
-            port.set_parameter("device", "eth1")
-            port.set_parameter("bridge", "br-lan")
-
-            wan_networks = [x for x in instance.slice.networks.all() if "wan" in x.name]
-            if not wan_networks:
-                raise XOSProgrammingError("No wan_network")
-            port = self.find_or_make_port(instance, wan_networks[0])
-            port.set_parameter("next_hop", value="10.0.1.253")   # FIX ME
-            port.set_parameter("device", "eth0")
-
-        if instance.isolation in ["vm"]:
-            lan_network = self.get_lan_network(instance)
-            port = self.find_or_make_port(instance, lan_network)
-            port.set_parameter("c_tag", self.volt.c_tag)
-            port.set_parameter("s_tag", self.volt.s_tag)
-            port.set_parameter("neutron_port_name", "stag-%s" % self.volt.s_tag)
-            port.save()
-
-        # tag the instance with the s-tag, so we can easily find the
-        # instance later
-        if self.volt and self.volt.s_tag:
-            tags = Tag.objects.filter(name="s_tag", value=self.volt.s_tag)
-            if not tags:
-                tag = Tag(service=self.provider_service, content_object=instance, name="s_tag", value=self.volt.s_tag)
-                tag.save()
-
-        # VTN-CORD needs a WAN address for the VM, so that the VM can
-        # be configured.
-        tags = Tag.select_by_content_object(instance).filter(name="vm_vrouter_tenant")
-
-        if not tags:
-            vrouter = self.get_vrouter_service().get_tenant(address_pool_name="addresses_veg", subscriber_service=self.provider_service)
-            vrouter.set_attribute("tenant_for_instance_id", instance.id)
-            vrouter.save()
-            tag = Tag(service=self.provider_service, content_object=instance, name="vm_vrouter_tenant",value="%d" % vrouter.id)
-            tag.save()
-
-def __xos_save_base(self, *args, **kwargs):
+def save(self, *args, **kwargs):
     if not self.creator:
         if not getattr(self, "caller", None):
             # caller must be set when creating a vEG since it creates a slice
@@ -307,11 +122,7 @@
             raise XOSProgrammingError("VEGTenant's self.creator was not set")
 
     super(VEGTenant, self).save(*args, **kwargs)
-    model_policy_veg(self.pk)
-    return True     # Indicate that we called super.save()
+
 
 def delete(self, *args, **kwargs):
-    self.cleanup_vrouter()
-    self.cleanup_container()
     super(VEGTenant, self).delete(*args, **kwargs)
-
diff --git a/xos/header.py b/xos/header.py
deleted file mode 120000
index 721b5c0..0000000
--- a/xos/header.py
+++ /dev/null
@@ -1 +0,0 @@
-attic/header.py
\ No newline at end of file
diff --git a/xos/header.py b/xos/header.py
new file mode 100644
index 0000000..9889cea
--- /dev/null
+++ b/xos/header.py
@@ -0,0 +1,33 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+from django.db import models
+from core.models import Service, XOSBase, Slice, Instance, TenantWithContainer, Node, Image, User, Flavor, NetworkParameter, NetworkParameterType, Port, AddressPool, User
+from core.models.xosbase import StrippedCharField
+import os
+from django.db import models, transaction
+from django.forms.models import model_to_dict
+from django.db.models import *
+from operator import itemgetter, attrgetter, methodcaller
+from core.models import Tag
+from core.models.service import LeastLoadedNodeScheduler
+import traceback
+from xos.exceptions import *
+from django.contrib.contenttypes.models import ContentType
+
+class ConfigurationError(Exception):
+    pass
+
+VEG_KIND = "vEG"
+CORD_SUBSCRIBER_KIND = "CordSubscriberRoot"
+
diff --git a/xos/synchronizer/Dockerfile.synchronizer b/xos/synchronizer/Dockerfile.synchronizer
index fade700..826db88 100644
--- a/xos/synchronizer/Dockerfile.synchronizer
+++ b/xos/synchronizer/Dockerfile.synchronizer
@@ -12,9 +12,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# xosproject/veg-synchronizer
 FROM xosproject/xos-synchronizer-base:candidate
 
-ADD . /opt/xos/synchronizers/veg
+COPY . /opt/xos/synchronizers/veg
 
 ENTRYPOINT []
 
diff --git a/xos/synchronizer/Makefile b/xos/synchronizer/Makefile
deleted file mode 100644
index a5bd739..0000000
--- a/xos/synchronizer/Makefile
+++ /dev/null
@@ -1,5 +0,0 @@
-synchronizer:
-	sudo docker build --rm -f Dockerfile.synchronizer -t xosproject/veg-synchronizer .
-
-up:
-	docker-compose -p veg up -d
\ No newline at end of file
diff --git a/xos/synchronizer/docker-compose.yml b/xos/synchronizer/docker-compose.yml
deleted file mode 100644
index 3790d3c..0000000
--- a/xos/synchronizer/docker-compose.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-
-# Copyright 2017-present Open Networking Foundation
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-version: '2'
-
-networks:
-  xos:
-    external: true
-
-services:
-  synchronizer:
-    image: xosproject/veg-synchronizer
-    networks:
-      - xos
-    #command: bash -c "sleep 86400"
-    volumes:
-        - /opt/cord_profile/key_import/veg_rsa:/opt/xos/services/veg/keys/veg_rsa:ro
-        - /opt/cord_profile/node_key:/opt/cord_profile/node_key:ro
-        - /opt/cord/build/platform-install/credentials/xosadmin@opencord.org:/opt/xos/services/veg/credentials/xosadmin@opencord.org
-    external_links:
-        - rcordbs_xos_redis_1:redis
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "1000k"
-        max-file: "5"
\ No newline at end of file
diff --git a/xos/synchronizer/files/etc/rc.local b/xos/synchronizer/files/etc/rc.local
index 2c7588f..49ee927 100755
--- a/xos/synchronizer/files/etc/rc.local
+++ b/xos/synchronizer/files/etc/rc.local
@@ -1,5 +1,19 @@
 #!/bin/sh -e
 #
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# 
 # rc.local
 #
 # This script is executed at the end of each multiuser runlevel.
diff --git a/xos/synchronizer/files/etc/ufw/after.rules b/xos/synchronizer/files/etc/ufw/after.rules
index 0d6c646..0075851 100644
--- a/xos/synchronizer/files/etc/ufw/after.rules
+++ b/xos/synchronizer/files/etc/ufw/after.rules
@@ -1,3 +1,16 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 #
 # rules.input-after
 #
diff --git a/xos/synchronizer/files/etc/ufw/after6.rules b/xos/synchronizer/files/etc/ufw/after6.rules
index 0d99672..974c55f 100644
--- a/xos/synchronizer/files/etc/ufw/after6.rules
+++ b/xos/synchronizer/files/etc/ufw/after6.rules
@@ -1,3 +1,16 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 #
 # rules.input-after
 #
diff --git a/xos/synchronizer/files/etc/ufw/before6.rules b/xos/synchronizer/files/etc/ufw/before6.rules
index 0b26ed8..90c0010 100644
--- a/xos/synchronizer/files/etc/ufw/before6.rules
+++ b/xos/synchronizer/files/etc/ufw/before6.rules
@@ -1,3 +1,16 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 #
 # rules.before
 #
diff --git a/xos/synchronizer/manifest b/xos/synchronizer/manifest
deleted file mode 100644
index 4fb448b..0000000
--- a/xos/synchronizer/manifest
+++ /dev/null
@@ -1,51 +0,0 @@
-templates/bwlimit.sh.j2
-templates/vlan_sample.j2
-templates/before.rules.j2
-templates/start-veg.sh.j2
-templates/dnsmasq_safe_servers.j2
-templates/docker.j2
-templates/firewall_sample.j2
-templates/rc.local.j2
-templates/veg.conf.j2
-templates/message.html.j2
-templates/dnsmasq_servers.j2
-templates/start-veg-vtn.sh.j2
-manifest
-broadbandshield.py
-observer_ansible_test.py
-veg_synchronizer_config
-start-bbs.sh
-steps/sync_vegtenant.py
-steps/sync_vegtenant_new.yaml
-steps/sync_vegtenant_vtn.yaml
-steps/sync_vegtenant.yaml
-steps/sync_monitoring_agent.yaml
-steps/test.yaml
-steps/ansible_test/README
-steps/ansible_test/test.yaml
-steps/ansible_test/xos.py
-steps/ansible_test/test.sh
-steps/ansible_test/inventory.txt
-start.sh
-files/veg.conf
-files/etc/service/message/run
-files/etc/rc.local
-files/etc/ufw/after6.rules
-files/etc/ufw/applications.d/openssh-server
-files/etc/ufw/sysctl.conf
-files/etc/ufw/ufw.conf
-files/etc/ufw/before6.rules
-files/etc/ufw/after.init
-files/etc/ufw/before.init
-files/etc/ufw/after.rules
-files/vm-resolv.conf
-files/docker.list
-files/veg.dnsmasq
-run-vtn.sh
-stop.sh
-veg-synchronizer.py
-model-deps
-supervisor/veg-observer.conf
-run.sh
-veg_synchronizer_config
-veg_stats_notifier.py
\ No newline at end of file
diff --git a/xos/synchronizer/model_policies/model_policy_vegtenant.py b/xos/synchronizer/model_policies/model_policy_vegtenant.py
new file mode 100644
index 0000000..30b7113
--- /dev/null
+++ b/xos/synchronizer/model_policies/model_policy_vegtenant.py
@@ -0,0 +1,193 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from synchronizers.new_base.modelaccessor import *
+from synchronizers.new_base.model_policies.model_policy_tenantwithcontainer import TenantWithContainerPolicy, LeastLoadedNodeScheduler
+from synchronizers.new_base.exceptions import *
+
+class VEGTenantPolicy(TenantWithContainerPolicy):
+    model_name = "VEGTenant"
+
+    def handle_create(self, tenant):
+        return self.handle_update(tenant)
+
+    def handle_update(self, tenant):
+        self.manage_container(tenant)
+        self.manage_address_service_instance(tenant)
+        self.cleanup_orphans(tenant)
+
+    def handle_delete(self, tenant):
+        if tenant.address_service_instance:
+            tenant.address_service_instance.delete()
+
+    def manage_address_service_instance(self, tenant):
+        if tenant.deleted:
+            return
+
+<<<<<<< HEAD:xos/synchronizer/model_policies/model_policy_vegtenant.py
+        if tenant.vrouter is None:
+            vrouter = self.allocate_public_service_instance(address_pool_name="addresses_veg", subscriber_tenant=tenant)
+            vrouter.save()
+
+
+    def cleanup_orphans(self, tenant):
+        # ensure vEG only has one AddressManagerServiceInstance
+        cur_asi = tenant.address_service_instance
+        for link in tenant.subscribed_links.all():
+            # TODO: hardcoded dependency
+            # cast from ServiceInstance to AddressManagerServiceInstance
+            asis = AddressManagerServiceInstance.objects.filter(id = link.provider_service_instance.id)
+            for asi in asis:
+                if (not cur_asi) or (asi.id != cur_asi.id):
+                    asi.delete()
+
+    def get_veg_service(self, tenant):
+        return VEGService.objects.get(id=tenant.owner.id)
+
+    def find_instance_for_s_tag(self, s_tag):
+        tags = Tag.objects.filter(name="s_tag", value=s_tag)
+        if tags:
+            return tags[0].content_object
+
+        return None
+
+    def find_or_make_instance_for_s_tag(self, tenant, s_tag):
+        instance = self.find_instance_for_s_tag(tenant.volt.s_tag)
+        if instance:
+            if instance.no_sync:
+                # if no_sync is still set, then perhaps we failed while saving it and need to retry.
+                self.save_instance(tenant, instance)
+            return instance
+
+        desired_image = self.get_image(tenant)
+
+        flavors = Flavor.objects.filter(name="m1.small")
+        if not flavors:
+            raise SynchronizerConfigurationError("No m1.small flavor")
+
+        slice = tenant.owner.slices.first()
+
+        (node, parent) = LeastLoadedNodeScheduler(slice, label=self.get_veg_service(tenant).node_label).pick()
+
+        assert (slice is not None)
+        assert (node is not None)
+        assert (desired_image is not None)
+        assert (tenant.creator is not None)
+        assert (node.site_deployment.deployment is not None)
+        assert (desired_image is not None)
+
+        instance = Instance(slice=slice,
+                            node=node,
+                            image=desired_image,
+                            creator=tenant.creator,
+                            deployment=node.site_deployment.deployment,
+                            flavor=flavors[0],
+                            isolation=slice.default_isolation,
+                            parent=parent)
+
+        self.save_instance(tenant, instance)
+
+        return instance
+
+    def manage_container(self, tenant):
+        if tenant.deleted:
+            return
+
+        if not tenant.volt:
+            raise SynchronizerConfigurationError("This VEG container has no volt")
+
+        if tenant.instance:
+            # We're good.
+            return
+
+        instance = self.find_or_make_instance_for_s_tag(tenant, tenant.volt.s_tag)
+        tenant.instance = instance
+        # TODO: possible for partial failure here?
+        tenant.save()
+
+    def find_or_make_port(self, instance, network, **kwargs):
+        port = Port.objects.filter(instance_id=instance.id, network_id=network.id)
+        if port:
+            port = port[0]
+        else:
+            port = Port(instance=instance, network=network, **kwargs)
+            port.save()
+        return port
+
+    def get_lan_network(self, tenant, instance):
+        slice = tenant.owner.slices.all()[0]
+        # there should only be one network private network, and its template should not be the management template
+        lan_networks = [x for x in slice.networks.all() if
+                        x.template.visibility == "private" and (not "management" in x.template.name)]
+        if len(lan_networks) > 1:
+            raise SynchronizerProgrammingError("The vEG slice should only have one non-management private network")
+        if not lan_networks:
+            raise SynchronizerProgrammingError("No lan_network")
+        return lan_networks[0]
+
+    def port_set_parameter(self, port, name, value):
+        pt = NetworkParameterType.objects.get(name=name)
+        existing_params = NetworkParameter.objects.filter(parameter_id=pt.id, content_type=port.self_content_type_id, object_id=port.id)
+
+        if existing_params:
+            p = existing_params[0]
+            p.value = str(value)
+            p.save()
+        else:
+            p = NetworkParameter(parameter=pt, content_type=port.self_content_type_id, object_id=port.id, value=str(value))
+            p.save()
+
+    def save_instance(self, tenant, instance):
+        instance.volumes = "/etc/dnsmasq.d,/etc/ufw"
+        instance.no_sync = True   # prevent instance from being synced until we're done with it
+        super(VEGTenantPolicy, self).save_instance(instance)
+        try:
+            if instance.isolation in ["container", "container_vm"]:
+                raise Exception("Not supported")
+
+            if instance.isolation in ["vm"]:
+                lan_network = self.get_lan_network(tenant, instance)
+                port = self.find_or_make_port(instance, lan_network)
+                self.port_set_parameter(port, "c_tag", tenant.volt.c_tag)
+                self.port_set_parameter(port, "s_tag", tenant.volt.s_tag)
+                self.port_set_parameter(port, "neutron_port_name", "stag-%s" % tenant.volt.s_tag)
+                port.save()
+
+            # tag the instance with the s-tag, so we can easily find the
+            # instance later
+            if tenant.volt and tenant.volt.s_tag:
+                tags = Tag.objects.filter(name="s_tag", value=tenant.volt.s_tag)
+                if not tags:
+                    tag = Tag(service=tenant.owner, content_type=instance.self_content_type_id, object_id=instance.id, name="s_tag", value=str(tenant.volt.s_tag))
+                    tag.save()
+
+            # VTN-CORD needs a WAN address for the VM, so that the VM can
+            # be configured.
+            tags = Tag.objects.filter(content_type=instance.self_content_type_id, object_id=instance.id, name="vm_vrouter_tenant")
+            if not tags:
+                address_service_instance = self.allocate_public_service_instance(address_pool_name="addresses_veg",
+                                                                                 subscriber_service=tenant.owner)
+                address_service_instance.set_attribute("tenant_for_instance_id", instance.id)
+                address_service_instance.save()
+                # TODO: potential partial failure
+                tag = Tag(service=tenant.owner, content_type=instance.self_content_type_id, object_id=instance.id, name="vm_vrouter_tenant", value="%d" % address_service_instance.id)
+                tag.save()
+
+            instance.no_sync = False   # allow the synchronizer to run now
+            super(VEGTenantPolicy, self).save_instance(instance)
+        except:
+            # need to clean up any failures here
+            raise
+
+
diff --git a/xos/synchronizer/stop.sh b/xos/synchronizer/model_policies/test_config.yaml
old mode 100755
new mode 100644
similarity index 83%
rename from xos/synchronizer/stop.sh
rename to xos/synchronizer/model_policies/test_config.yaml
index 073379a..07fe519
--- a/xos/synchronizer/stop.sh
+++ b/xos/synchronizer/model_policies/test_config.yaml
@@ -1,4 +1,3 @@
-
 # Copyright 2017-present Open Networking Foundation
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,5 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-
-pkill -9 -f veg-observer.py
+name: test-model-policies
+accessor:
+  username: xosadmin@opencord.org
+  password: "sample"
+  kind: "testframework"
diff --git a/xos/synchronizer/model_policies/test_model_policy_vegtenant.py b/xos/synchronizer/model_policies/test_model_policy_vegtenant.py
new file mode 100644
index 0000000..e7d1f4e
--- /dev/null
+++ b/xos/synchronizer/model_policies/test_model_policy_vegtenant.py
@@ -0,0 +1,495 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import unittest
+from mock import patch
+import mock
+
+import os, sys
+sys.path.append("../../..")
+config = os.path.abspath(os.path.dirname(os.path.realpath(__file__)) + "/test_config.yaml")
+from xosconfig import Config
+Config.init(config, 'synchronizer-config-schema.yaml')
+
+import synchronizers.new_base.modelaccessor
+
+import synchronizers.new_base.model_policies.model_policy_tenantwithcontainer
+import model_policy_vegtenant
+from model_policy_vegtenant import VEGTenantPolicy
+from synchronizers.new_base.model_policies.model_policy_tenantwithcontainer import LeastLoadedNodeScheduler
+
+MockObjectStores = {}
+
+class MockObjectList:
+    item_list = None
+
+    def __init__(self, initial=None):
+        self.id_counter = 0
+        if initial:
+            self.item_list=initial
+        elif self.item_list is None:
+            self.item_list=[]
+
+    def get_items(self):
+        return self.item_list
+
+    def count(self):
+        return len(self.get_items())
+
+    def first(self):
+        return self.get_items()[0]
+
+    def all(self):
+        return self.get_items()
+
+    def filter(self, **kwargs):
+        items = self.get_items()
+        for (k,v) in kwargs.items():
+            items = [x for x in items if getattr(x,k) == v]
+        return items
+
+    def get(self, **kwargs):
+        objs = self.filter(**kwargs)
+        if not objs:
+            raise Exception("No objects matching %s" % str(kwargs))
+        return objs[0]
+
+class MockObjectStore(MockObjectList):
+    def save(self, o):
+        if (not hasattr(o,"id")) or (not o.id):
+            for item in self.get_items():
+                if item.id >= self.id_counter:
+                    self.id_counter = item.id + 1
+
+            o.id = self.id_counter
+            self.id_counter = self.id_counter + 1
+
+        for item in self.get_items():
+            if item.id == o.id:
+                item = o
+                break
+        else:
+            self.get_items().append(o)
+
+class MockObject(object):
+    objects = None
+    id = None
+    def __init__(self, **kwargs):
+        for (k,v) in kwargs.items():
+            setattr(self,k,v)
+    @property
+    def self_content_type_id(self):
+        return self.__class__.__name__
+    def save(self):
+        if self.objects:
+            self.objects.save(self)
+    def delete(self):
+        pass
+
+def get_MockObjectStore(x):
+    return globals()["Mock%sObjects" % x]()
+
+class MockFlavorObjects(MockObjectStore): pass
+class MockFlavor(MockObject):
+    objects = get_MockObjectStore("Flavor")
+    name = None
+
+class MockInstanceObjects(MockObjectStore): pass
+class MockInstance(MockObject):
+    objects = get_MockObjectStore("Instance")
+    name = None
+
+class MockDeploymentObjects(MockObjectStore): pass
+class MockDeployment(MockObject):
+    objects = get_MockObjectStore("Deployment")
+    name = None
+
+class MockUserObjects(MockObjectStore): pass
+class MockUser(MockObject):
+    objects = get_MockObjectStore("User")
+    email = None
+
+class MockSliceObjects(MockObjectStore): pass
+class MockSlice(MockObject):
+    objects = get_MockObjectStore("Slice")
+    name = None
+    default_node = None
+    networks = None
+
+class MockNodeObjects(MockObjectStore): pass
+class MockNode(MockObject):
+    objects = get_MockObjectStore("Node")
+    hostname = None
+    site_deployment = None
+
+class MockImageObjects(MockObjectStore): pass
+class MockImage(MockObject):
+    objects = get_MockObjectStore("Image")
+    name = None
+
+class MockTagObjects(MockObjectStore): pass
+class MockTag(MockObject):
+    objects = get_MockObjectStore("Tag")
+    name = None
+    value = None
+
+class MockNetworkTemplateObjects(MockObjectStore): pass
+class MockNetworkTemplate(MockObject):
+    objects = get_MockObjectStore("NetworkTemplate")
+    name = None
+    visibility = None
+
+class MockNetworkParameterTypeObjects(MockObjectStore): pass
+class MockNetworkParameterType(MockObject):
+    objects = get_MockObjectStore("NetworkParameterType")
+    name = None
+
+class MockNetworkParameterObjects(MockObjectStore): pass
+class MockNetworkParameter(MockObject):
+    objects = get_MockObjectStore("NetworkParameter")
+    value = None
+    parameter_id = None
+
+class MockNetworkObjects(MockObjectStore): pass
+class MockNetwork(MockObject):
+    objects = get_MockObjectStore("Network")
+    name = None
+    template = None
+
+class MockPortObjects(MockObjectStore): pass
+class MockPort(MockObject):
+    objects = get_MockObjectStore("Port")
+    name = None
+    def set_parameter(self, name, value):
+        pass
+
+class MockAddressManagerServiceInstanceObjects(MockObjectStore): pass
+class MockAddressManagerServiceInstance(MockObject):
+    objects = get_MockObjectStore("AddressManagerServiceInstance")
+    public_ip = None
+    public_mac = None
+    address_pool_id = None
+    def set_attribute(self, name, value):
+        pass
+
+class MockVoltTenantObjects(MockObjectStore): pass
+class MockVoltTenant(MockObject):
+    objects = get_MockObjectStore("VoltTenant")
+    c_tag = None
+    s_tag = None
+
+class MockVEGServiceObjects(MockObjectStore): pass
+class MockVEGService(MockObject):
+    objects = get_MockObjectStore("VEGService")
+    name = None
+    node_label = None
+    slices = None
+    def __init__(self, **kwargs):
+        super(MockVEGService, self).__init__(**kwargs)
+
+class MockVEGTenantObjects(MockObjectStore): pass
+class MockVEGTenant(MockObject):
+    objects = get_MockObjectStore("VEGTenant")
+    owner = None
+    deleted = False
+    instance = None
+    creator = None
+    volt = None
+    service_specific_attribute = {}
+
+    def get_image(self):
+        return None
+
+class TestModelPolicyVegTenant(unittest.TestCase):
+    def setUp(self):
+        self.policy = VEGTenantPolicy()
+        self.tenant = MockVEGTenant()
+        self.user = MockUser(email="testadmin@test.org")
+        self.tenant = MockVEGTenant(creator=self.user, id=1)
+        self.flavor = MockFlavor(name="m1.small")
+        self.npt_ctag = MockNetworkParameterType(name="c_tag", id=1)
+        self.npt_stag = MockNetworkParameterType(name="s_tag", id=2)
+        self.npt_neutron_port_name = MockNetworkParameterType(name="neutron_port_name", id=3)
+        self.node = MockNode(hostname="my.node.com")
+        self.slice = MockSlice(name="mysite_test1", default_flavor=self.flavor, default_isolation="vm")
+        self.priv_template = MockNetworkTemplate(name="access_network", visibility="private")
+        self.priv_network = MockNetwork(name="mysite_test1_private", template=self.priv_template)
+        self.image = MockImage(name="trusty-server-multi-nic")
+        self.deployment = MockDeployment(name="testdeployment")
+        synchronizers.new_base.model_policies.model_policy_tenantwithcontainer.Instance = MockInstance
+        synchronizers.new_base.model_policies.model_policy_tenantwithcontainer.Flavor = MockFlavor
+        synchronizers.new_base.model_policies.model_policy_tenantwithcontainer.Tag = MockTag
+        synchronizers.new_base.model_policies.model_policy_tenantwithcontainer.Node = MockNode
+        model_policy_vegtenant.Instance = MockInstance
+        model_policy_vegtenant.Flavor = MockFlavor
+        model_policy_vegtenant.Tag = MockTag
+        model_policy_vegtenant.VEGService = MockVEGService
+        model_policy_vegtenant.Node = MockNode
+        model_policy_vegtenant.Port = MockPort
+        model_policy_vegtenant.NetworkParameterType = MockNetworkParameterType
+        model_policy_vegtenant.NetworkParameter = MockNetworkParameter
+
+    @patch.object(VEGTenantPolicy, "manage_container")
+    @patch.object(VEGTenantPolicy, "manage_address_service_instance")
+    @patch.object(VEGTenantPolicy, "cleanup_orphans")
+    def test_handle_create(self, cleanup_orphans, manage_address_service_instance, manage_container):
+        self.policy.handle_create(self.tenant)
+        manage_container.assert_called_with(self.tenant)
+        manage_address_service_instance.assert_called_with(self.tenant)
+        cleanup_orphans.assert_called_with(self.tenant)
+
+    @patch.object(VEGTenantPolicy, "manage_container")
+    @patch.object(VEGTenantPolicy, "manage_address_service_instance")
+    @patch.object(VEGTenantPolicy, "cleanup_orphans")
+    def test_handle_update(self, cleanup_orphans, manage_address_service_instance, manage_container):
+        self.policy.handle_create(self.tenant)
+        manage_container.assert_called_with(self.tenant)
+        manage_address_service_instance.assert_called_with(self.tenant)
+        cleanup_orphans.assert_called_with(self.tenant)
+
+    @patch.object(MockAddressManagerServiceInstance, "delete")
+    def test_handle_delete_asi_exist(self, amsi_delete):
+        vrtenant = MockAddressManagerServiceInstance()
+        self.tenant.address_service_instance = vrtenant
+        self.policy.handle_delete(self.tenant)
+        amsi_delete.assert_called()
+
+    @patch.object(MockAddressManagerServiceInstance, "delete")
+    def test_handle_delete_asi_noexist(self, amsi_delete):
+        self.tenant.address_service_instance = None
+        self.policy.handle_delete(self.tenant)
+        amsi_delete.assert_not_called()
+
+    @patch.object(MockAddressManagerServiceInstanceObjects, "get_items")
+    @patch.object(MockAddressManagerServiceInstance, "delete")
+    def test_cleanup_orphans(self, amsi_delete, amsi_objects):
+        vrtenant = MockAddressManagerServiceInstance(id=1)
+        self.tenant.address_service_instance = vrtenant
+        some_other_vrtenant = MockAddressManagerServiceInstance(id=2, subscriber_tenant_id = self.tenant.id)
+        amsi_objects.get_items = [some_other_vrtenant]
+        self.policy.handle_delete(self.tenant)
+        amsi_delete.assert_called()
+
+    @patch.object(MockTag, "objects")
+    def test_find_instance_for_s_tag_noexist(self, tag_objects):
+        tag_objects.filter.return_value = []
+        instance = self.policy.find_instance_for_s_tag(3)
+        self.assertEqual(instance, None)
+
+    @patch.object(MockTag, "objects")
+    def test_find_instance_for_s_tag(self, tag_objects):
+        tagged_instance = MockInstance()
+        tag = MockTag(content_object = tagged_instance)
+        tag_objects.filter.return_value = [tag]
+        instance = self.policy.find_instance_for_s_tag(3)
+        self.assertEqual(instance, tagged_instance)
+
+    def test_manage_container_no_volt(self):
+        with self.assertRaises(Exception) as e:
+            self.policy.manage_container(self.tenant)
+        self.assertEqual(e.exception.message, "This VEG container has no volt")
+
+    @patch.object(VEGTenantPolicy, "find_or_make_instance_for_s_tag")
+    @patch.object(MockVEGTenant, "save")
+    @patch.object(MockVEGTenant, "volt")
+    def test_manage_container_noinstance(self, volt, tenant_save, find_or_make_instance_for_s_tag):
+        instance = MockInstance()
+        volt.s_tag=222
+        volt.c_tag=111
+        find_or_make_instance_for_s_tag.return_value = instance
+        self.policy.manage_container(self.tenant)
+        self.assertEqual(self.tenant.instance, instance)
+        tenant_save.assert_called()
+
+    @patch.object(VEGTenantPolicy, "find_or_make_instance_for_s_tag")
+    @patch.object(MockVEGTenant, "save")
+    @patch.object(MockVEGTenant, "volt")
+    def test_manage_container_hasinstance(self, volt, tenant_save, find_or_make_instance_for_s_tag):
+        instance = MockInstance()
+        volt.s_tag=222
+        volt.c_tag=111
+        self.tenant.instance = instance
+        self.policy.manage_container(self.tenant)
+        find_or_make_instance_for_s_tag.assert_not_called()
+        self.assertEqual(self.tenant.instance, instance)
+        tenant_save.assert_not_called()
+
+    @patch.object(VEGTenantPolicy, "find_or_make_instance_for_s_tag")
+    @patch.object(MockVEGTenant, "save")
+    @patch.object(MockVEGTenant, "volt")
+    def test_manage_container_deleted(self, volt, tenant_save, find_or_make_instance_for_s_tag):
+        self.tenant.deleted = True
+        self.policy.manage_container(self.tenant)
+        find_or_make_instance_for_s_tag.assert_not_called()
+        tenant_save.assert_not_called()
+
+    @patch.object(MockPort, "save")
+    @patch.object(MockPort, "objects")
+    def test_find_or_make_port_noexist(self, port_objects, port_save):
+        instance = MockInstance(id=123)
+        network = MockInstance(id=456)
+        port_objects.filter.return_value = []
+        port=self.policy.find_or_make_port(instance, network)
+        self.assertNotEqual(port, None)
+        port_save.assert_called()
+
+    @patch.object(MockPort, "save")
+    @patch.object(MockPort, "objects")
+    def test_find_or_make_port_exists(self, port_objects, port_save):
+        someport = MockPort()
+        def mock_port_filter(network_id, instance_id):
+            if (network_id==456) and (instance_id==123):
+                return [someport]
+            return None
+        instance = MockInstance(id=123)
+        network = MockInstance(id=456)
+        port_objects.filter.side_effect = mock_port_filter
+        port=self.policy.find_or_make_port(instance, network)
+        self.assertEqual(port, someport)
+        port_save.assert_not_called()
+
+    @patch.object(MockVEGServiceObjects, "get_items")
+    def test_get_lan_network_noexist(self, vegservice_objects):
+        vegservice=MockVEGService(name="myvegservice", id=1, slices=MockObjectList(initial=[self.slice]))
+        vegservice_objects.return_value = [vegservice]
+        self.tenant.owner = vegservice
+        self.slice.networks = MockObjectList()
+        with self.assertRaises(Exception) as e:
+            self.policy.get_lan_network(self.tenant, None)
+        self.assertEqual(e.exception.message, "No lan_network")
+
+    @patch.object(MockVEGServiceObjects, "get_items")
+    def test_get_lan_network(self, vegservice_objects):
+        vegservice=MockVEGService(name="myvegservice", id=1, slices=MockObjectList(initial=[self.slice]))
+        vegservice_objects.return_value = [vegservice]
+        self.tenant.owner = vegservice
+        self.slice.networks = MockObjectList([self.priv_network])
+        lan_network = self.policy.get_lan_network(self.tenant, None)
+        self.assertEqual(lan_network, self.priv_network)
+
+    @patch.object(MockVEGServiceObjects, "get_items")
+    def test_get_lan_network_toomany(self, vegservice_objects):
+        some_other_network = MockNetwork(name="mysite_test1_private", template=self.priv_template)
+        vegservice=MockVEGService(name="myvegservice", id=1, slices=MockObjectList(initial=[self.slice]))
+        vegservice_objects.return_value = [vegservice]
+        self.tenant.owner = vegservice
+        self.slice.networks = MockObjectList([self.priv_network, some_other_network])
+        with self.assertRaises(Exception) as e:
+            lan_network = self.policy.get_lan_network(self.tenant, None)
+        self.assertEqual(e.exception.message, "The vEG slice should only have one non-management private network")
+
+    @patch.object(MockNetworkParameterTypeObjects, "get_items")
+    def test_port_set_parameter_noparamexist(self, npt_objects):
+        npt_objects.return_value = [self.npt_stag]
+        port = MockPort()
+        self.policy.port_set_parameter(port, "s_tag", "123")
+        self.assertNotEqual(MockNetworkParameter.objects.all(), [])
+        param = MockNetworkParameter.objects.first()
+        self.assertEqual(param.value, "123")
+        self.assertEqual(param.parameter, self.npt_stag)
+
+    @patch.object(MockNetworkParameterTypeObjects, "get_items")
+    @patch.object(MockNetworkParameterObjects, "get_items")
+    def test_port_set_parameter_paramexist(self, np_objects, npt_objects):
+        port = MockPort(id=1)
+        np_orig = MockNetworkParameter(parameter_id=self.npt_stag.id, value="456", object_id=port.id, content_type=port.self_content_type_id)
+        np_objects.return_value = [np_orig]
+        npt_objects.return_value = [self.npt_stag]
+        self.policy.port_set_parameter(port, "s_tag", "123")
+        self.assertEqual(MockNetworkParameter.objects.count(), 1)
+        param = MockNetworkParameter.objects.first()
+        self.assertEqual(param.value, "123")
+
+    @patch.object(MockNetworkParameterTypeObjects, "get_items")
+    @patch.object(MockNodeObjects, "get_items")
+    @patch.object(MockFlavorObjects, "get_items")
+    @patch.object(MockVEGServiceObjects, "get_items")
+    @patch.object(MockVEGTenant, "volt")
+    @patch.object(MockVEGTenant, "save")
+    @patch.object(VEGTenantPolicy, "get_image")
+    @patch.object(VEGTenantPolicy, "allocate_public_service_instance")
+    @patch.object(LeastLoadedNodeScheduler, "pick")
+    @patch.object(MockNode, "site_deployment")
+    @patch.object(MockInstance, "save")
+    @patch.object(MockInstance, "delete")
+    @patch.object(VEGTenantPolicy, "port_set_parameter")
+    def test_find_or_make_instance_for_s_tag(self, port_set_parameter, instance_delete, instance_save, site_deployment,
+                              pick, get_psi, get_image, tenant_save, volt,
+                              vegservice_objects, flavor_objects, node_objects, npt_objects):
+        # setup mocks
+        vrtenant = MockAddressManagerServiceInstance(public_ip="1.2.3.4", public_mac="01:02:03:04:05:06")
+        vegservice=MockVEGService(name="myvegservice", id=1, slices=MockObjectList(initial=[self.slice]))
+        vegservice_objects.return_value = [vegservice]
+        self.tenant.owner = vegservice
+        volt.s_tag=222
+        volt.c_tag=111
+        get_image.return_value = self.image
+        get_psi.return_value = vrtenant
+        pick.return_value = (self.node, None)
+        site_deployment.deployment = self.deployment
+        flavor_objects.return_value=[self.flavor]
+        node_objects.return_value=[self.node]
+        npt_objects.return_value=[self.npt_stag, self.npt_ctag, self.npt_neutron_port_name]
+        self.slice.networks = MockObjectList([self.priv_network])
+        # done setup mocks
+
+        # call the function under test
+        instance = self.policy.find_or_make_instance_for_s_tag(self.tenant, self.tenant.volt.s_tag)
+
+        # make sure Instance was created
+        self.assertNotEqual(instance, None)
+        self.assertEqual(instance.creator.email, "testadmin@test.org")
+        self.assertEqual(instance.image.name, "trusty-server-multi-nic")
+        self.assertEqual(instance.flavor.name, "m1.small")
+        self.assertEqual(instance.isolation, "vm")
+        self.assertEqual(instance.node.hostname, "my.node.com")
+        self.assertEqual(instance.slice.name, "mysite_test1")
+        self.assertEqual(instance.parent, None)
+        instance_save.assert_called()
+        instance_delete.assert_not_called()
+
+        # Access Network Port should have tags to c-tag and s-tag
+        port = MockPort.objects.first()
+        self.assertEqual(port.instance, instance)
+        self.assertEqual(port.network, self.priv_network)
+        port_set_parameter.assert_has_calls([mock.call(port, "c_tag", 111),
+                                             mock.call(port, "s_tag", 222),
+                                             mock.call(port, "neutron_port_name", "stag-222")])
+
+        # The instance should be tagged with the s-tag
+        tag = MockTag.objects.get(name="s_tag")
+        self.assertEqual(tag.value, "222")
+        self.assertEqual(tag.object_id, instance.id)
+
+        # The instance should have a tag pointing to its address_service_instance
+        tag = MockTag.objects.get(name="vm_vrouter_tenant")
+        self.assertNotEqual(tag.value, vrtenant.id)
+        self.assertEqual(tag.object_id, instance.id)
+
+        # Allocate_public_service_instance should have been called
+        get_psi.assert_called()
+
+    @patch.object(VEGTenantPolicy, "allocate_public_service_instance")
+    def test_manage_address_service_instance(self, get_psi):
+        vrtenant = MockAddressManagerServiceInstance(public_ip="1.2.3.4", public_mac="01:02:03:04:05:06")
+        get_psi.return_value = vrtenant
+
+        self.tenant.address_service_instance = None
+
+        self.policy.manage_address_service_instance(self.tenant)
+
+        get_psi.assert_called_with(address_pool_name="addresses_veg", subscriber_tenant=self.tenant)
+
+if __name__ == '__main__':
+    unittest.main()
+
diff --git a/xos/synchronizer/run-from-api.sh b/xos/synchronizer/run-from-api.sh
index aefc463..4b303f1 100644
--- a/xos/synchronizer/run-from-api.sh
+++ b/xos/synchronizer/run-from-api.sh
@@ -1,4 +1,3 @@
-
 # Copyright 2017-present Open Networking Foundation
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -14,5 +13,4 @@
 # limitations under the License.
 
 
-export XOS_DIR=/opt/xos
-python veg-synchronizer.py  -C $XOS_DIR/synchronizers/veg/veg_from_api_config
\ No newline at end of file
+python veg-synchronizer.py
diff --git a/xos/synchronizer/start.sh b/xos/synchronizer/start.sh
deleted file mode 100755
index 1c3488e..0000000
--- a/xos/synchronizer/start.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-
-# Copyright 2017-present Open Networking Foundation
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-#if [[ ! -e ./veg-observer.py ]]; then
-#    ln -s ../../xos-observer.py veg-observer.py
-#fi
-
-export XOS_DIR=/opt/xos
-nohup python veg-synchronizer.py  -C $XOS_DIR/synchronizers/veg/veg_synchronizer_config > /dev/null 2>&1 &
diff --git a/xos/synchronizer/steps/sync_vegtenant.py b/xos/synchronizer/steps/sync_vegtenant.py
index 056543d..6741518 100644
--- a/xos/synchronizer/steps/sync_vegtenant.py
+++ b/xos/synchronizer/steps/sync_vegtenant.py
@@ -21,7 +21,6 @@
 import base64
 import time
 from urlparse import urlparse
-from xos.config import Config
 from synchronizers.new_base.SyncInstanceUsingAnsible import SyncInstanceUsingAnsible
 from synchronizers.new_base.modelaccessor import *
 from synchronizers.new_base.ansible_helper import run_template_ssh
@@ -47,7 +46,7 @@
         super(SyncVEGTenant, self).__init__(*args, **kwargs)
 
     def get_veg_service(self, o):
-        if not o.provider_service:
+        if not o.owner:
             return None
 
         vegs = VEGService.objects.filter(id=o.provider_service.id)
@@ -86,10 +85,7 @@
             s_tags.append(o.volt.s_tag)
             c_tags.append(o.volt.c_tag)
 
-        try:
-            full_setup = Config().observer_full_setup
-        except:
-            full_setup = True
+        full_setup = True
 
         safe_macs=[]
         if veg_service.url_filter_kind == "safebrowsing":
@@ -149,8 +145,15 @@
 
         o.last_ansible_hash = ansible_hash
 
-    def delete_record(self, m):
-        pass
+    def sync_record(self, o):
+        if (not o.policed) or (o.policed<o.updated):
+            defer_sync("waiting on model policy")
+        super(SyncVEGTenant, self).sync_record(o)
+
+    def delete_record(self, o):
+        if (not o.policed) or (o.policed<o.updated):
+            defer_sync("waiting on model policy")
+        # do not call super, as we don't want to re-run the playbook
 
     def handle_service_monitoringagentinfo_watch_notification(self, monitoring_agent_info):
         if not monitoring_agent_info.service:
@@ -163,7 +166,7 @@
 
         objs = VEGTenant.get_tenant_objects().all()
         for obj in objs:
-            if obj.provider_service.id != monitoring_agent_info.service.id:
+            if obj.owner.id != monitoring_agent_info.service.id:
                 logger.info("handle watch notifications for service monitoring agent info...ignoring because service attribute in monitoring agent info:%s is not matching" % (monitoring_agent_info))
                 return
 
diff --git a/xos/synchronizer/supervisor/veg-observer.conf b/xos/synchronizer/supervisor/veg-observer.conf
deleted file mode 100644
index d5868a6..0000000
--- a/xos/synchronizer/supervisor/veg-observer.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-[program:veg-observer]
-command=python /opt/xos/synchronizers/veg/veg-synchronizer.py -C /opt/xos/synchronizers/veg/veg_synchronizer_config
diff --git a/xos/synchronizer/veg-synchronizer.py b/xos/synchronizer/veg-synchronizer.py
index 34ac99b..ffd1f72 100755
--- a/xos/synchronizer/veg-synchronizer.py
+++ b/xos/synchronizer/veg-synchronizer.py
@@ -21,7 +21,14 @@
 import importlib
 import os
 import sys
+from xosconfig import Config
+
+config_file = os.path.abspath(os.path.dirname(os.path.realpath(__file__)) + '/veg_config.yaml')
+
+Config.init(config_file, 'synchronizer-config-schema.yaml')
+
 observer_path = os.path.join(os.path.dirname(os.path.realpath(__file__)),"../../synchronizers/new_base")
 sys.path.append(observer_path)
 mod = importlib.import_module("xos-synchronizer")
 mod.main()
+
diff --git a/xos/synchronizer/run.sh b/xos/synchronizer/veg_config.yaml
old mode 100755
new mode 100644
similarity index 62%
rename from xos/synchronizer/run.sh
rename to xos/synchronizer/veg_config.yaml
index 588e2f3..342ffc1
--- a/xos/synchronizer/run.sh
+++ b/xos/synchronizer/veg_config.yaml
@@ -1,4 +1,3 @@
-
 # Copyright 2017-present Open Networking Foundation
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,10 +12,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-
-#if [[ ! -e ./veg-observer.py ]]; then
-#    ln -s ../../xos-observer.py veg-observer.py
-#fi
-
-export XOS_DIR=/opt/xos
-python veg-synchronizer.py  -C $XOS_DIR/synchronizers/veg/veg_synchronizer_config
+name: veg-synchronizer
+accessor:
+  username: xosadmin@opencord.org
+  password: "@/opt/xos/services/veg/credentials/xosadmin@opencord.org"
+dependency_graph: "/opt/xos/synchronizers/veg/model-deps"
+steps_dir: "/opt/xos/synchronizers/veg/steps"
+sys_dir: "/opt/xos/synchronizers/veg/sys"
+model_policies_dir: "/opt/xos/synchronizers/veg/model_policies"
diff --git a/xos/synchronizer/veg_synchronizer_config b/xos/synchronizer/veg_synchronizer_config
deleted file mode 100644
index 503d8e6..0000000
--- a/xos/synchronizer/veg_synchronizer_config
+++ /dev/null
@@ -1,48 +0,0 @@
-
-[plc]
-name=plc
-deployment=VICCI
-
-[db]
-name=xos
-user=postgres
-password=password
-host=xos_db
-port=5432
-
-[api]
-host=128.112.171.237
-port=8000
-ssl_key=None
-ssl_cert=None
-ca_ssl_cert=None
-ratelimit_enabled=0
-omf_enabled=0
-mail_support_address=support@localhost
-nova_enabled=True
-
-[observer]
-name=veg
-dependency_graph=/opt/xos/synchronizers/veg/model-deps
-steps_dir=/opt/xos/synchronizers/veg/steps
-sys_dir=/opt/xos/synchronizers/veg/sys
-deleters_dir=/opt/xos/synchronizers/veg/deleters
-log_file=console
-#/var/log/hpc.log
-driver=None
-pretend=False
-backoff_disabled=True
-save_ansible_output=True
-# set proxy_ssh to false on cloudlab
-full_setup=True
-proxy_ssh=True
-proxy_ssh_key=/opt/cord_profile/node_key
-proxy_ssh_user=root
-enable_watchers=True
-
-[networking]
-use_vtn=True
-
-[feefie]
-client_id='vicci_dev_central'
-user_id='pl'
diff --git a/xos/veg-onboard.yaml b/xos/veg-onboard.yaml
index 5750281..ef43d66 100644
--- a/xos/veg-onboard.yaml
+++ b/xos/veg-onboard.yaml
@@ -32,12 +32,8 @@
           xproto: ./
           admin: admin.py
           admin_template: templates/vegadmin.html
-          synchronizer: synchronizer/manifest
-          synchronizer_run: veg-synchronizer.py
           tosca_custom_types: veg.yaml
           tosca_resource: tosca/resources/vegservice.py
-          rest_service: subdirectory:veg api/service/veg/vegservice.py
-          rest_tenant: subdirectory:cord api/tenant/cord/veg.py
           private_key: file:///opt/xos/key_import/veg_rsa
           public_key: file:///opt/xos/key_import/veg_rsa.pub
 
diff --git a/xos/veg.xproto b/xos/veg.xproto
index aca8a69..f8d5a0e 100644
--- a/xos/veg.xproto
+++ b/xos/veg.xproto
@@ -4,14 +4,17 @@
 option app_label = "veg";
 
 message VEGService (Service){
-     optional string url_filter_kind = 1 [choices = "((None, 'None'), ('safebrowsing', 'Safe Browsing'), ('answerx', 'AnswerX'))", max_length = 30, content_type = "stripped",
- blank = True, null = True, db_index = False];
-     required string dns_servers = 2 [default = "8.8.8.8", max_length = 255, content_type = "stripped", blank = False, null = False, db_index = False];
-     optional string node_label = 3 [db_index = False, max_length = 30, null = True, content_type = "stripped", blank = True];
-     required string docker_image_name = 4 [default = "docker.io/xosproject/veg", max_length = 255, content_type = "stripped", blank = False, null = False, db_index = False];
-     required bool docker_insecure_registry = 5 [default = False, null = False, db_index = False, blank = True];
+    option verbose_name = "vEG Service";
+
+    optional string url_filter_kind = 1 [choices = "((None, 'None'), ('safebrowsing', 'Safe Browsing'), ('answerx', 'AnswerX'))", max_length = 30, content_type = "stripped", blank = True, null = True, db_index = False];
+    required string dns_servers = 2 [default = "8.8.8.8", max_length = 255, content_type = "stripped", blank = False, null = False, db_index = False];
+    optional string node_label = 3 [db_index = False, max_length = 30, null = True, content_type = "stripped", blank = True];
+    required string docker_image_name = 4 [default = "docker.io/xosproject/vsg", max_length = 255, content_type = "stripped", blank = False, null = False, db_index = False];
+    required bool docker_insecure_registry = 5 [default = False, null = False, db_index = False, blank = True];
 }
 
 
 message VEGTenant (TenantWithContainer){
+    option verbose_name = "vEG Tenant";
+    optional string last_ansible_hash = 1 [db_index = False, max_length = 128, null = True, content_type = "stripped", blank = True];
 }