diff --git a/.gitignore b/.gitignore
index 4adf44a..7813bf4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,4 +15,5 @@
 npm-debug.log
 xos/core/static/*.css
 !xos/core/static/xos.css
-.DS_Store
\ No newline at end of file
+.DS_Store
+xos/configurations/setup
diff --git a/xos/tests/api/apiary.apib b/apiary.apib
similarity index 97%
rename from xos/tests/api/apiary.apib
rename to apiary.apib
index 9eb3ba4..c94fe2d 100644
--- a/xos/tests/api/apiary.apib
+++ b/apiary.apib
@@ -94,6 +94,23 @@
         
  
  
+# Group Example
+
+## Example Services Collection [/api/service/exampleservice/]
+
+### List all Example Services [GET]
+
++ Response 200 (application/json)
+
+        [
+            {
+                "humanReadableName": "MyExample",
+                "id": 1,
+                "service_message": "This is the test message"
+            }
+        ]
+ 
+ 
 # Group ONOS Services
 
 List of the active onos services
@@ -128,8 +145,6 @@
             {
                 "humanReadableName": "service_vsg",
                 "id": 2,
-                "wan_container_gateway_ip": "",
-                "wan_container_gateway_mac": "",
                 "dns_servers": "8.8.8.8",
                 "url_filter_kind": null,
                 "node_label": null
diff --git a/containers/openvpn/Dockerfile b/containers/openvpn/Dockerfile
new file mode 100644
index 0000000..8ae8484
--- /dev/null
+++ b/containers/openvpn/Dockerfile
@@ -0,0 +1,12 @@
+FROM       xosproject/xos-synchronizer-openstack
+
+RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y \
+    openvpn
+
+# for OpenVPN
+RUN mkdir -p /opt/openvpn
+RUN chmod 777 /opt/openvpn
+RUN git clone https://github.com/OpenVPN/easy-rsa.git /opt/openvpn
+RUN git -C /opt/openvpn pull origin master
+RUN echo 'set_var EASYRSA	"/opt/openvpn/easyrsa3"' | tee /opt/openvpn/vars
+RUN echo 'set_var EASYRSA_BATCH	"true"' | tee -a /opt/openvpn/vars
diff --git a/containers/openvpn/Makefile b/containers/openvpn/Makefile
new file mode 100644
index 0000000..bdfb126
--- /dev/null
+++ b/containers/openvpn/Makefile
@@ -0,0 +1,18 @@
+IMAGE_NAME:=xosproject/xos-openvpn
+CONTAINER_NAME:=xos-synchronizer
+NO_DOCKER_CACHE?=true
+
+.PHONY: build
+build: ; sudo docker build --no-cache=${NO_DOCKER_CACHE} --rm -t ${IMAGE_NAME} .
+
+.PHONY: run
+run: ; sudo docker run -d --name ${CONTAINER_NAME} -v /usr/local/share/ca-certificates:/usr/local/share/ca-certificates:ro ${IMAGE_NAME}
+
+.PHONY: stop
+stop: ; sudo docker stop ${CONTAINER_NAME}
+
+.PHONY: rm
+rm: ; sudo docker rm ${CONTAINER_NAME}
+
+.PHONY: rmi
+rmi: ; docker rmi ${IMAGE_NAME}
diff --git a/containers/openvpn/conf/ansible-hosts b/containers/openvpn/conf/ansible-hosts
new file mode 100644
index 0000000..0dd74f1
--- /dev/null
+++ b/containers/openvpn/conf/ansible-hosts
@@ -0,0 +1,2 @@
+[localhost]
+127.0.0.1
diff --git a/containers/openvpn/conf/synchronizer.conf b/containers/openvpn/conf/synchronizer.conf
new file mode 100644
index 0000000..2131a25
--- /dev/null
+++ b/containers/openvpn/conf/synchronizer.conf
@@ -0,0 +1,9 @@
+[supervisord]
+logfile=/var/log/supervisord.log ; (main log file;default $CWD/supervisord.log)
+pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
+nodaemon=true
+
+[program:synchronizer]
+command=python /opt/xos/synchronizers/openstack/xos-synchronizer.py
+stderr_logfile=/var/log/supervisor/synchronizer.err.log
+stdout_logfile=/var/log/supervisor/synchronizer.out.log
diff --git a/containers/xos/Dockerfile b/containers/xos/Dockerfile
index b5064ae..afc7c9d 100644
--- a/containers/xos/Dockerfile
+++ b/containers/xos/Dockerfile
@@ -50,6 +50,7 @@
     django-timezones \
     djangorestframework==3.3.3 \
     dnslib \
+    jinja2 \
     lxml \
     markdown \
     netaddr \
diff --git a/containers/xos/Dockerfile.devel b/containers/xos/Dockerfile.devel
index 7bed082..5dc62a6 100644
--- a/containers/xos/Dockerfile.devel
+++ b/containers/xos/Dockerfile.devel
@@ -50,6 +50,7 @@
     django-timezones \
     djangorestframework==3.3.3 \
     dnslib \
+    jinja2 \
     lxml \
     markdown \
     netaddr \
diff --git a/views/ngXosViews/openVPNDashboard/.bowerrc b/views/ngXosViews/openVPNDashboard/.bowerrc
new file mode 100644
index 0000000..e491038
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/.bowerrc
@@ -0,0 +1,3 @@
+{
+  "directory": "src/vendor/"
+}
\ No newline at end of file
diff --git a/views/ngXosViews/openVPNDashboard/.eslintrc b/views/ngXosViews/openVPNDashboard/.eslintrc
new file mode 100644
index 0000000..c852748
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/.eslintrc
@@ -0,0 +1,42 @@
+{
+    "ecmaFeatures": {
+        "blockBindings": true,
+        "forOf": true,
+        "destructuring": true,
+        "arrowFunctions": true,
+        "templateStrings": true
+    },
+    "env": { 
+        "browser": true,
+        "node": true,
+        "es6": true
+    },
+    "plugins": [
+        //"angular"
+    ],
+    "rules": {
+        "quotes": [2, "single"],
+        "camelcase": [1, {"properties": "always"}],
+        "no-underscore-dangle": 1,
+        "eqeqeq": [2, "smart"],
+        "no-alert": 1,
+        "key-spacing": [1, { "beforeColon": false, "afterColon": true }],
+        "indent": [2, 2],
+        "no-irregular-whitespace": 1,
+        "eol-last": 0,
+        "max-nested-callbacks": [2, 4],
+        "comma-spacing": [1, {"before": false, "after": true}],
+        "no-trailing-spaces": [1, { skipBlankLines: true }],
+        "no-unused-vars": [1, {"vars": "all", "args": "after-used"}],
+        "new-cap": 0,
+
+        //"angular/ng_module_name": [2, '/^xos\.*[a-z]*$/'],
+        //"angular/ng_controller_name": [2, '/^[a-z].*Ctrl$/'],
+        //"angular/ng_service_name": [2, '/^[A-Z].*Service$/'],
+        //"angular/ng_directive_name": [2, '/^[a-z]+[[A-Z].*]*$/'],
+        //"angular/ng_di": [0, "function or array"]
+    },
+    "globals" :{
+        "angular": true
+    } 
+}
\ No newline at end of file
diff --git a/views/ngXosViews/openVPNDashboard/.gitignore b/views/ngXosViews/openVPNDashboard/.gitignore
new file mode 100644
index 0000000..567aee4
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/.gitignore
@@ -0,0 +1,6 @@
+dist/
+src/vendor
+.tmp
+node_modules
+npm-debug.log
+dist/
\ No newline at end of file
diff --git a/views/ngXosViews/openVPNDashboard/bower.json b/views/ngXosViews/openVPNDashboard/bower.json
new file mode 100644
index 0000000..01b2715
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/bower.json
@@ -0,0 +1,29 @@
+{
+  "name": "xos-openVPNDashboard",
+  "version": "0.0.0",
+  "authors": [
+    "Jeremy Mowery <jermowery@email.arizona.edu>"
+  ],
+  "description": "The OpenVPN Dashboard",
+  "license": "MIT",
+  "ignore": [
+    "**/.*",
+    "node_modules",
+    "bower_components",
+    "static/js/vendor/",
+    "test",
+    "tests"
+  ],
+  "dependencies": {
+  },
+  "devDependencies": {
+    "jquery": "2.1.4",
+    "angular-mocks": "1.4.7",
+    "angular": "1.4.7",
+    "angular-ui-router": "0.2.15",
+    "angular-cookies": "1.4.7",
+    "angular-resource": "1.4.7",
+    "ng-lodash": "0.3.0",
+    "bootstrap-css": "2.3.2"
+  }
+}
diff --git a/views/ngXosViews/openVPNDashboard/env/default.js b/views/ngXosViews/openVPNDashboard/env/default.js
new file mode 100644
index 0000000..5b198ec
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/env/default.js
@@ -0,0 +1,13 @@
+// This is a default configuration for your development environment.
+// You can duplicate this configuration for any of your Backend Environments.
+// Different configurations are loaded setting a NODE_ENV variable that contain the config file name.
+// `NODE_ENV=local npm start`
+//
+// If xoscsrftoken or xossessionid are not specified the browser value are used
+// (works only for local environment as both application are served on the same domain)
+
+module.exports = {
+  host: '',
+  xoscsrftoken: '',
+  xossessionid: ''
+};
diff --git a/views/ngXosViews/openVPNDashboard/gulp/build.js b/views/ngXosViews/openVPNDashboard/gulp/build.js
new file mode 100644
index 0000000..625e3ee
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/gulp/build.js
@@ -0,0 +1,150 @@
+'use strict';
+
+// BUILD
+//
+// The only purpose of this gulpfile is to build a XOS view and copy the correct files into
+// .html => dashboards
+// .js (minified and concat) => static/js
+//
+// The template are parsed and added to js with angular $templateCache
+
+var gulp = require('gulp');
+var ngAnnotate = require('gulp-ng-annotate');
+var uglify = require('gulp-uglify');
+var templateCache = require('gulp-angular-templatecache');
+var runSequence = require('run-sequence');
+var concat = require('gulp-concat');
+var del = require('del');
+var wiredep = require('wiredep');
+var angularFilesort = require('gulp-angular-filesort');
+var _ = require('lodash');
+var eslint = require('gulp-eslint');
+var inject = require('gulp-inject');
+var rename = require('gulp-rename');
+var replace = require('gulp-replace');
+var postcss = require('gulp-postcss');
+var autoprefixer = require('autoprefixer');
+var mqpacker = require('css-mqpacker');
+var csswring = require('csswring');
+
+var TEMPLATE_FOOTER = `}]);
+angular.module('xos.openVPNDashboard').run(function($location){$location.path('/')});
+angular.bootstrap(angular.element('#xosOpenVPNDashboard'), ['xos.openVPNDashboard']);`;
+
+module.exports = function(options){
+
+  // delete previous builded file
+  gulp.task('clean', function(){
+    return del(
+      [options.dashboards + 'xosOpenVPNDashboard.html'],
+      {force: true}
+    );
+  });
+
+  // minify css
+  gulp.task('css', function () {
+    var processors = [
+      autoprefixer({browsers: ['last 1 version']}),
+      mqpacker,
+      csswring
+    ];
+
+    gulp.src([
+      `${options.css}**/*.css`,
+      `!${options.css}dev.css`
+    ])
+    .pipe(postcss(processors))
+    .pipe(gulp.dest(options.tmp + '/css/'));
+  });
+
+  gulp.task('copyCss', ['css'], function(){
+    return gulp.src([`${options.tmp}/css/*.css`])
+    .pipe(concat('xosOpenVPNDashboard.css'))
+    .pipe(gulp.dest(options.static + 'css/'))
+  });
+
+  // compile and minify scripts
+  gulp.task('scripts', function() {
+    return gulp.src([
+      options.tmp + '**/*.js'
+    ])
+    .pipe(ngAnnotate())
+    .pipe(angularFilesort())
+    .pipe(concat('xosOpenVPNDashboard.js'))
+    .pipe(uglify())
+    .pipe(gulp.dest(options.static + 'js/'));
+  });
+
+  // set templates in cache
+  gulp.task('templates', function(){
+    return gulp.src('./src/templates/*.html')
+      .pipe(templateCache({
+        module: 'xos.openVPNDashboard',
+        root: 'templates/',
+        templateFooter: TEMPLATE_FOOTER
+      }))
+      .pipe(gulp.dest(options.tmp));
+  });
+
+  // copy html index to Django Folder
+  gulp.task('copyHtml', ['clean'], function(){
+    return gulp.src(options.src + 'index.html')
+      // remove dev dependencies from html
+      .pipe(replace(/<!-- bower:css -->(\n.*)*\n<!-- endbower --><!-- endcss -->/, ''))
+      .pipe(replace(/<!-- bower:js -->(\n.*)*\n<!-- endbower --><!-- endjs -->/, ''))
+      .pipe(replace(/ng-app=".*"\s/, ''))
+      // rewriting css path
+      // .pipe(replace(/(<link.*">)/, ''))
+      // injecting minified files
+      .pipe(
+        inject(
+          gulp.src([
+            options.static + 'js/vendor/xosOpenVPNDashboardVendor.js',
+            options.static + 'js/xosOpenVPNDashboard.js',
+            options.static + 'css/xosOpenVPNDashboard.css'
+          ]),
+          {ignorePath: '/../../../xos/core/xoslib'}
+        )
+      )
+      .pipe(rename('xosOpenVPNDashboard.html'))
+      .pipe(gulp.dest(options.dashboards));
+  });
+
+  // minify vendor js files
+  gulp.task('wiredep', function(){
+    var bowerDeps = wiredep().js;
+    if(!bowerDeps){
+      return;
+    }
+
+    // remove angular (it's already loaded)
+    _.remove(bowerDeps, function(dep){
+      return dep.indexOf('angular/angular.js') !== -1;
+    });
+
+    return gulp.src(bowerDeps)
+      .pipe(concat('xosOpenVPNDashboardVendor.js'))
+      .pipe(uglify())
+      .pipe(gulp.dest(options.static + 'js/vendor/'));
+  });
+
+  gulp.task('lint', function () {
+    return gulp.src(['src/js/**/*.js'])
+      .pipe(eslint())
+      .pipe(eslint.format())
+      .pipe(eslint.failAfterError());
+  });
+
+  gulp.task('build', function() {
+    runSequence(
+      'lint',
+      'templates',
+      'babel',
+      'scripts',
+      'wiredep',
+      'copyHtml',
+      'copyCss',
+      'cleanTmp'
+    );
+  });
+};
diff --git a/views/ngXosViews/openVPNDashboard/gulp/server.js b/views/ngXosViews/openVPNDashboard/gulp/server.js
new file mode 100644
index 0000000..7605294
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/gulp/server.js
@@ -0,0 +1,146 @@
+'use strict';
+
+var gulp = require('gulp');
+var browserSync = require('browser-sync').create();
+var inject = require('gulp-inject');
+var runSequence = require('run-sequence');
+var angularFilesort = require('gulp-angular-filesort');
+var babel = require('gulp-babel');
+var wiredep = require('wiredep').stream;
+var httpProxy = require('http-proxy');
+var del = require('del');
+
+const environment = process.env.NODE_ENV;
+
+if (environment){
+  var conf = require(`../env/${environment}.js`);
+}
+else{
+  var conf = require('../env/default.js')
+}
+
+var proxy = httpProxy.createProxyServer({
+  target: conf.host || 'http://0.0.0.0:9999'
+});
+
+
+proxy.on('error', function(error, req, res) {
+  res.writeHead(500, {
+    'Content-Type': 'text/plain'
+  });
+
+  console.error('[Proxy]', error);
+});
+
+module.exports = function(options){
+
+  // open in browser with sync and proxy to 0.0.0.0
+  gulp.task('browser', function() {
+    browserSync.init({
+      // reloadDelay: 500,
+      // logLevel: 'debug',
+      // logConnections: true,
+      startPath: '#/',
+      snippetOptions: {
+        rule: {
+          match: /<!-- browserSync -->/i
+        }
+      },
+      server: {
+        baseDir: options.src,
+        routes: {
+          '/api': options.api,
+          '/xosHelpers/src': options.helpers
+        },
+        middleware: function(req, res, next){
+          if(
+            req.url.indexOf('/xos/') !== -1 ||
+            req.url.indexOf('/xoslib/') !== -1 ||
+            req.url.indexOf('/hpcapi/') !== -1
+          ){
+            if(conf.xoscsrftoken && conf.xossessionid){
+              req.headers.cookie = `xoscsrftoken=${conf.xoscsrftoken}; xossessionid=${conf.xossessionid}`;
+              req.headers['x-csrftoken'] = conf.xoscsrftoken;
+            }
+            proxy.web(req, res);
+          }
+          else{
+            next();
+          }
+        }
+      }
+    });
+
+    gulp.watch(options.src + 'js/**/*.js', ['js-watch']);
+    gulp.watch(options.src + 'vendor/**/*.js', ['bower'], function(){
+      browserSync.reload();
+    });
+    gulp.watch(options.src + '**/*.html', function(){
+      browserSync.reload();
+    });
+  });
+
+  // transpile js with sourceMaps
+  gulp.task('babel', function(){
+    return gulp.src(options.scripts + '**/*.js')
+      .pipe(babel({sourceMaps: true}))
+      .pipe(gulp.dest(options.tmp));
+  });
+
+  // inject scripts
+  gulp.task('injectScript', ['cleanTmp', 'babel'], function(){
+    return gulp.src(options.src + 'index.html')
+      .pipe(
+        inject(
+          gulp.src([
+            options.tmp + '**/*.js',
+            options.api + '*.js',
+            options.helpers + '**/*.js'
+          ])
+          .pipe(angularFilesort()),
+          {
+            ignorePath: [options.src, '/../../ngXosLib']
+          }
+        )
+      )
+      .pipe(gulp.dest(options.src));
+  });
+
+  // inject CSS
+  gulp.task('injectCss', function(){
+    return gulp.src(options.src + 'index.html')
+      .pipe(
+        inject(
+          gulp.src(options.src + 'css/*.css'),
+          {
+            ignorePath: [options.src]
+          }
+          )
+        )
+      .pipe(gulp.dest(options.src));
+  });
+
+  // inject bower dependencies with wiredep
+  gulp.task('bower', function () {
+    return gulp.src(options.src + 'index.html')
+    .pipe(wiredep({devDependencies: true}))
+    .pipe(gulp.dest(options.src));
+  });
+
+  gulp.task('js-watch', ['injectScript'], function(){
+    browserSync.reload();
+  });
+
+  gulp.task('cleanTmp', function(){
+    return del([options.tmp + '**/*']);
+  });
+
+  gulp.task('serve', function() {
+    runSequence(
+      'bower',
+      'injectScript',
+      'injectCss',
+      ['browser']
+    );
+  });
+};
diff --git a/views/ngXosViews/openVPNDashboard/gulpfile.js b/views/ngXosViews/openVPNDashboard/gulpfile.js
new file mode 100644
index 0000000..a3523ee
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/gulpfile.js
@@ -0,0 +1,25 @@
+'use strict';
+
+var gulp = require('gulp');
+var wrench = require('wrench');
+
+var options = {
+  src: 'src/',
+  css: 'src/css/',
+  scripts: 'src/js/',
+  tmp: 'src/.tmp',
+  dist: 'dist/',
+  api: '../../ngXosLib/api/',
+  helpers: '../../ngXosLib/xosHelpers/src/',
+  static: '../../../xos/core/xoslib/static/', // this is the django static folder
+  dashboards: '../../../xos/core/xoslib/dashboards/' // this is the django html folder
+};
+
+wrench.readdirSyncRecursive('./gulp')
+.map(function(file) {
+  require('./gulp/' + file)(options);
+});
+
+gulp.task('default', function () {
+  gulp.start('build');
+});
diff --git a/views/ngXosViews/openVPNDashboard/karma.conf.js b/views/ngXosViews/openVPNDashboard/karma.conf.js
new file mode 100644
index 0000000..dbd344a
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/karma.conf.js
@@ -0,0 +1,89 @@
+// Karma configuration
+// Generated on Tue Oct 06 2015 09:27:10 GMT+0000 (UTC)
+
+/* eslint indent: [2,2], quotes: [2, "single"]*/
+
+/*eslint-disable*/
+var wiredep = require('wiredep');
+var path = require('path');
+
+var bowerComponents = wiredep( {devDependencies: true} )[ 'js' ].map(function( file ){
+  return path.relative(process.cwd(), file);
+});
+
+module.exports = function(config) {
+/*eslint-enable*/
+  config.set({
+
+    // base path that will be used to resolve all patterns (eg. files, exclude)
+    basePath: '',
+
+
+    // frameworks to use
+    // available frameworks: https://npmjs.org/browse/keyword/karma-adapter
+    frameworks: ['jasmine'],
+
+
+    // list of files / patterns to load in the browser
+    files: bowerComponents.concat([
+      'src/css/**/*.css',
+      '../../static/js/xosApi.js',
+      '../../static/js/vendor/ngXosHelpers.js',
+      'src/js/**/*.js',
+      'spec/**/*.mock.js',
+      'spec/**/*.test.js',
+      'src/**/*.html'
+    ]),
+
+
+    // list of files to exclude
+    exclude: [
+    ],
+
+
+    // preprocess matching files before serving them to the browser
+    // available preprocessors: https://npmjs.org/browse/keyword/karma-preprocessor
+    preprocessors: {
+      'src/js/**/*.js': ['babel'],
+      'spec/**/*.test.js': ['babel'],
+      'src/**/*.html': ['ng-html2js']
+    },
+
+    ngHtml2JsPreprocessor: {
+      stripPrefix: 'src/', //strip the src path from template url (http://stackoverflow.com/questions/22869668/karma-unexpected-request-when-testing-angular-directive-even-with-ng-html2js)
+      moduleName: 'templates' // define the template module name
+    },
+
+    // test results reporter to use
+    // possible values: 'dots', 'progress'
+    // available reporters: https://npmjs.org/browse/keyword/karma-reporter
+    reporters: ['mocha'],
+
+
+    // web server port
+    port: 9876,
+
+
+    // enable / disable colors in the output (reporters and logs)
+    colors: true,
+
+
+    // level of logging
+    // possible values: config.LOG_DISABLE || config.LOG_ERROR || config.LOG_WARN || config.LOG_INFO || config.LOG_DEBUG
+    logLevel: config.LOG_INFO,
+
+
+    // enable / disable watching file and executing tests whenever any file changes
+    autoWatch: true,
+
+
+    // start these browsers
+    // available browser launchers: https://npmjs.org/browse/keyword/karma-launcher
+    browsers: ['PhantomJS'],
+
+
+    // Continuous Integration mode
+    // if true, Karma captures browsers, runs the tests and exits
+    singleRun: false
+  });
+};
diff --git a/views/ngXosViews/openVPNDashboard/package.json b/views/ngXosViews/openVPNDashboard/package.json
new file mode 100644
index 0000000..412afec
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/package.json
@@ -0,0 +1,45 @@
+{
+  "name": "xos-openVPNDashboard",
+  "version": "1.0.0",
+  "description": "Angular Application for XOS, created with generator-xos",
+  "scripts": {
+    "prestart": "npm install && bower install",
+    "start": "gulp serve",
+    "prebuild": "npm install && bower install",
+    "build": "gulp",
+    "test": "karma start",
+    "lint": "eslint src/js/"
+  },
+  "keywords": [
+    "XOS",
+    "Angular",
+    "XOSlib"
+  ],
+  "author": "Jeremy Mowery",
+  "license": "MIT",
+  "dependencies": {},
+  "devDependencies": {
+    "browser-sync": "^2.9.11",
+    "del": "^2.0.2",
+    "gulp": "^3.9.0",
+    "gulp-angular-filesort": "^1.1.1",
+    "gulp-angular-templatecache": "^1.8.0",
+    "gulp-babel": "^5.3.0",
+    "gulp-concat": "^2.6.0",
+    "gulp-inject": "^3.0.0",
+    "gulp-minify-html": "^1.0.4",
+    "gulp-rename": "^1.2.2",
+    "gulp-replace": "^0.5.4",
+    "gulp-uglify": "^1.4.2",
+    "http-proxy": "^1.12.0",
+    "proxy-middleware": "^0.15.0",
+    "run-sequence": "^1.1.4",
+    "wiredep": "^3.0.0-beta",
+    "wrench": "^1.5.8",
+    "gulp-ng-annotate": "^1.1.0",
+    "lodash": "^3.10.1",
+    "eslint": "^1.8.0",
+    "eslint-plugin-angular": "linkmesrl/eslint-plugin-angular",
+    "gulp-eslint": "^1.0.0"
+  }
+}
diff --git a/views/ngXosViews/openVPNDashboard/spec/sample.test.js b/views/ngXosViews/openVPNDashboard/spec/sample.test.js
new file mode 100644
index 0000000..822c114
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/spec/sample.test.js
@@ -0,0 +1,37 @@
+'use strict';
+
+describe('The User List', () => {
+  
+  var scope, element, isolatedScope, httpBackend;
+
+  beforeEach(module('xos.openVPNDashboard'));
+  beforeEach(module('templates'));
+
+  beforeEach(inject(function($httpBackend, $compile, $rootScope){
+    
+    httpBackend = $httpBackend;
+    // Setting up mock request
+    $httpBackend.expectGET('/xos/users/?no_hyperlinks=1').respond([
+      {
+        email: 'jermowery@email.arizona.edu',
+        firstname: 'Jeremy',
+        lastname: 'Mowery' 
+      }
+    ]);
+  
+    scope = $rootScope.$new();
+    element = angular.element('<users-list></users-list>');
+    $compile(element)(scope);
+    scope.$digest();
+    isolatedScope = element.isolateScope().vm;
+  }));
+
+  it('should load 1 users', () => {
+    httpBackend.flush();
+    expect(isolatedScope.users.length).toBe(1);
+    expect(isolatedScope.users[0].email).toEqual('jermowery@email.arizona.edu');
+    expect(isolatedScope.users[0].firstname).toEqual('Jeremy');
+    expect(isolatedScope.users[0].lastname).toEqual('Mowery');
+  });
+
+});
\ No newline at end of file
diff --git a/views/ngXosViews/openVPNDashboard/src/css/openVPNDashboard.css b/views/ngXosViews/openVPNDashboard/src/css/openVPNDashboard.css
new file mode 100644
index 0000000..085d5d4
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/src/css/openVPNDashboard.css
@@ -0,0 +1,14 @@
+#xosOpenVPNDashboard{
+  width: 70%;
+  margin: auto;
+}
+.vpn-row {
+    display: table-row;
+}
+.vpn-cell {
+    display: table-cell;
+    padding: 5px;
+}
+.vpn-header {
+    font-weight: bold;
+}
diff --git a/views/ngXosViews/openVPNDashboard/src/index.html b/views/ngXosViews/openVPNDashboard/src/index.html
new file mode 100644
index 0000000..83048df
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/src/index.html
@@ -0,0 +1,34 @@
+<!-- browserSync -->
+<!-- bower:css -->
+<link rel="stylesheet" href="vendor/bootstrap-css/css/bootstrap.css" />
+<!-- endbower --><!-- endcss -->
+<!-- inject:css -->
+<link rel="stylesheet" href="/css/openVPNDashboard.css">
+<!-- endinject -->
+
+<div ng-app="xos.openVPNDashboard" id="xosOpenVPNDashboard">
+    <div ui-view></div>
+</div>
+
+<!-- bower:js -->
+<script src="vendor/jquery/dist/jquery.js"></script>
+<script src="vendor/angular/angular.js"></script>
+<script src="vendor/angular-mocks/angular-mocks.js"></script>
+<script src="vendor/angular-ui-router/release/angular-ui-router.js"></script>
+<script src="vendor/angular-cookies/angular-cookies.js"></script>
+<script src="vendor/angular-resource/angular-resource.js"></script>
+<script src="vendor/ng-lodash/build/ng-lodash.js"></script>
+<script src="vendor/bootstrap-css/js/bootstrap.js"></script>
+<!-- endbower --><!-- endjs -->
+<!-- inject:js -->
+<script src="/xosHelpers/src/xosHelpers.module.js"></script>
+<script src="/xosHelpers/src/ui_components/table/table.component.js"></script>
+<script src="/xosHelpers/src/ui_components/ui-components.module.js"></script>
+<script src="/xosHelpers/src/services/noHyperlinks.interceptor.js"></script>
+<script src="/xosHelpers/src/services/csrfToken.interceptor.js"></script>
+<script src="/xosHelpers/src/services/api.services.js"></script>
+<script src="/api/ng-xoslib.js"></script>
+<script src="/api/ng-xos.js"></script>
+<script src="/api/ng-hpcapi.js"></script>
+<script src="/.tmp/main.js"></script>
+<!-- endinject -->
diff --git a/views/ngXosViews/openVPNDashboard/src/js/main.js b/views/ngXosViews/openVPNDashboard/src/js/main.js
new file mode 100644
index 0000000..04d5d76
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/src/js/main.js
@@ -0,0 +1,61 @@
+'use strict';
+
+angular.module('xos.openVPNDashboard', [
+  'ngResource',
+  'ngCookies',
+  'ngLodash',
+  'ui.router',
+  'xos.helpers'
+])
+.config(($stateProvider) => {
+  $stateProvider
+  .state('openVPNList', {
+    url: '/',
+    template: '<vpn-list></vpn-list>'
+  });
+})
+.config(($compileProvider) => {
+  $compileProvider.aHrefSanitizationWhitelist(
+    /^\s*(https?|ftp|mailto|tel|file|blob):/);
+})
+.service('Vpn', function($http, $q){
+
+  this.getOpenVpnTenants = () => {
+    let deferred = $q.defer();
+
+    $http.get('/xoslib/openvpntenant/')
+    .then((res) => {
+      deferred.resolve(res.data)
+    })
+    .catch((e) => {
+      deferred.reject(e);
+    });
+
+    return deferred.promise;
+  }
+})
+.config(function($httpProvider){
+  $httpProvider.interceptors.push('NoHyperlinks');
+})
+.directive('vpnList', function(){
+  return {
+    restrict: 'E',
+    scope: {},
+    bindToController: true,
+    controllerAs: 'vm',
+    templateUrl: 'templates/openvpn-list.tpl.html',
+    controller: function(Vpn){
+      Vpn.getOpenVpnTenants()
+      .then((vpns) => {
+        this.vpns = vpns;
+        for (var i = 0; i < this.vpns.length; i++) {
+          var blob = new Blob([this.vpns[i].script_text], {type: 'text/plain'});
+          this.vpns[i].script_text = (window.URL || window.webkitURL).createObjectURL( blob );
+        }
+      })
+      .catch((e) => {
+        throw new Error(e);
+      });
+    }
+  };
+});
diff --git a/views/ngXosViews/openVPNDashboard/src/templates/openvpn-list.tpl.html b/views/ngXosViews/openVPNDashboard/src/templates/openvpn-list.tpl.html
new file mode 100644
index 0000000..0c7635f
--- /dev/null
+++ b/views/ngXosViews/openVPNDashboard/src/templates/openvpn-list.tpl.html
@@ -0,0 +1,19 @@
+<div style="display: table;">
+  <div class="vpn-row">
+    <h1 class="vpn-cell">VPN List</h1>
+  </div>
+  <div class="vpn-row">
+    <div class="vpn-cell vpn-header">ID</div>
+    <div class="vpn-cell vpn-header">VPN Network</div>
+    <div class="vpn-cell vpn-header">VPN Subnet</div>
+    <div class="vpn-cell vpn-header">Script Link</div>
+  </div>
+  <div class="vpn-row" ng-repeat="vpn in vm.vpns">
+    <div class="vpn-cell">{{ vpn.id }}</div>
+    <div class="vpn-cell">{{ vpn.server_network }}</div>
+    <div class="vpn-cell">{{ vpn.vpn_subnet }}</div>
+    <div class="vpn-cell">
+      <a download="connect-{{ vpn.id }}.vpn" ng-href="{{ vpn.script_text }}">Script</a>
+    </div>
+  </div>
+</div>
diff --git a/views/npm-debug.log b/views/npm-debug.log
new file mode 100644
index 0000000..38c9da9
--- /dev/null
+++ b/views/npm-debug.log
@@ -0,0 +1,20 @@
+0 info it worked if it ends with ok
+1 verbose cli [ '/usr/bin/nodejs', '/usr/bin/npm', 'start' ]
+2 info using npm@3.6.0
+3 info using node@v5.7.0
+4 verbose stack Error: ENOENT: no such file or directory, open '/home/jeremy/xos/views/package.json'
+4 verbose stack     at Error (native)
+5 verbose cwd /home/jeremy/xos/views
+6 error Linux 4.2.0-19-generic
+7 error argv "/usr/bin/nodejs" "/usr/bin/npm" "start"
+8 error node v5.7.0
+9 error npm  v3.6.0
+10 error path /home/jeremy/xos/views/package.json
+11 error code ENOENT
+12 error errno -2
+13 error syscall open
+14 error enoent ENOENT: no such file or directory, open '/home/jeremy/xos/views/package.json'
+15 error enoent ENOENT: no such file or directory, open '/home/jeremy/xos/views/package.json'
+15 error enoent This is most likely not a problem with npm itself
+15 error enoent and is related to npm not being able to find a file.
+16 verbose exit [ -2, true ]
diff --git a/xos/api/README.md b/xos/api/README.md
index c0244f0..eb2bd28 100644
--- a/xos/api/README.md
+++ b/xos/api/README.md
@@ -1,13 +1,24 @@
 ## XOS REST API
 
-The XOS API importer is automatic and will search this subdirectory and its hierarchy of children for valid API methods. API methods that are descendents of the django View class are discovered automatically. This should include django_rest_framework based Views and Viewsets. This processing is handled by import_methods.py.
+Source for the XOS REST API lives in directory `xos/api`. An importer
+tool, `import_methods.py`, auto-generates the REST API by searching
+this directory (and sub-directories) for valid API methods. These
+methods are descendents of the Django View class. This should include
+django_rest_framework based Views and Viewsets.
 
-A convention is established for locating API methods within the XOS hierarchy. The root of the api will automatically be /api/. Under that are the following paths:
+We establish a convention for locating API methods within the XOS
+hierarchy. The root of the api is automatically `/api/`. Under that
+are the following paths:
 
 * `/api/service` ... API endpoints that are service-wide
 * `/api/tenant` ... API endpoints that are relative to a tenant within a service
 
-For example, `/api/tenant/cord/subscriber/` contains the Subscriber API for the CORD service. 
+For example, `/api/tenant/cord/subscriber/` contains the Subscriber
+API for the CORD service.
 
-The API importer will automatically construct REST paths based on where files are placed within the directory hierarchy. For example, the files in `xos/api/tenant/cord/` will automatically appear at the API endpoint `http://server_name/api/tenant/cord/`. 
-The directory `examples` contains examples that demonstrate using the API from the Linux command line.
+The API importer automatically constructs REST paths based on
+where files are placed within the directory hierarchy. For example,
+the files in `xos/api/tenant/cord/` will automatically appear at the
+API endpoint `http://server_name/api/tenant/cord/`.  The directory
+`examples` contains examples that demonstrate using the API from the
+Linux command line.
diff --git a/xos/api/examples/util.sh b/xos/api/examples/util.sh
index b3d3060..648b32c 100644
--- a/xos/api/examples/util.sh
+++ b/xos/api/examples/util.sh
@@ -41,7 +41,7 @@
     fi
     ID=`echo $JSON | python -c "import json,sys; print json.load(sys.stdin)['related'].get('vsg_id','')"`
     if [[ $ID == "" ]]; then
-        echo "there is no volt for this subscriber" >&2
+        echo "there is no vsg for this subscriber" >&2
         exit -1
     fi
 
diff --git a/xos/api/import_methods.py b/xos/api/import_methods.py
index 1b5e3ca..3702f8a 100644
--- a/xos/api/import_methods.py
+++ b/xos/api/import_methods.py
@@ -30,7 +30,16 @@
 
 def import_module_by_dotted_name(name):
     print "import", name
-    module = __import__(name)
+    try:
+        module = __import__(name)
+    except:
+        # django will eat the exception, and then fail later with
+        #  'conflicting models in application'
+        # when it tries to import the module a second time.
+        print "exception in import_model_by_dotted_name"
+        import traceback
+        traceback.print_exc()
+        raise
     for part in name.split(".")[1:]:
         module = getattr(module, part)
     return module
diff --git a/xos/api/service/vtn.py b/xos/api/service/vtn.py
new file mode 100644
index 0000000..6b02616
--- /dev/null
+++ b/xos/api/service/vtn.py
@@ -0,0 +1,96 @@
+from rest_framework.decorators import api_view
+from rest_framework.response import Response
+from rest_framework.reverse import reverse
+from rest_framework import serializers
+from rest_framework import generics
+from rest_framework import viewsets
+from rest_framework.decorators import detail_route, list_route
+from rest_framework.views import APIView
+from core.models import *
+from services.vtn.models import VTNService
+from django.forms import widgets
+from django.conf.urls import patterns, url
+from api.xosapi_helpers import PlusModelSerializer, XOSViewSet, ReadOnlyField
+from django.shortcuts import get_object_or_404
+from xos.apibase import XOSListCreateAPIView, XOSRetrieveUpdateDestroyAPIView, XOSPermissionDenied
+from xos.exceptions import *
+import json
+import subprocess
+
+class VTNServiceSerializer(PlusModelSerializer):
+    id = ReadOnlyField()
+
+    privateGatewayMac = serializers.CharField(required=False)
+    localManagementIp = serializers.CharField(required=False)
+    ovsdbPort = serializers.IntegerField(required=False)
+    sshPort = serializers.IntegerField(required=False)
+    sshUser = serializers.CharField(required=False)
+    sshKeyFile = serializers.CharField(required=False)
+    mgmtSubnetBits = serializers.IntegerField(required=False)
+    xosEndpoint = serializers.CharField(required=False)
+    xosUser = serializers.CharField(required=False)
+    xosPassword = serializers.CharField(required=False)
+
+
+    humanReadableName = serializers.SerializerMethodField("getHumanReadableName")
+    class Meta:
+        model = VTNService
+        fields = ('humanReadableName', 'id', 'privateGatewayMac', 'localManagementIp', 'ovsdbPort', 'sshPort', 'sshUser', 'sshKeyFile',
+                  'mgmtSubnetBits', 'xosEndpoint', 'xosUser', 'xosPassword')
+
+    def getHumanReadableName(self, obj):
+        return obj.__unicode__()
+
+class VTNViewSet(XOSViewSet):
+    base_name = "vtn"
+    method_name = "vtn"
+    method_kind = "viewset"
+
+    # these are just because ViewSet needs some queryset and model, even if we don't use the
+    # default endpoints
+    queryset = VTNService.get_service_objects().all()
+    model = VTNService
+    serializer_class = VTNServiceSerializer
+
+    @classmethod
+    def get_urlpatterns(self, api_path="^"):
+        patterns = []
+
+        patterns.append( self.detail_url("services/$", {"get": "get_services"}, "services") )
+        patterns.append( self.detail_url("services_names/$", {"get": "get_services_names"}, "services") )
+        patterns.append( self.detail_url("services/(?P<service>[a-zA-Z0-9\-_]+)/$", {"get": "get_service"}, "get_service") )
+
+        # Not as RESTful as it could be, but maintain these endpoints for compability
+        patterns.append( self.list_url("services/$", {"get": "get_services"}, "rootvtn_services") )
+        patterns.append( self.list_url("services_names/$", {"get": "get_services_names"}, "rootvtn_services") )
+        patterns.append( self.list_url("services/(?P<service>[a-zA-Z0-9\-_]+)/$", {"get": "get_service"}, "rootvtn_get_service") )
+
+        patterns = patterns + super(VTNViewSet,self).get_urlpatterns(api_path)
+
+        return patterns
+
+    def get_services_names(self, request, pk=None):
+        result = {}
+        for service in Service.objects.all():
+           for id in service.get_vtn_src_names():
+               dependencies = service.get_vtn_dependencies_names()
+               if dependencies:
+                   result[id] = dependencies
+        return Response(result)
+
+    def get_services(self, request, pk=None):
+        result = {}
+        for service in Service.objects.all():
+           for id in service.get_vtn_src_ids():
+               dependencies = service.get_vtn_dependencies_ids()
+               if dependencies:
+                   result[id] = dependencies
+        return Response(result)
+
+    def get_service(self, request, pk=None, service=None):
+        for xos_service in Service.objects.all():
+            if service in xos_service.get_vtn_src_ids():
+                return Response(xos_service.get_vtn_dependencies_ids())
+        return Response([])
+
+
diff --git a/xos/api/tenant/cord/vsg.py b/xos/api/tenant/cord/vsg.py
new file mode 100644
index 0000000..6807e98
--- /dev/null
+++ b/xos/api/tenant/cord/vsg.py
@@ -0,0 +1,62 @@
+from rest_framework.decorators import api_view
+from rest_framework.response import Response
+from rest_framework.reverse import reverse
+from rest_framework import serializers
+from rest_framework import generics
+from rest_framework import status
+from core.models import *
+from django.forms import widgets
+from services.cord.models import VSGTenant, VSGService, CordSubscriberRoot
+from xos.apibase import XOSListCreateAPIView, XOSRetrieveUpdateDestroyAPIView, XOSPermissionDenied
+from api.xosapi_helpers import PlusModelSerializer, XOSViewSet, ReadOnlyField
+
+def get_default_vsg_service():
+    vsg_services = VSGService.get_service_objects().all()
+    if vsg_services:
+        return vsg_services[0].id
+    return None
+
+class VSGTenantForAPI(VSGTenant):
+    class Meta:
+        proxy = True
+        app_label = "cord"
+
+    @property
+    def related(self):
+        related = {}
+        if self.instance:
+            related["instance_id"] = self.instance.id
+        return related
+
+class VSGTenantSerializer(PlusModelSerializer):
+    id = ReadOnlyField()
+    wan_container_ip = serializers.CharField()
+    wan_container_mac = ReadOnlyField()
+    related = serializers.DictField(required=False)
+
+    humanReadableName = serializers.SerializerMethodField("getHumanReadableName")
+    class Meta:
+        model = VSGTenantForAPI
+        fields = ('humanReadableName', 'id', 'wan_container_ip', 'wan_container_mac', 'related' )
+
+    def getHumanReadableName(self, obj):
+        return obj.__unicode__()
+
+class VSGTenantViewSet(XOSViewSet):
+    base_name = "vsg"
+    method_name = "vsg"
+    method_kind = "viewset"
+    queryset = VSGTenantForAPI.get_tenant_objects().all()
+    serializer_class = VSGTenantSerializer
+
+    @classmethod
+    def get_urlpatterns(self, api_path="^"):
+        patterns = super(VSGTenantViewSet, self).get_urlpatterns(api_path=api_path)
+
+        return patterns
+
+
+
+
+
+
diff --git a/xos/api/utility/__init__.py b/xos/api/utility/__init__.py
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/xos/api/utility/__init__.py
@@ -0,0 +1 @@
+
diff --git a/xos/api/utility/loginview.py b/xos/api/utility/loginview.py
new file mode 100644
index 0000000..2dc79c6
--- /dev/null
+++ b/xos/api/utility/loginview.py
@@ -0,0 +1,101 @@
+from rest_framework.decorators import api_view
+from rest_framework.response import Response
+from rest_framework.reverse import reverse
+from rest_framework import serializers
+from rest_framework import generics
+from rest_framework.views import APIView
+from core.models import *
+from services.hpc.models import *
+from services.requestrouter.models import *
+from django.forms import widgets
+from django.core.exceptions import PermissionDenied
+from django.contrib.contenttypes.models import ContentType
+import json
+import socket
+import time
+import django.middleware.csrf
+from xos.exceptions import *
+from django.contrib.sessions.backends.db import SessionStore
+from django.contrib.sessions.models import Session
+from django.contrib.auth import authenticate
+
+def date_handler(obj):
+    return obj.isoformat() if hasattr(obj, 'isoformat') else obj
+
+def serialize_user(model):
+    serialized = model_to_dict(model)
+    del serialized['timezone']
+    del serialized['password']
+    return json.dumps(serialized, default=date_handler)
+
+class LoginView(APIView):
+    method_kind = "list"
+    method_name = "login"
+
+    def do_login(self, request, username, password):
+        if not username:
+            raise XOSMissingField("No username specified")
+
+        if not password:
+            raise XOSMissingField("No password specified")
+
+        u=authenticate(username=username, password=password)
+        if not u:
+            raise PermissionDenied("Failed to authenticate user %s" % username)
+
+        auth = {"username": username, "password": password}
+        request.session["auth"] = auth
+        request.session['_auth_user_id'] = u.pk
+        request.session['_auth_user_backend'] = u.backend
+        request.session.save()
+
+        return Response({
+            "xoscsrftoken": django.middleware.csrf.get_token(request),
+            "xossessionid": request.session.session_key,
+            "user": serialize_user(u)
+        })
+
+    def get(self, request, format=None):
+        username = request.GET.get("username", None)
+        password = request.GET.get("password", None)
+
+        return self.do_login(request, username, password)
+
+    def post(self, request, format=None):
+        username = request.data.get("username", None)
+        password = request.data.get("password", None)
+
+        return self.do_login(request, username, password)
+
+class LogoutView(APIView):
+    method_kind = "list"
+    method_name = "logout"
+
+    def do_logout(self, request, sessionid):
+        if not sessionid:
+            raise XOSMissingField("No xossessionid specified")
+
+        # Make sure the session exists. This prevents us from accidentally
+        # creating empty sessions with SessionStore()
+        session = Session.objects.filter(session_key=sessionid)
+        if not session:
+            # session doesn't exist
+            raise PermissionDenied("Session does not exist")
+
+        session = SessionStore(session_key=sessionid)
+        if "auth" in session:
+            del session["auth"]
+            session.save()
+        if "_auth_user_id" in session:
+            del session["_auth_user_id"]
+            session.save()
+
+        return Response("Logged Out")
+
+    def get(self, request, format=None):
+        sessionid = request.GET.get("xossessionid", None)
+        return self.do_logout(request, sessionid)
+
+    def post(self, request, format=None):
+        sessionid = request.data.get("xossessionid", None)
+        return self.do_logout(request, sessionid)
\ No newline at end of file
diff --git a/xos/configurations/acord/Makefile b/xos/configurations/acord/Makefile
index b5b93fa..cfa04f8 100644
--- a/xos/configurations/acord/Makefile
+++ b/xos/configurations/acord/Makefile
@@ -8,8 +8,9 @@
 cord: 
 	sudo MYIP=$(MYIP) docker-compose up -d
 	bash ../common/wait_for_xos.sh
-	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/fixtures.yaml
-	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/base.yaml
+	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/fixtures.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/mydeployment.yaml
+	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/cloudlab-openstack.yaml
 	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/nodes.yaml
 
 acord: cord
diff --git a/xos/configurations/acord/ceilometer.yaml b/xos/configurations/acord/ceilometer.yaml
index ff56579..66d5d32 100644
--- a/xos/configurations/acord/ceilometer.yaml
+++ b/xos/configurations/acord/ceilometer.yaml
@@ -164,6 +164,9 @@
     ceilometer-trusty-server-multi-nic:
       type: tosca.nodes.Image
 
+    m1.small:
+      type: tosca.nodes.Flavor
+
     mysite_ceilometer:
       description: Ceilometer Proxy Slice
       type: tosca.nodes.Slice
@@ -177,8 +180,10 @@
           - default_image:
                 node: ceilometer-trusty-server-multi-nic
                 relationship: tosca.relationships.DefaultImage
+          - m1.small:
+                node: m1.small
+                relationship: tosca.relationships.DefaultFlavor
       properties:
-          default_flavor: m1.small
           max_instances: 2
 
 #    mysite_sflow:
diff --git a/xos/configurations/bash/copyin-vtn.sh b/xos/configurations/bash/copyin-vtn.sh
deleted file mode 100644
index ef18704..0000000
--- a/xos/configurations/bash/copyin-vtn.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#! /bin/bash
-
-export SETUPDIR=/root/setup
-
-# copy in file necessary to setup VTN
-
-cd ../cord
-CONTAINER=$( docker ps|grep "xos"|awk '{print $NF}' )
-make vtn_network_cfg_json
-docker cp $SETUPDIR/vtn-network-cfg.json $CONTAINER:/root/setup/
-docker cp ../common/id_rsa.pub $CONTAINER:/opt/xos/observers/onos/onos_key.pub
-docker cp ../common/id_rsa $CONTAINER:/opt/xos/observers/onos/onos_key
diff --git a/xos/configurations/common/cloudlab-openstack.yaml b/xos/configurations/common/cloudlab-openstack.yaml
new file mode 100644
index 0000000..969f84c
--- /dev/null
+++ b/xos/configurations/common/cloudlab-openstack.yaml
@@ -0,0 +1,89 @@
+tosca_definitions_version: tosca_simple_yaml_1_0
+
+# Note:
+#   assumes mydeployment.yaml has already been run, and the following exist:
+#       MyDeployment
+#       mysite
+#       padmin@vicci.org
+#       Public Shared IPv4
+#   assumes the following have been created and filled with appropriate data:
+#       /root/setup/admin_openrc
+#       /root/setup/flat_net_name
+#       /root/setup/padmin_public_key
+
+description: >
+    * Adds OpenCloud Sites, Deployments, and Controllers.
+
+imports:
+   - custom_types/xos.yaml
+
+topology_template:
+  node_templates:
+    trusty-server-multi-nic:
+      type: tosca.nodes.Image
+      properties:
+         disk_format: QCOW2
+         container_format: BARE
+
+    MyDeployment:
+      type: tosca.nodes.Deployment
+      properties:
+          no-create: True
+          no-delete: True
+      requirements:
+          - image:
+              node: trusty-server-multi-nic
+              relationship: tosca.relationships.SupportsImage
+
+    CloudLab:
+      type: tosca.nodes.Controller
+      requirements:
+          - deployment:
+              node: MyDeployment
+              relationship: tosca.relationships.ControllerDeployment
+      properties:
+          backend_type: OpenStack
+          version: Kilo
+          auth_url: { get_script_env: [ SELF, adminrc, OS_AUTH_URL, LOCAL_FILE] }
+          admin_user: { get_script_env: [ SELF, adminrc, OS_USERNAME, LOCAL_FILE] }
+          admin_password: { get_script_env: [ SELF, adminrc, OS_PASSWORD, LOCAL_FILE] }
+          admin_tenant: { get_script_env: [ SELF, adminrc, OS_TENANT_NAME, LOCAL_FILE] }
+          rabbit_user: { get_script_env: [ SELF, controller_settings, RABBIT_USER, LOCAL_FILE] }
+          rabbit_password: { get_script_env: [ SELF, controller_settings, RABBIT_PASS, LOCAL_FILE] }
+          rabbit_host: { get_script_env: [ SELF, controller_settings, CONTROLLER_FLAT_LAN_IP, LOCAL_FILE] }
+          domain: Default
+      artifacts:
+          adminrc: /root/setup/admin-openrc.sh
+          controller_settings: /root/setup/controller_settings
+
+    mysite:
+      type: tosca.nodes.Site
+      properties:
+          no-create: True
+          no-delete: True
+      requirements:
+          - deployment:
+               node: MyDeployment
+               relationship: tosca.relationships.SiteDeployment
+               requirements:
+                   - controller:
+                       node: CloudLab
+                       relationship: tosca.relationships.UsesController
+
+    Public shared IPv4:
+      type: tosca.nodes.NetworkTemplate
+      properties:
+          no-create: True
+          no-delete: True
+          shared_network_name: { get_artifact: [ SELF, flat_net_name, LOCAL_FILE] }
+      artifacts:
+          flat_net_name: /root/setup/flat_net_name
+
+    padmin@vicci.org:
+      type: tosca.nodes.User
+      properties:
+          no-create: True
+          no-delete: True
+          public_key: { get_artifact: [ SELF, pubkey, LOCAL_FILE ] }
+      artifacts:
+          pubkey: /root/setup/padmin_public_key
diff --git a/xos/configurations/common/fixtures.yaml b/xos/configurations/common/fixtures.yaml
index 6419211..6d9c0e8 100644
--- a/xos/configurations/common/fixtures.yaml
+++ b/xos/configurations/common/fixtures.yaml
@@ -7,6 +7,11 @@
 
 topology_template:
   node_templates:
+
+# -----------------------------------------------------------------------------
+# Network Parameter Types
+# -----------------------------------------------------------------------------
+
     s_tag:
       type: tosca.nodes.NetworkParameterType
 
@@ -24,3 +29,97 @@
 
     neutron_port_name:
       type: tosca.nodes.NetworkParameterType
+
+# ----------------------------------------------------------------------------
+# Roles
+# ----------------------------------------------------------------------------
+
+    siterole#admin:
+      type: tosca.nodes.SiteRole
+
+    siterole#pi:
+      type: tosca.nodes.SiteRole
+
+    siterole#tech:
+      type: tosca.nodes.SiteRole
+
+    tenantrole#admin:
+      type: tosca.nodes.TenantRole
+
+    tenantrole#access:
+      type: tosca.nodes.TenantRole
+
+    deploymentrole#admin:
+      type: tosca.nodes.DeploymentRole
+
+    slicerole#admin:
+      type: tosca.nodes.SliceRole
+
+    slicerole#access:
+      type: tosca.nodes.SliceRole
+
+# -----------------------------------------------------------------------------
+# Flavors
+# -----------------------------------------------------------------------------
+
+    m1.small:
+      type: tosca.nodes.Flavor
+
+    m1.medium:
+      type: tosca.nodes.Flavor
+
+    m1.large:
+      type: tosca.nodes.Flavor
+
+# -----------------------------------------------------------------------------
+# Dashboard Views
+# -----------------------------------------------------------------------------
+
+    xsh:
+      type: tosca.nodes.DashboardView
+      properties:
+          url: template:xsh
+
+    Customize:
+      type: tosca.nodes.DashboardView
+      properties:
+          url: template:customize
+
+    Tenant:
+      type: tosca.nodes.DashboardView
+      properties:
+          url: template:xosTenant
+
+    Developer:
+      type: tosca.nodes.DashboardView
+      properties:
+          url: template:xosDeveloper_datatables
+
+# -----------------------------------------------------------------------------
+# Network Templates
+# -----------------------------------------------------------------------------
+
+    Private:
+      type: tosca.nodes.NetworkTemplate
+      properties:
+          visibility: private
+          translation: none
+
+    Public shared IPv4:
+      type: tosca.nodes.NetworkTemplate
+      properties:
+          visibility: private
+          translation: NAT
+          shared_network_name: nat-net
+
+    Public dedicated IPv4:
+      type: tosca.nodes.NetworkTemplate
+      properties:
+          visibility: public
+          translation: none
+          shared_network_name: ext-net
+
+
+
+
+
diff --git a/xos/configurations/common/mydeployment.yaml b/xos/configurations/common/mydeployment.yaml
new file mode 100644
index 0000000..66bb75d
--- /dev/null
+++ b/xos/configurations/common/mydeployment.yaml
@@ -0,0 +1,69 @@
+tosca_definitions_version: tosca_simple_yaml_1_0
+
+description: Some basic fixtures
+
+imports:
+   - custom_types/xos.yaml
+
+topology_template:
+  node_templates:
+    m1.large:
+      type: tosca.nodes.Flavor
+
+    m1.medium:
+      type: tosca.nodes.Flavor
+
+    m1.small:
+      type: tosca.nodes.Flavor
+
+    MyDeployment:
+      type: tosca.nodes.Deployment
+      requirements:
+          - m1.large:
+             node: m1.large
+             relationship: tosca.relationships.SupportsFlavor
+          - m1.medium:
+             node: m1.medium
+             relationship: tosca.relationships.SupportsFlavor
+          - m1.small:
+             node: m1.small
+             relationship: tosca.relationships.SupportsFlavor
+
+    mysite:
+      type: tosca.nodes.Site
+      properties:
+          display_name: MySite
+      requirements:
+          - deployment:
+               node: MyDeployment
+               relationship: tosca.relationships.SiteDeployment
+
+    # Attach the Tenant view to the MyDeployment deployment
+    Tenant:
+      type: tosca.nodes.DashboardView
+      properties:
+          no-create: true
+          no-delete: true
+      requirements:
+          - deployment:
+              node: MyDeployment
+              relationship: tosca.relationships.SupportsDeployment
+
+    padmin@vicci.org:
+      type: tosca.nodes.User
+      properties:
+          password: letmein
+#          encrypted_password: pbkdf2_sha256$12000$Qufx9iqtaYma$xs0YurPOcj9qYQna/Qrb3K+im9Yr2XEVr0J4Kqek7AE=
+          firstname: XOS
+          lastname: admin
+          is_admin: true
+      requirements:
+          - site:
+              node: mysite
+              relationship: tosca.relationships.MemberOfSite
+          - tenant_dashboard:
+              node: Tenant
+              relationship: tosca.relationships.UsesDashboard
+
+
+
diff --git a/xos/configurations/common/wait_for_xos_port.sh b/xos/configurations/common/wait_for_xos_port.sh
index dab6e70..3ed5833 100755
--- a/xos/configurations/common/wait_for_xos_port.sh
+++ b/xos/configurations/common/wait_for_xos_port.sh
@@ -11,7 +11,7 @@
 fi 
 
 echo "Waiting for XOS to come up"
-until http 0.0.0.0:$1 &> /dev/null
+until curl 0.0.0.0:$1 &> /dev/null
 do
     sleep 1
     RUNNING_CONTAINER=`sudo docker ps|grep "xos"|awk '{print $$NF}'`
diff --git a/xos/configurations/cord/Dockerfile.cord b/xos/configurations/cord-deprecated/Dockerfile.cord
similarity index 100%
rename from xos/configurations/cord/Dockerfile.cord
rename to xos/configurations/cord-deprecated/Dockerfile.cord
diff --git a/xos/configurations/cord/Makefile b/xos/configurations/cord-deprecated/Makefile
similarity index 94%
rename from xos/configurations/cord/Makefile
rename to xos/configurations/cord-deprecated/Makefile
index 1e53e79..184f2d5 100644
--- a/xos/configurations/cord/Makefile
+++ b/xos/configurations/cord-deprecated/Makefile
@@ -8,8 +8,9 @@
 cord: virtualbng_json vtn_network_cfg_json
 	sudo MYIP=$(MYIP) docker-compose up -d
 	bash ../common/wait_for_xos.sh
-	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/fixtures.yaml
-	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/base.yaml
+	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/fixtures.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/mydeployment.yaml
+	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/cloudlab-openstack.yaml
 	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/nodes.yaml
 	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/cord/cord.yaml
 
diff --git a/xos/configurations/cord/Makefile.inside b/xos/configurations/cord-deprecated/Makefile.inside
similarity index 100%
rename from xos/configurations/cord/Makefile.inside
rename to xos/configurations/cord-deprecated/Makefile.inside
diff --git a/xos/configurations/cord/README-VTN.md b/xos/configurations/cord-deprecated/README-VTN.md
similarity index 100%
rename from xos/configurations/cord/README-VTN.md
rename to xos/configurations/cord-deprecated/README-VTN.md
diff --git a/xos/configurations/cord/README.md b/xos/configurations/cord-deprecated/README.md
similarity index 95%
rename from xos/configurations/cord/README.md
rename to xos/configurations/cord-deprecated/README.md
index 606f12a..64075d9 100644
--- a/xos/configurations/cord/README.md
+++ b/xos/configurations/cord-deprecated/README.md
@@ -7,8 +7,10 @@
 * Brings up ONOS apps for controlling the dataplane: virtualbng, olt
 * Configures XOS with the CORD services: vCPE, vBNG, vOLT
 
-**NOTE:** This configuration is under **active development** and is not yet finished!  Some features are not
-fully working yet.
+**NOTE: This configuration is stale and likely not working at present.  If you are looking to evaluate 
+and/or contribute to [CORD](http://opencord.org/), 
+you should look instead at the [cord-pod](../cord-pod) configuration. Almost
+all CORD developers have transitioned to [cord-pod](../cord-pod).**
 
 ## End-to-end dataplane
 
diff --git a/xos/configurations/cord/ceilometer.yaml b/xos/configurations/cord-deprecated/ceilometer.yaml
similarity index 97%
rename from xos/configurations/cord/ceilometer.yaml
rename to xos/configurations/cord-deprecated/ceilometer.yaml
index 3724265..464b07b 100644
--- a/xos/configurations/cord/ceilometer.yaml
+++ b/xos/configurations/cord-deprecated/ceilometer.yaml
@@ -164,6 +164,9 @@
     ceilometer-trusty-server-multi-nic:
       type: tosca.nodes.Image
 
+    m1.small:
+      type: tosca.nodes.Flavor
+
     mysite_ceilometer:
       description: Ceilometer Proxy Slice
       type: tosca.nodes.Slice
@@ -177,8 +180,9 @@
           - default_image:
                 node: ceilometer-trusty-server-multi-nic
                 relationship: tosca.relationships.DefaultImage
-      properties:
-          default_flavor: m1.small
+          - default_flavor:
+                node: m1.small
+                relationship: tosca.relationships.DefaultFlavor
 
 #    mysite_sflow:
 #      description: Slice for sFlow service
diff --git a/xos/configurations/cord/cord.yaml b/xos/configurations/cord-deprecated/cord.yaml
similarity index 100%
rename from xos/configurations/cord/cord.yaml
rename to xos/configurations/cord-deprecated/cord.yaml
diff --git a/xos/configurations/cord/dataplane/ansible.cfg b/xos/configurations/cord-deprecated/dataplane/ansible.cfg
similarity index 100%
rename from xos/configurations/cord/dataplane/ansible.cfg
rename to xos/configurations/cord-deprecated/dataplane/ansible.cfg
diff --git a/xos/configurations/cord/dataplane/change_controller.sh b/xos/configurations/cord-deprecated/dataplane/change_controller.sh
similarity index 100%
rename from xos/configurations/cord/dataplane/change_controller.sh
rename to xos/configurations/cord-deprecated/dataplane/change_controller.sh
diff --git a/xos/configurations/cord/dataplane/cleanup.sh b/xos/configurations/cord-deprecated/dataplane/cleanup.sh
similarity index 100%
rename from xos/configurations/cord/dataplane/cleanup.sh
rename to xos/configurations/cord-deprecated/dataplane/cleanup.sh
diff --git a/xos/configurations/cord/dataplane/dataplane-bm.yaml b/xos/configurations/cord-deprecated/dataplane/dataplane-bm.yaml
similarity index 100%
rename from xos/configurations/cord/dataplane/dataplane-bm.yaml
rename to xos/configurations/cord-deprecated/dataplane/dataplane-bm.yaml
diff --git a/xos/configurations/cord/dataplane/dataplane-vtn.yaml b/xos/configurations/cord-deprecated/dataplane/dataplane-vtn.yaml
similarity index 100%
rename from xos/configurations/cord/dataplane/dataplane-vtn.yaml
rename to xos/configurations/cord-deprecated/dataplane/dataplane-vtn.yaml
diff --git a/xos/configurations/cord/dataplane/dataplane.yaml b/xos/configurations/cord-deprecated/dataplane/dataplane.yaml
similarity index 100%
rename from xos/configurations/cord/dataplane/dataplane.yaml
rename to xos/configurations/cord-deprecated/dataplane/dataplane.yaml
diff --git a/xos/configurations/cord/dataplane/gen-etc-hosts.sh b/xos/configurations/cord-deprecated/dataplane/gen-etc-hosts.sh
similarity index 100%
rename from xos/configurations/cord/dataplane/gen-etc-hosts.sh
rename to xos/configurations/cord-deprecated/dataplane/gen-etc-hosts.sh
diff --git a/xos/configurations/cord/dataplane/gen-inventory.sh b/xos/configurations/cord-deprecated/dataplane/gen-inventory.sh
similarity index 100%
rename from xos/configurations/cord/dataplane/gen-inventory.sh
rename to xos/configurations/cord-deprecated/dataplane/gen-inventory.sh
diff --git a/xos/configurations/cord/dataplane/generate-bm.sh b/xos/configurations/cord-deprecated/dataplane/generate-bm.sh
similarity index 100%
rename from xos/configurations/cord/dataplane/generate-bm.sh
rename to xos/configurations/cord-deprecated/dataplane/generate-bm.sh
diff --git a/xos/configurations/cord/dataplane/scripts/if_from_ip.py b/xos/configurations/cord-deprecated/dataplane/scripts/if_from_ip.py
similarity index 100%
rename from xos/configurations/cord/dataplane/scripts/if_from_ip.py
rename to xos/configurations/cord-deprecated/dataplane/scripts/if_from_ip.py
diff --git a/xos/configurations/cord/dataplane/scripts/restart-vcpes.sh b/xos/configurations/cord-deprecated/dataplane/scripts/restart-vcpes.sh
similarity index 100%
rename from xos/configurations/cord/dataplane/scripts/restart-vcpes.sh
rename to xos/configurations/cord-deprecated/dataplane/scripts/restart-vcpes.sh
diff --git a/xos/configurations/cord/docker-compose.yml b/xos/configurations/cord-deprecated/docker-compose.yml
similarity index 100%
rename from xos/configurations/cord/docker-compose.yml
rename to xos/configurations/cord-deprecated/docker-compose.yml
diff --git a/xos/configurations/cord/make-virtualbng-json.sh b/xos/configurations/cord-deprecated/make-virtualbng-json.sh
similarity index 100%
rename from xos/configurations/cord/make-virtualbng-json.sh
rename to xos/configurations/cord-deprecated/make-virtualbng-json.sh
diff --git a/xos/configurations/cord/make-vtn-networkconfig-json.sh b/xos/configurations/cord-deprecated/make-vtn-networkconfig-json.sh
similarity index 100%
rename from xos/configurations/cord/make-vtn-networkconfig-json.sh
rename to xos/configurations/cord-deprecated/make-vtn-networkconfig-json.sh
diff --git a/xos/configurations/cord/xos_cord_config b/xos/configurations/cord-deprecated/xos_cord_config
similarity index 100%
copy from xos/configurations/cord/xos_cord_config
copy to xos/configurations/cord-deprecated/xos_cord_config
diff --git a/xos/configurations/cord-pod/Makefile b/xos/configurations/cord-pod/Makefile
index 49a1c98..ce1baf8 100644
--- a/xos/configurations/cord-pod/Makefile
+++ b/xos/configurations/cord-pod/Makefile
@@ -2,20 +2,21 @@
 xos: nodes.yaml images.yaml
 	sudo docker-compose up -d
 	../common/wait_for_xos_port.sh 80
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/fixtures.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/mydeployment.yaml
 	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/setup.yaml
 	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/nodes.yaml
 	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/images.yaml
 
-vtn: vtn_network_cfg_json
+vtn: vtn-external.yaml
 	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/vtn-external.yaml
 
-cord: virtualbng_json
+cord: 
 	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/mgmt-net.yaml
-	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/fixtures.yaml
 	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/cord-vtn-vsg.yaml
 
 exampleservice:
-	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/pod-exampleservice.yaml 
+	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/pod-exampleservice.yaml
 
 cord-ceilometer: ceilometer_custom_images cord
 	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/ceilometer.yaml
@@ -26,6 +27,9 @@
 images.yaml:
 	export SETUPDIR=.; bash ../common/make-images-yaml.sh
 
+vtn-external.yaml:
+	export SETUPDIR=.; bash ./make-vtn-external-yaml.sh
+
 virtualbng_json:
 	export SETUPDIR=.; bash ./make-virtualbng-json.sh
 
diff --git a/xos/configurations/cord-pod/README-Tutorial.md b/xos/configurations/cord-pod/README-Tutorial.md
index 1e3def3..805812f 100644
--- a/xos/configurations/cord-pod/README-Tutorial.md
+++ b/xos/configurations/cord-pod/README-Tutorial.md
@@ -75,24 +75,7 @@
 
 ## Bring up XOS
 
-Under the `cord-pod` configuration, edit file `make-vtn-networkconfig-json.sh`.
-Change the definition of `"publicGateways"` so that it looks like this (adding
-  a second gatewayIp and gatewayMac):
-
-```
-"publicGateways": [
-    {
-        "gatewayIp": "10.168.0.1",
-        "gatewayMac": "02:42:0a:a8:00:01"
-    },
-    {
-        "gatewayIp": "10.168.1.1",
-        "gatewayMac": "02:42:0a:a8:00:01"
-    }
-],
-```
-
-Now run the `make` commands described in the [README.md](./README.md) file:
+Run the `make` commands described in the [README.md](./README.md) file:
 
 ```
 ubuntu@xos:~/xos/xos/configurations/cord-pod$ make
diff --git a/xos/configurations/cord-pod/README.md b/xos/configurations/cord-pod/README.md
index e9b1327..d5051c9 100644
--- a/xos/configurations/cord-pod/README.md
+++ b/xos/configurations/cord-pod/README.md
@@ -28,9 +28,13 @@
 
 ### Install OpenStack
 
-Follow the instructions in the [README.md](https://github.com/open-cloud/openstack-cluster-setup/blob/master/README.md)
+To set up OpenStack, follow the instructions in the
+[README.md](https://github.com/open-cloud/openstack-cluster-setup/blob/master/README.md)
 file of the [open-cloud/openstack-cluster-setup](https://github.com/open-cloud/openstack-cluster-setup/)
-repository.
+repository.  If you're just getting started with CORD, it's probably best to begin with the
+single-node CORD test environment to familiarize yourself with the overall setup.
+
+**NOTE: In order to use the cord-pod configuration, you must set up OpenStack using the above recipe.**
 
 ### Set up ONOS VTN
 
@@ -69,35 +73,112 @@
 ubuntu@xos:~$ cd xos/xos/configurations/cord-pod
 ```
 
-Next, check that the following files exist in this directory:
+Next, check that the following files exist in this directory
+(they will have been put there for you by the cluster installation scripts):
 
  * *admin-openrc.sh*: Admin credentials for your OpenStack cloud
  * *id_rsa[.pub]*: A keypair that will be used by the various services
  * *node_key*: A private key that allows root login to the compute nodes
 
-They will have been put there for you by the cluster installation scripts.
+XOS can then be brought up for CORD by running a few `make` commands.
+First, run:
 
-If your setup uses the CORD fabric, you need to edit `make-vtn-networkconfig-json.sh`
-and `cord-vtn-vsg.yml` as appropriate.  Specifically, in
-`make-vtn-networkconfig-json.sh` you need to set these parameters for VTN:
- * gatewayIp
- * gatewayMac
- * PHYPORT
-
-And in `cord-vtn-vsg.yml`:
- * public_addresses -> properties -> addresses
- * service_vsg -> properties -> wan_container_gateway_ip
- * service_vsg -> properties -> wan_container_gateway_mac
- * service_vsg -> properties -> wan_container_netbits
-
-If you're not using the fabric then the default values should be OK.  
-
-XOS can then be brought up for CORD by running a few 'make' commands:
 ```
 ubuntu@xos:~/xos/xos/configurations/cord-pod$ make
+```
+
+After this you will be able to login to the XOS GUI at
+*http://xos/* using username/password `padmin@vicci.org/letmein`.
+Before proceeding, you should verify that objects in XOS are
+being sync'ed with OpenStack.  Log into the GUI and select *Users*
+at left.  Make sure there is a green check next to `padmin@vicci.org`.
+
+> If you are **not** building the single-node development POD, the next
+> step is to create and edit the VTN configuration.  Run `make vtn-external.yaml`
+> then edit the `vtn-external.yml` TOSCA file.  The `rest_hostname:`
+> field points to the host where ONOS should run the VTN app.  The
+> fields in the `service_vtn` and the objects of type `tosca.nodes.Tag`
+> correspond to the VTN fields listed
+> on [the CORD VTN page on the ONOS Wiki](https://wiki.onosproject.org/display/ONOS/CORD+VTN),
+> under the **ONOS Settings** heading; refer there for the fields'
+> meanings.  
+
+Then run:
+
+```
 ubuntu@xos:~/xos/xos/configurations/cord-pod$ make vtn
+```
+The above step configures the ONOS VTN app by generating a configuration
+and pushing it to ONOS.  You are able to see and modify the configuration
+via the GUI as follows:
+
+* To see the generated configuration, go to *http://xos/admin/onos/onosapp/*, select
+*VTN_ONOS_app*, then the *Attributes* tab, and look for the
+`rest_onos/v1/network/configuration/` attribute.  
+
+* To change the VTN configuration, modify the fields of the VTN Service object
+and the Tag objects associated with Nodes.  Don't forget to select *Save*.
+
+* After modifying the above fields, delete the `rest_onos/v1/network/configuration/` attribute
+in the *ONOS_VTN_app* and select *Save*.  The attribute will be regenerated using the new information.
+
+* Alternatively, if you want to load your own VTN configuration manually, you can delete the
+`autogenerate` attribute from the *ONOS_VTN_app*, edit the configuration in the
+`rest_onos/v1/network/configuration/` attribute, and select *Save*.
+
+Before proceeding, check that the VTN app is controlling Open vSwitch on the compute nodes.  Log
+into ONOS and run the `cordvtn-nodes` command:
+
+```
+$ ssh -p 8101 karaf@onos-cord   # password is karaf
+onos> cordvtn-nodes
+hostname=nova-compute, hostMgmtIp=192.168.122.177/24, dpIp=192.168.199.1/24, br-int=of:0000000000000001, dpIntf=veth1, init=COMPLETE
+Total 1 nodes
+```
+The important part is the `init=COMPLETE` at the end.  If you do not see this, refer to
+[the CORD VTN page on the ONOS Wiki](https://wiki.onosproject.org/display/ONOS/CORD+VTN) for
+help fixing the problem.  This must be working to bring up VMs on the POD.
+
+> If you are **not** building the single-node development POD, modify `cord-vtn-vsg.yml` 
+> and change `addresses_vsg` so that it contains the IP address block,
+> gateway IP, and gateway MAC of the CORD fabric.  
+
+Then run:
+
+```
 ubuntu@xos:~/xos/xos/configurations/cord-pod$ make cord
 ```
 
-After the first 'make' command above, you will be able to login to XOS at
-*http://xos/* using username/password `padmin@vicci.org/letmein`.
+
+### Inspecting the vSG
+
+The above series of `make` commands will spin up a vSG for a sample subscriber.  The
+vSG is implemented as a Docker container (using the
+[andybavier/docker-vcpe](https://hub.docker.com/r/andybavier/docker-vcpe/) image
+hosted on Docker Hub) running inside an Ubuntu VM.  Once the VM is created, you
+can login as the `ubuntu` user at the management network IP (172.27.0.x) on the compute node
+hosting the VM, using the private key generated on the head node by the install process.
+For example, in the single-node development POD configuration, you can login to the VM
+with management IP 172.27.0.2 using a ProxyCommand as follows:
+
+```
+ubuntu@pod:~$ ssh -o ProxyCommand="ssh -W %h:%p ubuntu@nova-compute" ubuntu@172.27.0.2
+```
+
+Alternatively, you could copy the generated private key to the compute node
+and login from there:
+
+```
+ubuntu@pod:~$ scp ~/.ssh/id_rsa ubuntu@nova-compute:~/.ssh
+ubuntu@pod:~$ ssh ubuntu@nova-compute
+ubuntu@nova-compute:~$ ssh ubuntu@172.27.0.2
+```
+
+Once logged in to the VM, you can run `sudo docker ps` to see the running
+vSG containers:
+
+```
+ubuntu@mysite-vsg-1:~$ sudo docker ps
+CONTAINER ID        IMAGE                    COMMAND             CREATED             STATUS              PORTS               NAMES
+2b0bfb3662c7        andybavier/docker-vcpe   "/sbin/my_init"     5 days ago          Up 5 days                               vcpe-222-111
+```
diff --git a/xos/configurations/cord-pod/ceilometer.yaml b/xos/configurations/cord-pod/ceilometer.yaml
index 3b32345..d07f2e9 100644
--- a/xos/configurations/cord-pod/ceilometer.yaml
+++ b/xos/configurations/cord-pod/ceilometer.yaml
@@ -171,6 +171,9 @@
     ceilometer-trusty-server-multi-nic:
       type: tosca.nodes.Image
 
+    m1.small:
+      type: tosca.nodes.Flavor
+
     mysite_ceilometer:
       description: Ceilometer Proxy Slice
       type: tosca.nodes.Slice
@@ -187,8 +190,9 @@
           - management:
               node: management
               relationship: tosca.relationships.ConnectsToNetwork
-      properties:
-          default_flavor: m1.small
+          - m1.small:
+              node: m1.small
+              relationship: tosca.relationships.DefaultFlavor
 
 #    mysite_sflow:
 #      description: Slice for sFlow service
diff --git a/xos/configurations/cord-pod/cleanup.sh b/xos/configurations/cord-pod/cleanup.sh
index 6ca58c2..704cacb 100755
--- a/xos/configurations/cord-pod/cleanup.sh
+++ b/xos/configurations/cord-pod/cleanup.sh
@@ -47,3 +47,4 @@
 neutron net-delete ceilometer_network || true
 neutron net-delete management || true
 neutron net-delete mysite_vsg-access || true
+neutron net-delete exampleservice-public || true
diff --git a/xos/configurations/cord-pod/cord-vtn-vsg.yaml b/xos/configurations/cord-pod/cord-vtn-vsg.yaml
index f29e257..e3f73c6 100644
--- a/xos/configurations/cord-pod/cord-vtn-vsg.yaml
+++ b/xos/configurations/cord-pod/cord-vtn-vsg.yaml
@@ -24,36 +24,51 @@
           view_url: /admin/cord/voltservice/$id$/
           kind: vOLT
 
-    public_addresses:
+    addresses_vsg:
       type: tosca.nodes.AddressPool
       properties:
           addresses: 10.168.0.0/24
+          gateway_ip: 10.168.0.1
+          gateway_mac: 02:42:0a:a8:00:01
+
+    addresses_exampleservice-public:
+      type: tosca.nodes.AddressPool
+      properties:
+          addresses: 10.168.1.0/24
+          gateway_ip: 10.168.1.1
+          gateway_mac: 02:42:0a:a8:00:01
 
     service_vsg:
       type: tosca.nodes.VSGService
       requirements:
-          - vbng_tenant:
-              node: service_vbng
+          - vrouter_tenant:
+              node: service_vrouter
               relationship: tosca.relationships.TenantOfService
       properties:
           view_url: /admin/cord/vsgservice/$id$/
           backend_network_label: hpc_client
           public_key: { get_artifact: [ SELF, pubkey, LOCAL_FILE] }
           private_key_fn: /opt/xos/synchronizers/vcpe/vcpe_private_key
-          wan_container_gateway_ip: 10.168.0.1
-          wan_container_gateway_mac: 02:42:0a:a8:00:01
-          wan_container_netbits: 24
 #          node_label: label_vsg
       artifacts:
           pubkey: /opt/xos/synchronizers/vcpe/vcpe_public_key
 
-    service_vbng:
-      type: tosca.nodes.VBNGService
+    service_vrouter:
+      type: tosca.nodes.VRouterService
       properties:
-          view_url: /admin/cord/vbngservice/$id$/
-# if unspecified, vbng observer will look for an ONOSApp Tenant and
-# generate a URL from its IP address
-#          vbng_url: http://10.11.10.24:8181/onos/virtualbng/
+          view_url: /admin/vrouter/vrouterservice/$id$/
+      requirements:
+          - addresses_vsg:
+              node: addresses_vsg
+              relationship: tosca.relationships.ProvidesAddresses
+          - addresses_service1:
+              node: addresses_exampleservice-public
+              relationship: tosca.relationships.ProvidesAddresses
+
+    service_fabric:
+      type: tosca.nodes.FabricService
+      properties:
+          view_url: /admin/fabric/fabricservice/$id$/
 
     Private:
       type: tosca.nodes.NetworkTemplate
diff --git a/xos/configurations/cord-pod/docker-compose.yml b/xos/configurations/cord-pod/docker-compose.yml
index cb7194f..e2a5768 100644
--- a/xos/configurations/cord-pod/docker-compose.yml
+++ b/xos/configurations/cord-pod/docker-compose.yml
@@ -13,7 +13,7 @@
         - xos_db
     volumes:
         - ../common/xos_common_config:/opt/xos/xos_configuration/xos_common_config:ro
-        - ../cord//xos_cord_config:/opt/xos/xos_configuration/xos_cord_config:ro
+        - ./xos_cord_config:/opt/xos/xos_configuration/xos_cord_config:ro
         - .:/root/setup:ro
         - ../vtn/files/xos_vtn_config:/opt/xos/xos_configuration/xos_vtn_config:ro
         - ./images:/opt/xos/images:ro
@@ -96,7 +96,7 @@
     volumes:
         - .:/root/setup:ro
         - ../common/xos_common_config:/opt/xos/xos_configuration/xos_common_config:ro
-        - ../cord/xos_cord_config:/opt/xos/xos_configuration/xos_cord_config:ro
+        - ./xos_cord_config:/opt/xos/xos_configuration/xos_cord_config:ro
         - ../vtn/files/xos_vtn_config:/opt/xos/xos_configuration/xos_vtn_config:ro
         - ./id_rsa.pub:/opt/xos/synchronizers/onos/onos_key.pub:ro
         - ./id_rsa.pub:/opt/xos/synchronizers/vcpe/vcpe_public_key:ro
diff --git a/xos/configurations/cord-pod/images/.gitignore b/xos/configurations/cord-pod/images/.gitignore
new file mode 100644
index 0000000..6949d1f
--- /dev/null
+++ b/xos/configurations/cord-pod/images/.gitignore
@@ -0,0 +1,3 @@
+*.img
+*.qcow2
+*.qcow
diff --git a/xos/configurations/cord-pod/make-vtn-external-yaml.sh b/xos/configurations/cord-pod/make-vtn-external-yaml.sh
new file mode 100644
index 0000000..c623394
--- /dev/null
+++ b/xos/configurations/cord-pod/make-vtn-external-yaml.sh
@@ -0,0 +1,107 @@
+FN=$SETUPDIR/vtn-external.yaml
+
+rm -f $FN
+
+cat >> $FN <<EOF
+tosca_definitions_version: tosca_simple_yaml_1_0
+
+imports:
+   - custom_types/xos.yaml
+
+description: autogenerated node tags file for VTN configuration
+
+topology_template:
+  node_templates:
+
+    service_ONOS_CORD:
+      type: tosca.nodes.ONOSService
+      requirements:
+      properties:
+          kind: onos
+          view_url: /admin/onos/onosservice/$id$/
+          no_container: true
+          rest_hostname: onos-cord
+
+    service_vtn:
+      type: tosca.nodes.VTNService
+      properties:
+          view_url: /admin/vtn/vtnservice/$id$/
+          privateGatewayMac: 00:00:00:00:00:01
+          localManagementIp: 172.27.0.1/24
+          ovsdbPort: 6641
+          sshUser: root
+          sshKeyFile: /root/node_key
+          sshPort: 22
+          xosEndpoint: http://xos/
+          xosUser: padmin@vicci.org
+          xosPassword: letmein
+
+EOF
+
+NODES=$( bash -c "source $SETUPDIR/admin-openrc.sh ; nova host-list" |grep compute|awk '{print $2}' )
+I=0
+for NODE in $NODES; do
+    echo $NODE
+    cat >> $FN <<EOF
+    $NODE:
+      type: tosca.nodes.Node
+
+    # VTN bridgeId field for node $NODE
+    ${NODE}_bridgeId_tag:
+      type: tosca.nodes.Tag
+      properties:
+          name: bridgeId
+          value: of:0000000000000001
+      requirements:
+          - target:
+              node: $NODE
+              relationship: tosca.relationships.TagsObject
+          - service:
+              node: service_ONOS_CORD
+              relationship: tosca.relationships.MemberOfService
+
+    # VTN dataPlaneIntf field for node $NODE
+    ${NODE}_dataPlaneIntf_tag:
+      type: tosca.nodes.Tag
+      properties:
+          name: dataPlaneIntf
+          value: veth1
+      requirements:
+          - target:
+              node: $NODE
+              relationship: tosca.relationships.TagsObject
+          - service:
+              node: service_ONOS_CORD
+              relationship: tosca.relationships.MemberOfService
+
+    # VTN dataPlaneIp field for node $NODE
+    ${NODE}_dataPlaneIp_tag:
+      type: tosca.nodes.Tag
+      properties:
+          name: dataPlaneIp
+          value: 10.168.0.253/24
+      requirements:
+          - target:
+              node: $NODE
+              relationship: tosca.relationships.TagsObject
+          - service:
+              node: service_ONOS_CORD
+              relationship: tosca.relationships.MemberOfService
+
+EOF
+done
+
+cat >> $FN <<EOF
+    VTN_ONOS_app:
+      type: tosca.nodes.ONOSVTNApp
+      requirements:
+          - onos_tenant:
+              node: service_ONOS_CORD
+              relationship: tosca.relationships.TenantOfService
+          - vtn_service:
+              node: service_vtn
+              relationship: tosca.relationships.UsedByService
+      properties:
+          dependencies: org.onosproject.drivers, org.onosproject.drivers.ovsdb, org.onosproject.openflow-base, org.onosproject.ovsdb-base, org.onosproject.dhcp, org.onosproject.cordvtn, org.onosproject.olt, org.onosproject.igmp, org.onosproject.cordmcast
+          autogenerate: vtn-network-cfg
+EOF
\ No newline at end of file
diff --git a/xos/configurations/cord-pod/make-vtn-networkconfig-json.sh b/xos/configurations/cord-pod/make-vtn-networkconfig-json.sh
deleted file mode 100755
index a1e5137..0000000
--- a/xos/configurations/cord-pod/make-vtn-networkconfig-json.sh
+++ /dev/null
@@ -1,83 +0,0 @@
-FN=$SETUPDIR/vtn-network-cfg.json
-
-echo "Writing to $FN"
-
-rm -f $FN
-
-cat >> $FN <<EOF
-{
-    "apps" : {
-        "org.onosproject.cordvtn" : {
-            "cordvtn" : {
-                "privateGatewayMac" : "00:00:00:00:00:01",
-                "localManagementIp": "172.27.0.1/24",
-                "ovsdbPort": "6641",
-                "sshPort": "22",
-                "sshUser": "root",
-                "sshKeyFile": "/root/node_key",
-                "publicGateways": [
-                    {
-                        "gatewayIp": "10.168.0.1",
-                        "gatewayMac": "02:42:0a:a8:00:01"
-                    }
-                ],
-                "nodes" : [
-EOF
-
-NODES=$( sudo bash -c "source $SETUPDIR/admin-openrc.sh ; nova hypervisor-list" |grep -v ID|grep -v +|awk '{print $4}' )
-
-# XXX disabled - we don't need or want the nm node at this time
-# also configure ONOS to manage the nm node
-#NM="neutron-gateway"
-#NODES="$NODES $NM"
-
-NODECOUNT=0
-for NODE in $NODES; do
-    ((NODECOUNT++))
-done
-
-I=0
-for NODE in $NODES; do
-    echo $NODE
-    NODEIP=`getent hosts $NODE | awk '{ print $1 }'`
-
-    PHYPORT=veth1
-    # How to set LOCALIP?
-    LOCALIPNET="192.168.199"
-
-    ((I++))
-    cat >> $FN <<EOF
-                    {
-                      "hostname": "$NODE",
-                      "hostManagementIp": "$NODEIP/24",
-                      "bridgeId": "of:000000000000000$I",
-                      "dataPlaneIntf": "$PHYPORT",
-                      "dataPlaneIp": "$LOCALIPNET.$I/24"
-EOF
-    if [[ "$I" -lt "$NODECOUNT" ]]; then
-        echo "                    }," >> $FN
-    else
-        echo "                    }" >> $FN
-    fi
-done
-
-# get the openstack admin password and username
-source $SETUPDIR/admin-openrc.sh
-NEUTRON_URL=`keystone endpoint-get --service network|grep publicURL|awk '{print $4}'`
-
-cat >> $FN <<EOF
-                ]
-            }
-        },
-        "org.onosproject.openstackinterface" : {
-            "openstackinterface" : {
-                 "do_not_push_flows" : "true",
-                 "neutron_server" : "$NEUTRON_URL/v2.0/",
-                 "keystone_server" : "$OS_AUTH_URL/",
-                 "user_name" : "$OS_USERNAME",
-                 "password" : "$OS_PASSWORD"
-             }
-        }
-    }
-}
-EOF
diff --git a/xos/configurations/cord-pod/pod-exampleservice.yaml b/xos/configurations/cord-pod/pod-exampleservice.yaml
index 59a9c8f..4e4835c 100644
--- a/xos/configurations/cord-pod/pod-exampleservice.yaml
+++ b/xos/configurations/cord-pod/pod-exampleservice.yaml
@@ -18,11 +18,17 @@
           no-delete: true
           no-update: true
 
+    service_vrouter:
+      type: tosca.nodes.Service
+      properties:
+          no-create: true
+          no-delete: true
+          no-update: true
+
     exampleservice-public:
       type: tosca.nodes.network.Network
       properties:
           ip_version: 4
-          cidr: 10.168.1.0/24
       requirements:
           - network_template:
               node: Private
@@ -33,6 +39,9 @@
           - connection:
               node: mysite_exampleservice
               relationship: tosca.relationships.ConnectsToSlice
+          - vrouter_tenant:
+              node: service_vrouter
+              relationship: tosca.relationships.TenantOfService
 
     mysite:
       type: tosca.nodes.Site
diff --git a/xos/configurations/cord-pod/vtn-external.yaml b/xos/configurations/cord-pod/vtn-external.yaml
deleted file mode 100644
index 0aaee67..0000000
--- a/xos/configurations/cord-pod/vtn-external.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-tosca_definitions_version: tosca_simple_yaml_1_0
-
-description: Set up ONOS VTN app
-
-imports:
-   - custom_types/xos.yaml
-
-topology_template:
-  node_templates:
-
-    service_ONOS_VTN:
-      type: tosca.nodes.ONOSService
-      requirements:
-      properties:
-          kind: onos
-          view_url: /admin/onos/onosservice/$id$/
-          no_container: true
-          rest_hostname: onos-cord
-
-    VTN_ONOS_app:
-      type: tosca.nodes.ONOSVTNApp
-      requirements:
-          - onos_tenant:
-              node: service_ONOS_VTN
-              relationship: tosca.relationships.TenantOfService
-      properties:
-          dependencies: org.onosproject.drivers, org.onosproject.drivers.ovsdb, org.onosproject.openflow-base, org.onosproject.ovsdb-base, org.onosproject.dhcp, org.onosproject.cordvtn, org.onosproject.olt, org.onosproject.igmp, org.onosproject.cordmcast
-          rest_onos/v1/network/configuration/: { get_artifact: [ SELF, vtn_network_cfg_json, LOCAL_FILE ] }
-      artifacts:
-          vtn_network_cfg_json: /root/setup/vtn-network-cfg.json
diff --git a/xos/configurations/cord/xos_cord_config b/xos/configurations/cord-pod/xos_cord_config
similarity index 100%
rename from xos/configurations/cord/xos_cord_config
rename to xos/configurations/cord-pod/xos_cord_config
diff --git a/xos/configurations/cord/ceilometer-plugins b/xos/configurations/cord/ceilometer-plugins
deleted file mode 160000
index 87cd53b..0000000
--- a/xos/configurations/cord/ceilometer-plugins
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 87cd53b99e43b12f2a175a65440f02f53b564069
diff --git a/xos/configurations/devel/Makefile b/xos/configurations/devel/Makefile
index 1e650f3..e55f38b 100644
--- a/xos/configurations/devel/Makefile
+++ b/xos/configurations/devel/Makefile
@@ -7,7 +7,9 @@
 xos:
 	sudo MYIP=$(MYIP) docker-compose up -d
 	bash ../common/wait_for_xos.sh
-	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/base.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/fixtures.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/mydeployment.yaml
+	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/cloudlab-openstack.yaml
 	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/nodes.yaml
 
 containers:
diff --git a/xos/configurations/devel/README.md b/xos/configurations/devel/README.md
index df9f999..5dbad10 100644
--- a/xos/configurations/devel/README.md
+++ b/xos/configurations/devel/README.md
@@ -4,6 +4,9 @@
 XOS in three Docker containers (development GUI, Synchronizer, database) and configures XOS
 to talk to an OpenStack backend.  *docker-compose* is used to manage the containers.
 
+**NOTE: If your goal is to create a development environment for [CORD](http://opencord.org/), 
+this configuration is not what you want.  Look at the [cord-pod](../cord-pod) configuration instead!**
+
 ## How to run it
 
 The configuration can be either run on [CloudLab](http://cloudlab.us) (controlling
@@ -41,8 +44,6 @@
 This setup has been run successfully in a VirtualBox VM with 2 CPUs and 4096 GB RAM.
 However it is recommended to use a dedicated server with more resources.
 
-**NOTE: If your goal is to create a development environment for [CORD](http://opencord.org/), 
-DevStack is not what you want.  Look at the [cord-pod](../cord-pod) configuration instead!**
 
 ## What you get
 
diff --git a/xos/configurations/frontend/Makefile b/xos/configurations/frontend/Makefile
index 2b46441..09c714b 100644
--- a/xos/configurations/frontend/Makefile
+++ b/xos/configurations/frontend/Makefile
@@ -4,6 +4,8 @@
 	sudo make -f ../common/Makefile.prereqs
 	sudo docker-compose up -d
 	bash ../common/wait_for_xos.sh
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/fixtures.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/mydeployment.yaml
 	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/frontend/sample.yaml
 
 containers:
@@ -28,7 +30,14 @@
 	sudo docker exec frontend_xos_1 touch /opt/xos/xos/settings.py
 
 mock-cord:
-	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/fixtures.yaml
 	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/frontend/mocks/cord.yaml
 	sudo docker exec frontend_xos_1 cp /opt/xos/configurations/cord/xos_cord_config /opt/xos/xos_configuration/
 	sudo docker exec frontend_xos_1 touch /opt/xos/xos/settings.py
+
+mock-cord-pod:
+	echo "make sure to add '../vtn/files/xos_vtn_config:/opt/xos/xos_configuration/xos_vtn_config:ro' to volumes section of docker-compose.yml"
+	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/fixtures.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/cord-pod/mgmt-net.yaml
+	sudo docker-compose run xos bash -c "echo somekey > /opt/xos/synchronizers/vcpe/vcpe_public_key; python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/cord-pod/cord-vtn-vsg.yaml"
+	sudo docker exec frontend_xos_1 cp /opt/xos/configurations/cord/xos_cord_config /opt/xos/xos_configuration/
+	sudo docker exec frontend_xos_1 touch /opt/xos/xos/settings.py
diff --git a/xos/configurations/frontend/xos.sql b/xos/configurations/frontend/xos.sql
index 7b13f4d..bbfd15a 100644
--- a/xos/configurations/frontend/xos.sql
+++ b/xos/configurations/frontend/xos.sql
@@ -5163,12 +5163,6 @@
 265	Can add vbng tenant	12	add_vbngtenant
 266	Can change vbng tenant	12	change_vbngtenant
 267	Can delete vbng tenant	12	delete_vbngtenant
-268	Can add Hello World Service	7	add_helloworldservicecomplete
-269	Can change Hello World Service	7	change_helloworldservicecomplete
-270	Can delete Hello World Service	7	delete_helloworldservicecomplete
-271	Can add Hello World Tenant	12	add_helloworldtenantcomplete
-272	Can change Hello World Tenant	12	change_helloworldtenantcomplete
-273	Can delete Hello World Tenant	12	delete_helloworldtenantcomplete
 274	Can add ONOS Service	7	add_onosservice
 275	Can change ONOS Service	7	change_onosservice
 276	Can delete ONOS Service	7	delete_onosservice
@@ -6509,8 +6503,6 @@
 87	cord subscriber root	cord	cordsubscriberroot
 88	vOLT Service	cord	voltservice
 89	vSG Service	cord	vsgservice
-90	Hello World Tenant	helloworldservice_complete	helloworldtenantcomplete
-91	Hello World Service	helloworldservice_complete	helloworldservicecomplete
 92	ONOS Service	onos	onosservice
 93	onos app	onos	onosapp
 94	s flow tenant	ceilometer	sflowtenant
@@ -6548,7 +6540,6 @@
 4	auth	0001_initial	2016-04-05 17:41:46.384468+00
 5	ceilometer	0001_initial	2016-04-05 17:41:46.659809+00
 6	cord	0001_initial	2016-04-05 17:41:46.862406+00
-7	helloworldservice_complete	0001_initial	2016-04-05 17:41:47.056651+00
 8	hpc	0001_initial	2016-04-05 17:41:50.450946+00
 9	onos	0001_initial	2016-04-05 17:41:50.637887+00
 10	requestrouter	0001_initial	2016-04-05 17:41:51.319325+00
diff --git a/xos/configurations/opencloud/Makefile b/xos/configurations/opencloud/Makefile
index aef4946..03168ed 100644
--- a/xos/configurations/opencloud/Makefile
+++ b/xos/configurations/opencloud/Makefile
@@ -1,6 +1,7 @@
 xos:
 	sudo docker-compose up -d
 	bash ./wait_for_xos.sh
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/fixtures.yaml
 	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/opencloud/opencloud.yaml
 
 containers:
diff --git a/xos/configurations/openvpn/Makefile b/xos/configurations/openvpn/Makefile
new file mode 100644
index 0000000..aa6f2d5
--- /dev/null
+++ b/xos/configurations/openvpn/Makefile
@@ -0,0 +1,59 @@
+MYIP:=$(shell hostname -i)
+
+cloudlab: common_cloudlab xos
+
+xos:
+	sudo MYIP=$(MYIP) docker-compose up -d
+	bash ../common/wait_for_xos.sh
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/fixtures.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/mydeployment.yaml
+	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/cloudlab-openstack.yaml
+	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/nodes.yaml
+
+frontend:
+	sudo make -f ../common/Makefile.prereqs
+	sudo docker-compose up -d
+	bash ../common/wait_for_xos.sh
+	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/frontend/sample.yaml
+
+containers:
+	cd ../../../containers/xos; make devel
+	cd ../../../containers/synchronizer; make
+	cd ../../../containers/openvpn; make
+
+common_cloudlab:
+	make -C ../common -f Makefile.cloudlab
+
+stop:
+	sudo MYIP=$(MYIP) docker-compose stop
+
+showlogs:
+	sudo MYIP=$(MYIP) docker-compose logs
+
+rm: stop
+	sudo MYIP=$(MYIP) docker-compose rm
+
+ps:
+	sudo MYIP=$(MYIP) docker-compose ps
+
+enter-xos:
+	sudo docker exec -it openvpn_xos_1 bash
+
+enter-synchronizer:
+	sudo docker exec -it openvpn_xos_synchronizer_openvpn_1 bash
+
+upgrade_pkgs:
+	sudo pip install httpie --upgrade
+
+rebuild_xos:
+	make -C ../../../containers/xos devel
+
+rebuild_synchronizer:
+	make -C ../../../containers/synchronizer
+
+cleanup_docker: rm
+	sudo docker rm -v $(docker ps -a -q -f status=exited) || true
+	docker rm -v $(docker ps -a -q -f status=exited) || true
+	sudo docker rmi $(docker images -qf "dangling=true") || true
+	socker rmi $(docker images -qf "dangling=true") || true
+	sudo docker run -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/docker:/var/lib/docker --rm martin/docker-cleanup-volumes || true
diff --git a/xos/configurations/openvpn/docker-compose.yml b/xos/configurations/openvpn/docker-compose.yml
new file mode 100644
index 0000000..e609838
--- /dev/null
+++ b/xos/configurations/openvpn/docker-compose.yml
@@ -0,0 +1,62 @@
+xos_db:
+    image: xosproject/xos-postgres
+    expose:
+        - "5432"
+
+xos_synchronizer_openstack:
+    image: xosproject/xos-synchronizer-openstack
+    command: bash -c "sleep 120; python /opt/xos/synchronizers/openstack/xos-synchronizer.py"
+    labels:
+        org.xosproject.kind: synchronizer
+        org.xosproject.target: openstack
+    links:
+        - xos_db
+    extra_hosts:
+        - ctl:${MYIP}
+    volumes:
+        - ../common/xos_common_config:/opt/xos/xos_configuration/xos_common_config:ro
+        - ./images:/opt/xos/images:ro
+
+xos_synchronizer_openvpn:
+    image: xosproject/xos-openvpn
+    command: bash -c "sleep 120 ; python /opt/xos/synchronizers/openvpn/openvpn-synchronizer.py -C /opt/xos/synchronizers/openvpn/openvpn_config"
+    labels:
+        org.xosproject.kind: synchronizer
+        org.xosproject.target: openvpn
+    links:
+        - xos_db
+    extra_hosts:
+        - ctl:${MYIP}
+    volumes:
+        - ../setup/id_rsa:/opt/xos/synchronizers/openvpn/openvpn_private_key:ro  # private key
+    volumes_from:
+        - xos_openvpn_data:rw
+
+xos_openvpn_data:
+    image: xosproject/xos-openvpn
+    links:
+        - xos_db
+    extra_hosts:
+        - ctl:${MYIP}
+    volumes:
+        - /opt/openvpn
+
+# FUTURE
+#xos_swarm_synchronizer:
+#    image: xosproject/xos-swarm-synchronizer
+#    labels:
+#        org.xosproject.kind: synchronizer
+#        org.xosproject.target: swarm
+
+xos:
+    image: xosproject/xos-openvpn
+    command: python /opt/xos/manage.py runserver 0.0.0.0:8000 --insecure --makemigrations
+    ports:
+        - "9999:8000"
+    links:
+        - xos_db
+    volumes:
+      - ../setup:/root/setup:ro
+      - ../common/xos_common_config:/opt/xos/xos_configuration/xos_common_config:ro
+    volumes_from:
+      - xos_openvpn_data:rw
diff --git a/xos/configurations/setup/admin-openrc.sh b/xos/configurations/setup/admin-openrc.sh
deleted file mode 100644
index 84e53f6..0000000
--- a/xos/configurations/setup/admin-openrc.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-export OS_PROJECT_DOMAIN_ID=default
-export OS_USER_DOMAIN_ID=default
-export OS_PROJECT_NAME=admin
-export OS_TENANT_NAME=admin
-export OS_USERNAME=adminapi
-export OS_PASSWORD=765e8807825bbd087333
-export OS_AUTH_URL=http://ctl:35357/v3
-export OS_IDENTITY_API_VERSION=3
diff --git a/xos/configurations/setup/ceilometer_url b/xos/configurations/setup/ceilometer_url
deleted file mode 100644
index 586594e..0000000
--- a/xos/configurations/setup/ceilometer_url
+++ /dev/null
@@ -1 +0,0 @@
-http://130.127.133.45/xosmetering/
diff --git a/xos/configurations/setup/controller_settings b/xos/configurations/setup/controller_settings
deleted file mode 100644
index a4f0fab..0000000
--- a/xos/configurations/setup/controller_settings
+++ /dev/null
@@ -1,48 +0,0 @@
-GENIUSER=1
-CONTROLLER="ctl"
-NETWORKMANAGER="nm"
-STORAGEHOST="ctl"
-OBJECTHOST="ctl"
-COMPUTENODES="cp-1 cp-2 "
-DB_ROOT_PASS="f638fdd304e96fe6f264"
-RABBIT_USER="openstack"
-RABBIT_PASS="b3df6035e70fab63fafe"
-ADMIN_API="adminapi"
-ADMIN_API_PASS="765e8807825bbd087333"
-KEYSTONE_DBPASS="0785387a67431d0e679a"
-GLANCE_DBPASS="b8f8af1dbed9ef7c9672"
-GLANCE_PASS="070f62b5aae7bfcb82b1"
-NOVA_DBPASS="000c2e0391b6e6c1efe1"
-NOVA_PASS="4e5cd858d46a773490ac"
-NOVA_COMPUTENODES_DONE="1"
-NEUTRON_DBPASS="2c00ab52cd022784ab1c"
-NEUTRON_PASS="a54a81b15d2a86da80cf"
-NEUTRON_METADATA_SECRET="bace09098263e43cad83"
-NEUTRON_NETWORKMANAGER_DONE="1"
-NEUTRON_COMPUTENODES_DONE="1"
-NEUTRON_NETWORKS_DONE="1"
-DASHBOARD_DONE="1"
-CINDER_DBPASS="9b7303ea7e149a6f37f3"
-CINDER_PASS="1605df1e285197ec716e"
-STORAGE_HOST_DONE="1"
-SWIFT_PASS="bdfcbd193b99e4d53878"
-SWIFT_HASH_PATH_PREFIX="6622bbfb9a47a85353dc"
-SWIFT_HASH_PATH_SUFFIX="860e0d7ecfd3b622b7ff"
-OBJECT_HOST_DONE="1"
-OBJECT_RING_DONE="1"
-HEAT_DBPASS="b478c3dc47d08e5a2dd0"
-HEAT_PASS="e6a1ad28e1585e2d1dc5"
-HEAT_DOMAIN_PASS="0c499d0fd9cb03ef74fe"
-CEILOMETER_DBPASS="909b521d60d942f674df"
-CEILOMETER_PASS="e859d8ba439d808a0b0f"
-CEILOMETER_SECRET="9978523d156d88591b1c"
-TELEMETRY_COMPUTENODES_DONE="1"
-TELEMETRY_GLANCE_DONE="1"
-TELEMETRY_CINDER_DONE="1"
-TELEMETRY_SWIFT_DONE="1"
-TROVE_DBPASS="9df003b06314d65ef2be"
-TROVE_PASS="61be0107aab4211919a2"
-SAHARA_DBPASS="c5a218e87b1fd83c36bc"
-SAHARA_PASS="eb2133117dd1e48d9419"
-SETUP_BASIC_DONE="1"
-CONTROLLER_FLAT_LAN_IP=10.11.10.1
diff --git a/xos/configurations/setup/flat-lan-cp-1.cord.xos-pg0.clemson.cloudlab.us b/xos/configurations/setup/flat-lan-cp-1.cord.xos-pg0.clemson.cloudlab.us
deleted file mode 100644
index 5db289f..0000000
--- a/xos/configurations/setup/flat-lan-cp-1.cord.xos-pg0.clemson.cloudlab.us
+++ /dev/null
@@ -1,8 +0,0 @@
-DATABRIDGE=br-flat-lan-1
-DATAIP=10.11.10.3
-DATANETMASK=255.255.0.0
-DATAVLAN=0
-DATAVLANTAG=0
-DATAVLANDEV=
-DATAMAC=008cfa5b088a
-DATADEV=enp130s0f0
diff --git a/xos/configurations/setup/flat-lan-cp-2.cord.xos-pg0.clemson.cloudlab.us b/xos/configurations/setup/flat-lan-cp-2.cord.xos-pg0.clemson.cloudlab.us
deleted file mode 100644
index f7943d8..0000000
--- a/xos/configurations/setup/flat-lan-cp-2.cord.xos-pg0.clemson.cloudlab.us
+++ /dev/null
@@ -1,8 +0,0 @@
-DATABRIDGE=br-flat-lan-1
-DATAIP=10.11.10.4
-DATANETMASK=255.255.0.0
-DATAVLAN=0
-DATAVLANTAG=0
-DATAVLANDEV=
-DATAMAC=008cfa5b088c
-DATADEV=enp130s0f0
diff --git a/xos/configurations/setup/flat_net_name b/xos/configurations/setup/flat_net_name
deleted file mode 100644
index 09246fa..0000000
--- a/xos/configurations/setup/flat_net_name
+++ /dev/null
@@ -1 +0,0 @@
-flat-lan-1-net
\ No newline at end of file
diff --git a/xos/configurations/setup/id_rsa b/xos/configurations/setup/id_rsa
deleted file mode 100644
index 3678ee0..0000000
--- a/xos/configurations/setup/id_rsa
+++ /dev/null
@@ -1,27 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEAsTKLFAqVd6Co8xXihfuFzyilUpufjy01tVmVwIssmZRgWNlZ
-EvD7L+pAVMoQDEPLmv3jF/+u7QHoIN/KOniC2SzYLuqTbFZ2lYhb7Qbnq/gFzqbn
-aKelUqD/BCPi+FmZuOWrzHr80UApwD0rfwJSHdkFPooz9ADBVr739EFnwhywJdDc
-6fT8GLfr8au6FXiPMQMd1y+DxoYvBqC1yRW8aJ/+jHeJ6+8A0eLlHpAohx1GewhL
-ilI/doswoC+pxyoES3/6BApGZcp6xvmRrLTvvC8Nao3bMBvVOu91SFGUptj/gNse
-lhv7g1eDChn/sjnQ580lG/a9Lki427i0l1VIWQIDAQABAoIBAHkLnug85qfGr0MH
-Qyvlix3dlTneJ1xmNNdCcEMMj5YGPt7S8r82sVClA/cn5ViLg23IW7aMKhGriMfU
-OFBC/Jegw7kg8z5BvlYdxTYgzmeyUT0+1LuwMgZFBo/sd+LRSmp9MiPILCZBX4P8
-BVeI3VGYa7WyMRVQ4sIASF+pwlhdn5SJt7rUrNHPgztHkuWn9jaC0TYDCINFGAiU
-D1XgOkh9fils+gbeW1BVy03MwFJrpf2qFe3BA/hF51dUdH4+62aOb7OlBj3KE/K1
-1L3EkZLD8yTGjV5S2RxR9/7szh2XOPlct3TaWaqeplG40UOAToTqjFQKVzhnKvLD
-JSbAbCUCgYEA1jhsyyCrKgUdY50Ybx8KqYvs+Y80iDOmc7Be2cubvg7VrhPD/zkS
-gy/WLSnL3bEU3rB2PZ7B0M3w3gGjK8BzedoLKOQ77OM+qlYax/a7GIQvF+jNGM8n
-4w7S4L9svoTmukqjSCjOlCx0E1G7PvP1xyE2GCqX2TXD0hJpO7hHA6sCgYEA08Gj
-kDUwdNxYq2m4+CTcupEPn+BRlpUFQkWt9pSRAjHsij5M1XcwcegabthRdTf8ix9d
-rAB80IZRJJMf+mwuT7hHFi1h+mkyAr7YcZ4uOTu1PraervdLs40GImHPk2d3ggWe
-28amqCCUmW7CJzfQsI72bHli/S8Y+TAlkzi4YAsCgYEAuaOSHAFGcxaVnlJv7zQO
-UFky1h1Un8dqsoyf1cuNPomqgL0eN1llAox85Qx4X7hqZoSzIrkmKmWdGzZ+CZcw
-OuNKkngeui0/i+ssMCdPgXJjQSv8OEikvy6EbkFU4lFXhQ7TKuA6DMvtFyTXyDkv
-vw23y/91McVW2gAcc6VA3RsCgYBWyYor1GDjxFtjBZWVviXpIQLyV5GY0cKyArTl
-1sYHzEZR8m6zHoJwbNxIicf47tVGf7h4gkqlfCdNgi8dB7GDYtdfs4Hwi6S/k1BK
-YLY5JsuFxHsM4rXYBPh6pvPYShOk6oDNOoGbbp74s3hHcozJkA5XLvjvI5psptr/
-l8OZOQKBgQCu64v70zDXaaeDnbHfnABuo00YBgjOVXa8YwVUYdP/qpYR7vKLdrvx
-lT/658Lup7vD+9xTWqaLlp5KehyFXNBARGl7oNRWQjZbIWWVVGwx4WjcmEk93BjV
-cogv+YEeGyzsDHDYu7VmoPYc/WAugGD/c9btLFU2QMKQV4vvmf1+cg==
------END RSA PRIVATE KEY-----
diff --git a/xos/configurations/setup/id_rsa.pub b/xos/configurations/setup/id_rsa.pub
deleted file mode 100644
index cc8fa0d..0000000
--- a/xos/configurations/setup/id_rsa.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxMosUCpV3oKjzFeKF+4XPKKVSm5+PLTW1WZXAiyyZlGBY2VkS8Psv6kBUyhAMQ8ua/eMX/67tAegg38o6eILZLNgu6pNsVnaViFvtBuer+AXOpudop6VSoP8EI+L4WZm45avMevzRQCnAPSt/AlId2QU+ijP0AMFWvvf0QWfCHLAl0Nzp9PwYt+vxq7oVeI8xAx3XL4PGhi8GoLXJFbxon/6Md4nr7wDR4uUekCiHHUZ7CEuKUj92izCgL6nHKgRLf/oECkZlynrG+ZGstO+8Lw1qjdswG9U673VIUZSm2P+A2x6WG/uDV4MKGf+yOdDnzSUb9r0uSLjbuLSXVUhZ teone@ctl.cord.xos-pg0.clemson.cloudlab.us
diff --git a/xos/configurations/setup/node_key b/xos/configurations/setup/node_key
deleted file mode 100644
index c6bd19b..0000000
--- a/xos/configurations/setup/node_key
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDKuGcchWTf4G/UXCzbKgKEnca8HvNv1nUW/h0NyZtXDFSpBldu
-dsXn5qPkeFkhvGz26KnuD+VOAV2eLfzRWdwkj3+GX8V18ifcm3j8j6Zxur7KQzPk
-P2SXRdFhKMv0iBVvu1qBg176TcqJBwBCNi9wVJV6RzYaY7LzhyNIn+SBWwIDAQAB
-AoGAFzYmGE3tzvST2Wz0dePJhgXKy59/oD6eCZPvH7UF5GG1D+V5/Vv8LSFrgq2F
-ByfcEilxy6BmURg27/W0DQSNAC5wx5wpt/dBFfaoYx9jC4vtXliFa2fwQLisE2mj
-htz36oMQplsOpbnJbFvuDvGb5ATZe44QR2ZSadLFLIEB9IECQQDv+qeAdrBLzc3T
-4kvwJaIdq/0C8G1Nq5HoMuI/o7UeyjDzbv8yL3ICVE/CbvwY6e96dM2RAVrZW3S1
-xMASQge3AkEA2ED60IZOn34toOPdqansCEzbPfOjP2FkCasvBdmhGaSCFzttLP1J
-x/Ff1wsr7N4lq9D3x9CsNfKCdj9x9n0rfQJBAN3NYVXF3YoirNPiu+c5EU61cQNv
-bsc0BYaEyUKir7vGi1nkRHCBE7H9dT6zT8RDK/mVzY3xn6N3+TYrpI77gp8CQHMD
-3GIbjKV3Tn1LtBEQtuCTP+frNN/4xGQAD7pkzTH+NNJ2YNKUxDD7R6Xv4yTP4elH
-8wDrEyx+FrUdeVdHq2ECQQDaQLzVDsBGDWgKh8ljoLgNCgp8QD8ykYe5xifWsr0r
-R2Eh7n1YMbS4S3Duomz3k2S6LdIwJaKVxK1Ak+2lvF0z
------END RSA PRIVATE KEY-----
-
diff --git a/xos/configurations/setup/node_key.pub b/xos/configurations/setup/node_key.pub
deleted file mode 100644
index b917c9e..0000000
--- a/xos/configurations/setup/node_key.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDKuGcchWTf4G/UXCzbKgKEnca8HvNv1nUW/h0NyZtXDFSpBldudsXn5qPkeFkhvGz26KnuD+VOAV2eLfzRWdwkj3+GX8V18ifcm3j8j6Zxur7KQzPkP2SXRdFhKMv0iBVvu1qBg176TcqJBwBCNi9wVJV6RzYaY7LzhyNIn+SBWw==
diff --git a/xos/configurations/setup/nodes.yaml b/xos/configurations/setup/nodes.yaml
deleted file mode 100644
index f9ceb0e..0000000
--- a/xos/configurations/setup/nodes.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-tosca_definitions_version: tosca_simple_yaml_1_0
-
-imports:
-   - custom_types/xos.yaml
-
-description: autogenerated nodes file
-
-topology_template:
-  node_templates:
-    MyDeployment:
-        type: tosca.nodes.Deployment
-    mysite:
-        type: tosca.nodes.Site
-    cp-1.cord.xos-pg0.clemson.cloudlab.us:
-      type: tosca.nodes.Node
-      requirements:
-        - site:
-            node: mysite
-            relationship: tosca.relationships.MemberOfSite
-        - deployment:
-            node: MyDeployment
-            relationship: tosca.relationships.MemberOfDeployment
-    cp-2.cord.xos-pg0.clemson.cloudlab.us:
-      type: tosca.nodes.Node
-      requirements:
-        - site:
-            node: mysite
-            relationship: tosca.relationships.MemberOfSite
-        - deployment:
-            node: MyDeployment
-            relationship: tosca.relationships.MemberOfDeployment
diff --git a/xos/configurations/setup/padmin_public_key b/xos/configurations/setup/padmin_public_key
deleted file mode 100644
index cc8fa0d..0000000
--- a/xos/configurations/setup/padmin_public_key
+++ /dev/null
@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxMosUCpV3oKjzFeKF+4XPKKVSm5+PLTW1WZXAiyyZlGBY2VkS8Psv6kBUyhAMQ8ua/eMX/67tAegg38o6eILZLNgu6pNsVnaViFvtBuer+AXOpudop6VSoP8EI+L4WZm45avMevzRQCnAPSt/AlId2QU+ijP0AMFWvvf0QWfCHLAl0Nzp9PwYt+vxq7oVeI8xAx3XL4PGhi8GoLXJFbxon/6Md4nr7wDR4uUekCiHHUZ7CEuKUj92izCgL6nHKgRLf/oECkZlynrG+ZGstO+8Lw1qjdswG9U673VIUZSm2P+A2x6WG/uDV4MKGf+yOdDnzSUb9r0uSLjbuLSXVUhZ teone@ctl.cord.xos-pg0.clemson.cloudlab.us
diff --git a/xos/configurations/setup/virtualbng.json b/xos/configurations/setup/virtualbng.json
deleted file mode 100644
index 843ac04..0000000
--- a/xos/configurations/setup/virtualbng.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-    "localPublicIpPrefixes" : [
-        "10.254.0.128/25"
-    ],
-    "nextHopIpAddress" : "10.254.0.1",
-    "publicFacingMac" : "00:00:00:00:00:66",
-    "xosIpAddress" : "10.11.10.1",
-    "xosRestPort" : "9999",
-    "hosts" : {
-      "cp-1.cord.xos-pg0.clemson.cloudlab.us" : "of:0000000000000001/1",
-      "cp-2.cord.xos-pg0.clemson.cloudlab.us" : "of:0000000000000001/1"
-    }
-}
diff --git a/xos/configurations/setup/vtn-network-cfg.json b/xos/configurations/setup/vtn-network-cfg.json
deleted file mode 100644
index 4d7ab07..0000000
--- a/xos/configurations/setup/vtn-network-cfg.json
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-    "apps" : {
-        "org.onosproject.cordvtn" : {
-            "cordvtn" : {
-                "privateGatewayMac" : "00:00:00:00:00:01",
-                "localManagementIp": "172.27.0.1/24",
-                "ovsdbPort": "6641",
-                "sshPort": "22",
-                "sshUser": "root",
-                "sshKeyFile": "/root/node_key",
-                "publicGateways": [
-                    {
-                        "gatewayIp": "10.123.0.1",
-                        "gatewayMac": "00:8c:fa:5b:09:d8"
-                    }
-                ],
-                "nodes" : [
-                    {
-                      "hostname": "cp-1.cord.xos-pg0.clemson.cloudlab.us",
-                      "hostManagementIp": "130.127.133.46/24",
-                      "bridgeId": "of:0000000000000001",
-                      "dataPlaneIntf": "enp130s0f0",
-                      "dataPlaneIp": "10.11.10.3/24"
-                    },
-                    {
-                      "hostname": "cp-2.cord.xos-pg0.clemson.cloudlab.us",
-                      "hostManagementIp": "130.127.133.39/24",
-                      "bridgeId": "of:0000000000000002",
-                      "dataPlaneIntf": "enp130s0f0",
-                      "dataPlaneIp": "10.11.10.4/24"
-                    }
-                ]
-            }
-        },
-        "org.onosproject.openstackinterface" : {
-            "openstackinterface" : {
-                 "do_not_push_flows" : "true",
-                 "neutron_server" : "http://130.127.133.45:9696/v2.0/",
-                 "keystone_server" : "http://130.127.133.45:5000/v2.0/",
-                 "user_name" : "adminapi",
-                 "password" : "765e8807825bbd087333"
-             }
-        }
-    }
-}
diff --git a/xos/configurations/syndicate/Makefile b/xos/configurations/syndicate/Makefile
index eb8050e..3b29ee5 100644
--- a/xos/configurations/syndicate/Makefile
+++ b/xos/configurations/syndicate/Makefile
@@ -7,7 +7,9 @@
 xos: syndicate_config
 	sudo MYIP=$(MYIP) docker-compose up -d
 	bash ../common/wait_for_xos.sh
-	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/base.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/fixtures.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/mydeployment.yaml
+	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/cloudlab-openstack.yaml
 	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/nodes.yaml
 
 containers:
diff --git a/xos/configurations/test-standalone/Makefile b/xos/configurations/test-standalone/Makefile
index 50f2cc5..efea0b5 100644
--- a/xos/configurations/test-standalone/Makefile
+++ b/xos/configurations/test-standalone/Makefile
@@ -16,8 +16,6 @@
 export TRUNCATE_FN
 
 prepare: xos
-	# INSTALL DEPS
-	# RUN ONCE BEFORE RUNNING TESTS
 	sudo docker exec -i teststandalone_xos_1 bash -c "cd /opt/xos/tests/api; npm install --production"
 	sudo docker exec teststandalone_xos_1 pip install dredd_hooks
 
@@ -25,30 +23,25 @@
 	sudo make -f ../common/Makefile.prereqs
 	sudo docker-compose up -d
 	bash ../common/wait_for_xos.sh
-	# sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/frontend/sample.yaml
-	# sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/fixtures.yaml
 
 restore-initial-db-status:
-	sudo docker exec teststandalone_xos_db_1 psql -U postgres -d xos -c "$$TRUNCATE_FN"
-	sudo docker exec teststandalone_xos_db_1 psql -U postgres -d xos -c "SELECT truncate_tables('postgres');"
-	sudo docker exec teststandalone_xos_db_1 psql -U postgres -d xos -c "SELECT setval('core_tenant_id_seq', 1)"
+	sudo docker exec teststandalone_xos_db_1 psql -U postgres -d xos -c "$$TRUNCATE_FN" >/dev/null 2>&1
+	sudo docker exec teststandalone_xos_db_1 psql -U postgres -d xos -c "SELECT truncate_tables('postgres');" >/dev/null 2>&1
+	sudo docker exec teststandalone_xos_db_1 psql -U postgres -d xos -c "SELECT setval('core_tenant_id_seq', 1)" >/dev/null 2>&1
 	sudo docker-compose run xos python /opt/xos/manage.py --noobserver --nomodelpolicy loaddata /opt/xos/core/fixtures/core_initial_data.json
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/fixtures.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/mydeployment.yaml
 	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/frontend/sample.yaml
-	sudo docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/fixtures.yaml
-
 
 
 test: restore-initial-db-status
 	# RUN TESTS
+	sudo docker cp ../../../apiary.apib teststandalone_xos_1:/opt/xos/tests/api/apiary.apib
 	sudo docker exec -i teststandalone_xos_1 bash -c "cd /opt/xos/tests/api; npm test"
 
 test-tosca:
 	sudo docker-compose run xos bash -c "cd /opt/xos/tosca/tests; python ./alltests.py"
 
-test-gui:
-	cd ../../../views/ngXosViews/ceilometerDashboard; npm install
-	cd ../../../views/ngXosViews/ceilometerDashboard; npm run test:ci
-
 base-container: 
 	cd ../../../containers/xos; make devel
 
diff --git a/xos/configurations/test/Makefile b/xos/configurations/test/Makefile
index adf349a..d4e54fd 100644
--- a/xos/configurations/test/Makefile
+++ b/xos/configurations/test/Makefile
@@ -7,7 +7,9 @@
 xos:
 	sudo MYIP=$(MYIP) docker-compose up -d
 	bash ../common/wait_for_xos.sh
-	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/base.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/fixtures.yaml
+	sudo docker-compose run xos python /opt/xos/tosca/run.py none /opt/xos/configurations/common/mydeployment.yaml
+	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /opt/xos/configurations/common/cloudlab-openstack.yaml
 	sudo MYIP=$(MYIP) docker-compose run xos python /opt/xos/tosca/run.py padmin@vicci.org /root/setup/nodes.yaml
 	sudo MYIP=$(MYIP) docker-compose run xos bash -c "cd /opt/xos/tosca/tests; python ./alltests.py"
 	sudo MYIP=$(MYIP) docker-compose run xos bash -c "cd /opt/xos/tosca/tests; python ./allObserverTests.py"
diff --git a/xos/core/admin.py b/xos/core/admin.py
index 7a88d0e..5cc0ddd 100644
--- a/xos/core/admin.py
+++ b/xos/core/admin.py
@@ -1,49 +1,49 @@
-from core.models import Site
-from core.models import *
-from openstack.manager import OpenStackManager
+import threading
+from cgi import escape as html_escape
 
-from django.contrib import admin
-from django.contrib.auth.models import Group
+from core.models import *
+from core.models import Site
 from django import forms
-from django.utils.safestring import mark_safe
+from django.contrib import admin, messages
+from django.contrib.admin.widgets import (AdminTextareaWidget,
+                                          FilteredSelectMultiple)
 from django.contrib.auth.admin import UserAdmin
-from django.contrib.admin.widgets import FilteredSelectMultiple, AdminTextareaWidget
-from django.contrib.auth.forms import ReadOnlyPasswordHashField, AdminPasswordChangeForm
+from django.contrib.auth.forms import (AdminPasswordChangeForm,
+                                       ReadOnlyPasswordHashField)
+from django.contrib.auth.models import Group
 from django.contrib.auth.signals import user_logged_in
-from django.utils import timezone
 from django.contrib.contenttypes import generic
-from suit.widgets import LinkedSelect
-from django.core.exceptions import PermissionDenied
-from django.core.urlresolvers import reverse, resolve, NoReverseMatch
+from django.core.exceptions import PermissionDenied, ValidationError
+from django.core.urlresolvers import NoReverseMatch, resolve, reverse
+from django.forms.utils import flatatt, to_current_timezone
+from django.utils import timezone
 from django.utils.encoding import force_text, python_2_unicode_compatible
 from django.utils.html import conditional_escape, format_html
+from django.utils.safestring import mark_safe
 from django.utils.text import capfirst
-from django.forms.utils import flatatt, to_current_timezone
-from django.core.exceptions import PermissionDenied, ValidationError
-from cgi import escape as html_escape
-from django.contrib import messages
-
-import threading
+from openstack.manager import OpenStackManager
+from suit.widgets import LinkedSelect
 
 # thread locals necessary to work around a django-suit issue
 _thread_locals = threading.local()
 
 ICON_URLS = {"success": "/static/admin/img/icon_success.gif",
-            "clock": "/static/admin/img/icon_clock.gif",
-            "error": "/static/admin/img/icon_error.gif"}
+             "clock": "/static/admin/img/icon_clock.gif",
+             "error": "/static/admin/img/icon_error.gif"}
+
 
 def backend_icon(obj):
     (icon, tooltip) = obj.get_backend_icon()
 
     icon_url = ICON_URLS.get(icon, "unknown")
 
-    (exponent,last_success,last_failure,failures) = obj.get_backend_details()
+    (exponent, last_success, last_failure, failures) = obj.get_backend_details()
 
     # FIXME: Need to clean this up by separating Javascript from Python
     if (obj.pk):
         script = """
         <script type="text/javascript">$(document).ready(function () {$("#show_details_%d").click(function () {$("#status%d").dialog({modal: true, height: 200, width: 200 });});});</script>
-        """%(obj.pk,obj.pk)
+        """ % (obj.pk, obj.pk)
 
         div = """
         <div style="display:none;" id="status%d" title="Details">
@@ -52,8 +52,8 @@
                 <p>Failures: %r</p>
                 <p>Last Failure: %r</p>
                     </div>
-        """%(obj.pk,exponent,last_success,failures,last_failure)
-        a = '<a id="show_details_%d" href="#">'%obj.pk
+        """ % (obj.pk, exponent, last_success, failures, last_failure)
+        a = '<a id="show_details_%d" href="#">' % obj.pk
         astop = '</a>'
     else:
         div = ''
@@ -66,24 +66,30 @@
     else:
         return '<span style="min-width:16px;"><img src="%s"></span>' % icon_url
 
+
 def backend_text(obj):
     (icon, tooltip) = obj.get_backend_icon()
     icon_url = ICON_URLS.get(icon, "unknown")
 
     return '<img src="%s"> %s' % (icon_url, tooltip)
 
+
 class UploadTextareaWidget(AdminTextareaWidget):
+
     def render(self, name, value, attrs=None):
         if value is None:
             value = ''
         final_attrs = self.build_attrs(attrs, name=name)
-        return format_html('<input type="file" style="width: 0; height: 0" id="btn_upload_%s" onChange="uploadTextarea(event,\'%s\');">' \
-                           '<button onClick="$(\'#btn_upload_%s\').click(); return false;">Upload</button>' \
-                           '<br><textarea{0}>\r\n{1}</textarea>' % (attrs["id"], attrs["id"], attrs["id"]),
+        return format_html('<input type="file" style="width: 0; height: 0" id="btn_upload_%s" onChange="uploadTextarea(event,\'%s\');">'
+                           '<button onClick="$(\'#btn_upload_%s\').click(); return false;">Upload</button>'
+                           '<br><textarea{0}>\r\n{1}</textarea>' % (
+                               attrs["id"], attrs["id"], attrs["id"]),
                            flatatt(final_attrs),
                            force_text(value))
 
+
 class SliderWidget(forms.HiddenInput):
+
     def render(self, name, value,  attrs=None):
         if value is None:
             value = '0'
@@ -102,7 +108,7 @@
                               </script>
                               <input type="hidden" id="%(id)s" name="%(name)s" value="%(value)s"></input>
                            """ % attrs
-        html = html.replace("{","{{").replace("}","}}")
+        html = html.replace("{", "{{").replace("}", "}}")
         return format_html(html,
                            flatatt(final_attrs),
                            force_text(value))
@@ -116,6 +122,7 @@
             value = ''
         return mark_safe(str(value) + super(PlainTextWidget, self).render(name, value, attrs))
 
+
 class XOSAdminMixin(object):
     # call save_by_user and delete_by_user instead of save and delete
 
@@ -166,8 +173,8 @@
 
         formset.save_m2m()
 
-    def get_actions(self,request):
-        actions = super(XOSAdminMixin,self).get_actions(request)
+    def get_actions(self, request):
+        actions = super(XOSAdminMixin, self).get_actions(request)
 
         if self.__user_is_readonly(request):
             if 'delete_selected' in actions:
@@ -181,13 +188,16 @@
 
     def add_extra_context(self, request, extra_context):
         # allow custom application breadcrumb url and name
-        extra_context["custom_app_breadcrumb_url"] = getattr(self, "custom_app_breadcrumb_url", None)
-        extra_context["custom_app_breadcrumb_name"] = getattr(self, "custom_app_breadcrumb_name", None)
-        extra_context["custom_changelist_breadcrumb_url"] = getattr(self, "custom_changelist_breadcrumb_url", None)
+        extra_context["custom_app_breadcrumb_url"] = getattr(
+            self, "custom_app_breadcrumb_url", None)
+        extra_context["custom_app_breadcrumb_name"] = getattr(
+            self, "custom_app_breadcrumb_name", None)
+        extra_context["custom_changelist_breadcrumb_url"] = getattr(
+            self, "custom_changelist_breadcrumb_url", None)
 
         # for Service admins to render their Administration page
         if getattr(self, "extracontext_registered_admins", False):
-            admins=[]
+            admins = []
             for model, model_admin in admin.site._registry.items():
                 if model == self.model:
                     continue
@@ -195,11 +205,11 @@
                     info = {"app": model._meta.app_label,
                             "model": model._meta.model_name,
                             "name": capfirst(model._meta.verbose_name_plural),
-                            "url": self.url_for_model_changelist(request,model) }
+                            "url": self.url_for_model_changelist(request, model)}
                     admins.append(info)
             extra_context["registered_admins"] = admins
 
-    def change_view(self,request,object_id, extra_context=None):
+    def change_view(self, request, object_id, extra_context=None):
         extra_context = extra_context or {}
 
         if self.__user_is_readonly(request):
@@ -208,7 +218,7 @@
                 self.readonly_save = self.readonly_fields
                 self.inlines_save = self.inlines
             if hasattr(self, "user_readonly_fields"):
-                self.readonly_fields=self.user_readonly_fields
+                self.readonly_fields = self.user_readonly_fields
             if hasattr(self, "user_readonly_inlines"):
                 self.inlines = self.user_readonly_inlines
         else:
@@ -244,14 +254,14 @@
         request.readonly = True
         return super(XOSAdminMixin, self).change_view(request, object_id, extra_context=extra_context)
 
-    def changelist_view(self, request, extra_context = None):
+    def changelist_view(self, request, extra_context=None):
         extra_context = extra_context or {}
 
         self.add_extra_context(request, extra_context)
 
         return super(XOSAdminMixin, self).changelist_view(request, extra_context=extra_context)
 
-    def add_view(self, request, form_url='', extra_context = None):
+    def add_view(self, request, form_url='', extra_context=None):
         extra_context = extra_context or {}
 
         self.add_extra_context(request, extra_context)
@@ -286,16 +296,20 @@
 
         return inlines
 
+
 class ReadOnlyAwareAdmin(XOSAdminMixin, admin.ModelAdmin):
     # Note: Make sure XOSAdminMixin is listed before
     # admin.ModelAdmin in the class declaration.
 
     pass
 
+
 class XOSBaseAdmin(ReadOnlyAwareAdmin):
     save_on_top = False
 
+
 class SingletonAdmin (ReadOnlyAwareAdmin):
+
     def has_add_permission(self, request):
         if not super(SingletonAdmin, self).has_add_permission(request):
             return False
@@ -306,10 +320,13 @@
         else:
             return True
 
+
 class ServiceAppAdmin (SingletonAdmin):
     extracontext_registered_admins = True
 
+
 class XOSTabularInline(admin.TabularInline):
+
     def __init__(self, *args, **kwargs):
         super(XOSTabularInline, self).__init__(*args, **kwargs)
 
@@ -328,7 +345,7 @@
                 object instead of trying to bring up a change view of the
                 SliceNetwork object.
             """
-            return getattr(self.model,self.selflink_fieldname).field.rel.to
+            return getattr(self.model, self.selflink_fieldname).field.rel.to
         else:
             return self.model
 
@@ -338,7 +355,7 @@
 
     def get_change_url(self, id):
         """ Get the URL to a change form in the admin for this model """
-        reverse_path = self.selflink_reverse_path # "admin:%s_change" % (self.selflink_model._meta.db_table)
+        reverse_path = self.selflink_reverse_path  # "admin:%s_change" % (self.selflink_model._meta.db_table)
         try:
             url = reverse(reverse_path, args=(id,))
         except NoReverseMatch:
@@ -397,7 +414,9 @@
         return mark_safe(backend_icon(obj))
     backend_status_icon.short_description = ""
 
+
 class PlStackGenericTabularInline(generic.GenericTabularInline):
+
     def has_add_permission(self, request):
         return not request.user.isReadOnlyUser()
 
@@ -413,6 +432,7 @@
         return mark_safe(backend_icon(obj))
     backend_status_icon.short_description = ""
 
+
 class ReservationInline(XOSTabularInline):
     model = Reservation
     extra = 0
@@ -421,6 +441,7 @@
     def queryset(self, request):
         return Reservation.select_by_user(request.user)
 
+
 class TagInline(PlStackGenericTabularInline):
     model = Tag
     extra = 0
@@ -430,12 +451,15 @@
     def queryset(self, request):
         return Tag.select_by_user(request.user)
 
+
 class InstanceInline(XOSTabularInline):
     model = Instance
-    fields = ['backend_status_icon', 'all_ips_string', 'instance_id', 'instance_name', 'slice', 'deployment', 'flavor', 'image', 'node']
+    fields = ['backend_status_icon', 'all_ips_string', 'instance_id',
+              'instance_name', 'slice', 'deployment', 'flavor', 'image', 'node']
     extra = 0
     max_num = 0
-    readonly_fields = ['backend_status_icon', 'all_ips_string', 'instance_id', 'instance_name', 'slice', 'deployment', 'flavor', 'image', 'node']
+    readonly_fields = ['backend_status_icon', 'all_ips_string', 'instance_id',
+                       'instance_name', 'slice', 'deployment', 'flavor', 'image', 'node']
     suit_classes = 'suit-tab suit-tab-instances'
 
     def queryset(self, request):
@@ -443,20 +467,27 @@
 
     def formfield_for_foreignkey(self, db_field, request=None, **kwargs):
         if db_field.name == 'deployment':
-           kwargs['queryset'] = Deployment.select_by_acl(request.user).filter(sitedeployments__nodes__isnull=False).distinct()
-           kwargs['widget'] = forms.Select(attrs={'onChange': "instance_deployment_changed(this);"})
+            kwargs['queryset'] = Deployment.select_by_acl(request.user).filter(
+                sitedeployments__nodes__isnull=False).distinct()
+            kwargs['widget'] = forms.Select(
+                attrs={'onChange': "instance_deployment_changed(this);"})
         if db_field.name == 'flavor':
-           kwargs['widget'] = forms.Select(attrs={'onChange': "instance_flavor_changed(this);"})
+            kwargs['widget'] = forms.Select(
+                attrs={'onChange': "instance_flavor_changed(this);"})
 
-        field = super(InstanceInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
+        field = super(InstanceInline, self).formfield_for_foreignkey(
+            db_field, request, **kwargs)
 
         return field
 
+
 class CordInstanceInline(XOSTabularInline):
     model = Instance
-    fields = ['backend_status_icon', 'all_ips_string', 'instance_id', 'instance_name', 'slice', 'flavor', 'image', 'node']
+    fields = ['backend_status_icon', 'all_ips_string', 'instance_id',
+              'instance_name', 'slice', 'flavor', 'image', 'node']
     extra = 0
-    readonly_fields = ['backend_status_icon', 'all_ips_string', 'instance_id', 'instance_name']
+    readonly_fields = ['backend_status_icon',
+                       'all_ips_string', 'instance_id', 'instance_name']
     suit_classes = 'suit-tab suit-tab-instances'
 
     def queryset(self, request):
@@ -465,15 +496,20 @@
     def formfield_for_foreignkey(self, db_field, request=None, **kwargs):
         if db_field.name == 'deployment':
 
-           kwargs['queryset'] = Deployment.select_by_acl(request.user).filter(sitedeployments__nodes__isnull=False).distinct()
-           kwargs['widget'] = forms.Select(attrs={'onChange': "instance_deployment_changed(this);"})
+            kwargs['queryset'] = Deployment.select_by_acl(request.user).filter(
+                sitedeployments__nodes__isnull=False).distinct()
+            kwargs['widget'] = forms.Select(
+                attrs={'onChange': "instance_deployment_changed(this);"})
         if db_field.name == 'flavor':
-           kwargs['widget'] = forms.Select(attrs={'onChange': "instance_flavor_changed(this);"})
+            kwargs['widget'] = forms.Select(
+                attrs={'onChange': "instance_flavor_changed(this);"})
 
-        field = super(CordInstanceInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
+        field = super(CordInstanceInline, self).formfield_for_foreignkey(
+            db_field, request, **kwargs)
 
         return field
 
+
 class SiteInline(XOSTabularInline):
     model = Site
     extra = 0
@@ -482,13 +518,18 @@
     def queryset(self, request):
         return Site.select_by_user(request.user)
 
+
 class SiteHostsNodesInline(SiteInline):
+
     def queryset(self, request):
         return Site.select_by_user(request.user).filter(hosts_nodes=True)
 
+
 class SiteHostsUsersInline(SiteInline):
+
     def queryset(self, request):
-        return Site.select_by_user(request.user).filter(hosts_users=True)        
+        return Site.select_by_user(request.user).filter(hosts_users=True)
+
 
 class UserInline(XOSTabularInline):
     model = User
@@ -500,6 +541,7 @@
     def queryset(self, request):
         return User.select_by_user(request.user)
 
+
 class SliceInline(XOSTabularInline):
     model = Slice
     fields = ['backend_status_icon', 'name', 'site', 'serviceClass', 'service']
@@ -510,6 +552,7 @@
     def queryset(self, request):
         return Slice.select_by_user(request.user)
 
+
 class NodeInline(XOSTabularInline):
     model = Node
     extra = 0
@@ -517,16 +560,18 @@
     fields = ['backend_status_icon', 'name', 'site_deployment']
     readonly_fields = ('backend_status_icon', )
 
+
 class DeploymentPrivilegeInline(XOSTabularInline):
     model = DeploymentPrivilege
     extra = 0
     suit_classes = 'suit-tab suit-tab-deploymentprivileges'
-    fields = ['backend_status_icon', 'user','role','deployment']
+    fields = ['backend_status_icon', 'user', 'role', 'deployment']
     readonly_fields = ('backend_status_icon', )
 
     def queryset(self, request):
         return DeploymentPrivilege.select_by_user(request.user)
 
+
 class ControllerSiteInline(XOSTabularInline):
     model = ControllerSite
     extra = 0
@@ -538,7 +583,7 @@
     model = SitePrivilege
     extra = 0
     suit_classes = 'suit-tab suit-tab-siteprivileges'
-    fields = ['backend_status_icon', 'user','site', 'role']
+    fields = ['backend_status_icon', 'user', 'site', 'role']
     readonly_fields = ('backend_status_icon', )
 
     def formfield_for_foreignkey(self, db_field, request, **kwargs):
@@ -557,7 +602,7 @@
     model = ServicePrivilege
     extra = 0
     suit_classes = 'suit-tab suit-tab-serviceprivileges'
-    fields = ['backend_status_icon', 'user','service', 'role']
+    fields = ['backend_status_icon', 'user', 'service', 'role']
     readonly_fields = ('backend_status_icon', )
 
     def formfield_for_foreignkey(self, db_field, request, **kwargs):
@@ -565,16 +610,17 @@
             kwargs['queryset'] = Service.select_by_user(request.user)
         if db_field.name == 'user':
             kwargs['queryset'] = User.select_by_user(request.user)
-        return super(ServicePrivilegeInline, self).formfield_for_foreignkey(db_field, request, **kwargs)         
+        return super(ServicePrivilegeInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
 
     def queryset(self, request):
         return ServicePrivilege.select_by_user(request.user)
 
+
 class SiteDeploymentInline(XOSTabularInline):
     model = SiteDeployment
     extra = 0
     suit_classes = 'suit-tab suit-tab-sitedeployments'
-    fields = ['backend_status_icon', 'deployment','site', 'controller']
+    fields = ['backend_status_icon', 'deployment', 'site', 'controller']
     readonly_fields = ('backend_status_icon', )
 
     def formfield_for_foreignkey(self, db_field, request, **kwargs):
@@ -586,7 +632,8 @@
 
         if db_field.name == 'controller':
             if len(resolve(request.path).args) > 0:
-                kwargs['queryset'] = Controller.select_by_user(request.user).filter(deployment__id=int(resolve(request.path).args[0]))
+                kwargs['queryset'] = Controller.select_by_user(request.user).filter(
+                    deployment__id=int(resolve(request.path).args[0]))
 
         return super(SiteDeploymentInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
 
@@ -603,16 +650,17 @@
 
     def formfield_for_foreignkey(self, db_field, request, **kwargs):
         if db_field.name == 'slice':
-           kwargs['queryset'] = Slice.select_by_user(request.user)
+            kwargs['queryset'] = Slice.select_by_user(request.user)
         if db_field.name == 'user':
-           # all users are available to be granted SlicePrivilege
-           kwargs['queryset'] = User.objects.all()
+            # all users are available to be granted SlicePrivilege
+            kwargs['queryset'] = User.objects.all()
 
         return super(SlicePrivilegeInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
 
     def queryset(self, request):
         return SlicePrivilege.select_by_user(request.user)
 
+
 class SliceNetworkInline(XOSTabularInline):
     model = Network.slices.through
     selflink_fieldname = "network"
@@ -623,6 +671,7 @@
     fields = ['backend_status_icon', 'network']
     readonly_fields = ('backend_status_icon', )
 
+
 class ImageDeploymentsInline(XOSTabularInline):
     model = ImageDeployments
     extra = 0
@@ -632,6 +681,7 @@
     fields = ['backend_status_icon', 'image', 'deployment']
     readonly_fields = ['backend_status_icon']
 
+
 class ControllerImagesInline(XOSTabularInline):
     model = ControllerImages
     extra = 0
@@ -641,14 +691,17 @@
     fields = ['backend_status_icon', 'image', 'controller', 'glance_image_id']
     readonly_fields = ['backend_status_icon', 'glance_image_id']
 
+
 class SliceRoleAdmin(XOSBaseAdmin):
     model = SliceRole
     pass
 
+
 class SiteRoleAdmin(XOSBaseAdmin):
     model = SiteRole
     pass
 
+
 class DeploymentAdminForm(forms.ModelForm):
     images = forms.ModelMultipleChoiceField(
         queryset=Image.objects.all(),
@@ -666,19 +719,22 @@
             verbose_name=('Flavors'), is_stacked=False
         )
     )
+
     class Meta:
         model = Deployment
-        many_to_many = ["flavors",]
+        many_to_many = ["flavors", ]
 
     def __init__(self, *args, **kwargs):
-      request = kwargs.pop('request', None)
-      super(DeploymentAdminForm, self).__init__(*args, **kwargs)
+        request = kwargs.pop('request', None)
+        super(DeploymentAdminForm, self).__init__(*args, **kwargs)
 
-      self.fields['accessControl'].initial = "allow site " + request.user.site.name
+        self.fields['accessControl'].initial = "allow site " + \
+            request.user.site.name
 
-      if self.instance and self.instance.pk:
-        self.fields['images'].initial = [x.image for x in self.instance.imagedeployments.all()]
-        self.fields['flavors'].initial = self.instance.flavors.all()
+        if self.instance and self.instance.pk:
+            self.fields['images'].initial = [
+                x.image for x in self.instance.imagedeployments.all()]
+            self.fields['flavors'].initial = self.instance.flavors.all()
 
     def manipulate_m2m_objs(self, this_obj, selected_objs, all_relations, relation_class, local_attrname, foreign_attrname):
         """ helper function for handling m2m relations from the MultipleChoiceField
@@ -703,61 +759,70 @@
         existing_dest_objs = []
         for relation in list(all_relations):
             if getattr(relation, foreign_attrname) not in selected_objs:
-                #print "deleting site", sdp.site
+                # print "deleting site", sdp.site
                 relation.delete()
             else:
                 existing_dest_objs.append(getattr(relation, foreign_attrname))
 
         for dest_obj in selected_objs:
             if dest_obj not in existing_dest_objs:
-                #print "adding site", site
+                # print "adding site", site
                 kwargs = {foreign_attrname: dest_obj, local_attrname: this_obj}
                 relation = relation_class(**kwargs)
                 relation.save()
 
     def save(self, commit=True):
-      deployment = super(DeploymentAdminForm, self).save(commit=False)
+        deployment = super(DeploymentAdminForm, self).save(commit=False)
 
-      if commit:
-        deployment.save()
-        # this has to be done after save() if/when a deployment is first created
-        deployment.flavors = self.cleaned_data['flavors']
+        if commit:
+            deployment.save()
+            # this has to be done after save() if/when a deployment is first
+            # created
+            deployment.flavors = self.cleaned_data['flavors']
 
-      if deployment.pk:
-        # save_m2m() doesn't seem to work with 'through' relations. So we
-        #    create/destroy the through models ourselves. There has to be
-        #    a better way...
+        if deployment.pk:
+            # save_m2m() doesn't seem to work with 'through' relations. So we
+            #    create/destroy the through models ourselves. There has to be
+            #    a better way...
 
-        self.manipulate_m2m_objs(deployment, self.cleaned_data['images'], deployment.imagedeployments.all(), ImageDeployments, "deployment", "image")
-        # manipulate_m2m_objs doesn't work for Flavor/Deployment relationship
-        # so well handle that manually here
-        for flavor in deployment.flavors.all():
-            if getattr(flavor, 'name') not in self.cleaned_data['flavors']:
-                deployment.flavors.remove(flavor)
-        for flavor in self.cleaned_data['flavors']:
-            if flavor not in deployment.flavors.all():
-                flavor.deployments.add(deployment)
+            self.manipulate_m2m_objs(deployment, self.cleaned_data[
+                                     'images'], deployment.imagedeployments.all(), ImageDeployments, "deployment", "image")
+            # manipulate_m2m_objs doesn't work for Flavor/Deployment relationship
+            # so well handle that manually here
+            for flavor in deployment.flavors.all():
+                if getattr(flavor, 'name') not in self.cleaned_data['flavors']:
+                    deployment.flavors.remove(flavor)
+            for flavor in self.cleaned_data['flavors']:
+                if flavor not in deployment.flavors.all():
+                    flavor.deployments.add(deployment)
 
-      self.save_m2m()
+        self.save_m2m()
 
-      return deployment
+        return deployment
+
 
 class DeploymentAdminROForm(DeploymentAdminForm):
+
     def save(self, commit=True):
         raise PermissionDenied
 
+
 class SiteAssocInline(XOSTabularInline):
     model = Site.deployments.through
     extra = 0
     suit_classes = 'suit-tab suit-tab-sites'
 
+
 class DeploymentAdmin(XOSBaseAdmin):
     model = Deployment
-    fieldList = ['backend_status_text', 'name', 'images', 'flavors', 'accessControl']
-    fieldsets = [(None, {'fields': fieldList, 'classes':['suit-tab suit-tab-general']})]
+    fieldList = ['backend_status_text', 'name',
+                 'images', 'flavors', 'accessControl']
+    fieldsets = [
+        (None, {'fields': fieldList, 'classes': ['suit-tab suit-tab-general']})]
     # node no longer directly connected to deployment
     #inlines = [DeploymentPrivilegeInline,NodeInline,TagInline,ImageDeploymentsInline]
-    inlines = [DeploymentPrivilegeInline,TagInline,ImageDeploymentsInline,SiteDeploymentInline]
+    inlines = [DeploymentPrivilegeInline, TagInline,
+               ImageDeploymentsInline, SiteDeploymentInline]
     list_display = ['backend_status_icon', 'name']
     list_display_links = ('backend_status_icon', 'name', )
     readonly_fields = ('backend_status_text', )
@@ -765,48 +830,58 @@
     user_readonly_fields = ['name']
 
     # nodes no longer direclty connected to deployments
-    suit_form_tabs =(('general','Deployment Details'),('deploymentprivileges','Privileges'), ('sitedeployments', 'Sites'))
+    suit_form_tabs = (('general', 'Deployment Details'),
+                      ('deploymentprivileges', 'Privileges'), ('sitedeployments', 'Sites'))
 
     def get_form(self, request, obj=None, **kwargs):
         if request.user.isReadOnlyUser() or not request.user.is_admin:
             kwargs["form"] = DeploymentAdminROForm
         else:
             kwargs["form"] = DeploymentAdminForm
-        adminForm = super(DeploymentAdmin,self).get_form(request, obj, **kwargs)
+        adminForm = super(DeploymentAdmin, self).get_form(
+            request, obj, **kwargs)
 
         # from stackexchange: pass the request object into the form
 
         class AdminFormMetaClass(adminForm):
-           def __new__(cls, *args, **kwargs):
-               kwargs['request'] = request
-               return adminForm(*args, **kwargs)
+
+            def __new__(cls, *args, **kwargs):
+                kwargs['request'] = request
+                return adminForm(*args, **kwargs)
 
         return AdminFormMetaClass
 
+
 class ControllerAdminForm(forms.ModelForm):
     backend_disabled = forms.BooleanField(required=False)
+
     class Meta:
         model = Controller
 
     def __init__(self, *args, **kwargs):
-      request = kwargs.pop('request', None)
-      super(ControllerAdminForm, self).__init__(*args, **kwargs)
+        request = kwargs.pop('request', None)
+        super(ControllerAdminForm, self).__init__(*args, **kwargs)
 
-      if self.instance and self.instance.pk:
-        self.fields['backend_disabled'].initial = self.instance.get_backend_register('disabled', False)
-      else:
-        # defaults when adding new controller
-        self.fields['backend_disabled'].initial = False
+        if self.instance and self.instance.pk:
+            self.fields['backend_disabled'].initial = self.instance.get_backend_register(
+                'disabled', False)
+        else:
+            # defaults when adding new controller
+            self.fields['backend_disabled'].initial = False
 
     def save(self, commit=True):
-      self.instance.set_backend_register("disabled", self.cleaned_data["backend_disabled"])
-      return super(ControllerAdminForm, self).save(commit=commit)
+        self.instance.set_backend_register(
+            "disabled", self.cleaned_data["backend_disabled"])
+        return super(ControllerAdminForm, self).save(commit=commit)
+
 
 class ControllerAdmin(XOSBaseAdmin):
     model = Controller
-    fieldList = ['deployment', 'name', 'backend_type', 'backend_disabled', 'version', 'auth_url', 'admin_user', 'admin_tenant','admin_password', 'domain', 'rabbit_host', 'rabbit_user', 'rabbit_password']
-    fieldsets = [(None, {'fields': fieldList, 'classes':['suit-tab suit-tab-general']})]
-    inlines = [ControllerSiteInline] # ,ControllerImagesInline]
+    fieldList = ['deployment', 'name', 'backend_type', 'backend_disabled', 'version', 'auth_url', 'admin_user',
+                 'admin_tenant', 'admin_password', 'domain', 'rabbit_host', 'rabbit_user', 'rabbit_password']
+    fieldsets = [
+        (None, {'fields': fieldList, 'classes': ['suit-tab suit-tab-general']})]
+    inlines = [ControllerSiteInline]  # ,ControllerImagesInline]
     list_display = ['backend_status_icon', 'name', 'version', 'backend_type']
     list_display_links = ('backend_status_icon', 'name', )
     readonly_fields = ('backend_status_text',)
@@ -815,47 +890,52 @@
     user_readonly_fields = []
 
     def save_model(self, request, obj, form, change):
-        # update openstack connection to use this site/tenant
+            # update openstack connection to use this site/tenant
         obj.save_by_user(request.user)
-                    
+
     def delete_model(self, request, obj):
         obj.delete_by_user(request.user)
 
     def queryset(self, request):
-        return Controller.select_by_user(request.user)    
+        return Controller.select_by_user(request.user)
 
     @property
     def suit_form_tabs(self):
         tabs = [('general', 'Controller Details'),
-        ]
+                ]
 
-        request=getattr(_thread_locals, "request", None)
+        request = getattr(_thread_locals, "request", None)
         if request and request.user.is_admin:
-            tabs.append( ('admin-only', 'Admin-Only') )
+            tabs.append(('admin-only', 'Admin-Only'))
 
         return tabs
 
+
 class TenantAttributeAdmin(XOSBaseAdmin):
     model = TenantAttribute
     list_display = ('backend_status_icon', 'tenant', 'name', 'value')
     list_display_links = ('backend_status_icon', 'name')
     fieldList = ('backend_status_text', 'tenant', 'name', 'value', )
-    fieldsets = [(None, {'fields': fieldList, 'classes':['suit-tab suit-tab-general']})]
+    fieldsets = [
+        (None, {'fields': fieldList, 'classes': ['suit-tab suit-tab-general']})]
     readonly_fields = ('backend_status_text', )
 
-    suit_form_tabs =(('general', 'Tenant Root Details'),
-    )
+    suit_form_tabs = (('general', 'Tenant Root Details'),
+                      )
+
 
 class TenantAttrAsTabInline(XOSTabularInline):
     model = TenantAttribute
-    fields = ['name','value']
+    fields = ['name', 'value']
     extra = 0
     suit_classes = 'suit-tab suit-tab-tenantattrs'
 
+
 class TenantRootRoleAdmin(XOSBaseAdmin):
     model = TenantRootRole
     fields = ('role',)
 
+
 class TenantRootTenantInline(XOSTabularInline):
     model = Tenant
     fields = ['provider_service', 'subscriber_root']
@@ -865,10 +945,11 @@
     verbose_name = 'subscribed tenant'
     verbose_name_plural = 'subscribed tenants'
 
-    #def queryset(self, request):
+    # def queryset(self, request):
     #    qs = super(TenantRootTenantInline, self).queryset(request)
     #    return qs.filter(kind="coarse")
 
+
 class TenantRootPrivilegeInline(XOSTabularInline):
     model = TenantRootPrivilege
     extra = 0
@@ -879,19 +960,40 @@
     def queryset(self, request):
         return TenantRootPrivilege.select_by_user(request.user)
 
+
 class TenantRootAdmin(XOSBaseAdmin):
     model = TenantRoot
     list_display = ('backend_status_icon', 'name', 'kind')
     list_display_links = ('backend_status_icon', 'name')
     fieldList = ('backend_status_text', 'name', 'kind', )
-    fieldsets = [(None, {'fields': fieldList, 'classes':['suit-tab suit-tab-general']})]
+    fieldsets = [
+        (None, {'fields': fieldList, 'classes': ['suit-tab suit-tab-general']})]
     inlines = (TenantRootTenantInline, TenantRootPrivilegeInline)
     readonly_fields = ('backend_status_text', )
 
-    suit_form_tabs =(('general', 'Tenant Root Details'),
-        ('tenantroots','Tenancy'),
-        ('tenantrootprivileges','Privileges')
-    )
+    suit_form_tabs = (('general', 'Tenant Root Details'),
+                      ('tenantroots', 'Tenancy'),
+                      ('tenantrootprivileges', 'Privileges')
+                      )
+
+
+class TenantRoleAdmin(XOSBaseAdmin):
+    """Admin for TenantRoles."""
+    model = TenantRole
+    fields = ('role',)
+
+
+class TenantPrivilegeInline(XOSTabularInline):
+    """Inline for adding a TenantPrivilege to a Tenant."""
+    model = TenantPrivilege
+    extra = 0
+    suit_classes = 'suit-tab suit-tab-tenantprivileges'
+    fields = ['backend_status_icon', 'user', 'role', 'tenant']
+    readonly_fields = ('backend_status_icon', )
+
+    def queryset(self, request):
+        return TenantPrivilege.select_by_user(request.user)
+
 
 class ProviderTenantInline(XOSTabularInline):
     model = CoarseTenant
@@ -906,6 +1008,7 @@
         qs = super(ProviderTenantInline, self).queryset(request)
         return qs.filter(kind="coarse")
 
+
 class SubscriberTenantInline(XOSTabularInline):
     model = CoarseTenant
     fields = ['provider_service', 'subscriber_service', 'connect_method']
@@ -919,28 +1022,35 @@
         qs = super(SubscriberTenantInline, self).queryset(request)
         return qs.filter(kind="coarse")
 
+
 class ServiceAttrAsTabInline(XOSTabularInline):
     model = ServiceAttribute
-    fields = ['name','value']
+    fields = ['name', 'value']
     extra = 0
     suit_classes = 'suit-tab suit-tab-serviceattrs'
 
+
 class ServiceAdmin(XOSBaseAdmin):
-    list_display = ("backend_status_icon","name","kind","versionNumber","enabled","published")
+    list_display = ("backend_status_icon", "name", "kind",
+                    "versionNumber", "enabled", "published")
     list_display_links = ('backend_status_icon', 'name', )
-    fieldList = ["backend_status_text","name","kind","description","versionNumber","enabled","published","view_url","icon_url","public_key","private_key_fn","service_specific_attribute","service_specific_id"]
-    fieldsets = [(None, {'fields': fieldList, 'classes':['suit-tab suit-tab-general']})]
-    inlines = [ServiceAttrAsTabInline,SliceInline,ProviderTenantInline,SubscriberTenantInline,ServicePrivilegeInline]
+    fieldList = ["backend_status_text", "name", "kind", "description", "versionNumber", "enabled", "published",
+                 "view_url", "icon_url", "public_key", "private_key_fn", "service_specific_attribute", "service_specific_id"]
+    fieldsets = [
+        (None, {'fields': fieldList, 'classes': ['suit-tab suit-tab-general']})]
+    inlines = [ServiceAttrAsTabInline, SliceInline, ProviderTenantInline,
+               SubscriberTenantInline, ServicePrivilegeInline]
     readonly_fields = ('backend_status_text', )
 
     user_readonly_fields = fieldList
 
-    suit_form_tabs =(('general', 'Service Details'),
-        ('slices','Slices'),
-        ('serviceattrs','Additional Attributes'),
-        ('servicetenants','Tenancy'),
-        ('serviceprivileges','Privileges')
-    )
+    suit_form_tabs = (('general', 'Service Details'),
+                      ('slices', 'Slices'),
+                      ('serviceattrs', 'Additional Attributes'),
+                      ('servicetenants', 'Tenancy'),
+                      ('serviceprivileges', 'Privileges')
+                      )
+
 
 class SiteNodeInline(XOSTabularInline):
     model = Node
@@ -950,43 +1060,50 @@
 
     def formfield_for_foreignkey(self, db_field, request, **kwargs):
         # only display site deployments associated with this site
-        if db_field.name ==  'site_deployment':
-            kwargs['queryset'] = SiteDeployment.objects.filter(site__id=int(request.path.split('/')[-2]))
+        if db_field.name == 'site_deployment':
+            kwargs['queryset'] = SiteDeployment.objects.filter(
+                site__id=int(request.path.split('/')[-2]))
 
         return super(SiteNodeInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
 
+
 class SiteAdmin(XOSBaseAdmin):
     #fieldList = ['backend_status_text', 'name', 'site_url', 'enabled', 'is_public', 'login_base', 'accountLink','location']
-    fieldList = ['backend_status_text', 'name', 'site_url', 'enabled', 'login_base', 'location', 'is_public', 'hosts_nodes', 'hosts_users']
+    fieldList = ['backend_status_text', 'name', 'site_url', 'enabled',
+                 'login_base', 'location', 'is_public', 'hosts_nodes', 'hosts_users']
     fieldsets = [
-        (None, {'fields': fieldList, 'classes':['suit-tab suit-tab-general']}),
+        (None, {'fields': fieldList, 'classes': [
+         'suit-tab suit-tab-general']}),
         #('Deployment Networks', {'fields': ['deployments'], 'classes':['suit-tab suit-tab-deployments']}),
     ]
     #readonly_fields = ['backend_status_text', 'accountLink']
     readonly_fields = ['backend_status_text']
 
     #user_readonly_fields = ['name', 'deployments','site_url', 'enabled', 'is_public', 'login_base', 'accountLink']
-    user_readonly_fields = ['name', 'deployments','site_url', 'enabled', 'is_public', 'login_base', 'hosts_nodes', 'hosts_users']
+    user_readonly_fields = ['name', 'deployments', 'site_url',
+                            'enabled', 'is_public', 'login_base', 'hosts_nodes', 'hosts_users']
 
-    list_display = ('backend_status_icon', 'name', 'login_base','site_url', 'enabled')
+    list_display = ('backend_status_icon', 'name',
+                    'login_base', 'site_url', 'enabled')
     list_display_links = ('backend_status_icon', 'name', )
     filter_horizontal = ('deployments',)
-    inlines = [SliceInline,UserInline,TagInline, SitePrivilegeInline, SiteNodeInline]
+    inlines = [SliceInline, UserInline, TagInline,
+               SitePrivilegeInline, SiteNodeInline]
     admin_inlines = [ControllerSiteInline]
     search_fields = ['name']
 
     @property
     def suit_form_tabs(self):
         tabs = [('general', 'Site Details'),
-            ('users','Users'),
-            ('siteprivileges','Privileges'),
-            ('slices','Slices'),
-            ('nodes','Nodes'),
-        ]
+                ('users', 'Users'),
+                ('siteprivileges', 'Privileges'),
+                ('slices', 'Slices'),
+                ('nodes', 'Nodes'),
+                ]
 
-        request=getattr(_thread_locals, "request", None)
+        request = getattr(_thread_locals, "request", None)
         if request and request.user.is_admin:
-            tabs.append( ('admin-only', 'Admin-Only') )
+            tabs.append(('admin-only', 'Admin-Only'))
 
         return tabs
 
@@ -1006,7 +1123,7 @@
         link_obj = obj.accounts.all()
         if link_obj:
             reverse_path = "admin:core_account_change"
-            url = reverse(reverse_path, args =(link_obj[0].id,))
+            url = reverse(reverse_path, args=(link_obj[0].id,))
             return "<a href='%s'>%s</a>" % (url, "view billing details")
         else:
             return "no billing data for this site"
@@ -1015,16 +1132,16 @@
 
     def save_model(self, request, obj, form, change):
         # update openstack connection to use this site/tenant
-        obj.save_by_user(request.user) 
+        obj.save_by_user(request.user)
 
     def delete_model(self, request, obj):
         obj.delete_by_user(request.user)
-        
+
 
 class SitePrivilegeAdmin(XOSBaseAdmin):
     fieldList = ['backend_status_text', 'user', 'site', 'role']
     fieldsets = [
-        (None, {'fields': fieldList, 'classes':['collapse']})
+        (None, {'fields': fieldList, 'classes': ['collapse']})
     ]
     readonly_fields = ('backend_status_text', )
     list_display = ('backend_status_icon', 'user', 'site', 'role')
@@ -1046,10 +1163,12 @@
             if not request.user.is_admin:
                 # only show users from sites where caller has admin or pi role
                 roles = Role.objects.filter(role_type__in=['admin', 'pi'])
-                site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
+                site_privileges = SitePrivilege.objects.filter(
+                    user=request.user).filter(role__in=roles)
                 sites = [site_privilege.site for site_privilege in site_privileges]
                 site_privileges = SitePrivilege.objects.filter(site__in=sites)
-                emails = [site_privilege.user.email for site_privilege in site_privileges]
+                emails = [
+                    site_privilege.user.email for site_privilege in site_privileges]
                 users = User.objects.filter(email__in=emails)
                 kwargs['queryset'] = users
 
@@ -1059,7 +1178,7 @@
         # admins can see all privileges. Users can only see privileges at sites
         # where they have the admin role or pi role.
         qs = super(SitePrivilegeAdmin, self).queryset(request)
-        #if not request.user.is_admin:
+        # if not request.user.is_admin:
         #    roles = Role.objects.filter(role_type__in=['admin', 'pi'])
         #    site_privileges = SitePrivilege.objects.filter(user=request.user).filter(role__in=roles)
         #    login_bases = [site_privilege.site.login_base for site_privilege in site_privileges]
@@ -1067,7 +1186,9 @@
         #    qs = qs.filter(site__in=sites)
         return qs
 
+
 class SliceForm(forms.ModelForm):
+
     class Meta:
         model = Slice
         widgets = {
@@ -1081,13 +1202,15 @@
         slice_id = self.instance.id
         if not site and slice_id:
             site = Slice.objects.get(id=slice_id).site
-        if (not isinstance(site,Site)):
+        if (not isinstance(site, Site)):
             # previous code indicates 'site' could be a site_id and not a site?
             site = Slice.objects.get(id=site.id)
         if not name.startswith(site.login_base):
-            raise forms.ValidationError('slice name must begin with %s' % site.login_base)
+            raise forms.ValidationError(
+                'slice name must begin with %s' % site.login_base)
         return cleaned_data
 
+
 class ControllerSliceInline(XOSTabularInline):
     model = ControllerSlice
     extra = 0
@@ -1095,16 +1218,21 @@
     verbose_name_plural = "Controller Slices"
     suit_classes = 'suit-tab suit-tab-admin-only'
     fields = ['backend_status_icon', 'controller', 'tenant_id']
-    readonly_fields = ('backend_status_icon', 'controller' )
+    readonly_fields = ('backend_status_icon', 'controller')
+
 
 class SliceAdmin(XOSBaseAdmin):
     form = SliceForm
-    fieldList = ['backend_status_text', 'site', 'name', 'serviceClass', 'enabled','description', 'service', 'slice_url', 'max_instances', "default_isolation", "network"]
-    fieldsets = [('Slice Details', {'fields': fieldList, 'classes':['suit-tab suit-tab-general']}),]
+    fieldList = ['backend_status_text', 'site', 'name', 'serviceClass', 'enabled',
+                 'description', 'service', 'slice_url', 'max_instances', "default_isolation", "network"]
+    fieldsets = [('Slice Details', {'fields': fieldList, 'classes': [
+                  'suit-tab suit-tab-general']}), ]
     readonly_fields = ('backend_status_text', )
-    list_display = ('backend_status_icon', 'name', 'site','serviceClass', 'slice_url', 'max_instances')
+    list_display = ('backend_status_icon', 'name', 'site',
+                    'serviceClass', 'slice_url', 'max_instances')
     list_display_links = ('backend_status_icon', 'name', )
-    normal_inlines = [SlicePrivilegeInline, InstanceInline, TagInline, ReservationInline, SliceNetworkInline]
+    normal_inlines = [SlicePrivilegeInline, InstanceInline,
+                      TagInline, ReservationInline, SliceNetworkInline]
     inlines = normal_inlines
     admin_inlines = [ControllerSliceInline]
     suit_form_includes = (('slice_instance_tab.html', 'bottom', 'instances'),)
@@ -1113,20 +1241,20 @@
 
     @property
     def suit_form_tabs(self):
-        tabs =[('general', 'Slice Details'),
-          ('slicenetworks','Networks'),
-          ('sliceprivileges','Privileges'),
-          ('instances','Instances'),
-          #('reservations','Reservations'), 
-          ('tags','Tags'),
-          ]
+        tabs = [('general', 'Slice Details'),
+                ('slicenetworks', 'Networks'),
+                ('sliceprivileges', 'Privileges'),
+                ('instances', 'Instances'),
+                #('reservations','Reservations'),
+                ('tags', 'Tags'),
+                ]
 
-        request=getattr(_thread_locals, "request", None)
+        request = getattr(_thread_locals, "request", None)
         if request and request.user.is_admin:
-            tabs.append( ('admin-only', 'Admin-Only') )
+            tabs.append(('admin-only', 'Admin-Only'))
 
         return tabs
-    
+
     def add_view(self, request, form_url='', extra_context=None):
         # Ugly hack for CORD
         self.inlines = self.normal_inlines
@@ -1135,26 +1263,30 @@
         return super(SliceAdmin, self).add_view(request, form_url, extra_context=extra_context)
 
     def change_view(self, request, object_id, form_url='', extra_context=None):
-        # cannot change the site of an existing slice so make the site field read only
+        # cannot change the site of an existing slice so make the site field
+        # read only
         if object_id:
-            self.readonly_fields = ('backend_status_text','site')
+            self.readonly_fields = ('backend_status_text', 'site')
 
         return super(SliceAdmin, self).change_view(request, object_id, form_url)
 
     def render_change_form(self, request, context, add=False, change=False, form_url='', obj=None):
         deployment_nodes = []
         for node in Node.objects.all():
-            deployment_nodes.append( (node.site_deployment.deployment.id, node.id, node.name) )
+            deployment_nodes.append(
+                (node.site_deployment.deployment.id, node.id, node.name))
 
         deployment_flavors = []
         for flavor in Flavor.objects.all():
             for deployment in flavor.deployments.all():
-                deployment_flavors.append( (deployment.id, flavor.id, flavor.name) )
+                deployment_flavors.append(
+                    (deployment.id, flavor.id, flavor.name))
 
         deployment_images = []
         for image in Image.objects.all():
             for deployment_image in image.imagedeployments.all():
-                deployment_images.append( (deployment_image.deployment.id, image.id, image.name) )
+                deployment_images.append(
+                    (deployment_image.deployment.id, image.id, image.name))
 
         site_login_bases = []
         for site in Site.objects.all():
@@ -1168,8 +1300,10 @@
 
     def formfield_for_foreignkey(self, db_field, request, **kwargs):
         if db_field.name == 'site':
-            kwargs['queryset'] = Site.select_by_user(request.user).filter(hosts_users=True)
-            kwargs['widget'] = forms.Select(attrs={'onChange': "update_slice_prefix(this, $($(this).closest('fieldset')[0]).find('.field-name input')[0].id)"})
+            kwargs['queryset'] = Site.select_by_user(
+                request.user).filter(hosts_users=True)
+            kwargs['widget'] = forms.Select(
+                attrs={'onChange': "update_slice_prefix(this, $($(this).closest('fieldset')[0]).find('.field-name input')[0].id)"})
 
         return super(SliceAdmin, self).formfield_for_foreignkey(db_field, request, **kwargs)
 
@@ -1189,7 +1323,7 @@
     def add_extra_context(self, request, extra_context):
         super(SliceAdmin, self).add_extra_context(request, extra_context)
         # set context["slice_id"] to the PK passed in the URL to this view
-        if len(request.resolver_match.args)>0:
+        if len(request.resolver_match.args) > 0:
             extra_context["slice_id"] = request.resolver_match.args[0]
 
     def UNUSED_get_inline_instances(self, request, obj=None):
@@ -1199,16 +1333,19 @@
         #    XXX this approach is better than clobbering self.inlines, so
         #    try to make this work post-demo.
         if (obj is not None) and (obj.name == "mysite_vcpe"):
-            cord_vcpe_inlines = [ SlicePrivilegeInline, CordInstanceInline, TagInline, ReservationInline,SliceNetworkInline]
+            cord_vcpe_inlines = [SlicePrivilegeInline, CordInstanceInline,
+                                 TagInline, ReservationInline, SliceNetworkInline]
 
-            inlines=[]
+            inlines = []
             for inline_class in cord_vcpe_inlines:
                 inlines.append(inline_class(self.model, self.admin_site))
         else:
-            inlines = super(SliceAdmin, self).get_inline_instances(request, obj)
+            inlines = super(SliceAdmin, self).get_inline_instances(
+                request, obj)
 
         return inlines
 
+
 class SlicePrivilegeAdmin(XOSBaseAdmin):
     fieldsets = [
         (None, {'fields': ['backend_status_text', 'user', 'slice', 'role']})
@@ -1223,7 +1360,7 @@
     def formfield_for_foreignkey(self, db_field, request, **kwargs):
         if db_field.name == 'slice':
             kwargs['queryset'] = Slice.select_by_user(request.user)
-        
+
         if db_field.name == 'user':
             kwargs['queryset'] = User.select_by_user(request.user)
 
@@ -1248,23 +1385,27 @@
         obj.os_manager = OpenStackManager(auth=auth, caller=request.user)
         obj.delete()
 
+
 class ImageAdmin(XOSBaseAdmin):
 
     fieldsets = [('Image Details',
-                   {'fields': ['backend_status_text', 'name', 'kind', 'disk_format', 'container_format', 'tag', 'path'],
-                    'classes': ['suit-tab suit-tab-general']})
-               ]
+                  {'fields': ['backend_status_text', 'name', 'kind', 'disk_format', 'container_format', 'tag', 'path'],
+                   'classes': ['suit-tab suit-tab-general']})
+                 ]
     readonly_fields = ('backend_status_text', )
 
-    suit_form_tabs =(('general','Image Details'),('instances','Instances'),('imagedeployments','Deployments'), ('admin-only', 'Admin-Only'))
+    suit_form_tabs = (('general', 'Image Details'), ('instances', 'Instances'),
+                      ('imagedeployments', 'Deployments'), ('admin-only', 'Admin-Only'))
 
     inlines = [InstanceInline, ControllerImagesInline]
 
-    user_readonly_fields = ['name', 'disk_format', 'container_format', 'tag', 'path']
+    user_readonly_fields = ['name', 'disk_format',
+                            'container_format', 'tag', 'path']
 
     list_display = ['backend_status_icon', 'name', 'kind']
     list_display_links = ('backend_status_icon', 'name', )
 
+
 class NodeForm(forms.ModelForm):
     nodelabels = forms.ModelMultipleChoiceField(
         queryset=NodeLabel.objects.all(),
@@ -1274,6 +1415,7 @@
             verbose_name=('Labels'), is_stacked=False
         )
     )
+
     class Meta:
         model = Node
         widgets = {
@@ -1282,21 +1424,21 @@
         }
 
     def __init__(self, *args, **kwargs):
-      request = kwargs.pop('request', None)
-      super(NodeForm, self).__init__(*args, **kwargs)
+        request = kwargs.pop('request', None)
+        super(NodeForm, self).__init__(*args, **kwargs)
 
-      if self.instance and self.instance.pk:
-        self.fields['nodelabels'].initial = self.instance.nodelabels.all()
+        if self.instance and self.instance.pk:
+            self.fields['nodelabels'].initial = self.instance.nodelabels.all()
 
     def save(self, commit=True):
-      node = super(NodeForm, self).save(commit=False)
+        node = super(NodeForm, self).save(commit=False)
 
-      node.nodelabels = self.cleaned_data['nodelabels']
+        node.nodelabels = self.cleaned_data['nodelabels']
 
-      if commit:
-        node.save()
+        if commit:
+            node.save()
 
-      return node
+        return node
 
 
 class NodeLabelAdmin(XOSBaseAdmin):
@@ -1312,25 +1454,30 @@
     list_display_links = ('backend_status_icon', 'name', )
     list_filter = ('site_deployment',)
 
-    inlines = [TagInline,InstanceInline]
+    inlines = [TagInline, InstanceInline]
     fieldsets = [('Node Details', {'fields': ['backend_status_text', 'name', 'site_deployment'], 'classes':['suit-tab suit-tab-details']}),
                  ('Labels', {'fields': ['nodelabels'], 'classes':['suit-tab suit-tab-labels']})]
     readonly_fields = ('backend_status_text', )
 
-    user_readonly_fields = ['name','site_deployment']
-    user_readonly_inlines = [TagInline,InstanceInline]
+    user_readonly_fields = ['name', 'site_deployment']
+    user_readonly_inlines = [TagInline, InstanceInline]
 
-    suit_form_tabs =(('details','Node Details'),('instances','Instances'), ('labels', 'Labels'), ('tags','Tags'))
+    suit_form_tabs = (('details', 'Node Details'), ('instances',
+                                                    'Instances'), ('labels', 'Labels'), ('tags', 'Tags'))
 
     def formfield_for_foreignkey(self, db_field, request, **kwargs):
         if db_field.name == 'site':
-            kwargs['queryset'] = Site.select_by_user(request.user).filter(hosts_nodes=True)
+            kwargs['queryset'] = Site.select_by_user(
+                request.user).filter(hosts_nodes=True)
 
-        field = super(NodeAdmin, self).formfield_for_foreignkey(db_field, request, **kwargs)
+        field = super(NodeAdmin, self).formfield_for_foreignkey(
+            db_field, request, **kwargs)
 
         return field
 
+
 class InstanceForm(forms.ModelForm):
+
     class Meta:
         model = Instance
         ip = forms.CharField(widget=PlainTextWidget)
@@ -1345,12 +1492,16 @@
             'image': LinkedSelect
         }
 
+
 class TagAdmin(XOSBaseAdmin):
-    list_display = ['backend_status_icon', 'service', 'name', 'value', 'content_type', 'content_object',]
+    list_display = ['backend_status_icon', 'service',
+                    'name', 'value', 'content_type', 'content_object', ]
     list_display_links = list_display
-    user_readonly_fields = ['service', 'name', 'value', 'content_type', 'content_object',]
+    user_readonly_fields = ['service', 'name',
+                            'value', 'content_type', 'content_object', ]
     user_readonly_inlines = []
 
+
 class InstancePortInline(XOSTabularInline):
     fields = ['backend_status_icon', 'network', 'instance', 'ip', 'mac']
     readonly_fields = ("backend_status_icon", "ip", "mac")
@@ -1361,21 +1512,28 @@
     verbose_name = "Port"
     suit_classes = 'suit-tab suit-tab-ports'
 
+
 class InstanceAdmin(XOSBaseAdmin):
     form = InstanceForm
     fieldsets = [
-        ('Instance Details', {'fields': ['backend_status_text', 'slice', 'deployment', 'isolation', 'flavor', 'image', 'node', 'parent', 'all_ips_string', 'instance_id', 'instance_name', 'ssh_command', ], 'classes': ['suit-tab suit-tab-general'], }),
-        ('Container Settings', {'fields': ['volumes'], 'classes': ['suit-tab suit-tab-container'], }),
+        ('Instance Details', {'fields': ['backend_status_text', 'slice', 'deployment', 'isolation', 'flavor', 'image', 'node',
+                                         'parent', 'all_ips_string', 'instance_id', 'instance_name', 'ssh_command', ], 'classes': ['suit-tab suit-tab-general'], }),
+        ('Container Settings', {'fields': ['volumes'], 'classes': [
+         'suit-tab suit-tab-container'], }),
     ]
     readonly_fields = ('backend_status_text', 'ssh_command', 'all_ips_string')
-    list_display = ['backend_status_icon', 'all_ips_string', 'instance_id', 'instance_name', 'isolation', 'slice', 'flavor', 'image', 'node', 'deployment']
-    list_display_links = ('backend_status_icon', 'all_ips_string', 'instance_id', )
+    list_display = ['backend_status_icon', 'all_ips_string', 'instance_id',
+                    'instance_name', 'isolation', 'slice', 'flavor', 'image', 'node', 'deployment']
+    list_display_links = ('backend_status_icon',
+                          'all_ips_string', 'instance_id', )
 
-    suit_form_tabs =(('general', 'Instance Details'), ('ports', 'Ports'), ('container', 'Container Settings'), ('tags', 'Tags'))
+    suit_form_tabs = (('general', 'Instance Details'), ('ports', 'Ports'),
+                      ('container', 'Container Settings'), ('tags', 'Tags'))
 
     inlines = [TagInline, InstancePortInline]
 
-    user_readonly_fields = ['slice', 'deployment', 'node', 'ip', 'instance_name', 'flavor', 'image']
+    user_readonly_fields = ['slice', 'deployment',
+                            'node', 'ip', 'instance_name', 'flavor', 'image']
 
     def ssh_command(self, obj):
         ssh_command = obj.get_ssh_command()
@@ -1395,30 +1553,36 @@
         # the slices they belong to.
         return Instance.select_by_user(request.user)
 
-    def add_view(self, request, form_url='', extra_context = None):
-        self.readonly_fields = ('backend_status_text', 'ssh_command', 'all_ips_string')
-        return super(InstanceAdmin,self).add_view(request, form_url, extra_context)
+    def add_view(self, request, form_url='', extra_context=None):
+        self.readonly_fields = ('backend_status_text',
+                                'ssh_command', 'all_ips_string')
+        return super(InstanceAdmin, self).add_view(request, form_url, extra_context)
 
     def change_view(self, request, object_id, extra_context=None):
-        self.readonly_fields = ('backend_status_text', 'ssh_command', 'all_ips_string', 'deployment', 'slice', 'flavor', 'image', 'node')
-        self.readonly_save = self.readonly_fields # for XOSAdminMixin.change_view's user_readonly_fields switching code
-        return super(InstanceAdmin,self).change_view(request, object_id, extra_context)
+        self.readonly_fields = ('backend_status_text', 'ssh_command',
+                                'all_ips_string', 'deployment', 'slice', 'flavor', 'image', 'node')
+        # for XOSAdminMixin.change_view's user_readonly_fields switching code
+        self.readonly_save = self.readonly_fields
+        return super(InstanceAdmin, self).change_view(request, object_id, extra_context)
 
     def render_change_form(self, request, context, add=False, change=False, form_url='', obj=None):
         deployment_nodes = []
 #        for node in Node.objects.all():
         for node in Node.objects.order_by("name"):
-            deployment_nodes.append( (node.site_deployment.deployment.id, node.id, node.name) )
+            deployment_nodes.append(
+                (node.site_deployment.deployment.id, node.id, node.name))
 
         deployment_flavors = []
         for flavor in Flavor.objects.all():
             for deployment in flavor.deployments.all():
-                deployment_flavors.append( (deployment.id, flavor.id, flavor.name) )
+                deployment_flavors.append(
+                    (deployment.id, flavor.id, flavor.name))
 
         deployment_images = []
         for image in Image.objects.all():
             for deployment_image in image.imagedeployments.all():
-                deployment_images.append( (deployment_image.deployment.id, image.id, image.name) )
+                deployment_images.append(
+                    (deployment_image.deployment.id, image.id, image.name))
 
         site_login_bases = []
         for site in Site.objects.all():
@@ -1432,16 +1596,20 @@
 
     def formfield_for_foreignkey(self, db_field, request=None, **kwargs):
         if db_field.name == 'deployment':
-           kwargs['queryset'] = Deployment.select_by_acl(request.user).filter(sitedeployments__nodes__isnull=False).distinct()
-           kwargs['widget'] = forms.Select(attrs={'onChange': "instance_deployment_changed(this);"})
+            kwargs['queryset'] = Deployment.select_by_acl(request.user).filter(
+                sitedeployments__nodes__isnull=False).distinct()
+            kwargs['widget'] = forms.Select(
+                attrs={'onChange': "instance_deployment_changed(this);"})
         if db_field.name == 'flavor':
-           kwargs['widget'] = forms.Select(attrs={'onChange': "instance_flavor_changed(this);"})
+            kwargs['widget'] = forms.Select(
+                attrs={'onChange': "instance_flavor_changed(this);"})
 
-        field = super(InstanceAdmin, self).formfield_for_foreignkey(db_field, request, **kwargs)
+        field = super(InstanceAdmin, self).formfield_for_foreignkey(
+            db_field, request, **kwargs)
 
         return field
 
-    #def save_model(self, request, obj, form, change):
+    # def save_model(self, request, obj, form, change):
     #    # update openstack connection to use this site/tenant
     #    auth = request.session.get('auth', {})
     #    auth['tenant'] = obj.slice.name
@@ -1449,14 +1617,14 @@
     #    obj.creator = request.user
     #    obj.save()
 
-    #def delete_model(self, request, obj):
+    # def delete_model(self, request, obj):
     #    # update openstack connection to use this site/tenant
     #    auth = request.session.get('auth', {})
     #    auth['tenant'] = obj.slice.name
     #    obj.os_manager = OpenStackManager(auth=auth, caller=request.user)
     #    obj.delete()
 
-#class ContainerPortInline(XOSTabularInline):
+# class ContainerPortInline(XOSTabularInline):
 #    fields = ['backend_status_icon', 'network', 'container', 'ip', 'mac', 'segmentation_id']
 #    readonly_fields = ("backend_status_icon", "ip", "mac", "segmentation_id")
 #    model = Port
@@ -1466,7 +1634,7 @@
 #    verbose_name = "Port"
 #    suit_classes = 'suit-tab suit-tab-ports'
 
-#class ContainerAdmin(XOSBaseAdmin):
+# class ContainerAdmin(XOSBaseAdmin):
 #    fieldsets = [
 #        ('Container Details', {'fields': ['backend_status_text', 'slice', 'node', 'docker_image', 'volumes', 'no_sync'], 'classes': ['suit-tab suit-tab-general'], })
 #    ]
@@ -1489,11 +1657,13 @@
 #        # the slices they belong to.
 #        return Container.select_by_user(request.user)
 
+
 class UserCreationForm(forms.ModelForm):
     """A form for creating new users. Includes all the required
     fields, plus a repeated password."""
     password1 = forms.CharField(label='Password', widget=forms.PasswordInput)
-    password2 = forms.CharField(label='Password confirmation', widget=forms.PasswordInput)
+    password2 = forms.CharField(
+        label='Password confirmation', widget=forms.PasswordInput)
 
     class Meta:
         model = User
@@ -1511,7 +1681,7 @@
         # Save the provided password in hashed format
         user = super(UserCreationForm, self).save(commit=False)
         user.password = self.cleaned_data["password1"]
-        #user.set_password(self.cleaned_data["password1"])
+        # user.set_password(self.cleaned_data["password1"])
         if commit:
             user.save()
         return user
@@ -1523,14 +1693,16 @@
     password hash display field.
     """
     password = ReadOnlyPasswordHashField(label='Password',
-                   help_text= '<a href=\"password/\">Change Password</a>.')
+                                         help_text='<a href=\"password/\">Change Password</a>.')
 
-    PROFILE_CHOICES = ((None, '------'), ('regular', 'Regular user'), ('cp', 'Content Provider'))
-    profile = forms.ChoiceField(choices=PROFILE_CHOICES, required=False, label="Quick Profile")
+    PROFILE_CHOICES = ((None, '------'), ('regular',
+                                          'Regular user'), ('cp', 'Content Provider'))
+    profile = forms.ChoiceField(
+        choices=PROFILE_CHOICES, required=False, label="Quick Profile")
 
     class Meta:
         model = User
-        widgets = { 'public_key': UploadTextareaWidget, }
+        widgets = {'public_key': UploadTextareaWidget, }
 
     def clean_password(self):
         # Regardless of what the user provides, return the initial value.
@@ -1540,16 +1712,18 @@
 
     def save(self, *args, **kwargs):
         if self.cleaned_data['profile']:
-             self.instance.apply_profile(self.cleaned_data['profile'])
+            self.instance.apply_profile(self.cleaned_data['profile'])
 
         return super(UserChangeForm, self).save(*args, **kwargs)
 
+
 class UserDashboardViewInline(XOSTabularInline):
     model = UserDashboardView
     extra = 0
     suit_classes = 'suit-tab suit-tab-dashboards'
     fields = ['user', 'dashboardView', 'order']
 
+
 class ControllerUserInline(XOSTabularInline):
     model = ControllerUser
     extra = 0
@@ -1571,24 +1745,28 @@
     # The fields to be used in displaying the User model.
     # These override the definitions on the base UserAdmin
     # that reference specific fields on auth.User.
-    list_display = ('backend_status_icon', 'email', 'firstname', 'lastname', 'site', 'last_login')
+    list_display = ('backend_status_icon', 'email',
+                    'firstname', 'lastname', 'site', 'last_login')
     list_display_links = ("email",)
     list_filter = ('site',)
-    inlines = [SlicePrivilegeInline,SitePrivilegeInline]
+    inlines = [SlicePrivilegeInline, SitePrivilegeInline]
     admin_inlines = [ControllerUserInline]
-    fieldListLoginDetails = ['backend_status_text', 'email', 'site','password','is_active','is_readonly','is_admin','is_appuser', 'public_key', 'login_page', 'profile']
-    fieldListContactInfo = ['firstname','lastname','phone','timezone']
+    fieldListLoginDetails = ['backend_status_text', 'email', 'site', 'password', 'is_active',
+                             'is_readonly', 'is_admin', 'is_appuser', 'public_key', 'login_page', 'profile']
+    fieldListContactInfo = ['firstname', 'lastname', 'phone', 'timezone']
 
     fieldsets = (
-        ('Login Details', {'fields': ['backend_status_text', 'email', 'site','password', 'is_active', 'is_readonly', 'is_admin', 'is_appuser', 'public_key'], 'classes':['suit-tab suit-tab-general']}),
-        ('Contact Information', {'fields': ('firstname','lastname','phone', 'timezone'), 'classes':['suit-tab suit-tab-contact']}),
+        ('Login Details', {'fields': ['backend_status_text', 'email', 'site', 'password', 'is_active',
+                                      'is_readonly', 'is_admin', 'is_appuser', 'public_key'], 'classes': ['suit-tab suit-tab-general']}),
+        ('Contact Information', {'fields': (
+            'firstname', 'lastname', 'phone', 'timezone'), 'classes': ['suit-tab suit-tab-contact']}),
         #('Important dates', {'fields': ('last_login',)}),
     )
     add_fieldsets = (
         (None, {
             'classes': ('wide',),
-            'fields': ('site', 'email', 'firstname', 'lastname', 'is_admin', 'is_readonly', 'is_appuser', 'phone', 'public_key','password1', 'password2')},
-        ),
+            'fields': ('site', 'email', 'firstname', 'lastname', 'is_admin', 'is_readonly', 'is_appuser', 'phone', 'public_key', 'password1', 'password2')},
+         ),
     )
     readonly_fields = ('backend_status_text', )
     search_fields = ('email',)
@@ -1602,20 +1780,21 @@
         if getattr(_thread_locals, "obj", None) is None:
             return []
         else:
-            tabs = [('general','Login Details'),
-                         ('contact','Contact Information'),
-                         ('sliceprivileges','Slice Privileges'),
-                         ('siteprivileges','Site Privileges')]
+            tabs = [('general', 'Login Details'),
+                    ('contact', 'Contact Information'),
+                    ('sliceprivileges', 'Slice Privileges'),
+                    ('siteprivileges', 'Site Privileges')]
 
-            request=getattr(_thread_locals, "request", None)
+            request = getattr(_thread_locals, "request", None)
             if request and request.user.is_admin:
-                tabs.append( ('admin-only', 'Admin-Only') )
+                tabs.append(('admin-only', 'Admin-Only'))
 
             return tabs
 
     def formfield_for_foreignkey(self, db_field, request, **kwargs):
         if db_field.name == 'site':
-            kwargs['queryset'] = Site.select_by_user(request.user).filter(hosts_users=True)
+            kwargs['queryset'] = Site.select_by_user(
+                request.user).filter(hosts_users=True)
 
         return super(UserAdmin, self).formfield_for_foreignkey(db_field, request, **kwargs)
 
@@ -1635,14 +1814,17 @@
                 login_details_fields.remove('is_admin')
             if 'profile' in login_details_fields:
                 login_details_fields.remove('profile')
-            #if len(request.user.siteprivileges.filter(role__role = 'pi')) > 0:
+            # if len(request.user.siteprivileges.filter(role__role = 'pi')) > 0:
                 # only admins and pis can change a user's site
-            #    self.readonly_fields = ('backend_status_text', 'site') 
+            #    self.readonly_fields = ('backend_status_text', 'site')
         self.fieldsets = (
-            ('Login Details', {'fields': login_details_fields, 'classes':['suit-tab suit-tab-general']}),
-            ('Contact Information', {'fields': self.fieldListContactInfo, 'classes':['suit-tab suit-tab-contact']}),
+            ('Login Details', {'fields': login_details_fields,
+                               'classes': ['suit-tab suit-tab-general']}),
+            ('Contact Information', {
+             'fields': self.fieldListContactInfo, 'classes': ['suit-tab suit-tab-contact']}),
         )
-        return super(UserAdmin, self).get_form(request, obj, **kwargs)     
+        return super(UserAdmin, self).get_form(request, obj, **kwargs)
+
 
 class ControllerDashboardViewInline(XOSTabularInline):
     model = ControllerDashboardView
@@ -1650,42 +1832,49 @@
     fields = ["controller", "url"]
     suit_classes = 'suit-tab suit-tab-controllers'
 
+
 class DashboardViewAdmin(XOSBaseAdmin):
     fieldsets = [('Dashboard View Details',
-                   {'fields': ['backend_status_text', 'name', 'url', 'enabled', 'deployments'],
-                    'classes': ['suit-tab suit-tab-general']})
-               ]
+                  {'fields': ['backend_status_text', 'name', 'url', 'enabled', 'deployments'],
+                   'classes': ['suit-tab suit-tab-general']})
+                 ]
     list_display = ["name", "enabled", "url"]
     readonly_fields = ('backend_status_text', )
     inlines = [ControllerDashboardViewInline]
 
-    suit_form_tabs =(('general','Dashboard View Details'),
-                     ('controllers', 'Per-controller Dashboard Details'))
+    suit_form_tabs = (('general', 'Dashboard View Details'),
+                      ('controllers', 'Per-controller Dashboard Details'))
+
 
 class ServiceResourceInline(XOSTabularInline):
     model = ServiceResource
     extra = 0
 
+
 class ServiceClassAdmin(XOSBaseAdmin):
-    list_display = ('backend_status_icon', 'name', 'commitment', 'membershipFee')
+    list_display = ('backend_status_icon', 'name',
+                    'commitment', 'membershipFee')
     list_display_links = ('backend_status_icon', 'name', )
     inlines = [ServiceResourceInline]
 
     user_readonly_fields = ['name', 'commitment', 'membershipFee']
     user_readonly_inlines = []
 
+
 class ReservedResourceInline(XOSTabularInline):
     model = ReservedResource
     extra = 0
     suit_classes = 'suit-tab suit-tab-reservedresources'
 
     def formfield_for_foreignkey(self, db_field, request=None, **kwargs):
-        field = super(ReservedResourceInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
+        field = super(ReservedResourceInline, self).formfield_for_foreignkey(
+            db_field, request, **kwargs)
 
         if db_field.name == 'resource':
             # restrict resources to those that the slice's service class allows
             if request._slice is not None:
-                field.queryset = field.queryset.filter(serviceClass = request._slice.serviceClass, calendarReservable=True)
+                field.queryset = field.queryset.filter(
+                    serviceClass=request._slice.serviceClass, calendarReservable=True)
                 if len(field.queryset) > 0:
                     field.initial = field.queryset.all()[0]
             else:
@@ -1693,7 +1882,7 @@
         elif db_field.name == 'instance':
             # restrict instances to those that belong to the slice
             if request._slice is not None:
-                field.queryset = field.queryset.filter(slice = request._slice)
+                field.queryset = field.queryset.filter(slice=request._slice)
             else:
                 field.queryset = field.queryset.none()
 
@@ -1702,31 +1891,37 @@
     def queryset(self, request):
         return ReservedResource.select_by_user(request.user)
 
+
 class ReservationChangeForm(forms.ModelForm):
+
     class Meta:
         model = Reservation
         widgets = {
-            'slice' : LinkedSelect
+            'slice': LinkedSelect
         }
 
+
 class ReservationAddForm(forms.ModelForm):
-    slice = forms.ModelChoiceField(queryset=Slice.objects.all(), widget=forms.Select(attrs={"onChange":"document.getElementById('id_refresh').value=1; submit()"}))
+    slice = forms.ModelChoiceField(queryset=Slice.objects.all(), widget=forms.Select(
+        attrs={"onChange": "document.getElementById('id_refresh').value=1; submit()"}))
     refresh = forms.CharField(widget=forms.HiddenInput())
 
     class Media:
-       css = {'all': ('xos.css',)}   # .field-refresh { display: none; }
+        css = {'all': ('xos.css',)}   # .field-refresh { display: none; }
 
     def clean_slice(self):
         slice = self.cleaned_data.get("slice")
-        x = ServiceResource.objects.filter(serviceClass = slice.serviceClass, calendarReservable=True)
+        x = ServiceResource.objects.filter(
+            serviceClass=slice.serviceClass, calendarReservable=True)
         if len(x) == 0:
-            raise forms.ValidationError("The slice you selected does not have a service class that allows reservations")
+            raise forms.ValidationError(
+                "The slice you selected does not have a service class that allows reservations")
         return slice
 
     class Meta:
         model = Reservation
         widgets = {
-            'slice' : LinkedSelect
+            'slice': LinkedSelect
         }
 
 
@@ -1750,17 +1945,21 @@
         return result
 
     """ don't save anything """
+
     def is_valid(self):
         return False
 
+
 class ReservationAdmin(XOSBaseAdmin):
     fieldList = ['backend_status_text', 'slice', 'startTime', 'duration']
-    fieldsets = [('Reservation Details', {'fields': fieldList, 'classes': ['suit-tab suit-tab-general']})]
+    fieldsets = [('Reservation Details', {
+                  'fields': fieldList, 'classes': ['suit-tab suit-tab-general']})]
     readonly_fields = ('backend_status_text', )
     list_display = ('startTime', 'duration')
     form = ReservationAddForm
 
-    suit_form_tabs = (('general','Reservation Details'), ('reservedresources','Reserved Resources'))
+    suit_form_tabs = (('general', 'Reservation Details'),
+                      ('reservedresources', 'Reserved Resources'))
 
     inlines = [ReservedResourceInline]
     user_readonly_fields = fieldList
@@ -1772,20 +1971,21 @@
         if request.method == 'POST':
             # "refresh" will be set to "1" if the form was submitted due to
             # a change in the Slice dropdown.
-            if request.POST.get("refresh","1") == "1":
+            if request.POST.get("refresh", "1") == "1":
                 request._refresh = True
                 request.POST["refresh"] = "0"
 
             # Keep track of the slice that was selected, so the
             # reservedResource inline can filter items for the slice.
-            request._slice = request.POST.get("slice",None)
+            request._slice = request.POST.get("slice", None)
             if (request._slice is not None):
                 request._slice = Slice.objects.get(id=request._slice)
 
-        result =  super(ReservationAdmin, self).add_view(request, form_url, extra_context)
+        result = super(ReservationAdmin, self).add_view(
+            request, form_url, extra_context)
         return result
 
-    def changelist_view(self, request, extra_context = None):
+    def changelist_view(self, request, extra_context=None):
         timezone.activate(request.user.timezone)
         return super(ReservationAdmin, self).changelist_view(request, extra_context)
 
@@ -1814,18 +2014,21 @@
     def queryset(self, request):
         return Reservation.select_by_user(request.user)
 
+
 class NetworkParameterTypeAdmin(XOSBaseAdmin):
     list_display = ("backend_status_icon", "name", )
     list_display_links = ('backend_status_icon', 'name', )
     user_readonly_fields = ['name']
     user_readonly_inlines = []
 
+
 class RouterAdmin(XOSBaseAdmin):
     list_display = ("backend_status_icon", "name", )
     list_display_links = ('backend_status_icon', 'name', )
     user_readonly_fields = ['name']
     user_readonly_inlines = []
 
+
 class RouterInline(XOSTabularInline):
     model = Router.networks.through
     extra = 0
@@ -1833,6 +2036,7 @@
     verbose_name = "Router"
     suit_classes = 'suit-tab suit-tab-routers'
 
+
 class NetworkParameterInline(PlStackGenericTabularInline):
     model = NetworkParameter
     extra = 0
@@ -1842,6 +2046,7 @@
     fields = ['backend_status_icon', 'parameter', 'value']
     readonly_fields = ('backend_status_icon', )
 
+
 class NetworkPortInline(XOSTabularInline):
     fields = ['backend_status_icon', 'network', 'instance', 'ip', 'mac']
     readonly_fields = ("backend_status_icon", "ip", "mac")
@@ -1852,6 +2057,7 @@
     verbose_name = "Port"
     suit_classes = 'suit-tab suit-tab-ports'
 
+
 class NetworkSlicesInline(XOSTabularInline):
     model = NetworkSlice
     selflink_fieldname = "slice"
@@ -1859,19 +2065,23 @@
     verbose_name_plural = "Slices"
     verbose_name = "Slice"
     suit_classes = 'suit-tab suit-tab-networkslices'
-    fields = ['backend_status_icon', 'network','slice']
+    fields = ['backend_status_icon', 'network', 'slice']
     readonly_fields = ('backend_status_icon', )
 
+
 class ControllerNetworkInline(XOSTabularInline):
     model = ControllerNetwork
     extra = 0
     verbose_name_plural = "Controller Networks"
     verbose_name = "Controller Network"
     suit_classes = 'suit-tab suit-tab-admin-only'
-    fields = ['backend_status_icon', 'controller','net_id','subnet_id','subnet']
+    fields = ['backend_status_icon', 'controller',
+              'net_id', 'subnet_id', 'subnet']
     readonly_fields = ('backend_status_icon', )
 
+
 class NetworkForm(forms.ModelForm):
+
     class Meta:
         model = Network
         widgets = {
@@ -1879,57 +2089,62 @@
             'controllerParameters': UploadTextareaWidget,
         }
 
+
 class NetworkAdmin(XOSBaseAdmin):
     list_display = ("backend_status_icon", "name", "subnet", "ports", "labels")
     list_display_links = ('backend_status_icon', 'name', )
     readonly_fields = ("subnet", )
-    inlines = [NetworkParameterInline, NetworkPortInline, NetworkSlicesInline, RouterInline]
+    inlines = [NetworkParameterInline, NetworkPortInline,
+               NetworkSlicesInline, RouterInline]
     admin_inlines = [ControllerNetworkInline]
 
-    form=NetworkForm
+    form = NetworkForm
 
     fieldsets = [
-        (None, {'fields': ['backend_status_text', 'name','template','ports','labels',
-                           'owner','guaranteed_bandwidth', 'permit_all_slices',
-                           'permitted_slices','network_id','router_id','subnet_id',
+        (None, {'fields': ['backend_status_text', 'name', 'template', 'ports', 'labels',
+                           'owner', 'guaranteed_bandwidth', 'permit_all_slices',
+                           'permitted_slices', 'network_id', 'router_id', 'subnet_id',
                            'subnet', 'autoconnect'],
                 'classes':['suit-tab suit-tab-general']}),
         (None, {'fields': ['topology_parameters', 'controller_url', 'controller_parameters'],
                 'classes':['suit-tab suit-tab-sdn']}),
-                ]
+    ]
 
     readonly_fields = ('backend_status_text', )
-    user_readonly_fields = ['name','template','ports','labels','owner','guaranteed_bandwidth',
-                            'permit_all_slices','permitted_slices','network_id','router_id',
-                            'subnet_id','subnet','autoconnect']
+    user_readonly_fields = ['name', 'template', 'ports', 'labels', 'owner', 'guaranteed_bandwidth',
+                            'permit_all_slices', 'permitted_slices', 'network_id', 'router_id',
+                            'subnet_id', 'subnet', 'autoconnect']
 
     @property
     def suit_form_tabs(self):
-        tabs=[('general','Network Details'),
-            ('sdn', 'SDN Configuration'),
-            ('netparams', 'Parameters'),
-            ('ports','Ports'),
-            ('networkslices','Slices'),
-            ('routers','Routers'),
-        ]
+        tabs = [('general', 'Network Details'),
+                ('sdn', 'SDN Configuration'),
+                ('netparams', 'Parameters'),
+                ('ports', 'Ports'),
+                ('networkslices', 'Slices'),
+                ('routers', 'Routers'),
+                ]
 
-        request=getattr(_thread_locals, "request", None)
+        request = getattr(_thread_locals, "request", None)
         if request and request.user.is_admin:
-            tabs.append( ('admin-only', 'Admin-Only') )
+            tabs.append(('admin-only', 'Admin-Only'))
 
         return tabs
 
 
 class NetworkTemplateAdmin(XOSBaseAdmin):
-    list_display = ("backend_status_icon", "name", "guaranteed_bandwidth", "visibility")
+    list_display = ("backend_status_icon", "name",
+                    "guaranteed_bandwidth", "visibility")
     list_display_links = ('backend_status_icon', 'name', )
     user_readonly_fields = ["name", "guaranteed_bandwidth", "visibility"]
     user_readonly_inlines = []
-    inlines = [NetworkParameterInline,]
+    inlines = [NetworkParameterInline, ]
     fieldsets = [
         (None, {'fields': ['name', 'description', 'guaranteed_bandwidth', 'visibility', 'translation', 'access', 'shared_network_name', 'shared_network_id', 'topology_kind', 'controller_kind'],
-                'classes':['suit-tab suit-tab-general']}),]
-    suit_form_tabs = (('general','Network Template Details'), ('netparams', 'Parameters') )
+                'classes':['suit-tab suit-tab-general']}), ]
+    suit_form_tabs = (('general', 'Network Template Details'),
+                      ('netparams', 'Parameters'))
+
 
 class PortAdmin(XOSBaseAdmin):
     list_display = ("backend_status_icon", "id", "ip")
@@ -1940,59 +2155,70 @@
     fieldsets = [
         (None, {'fields': ['backend_status_text', 'network', 'instance', 'ip', 'port_id', 'mac'],
                 'classes':['suit-tab suit-tab-general']}),
-                ]
+    ]
 
     readonly_fields = ('backend_status_text', )
     suit_form_tabs = (('general', 'Port Details'), ('netparams', 'Parameters'))
 
+
 class FlavorAdmin(XOSBaseAdmin):
-    list_display = ("backend_status_icon", "name", "flavor", "order", "default")
+    list_display = ("backend_status_icon", "name",
+                    "flavor", "order", "default")
     list_display_links = ("backend_status_icon", "name")
     user_readonly_fields = ("name", "flavor")
     fields = ("name", "description", "flavor", "order", "default")
 
 # register a signal that caches the user's credentials when they log in
+
+
 def cache_credentials(sender, user, request, **kwds):
     auth = {'username': request.POST['username'],
             'password': request.POST['password']}
     request.session['auth'] = auth
 user_logged_in.connect(cache_credentials)
 
+
 def dollar_field(fieldName, short_description):
     def newFunc(self, obj):
         try:
-            x= "$ %0.2f" % float(getattr(obj, fieldName, 0.0))
+            x = "$ %0.2f" % float(getattr(obj, fieldName, 0.0))
         except:
-            x=getattr(obj, fieldName, 0.0)
+            x = getattr(obj, fieldName, 0.0)
         return x
     newFunc.short_description = short_description
     return newFunc
 
+
 def right_dollar_field(fieldName, short_description):
     def newFunc(self, obj):
         try:
             #x= '<div align=right style="width:6em">$ %0.2f</div>' % float(getattr(obj, fieldName, 0.0))
-            x= '<div align=right>$ %0.2f</div>' % float(getattr(obj, fieldName, 0.0))
+            x = '<div align=right>$ %0.2f</div>' % float(
+                getattr(obj, fieldName, 0.0))
         except:
-            x=getattr(obj, fieldName, 0.0)
+            x = getattr(obj, fieldName, 0.0)
         return x
     newFunc.short_description = short_description
     newFunc.allow_tags = True
     return newFunc
 
+
 class InvoiceChargeInline(XOSTabularInline):
     model = Charge
     extra = 0
     verbose_name_plural = "Charges"
     verbose_name = "Charge"
     exclude = ['account']
-    fields = ["date", "kind", "state", "object", "coreHours", "dollar_amount", "slice"]
-    readonly_fields = ["date", "kind", "state", "object", "coreHours", "dollar_amount", "slice"]
+    fields = ["date", "kind", "state", "object",
+              "coreHours", "dollar_amount", "slice"]
+    readonly_fields = ["date", "kind", "state",
+                       "object", "coreHours", "dollar_amount", "slice"]
     can_delete = False
     max_num = 0
 
     dollar_amount = right_dollar_field("amount", "Amount")
 
+
 class InvoiceAdmin(admin.ModelAdmin):
     list_display = ("date", "account")
 
@@ -2003,6 +2229,7 @@
 
     dollar_amount = dollar_field("amount", "Amount")
 
+
 class InvoiceInline(XOSTabularInline):
     model = Invoice
     extra = 0
@@ -2011,22 +2238,25 @@
     fields = ["date", "dollar_amount"]
     readonly_fields = ["date", "dollar_amount"]
     suit_classes = 'suit-tab suit-tab-accountinvoice'
-    can_delete=False
-    max_num=0
+    can_delete = False
+    max_num = 0
 
     dollar_amount = right_dollar_field("amount", "Amount")
 
+
 class PendingChargeInline(XOSTabularInline):
     model = Charge
     extra = 0
     verbose_name_plural = "Charges"
     verbose_name = "Charge"
     exclude = ["invoice"]
-    fields = ["date", "kind", "state", "object", "coreHours", "dollar_amount", "slice"]
-    readonly_fields = ["date", "kind", "state", "object", "coreHours", "dollar_amount", "slice"]
+    fields = ["date", "kind", "state", "object",
+              "coreHours", "dollar_amount", "slice"]
+    readonly_fields = ["date", "kind", "state",
+                       "object", "coreHours", "dollar_amount", "slice"]
     suit_classes = 'suit-tab suit-tab-accountpendingcharges'
-    can_delete=False
-    max_num=0
+    can_delete = False
+    max_num = 0
 
     def queryset(self, request):
         qs = super(PendingChargeInline, self).queryset(request)
@@ -2035,41 +2265,46 @@
 
     dollar_amount = right_dollar_field("amount", "Amount")
 
+
 class PaymentInline(XOSTabularInline):
-    model=Payment
+    model = Payment
     extra = 1
     verbose_name_plural = "Payments"
     verbose_name = "Payment"
     fields = ["date", "dollar_amount"]
     readonly_fields = ["date", "dollar_amount"]
     suit_classes = 'suit-tab suit-tab-accountpayments'
-    can_delete=False
-    max_num=0
+    can_delete = False
+    max_num = 0
 
     dollar_amount = right_dollar_field("amount", "Amount")
 
+
 class AccountAdmin(admin.ModelAdmin):
     list_display = ("site", "balance_due")
 
     inlines = [InvoiceInline, PaymentInline, PendingChargeInline]
 
     fieldsets = [
-        (None, {'fields': ['site', 'dollar_balance_due', 'dollar_total_invoices', 'dollar_total_payments'],'classes':['suit-tab suit-tab-general']}),]
+        (None, {'fields': ['site', 'dollar_balance_due', 'dollar_total_invoices', 'dollar_total_payments'], 'classes':['suit-tab suit-tab-general']}), ]
 
-    readonly_fields = ['site', 'dollar_balance_due', 'dollar_total_invoices', 'dollar_total_payments']
+    readonly_fields = ['site', 'dollar_balance_due',
+                       'dollar_total_invoices', 'dollar_total_payments']
 
-    suit_form_tabs =(
-        ('general','Account Details'),
+    suit_form_tabs = (
+        ('general', 'Account Details'),
         ('accountinvoice', 'Invoices'),
         ('accountpayments', 'Payments'),
-        ('accountpendingcharges','Pending Charges'),
+        ('accountpendingcharges', 'Pending Charges'),
     )
 
     dollar_balance_due = dollar_field("balance_due", "Balance Due")
     dollar_total_invoices = dollar_field("total_invoices", "Total Invoices")
     dollar_total_payments = dollar_field("total_payments", "Total Payments")
 
+
 class ProgramForm(forms.ModelForm):
+
     class Meta:
         model = Program
         widgets = {
@@ -2079,11 +2314,12 @@
             'output': forms.Textarea(attrs={'rows': 3, 'cols': 80, 'class': 'input-xxlarge'})
         }
 
+
 class ProgramAdmin(XOSBaseAdmin):
     list_display = ("name", "status")
     list_display_links = ('name', "status")
 
-    form=ProgramForm
+    form = ProgramForm
 
     fieldsets = [
         (None, {'fields': ['name', 'command', 'kind', 'description', 'output', 'status'],
@@ -2092,20 +2328,56 @@
                 'classes':['suit-tab suit-tab-contents']}),
         (None, {'fields': ['messages'],
                 'classes':['suit-tab suit-tab-messages']}),
-                ]
+    ]
 
     readonly_fields = ("status",)
 
     @property
     def suit_form_tabs(self):
-        tabs=[('general','Program Details'),
-              ('contents','Program Source'),
-              ('messages','Messages'),
-        ]
+        tabs = [('general', 'Program Details'),
+                ('contents', 'Program Source'),
+                ('messages', 'Messages'),
+                ]
 
-        request=getattr(_thread_locals, "request", None)
+        request = getattr(_thread_locals, "request", None)
         if request and request.user.is_admin:
-            tabs.append( ('admin-only', 'Admin-Only') )
+            tabs.append(('admin-only', 'Admin-Only'))
+
+        return tabs
+
+
+class AddressPoolForm(forms.ModelForm):
+
+    class Meta:
+        model = Program
+        widgets = {
+            'addresses': UploadTextareaWidget(attrs={'rows': 20, 'cols': 80, 'class': "input-xxlarge"}),
+        }
+
+
+class AddressPoolAdmin(XOSBaseAdmin):
+    list_display = ("name", "cidr")
+    list_display_links = ('name',)
+
+    form = AddressPoolForm
+
+    fieldsets = [
+        (None, {'fields': ['name', 'cidr', 'gateway_ip', 'gateway_mac', 'addresses', 'inuse', 'service'],
+                'classes':['suit-tab suit-tab-general']}),
+    ]
+
+    readonly_fields = ("status",)
+
+    @property
+    def suit_form_tabs(self):
+        tabs = [('general', 'Program Details'),
+                ('contents', 'Program Source'),
+                ('messages', 'Messages'),
+                ]
+
+#        request=getattr(_thread_locals, "request", None)
+#        if request and request.user.is_admin:
+#            tabs.append( ('admin-only', 'Admin-Only') )
 
         return tabs
 
@@ -2113,9 +2385,9 @@
 admin.site.register(User, UserAdmin)
 # ... and, since we're not using Django's builtin permissions,
 # unregister the Group model from admin.
-#admin.site.unregister(Group)
+# admin.site.unregister(Group)
 
-# When debugging it is often easier to see all the classes, but for regular use 
+# When debugging it is often easier to see all the classes, but for regular use
 # only the top-levels should be displayed
 showAll = False
 
@@ -2150,6 +2422,6 @@
     admin.site.register(Flavor, FlavorAdmin)
     admin.site.register(TenantRoot, TenantRootAdmin)
     admin.site.register(TenantRootRole, TenantRootRoleAdmin)
+    admin.site.register(TenantRole, TenantRoleAdmin)
     admin.site.register(TenantAttribute, TenantAttributeAdmin)
-#    admin.site.register(Container, ContainerAdmin)
-
+    admin.site.register(AddressPool, AddressPoolAdmin)
diff --git a/xos/core/fixtures/core_initial_data.json b/xos/core/fixtures/core_initial_data.json
index 86658bb..01ff999 100644
--- a/xos/core/fixtures/core_initial_data.json
+++ b/xos/core/fixtures/core_initial_data.json
@@ -1,214 +1,6 @@
 [
 {
     "fields": {
-        "updated": "2015-02-17T22:06:37.837Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:37.837Z",
-        "deleted": false,
-        "site_url": null,
-        "enabled": true,
-        "longitude": null,
-        "name": "MySite",
-        "backend_register": "{}",
-        "login_base": "mysite",
-        "location": "0,0",
-        "latitude": null,
-        "is_public": true,
-        "backend_status": "0 - Provisioning in progress",
-        "abbreviated_name": "mysite",
-        "enacted": null
-    },
-    "model": "core.site",
-    "pk": 1
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:38.620Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:38.620Z",
-        "deleted": false,
-        "backend_register": "{}",
-        "role": "admin",
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.siterole",
-    "pk": 1
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:38.670Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:38.669Z",
-        "deleted": false,
-        "backend_register": "{}",
-        "role": "pi",
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.siterole",
-    "pk": 2
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:38.731Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:38.730Z",
-        "deleted": false,
-        "backend_register": "{}",
-        "role": "tech",
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.siterole",
-    "pk": 3
-},
-{
-    "fields": {
-        "accessControl": "allow all",
-        "updated": "2015-02-17T22:06:37.789Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:37.789Z",
-        "deleted": false,
-        "name": "MyDeployment",
-        "backend_register": "{}",
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.deployment",
-    "pk": 1
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:38.894Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:38.894Z",
-        "deleted": false,
-        "backend_register": "{}",
-        "role": "admin",
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.deploymentrole",
-    "pk": 1
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:37.893Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:37.893Z",
-        "deleted": false,
-        "availability_zone": null,
-        "site": 1,
-        "backend_register": "{}",
-        "controller": null,
-        "deployment": 1,
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.sitedeployment",
-    "pk": 1
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:38.953Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:38.953Z",
-        "deleted": false,
-        "deployments": [],
-        "enabled": true,
-        "name": "xsh",
-        "backend_register": "{}",
-        "url": "template:xsh",
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.dashboardview",
-    "pk": 1
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:39.011Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:39.011Z",
-        "deleted": false,
-        "deployments": [],
-        "enabled": true,
-        "name": "Customize",
-        "backend_register": "{}",
-        "url": "template:customize",
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.dashboardview",
-    "pk": 2
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:39.244Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:39.069Z",
-        "deleted": false,
-        "deployments": [
-            1
-        ],
-        "enabled": true,
-        "name": "Tenant",
-        "backend_register": "{}",
-        "url": "template:xosTenant",
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.dashboardview",
-    "pk": 3
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:39.302Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:39.302Z",
-        "deleted": false,
-        "deployments": [],
-        "enabled": true,
-        "name": "Developer",
-        "backend_register": "{}",
-        "url": "template:xosDeveloper_datatables",
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.dashboardview",
-    "pk": 4
-},
-{
-    "fields": {
-        "policed": null,
-        "site": 1,
-        "is_staff": true,
-        "timezone": "America/New_York",
-        "backend_status": "Provisioning in progress",
-        "is_registering": false,
-        "last_login": "2015-02-17T22:35:17.822Z",
-        "email": "padmin@vicci.org",
-        "username": "padmin@vicci.org",
-        "updated": "2015-02-17T22:06:38.059Z",
-        "firstname": "XOS",
-        "user_url": null,
-        "deleted": false,
-        "lastname": "admin",
-        "is_active": true,
-        "phone": null,
-        "is_admin": true,
-        "password": "pbkdf2_sha256$12000$Qufx9iqtaYma$xs0YurPOcj9qYQna/Qrb3K+im9Yr2XEVr0J4Kqek7AE=",
-        "enacted": null,
-        "public_key": null,
-        "is_readonly": false,
-        "created": "2015-02-17T22:06:38.059Z"
-    },
-    "model": "core.user",
-    "pk": 1
-},
-{
-    "fields": {
         "updated": "2015-02-17T22:06:39.361Z",
         "membershipFee": 0,
         "policed": null,
@@ -226,162 +18,5 @@
     },
     "model": "core.serviceclass",
     "pk": 1
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:38.236Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:38.095Z",
-        "deleted": false,
-        "deployments": [
-            1
-        ],
-        "description": null,
-        "name": "m1.small",
-        "backend_register": "{}",
-        "default": false,
-        "flavor": "m1.small",
-        "backend_status": "0 - Provisioning in progress",
-        "order": 0,
-        "enacted": null
-    },
-    "model": "core.flavor",
-    "pk": 1
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:38.394Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:38.287Z",
-        "deleted": false,
-        "deployments": [
-            1
-        ],
-        "description": null,
-        "name": "m1.medium",
-        "backend_register": "{}",
-        "default": false,
-        "flavor": "m1.medium",
-        "backend_status": "0 - Provisioning in progress",
-        "order": 0,
-        "enacted": null
-    },
-    "model": "core.flavor",
-    "pk": 2
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:38.561Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:38.445Z",
-        "deleted": false,
-        "deployments": [
-            1
-        ],
-        "description": null,
-        "name": "m1.large",
-        "backend_register": "{}",
-        "default": false,
-        "flavor": "m1.large",
-        "backend_status": "0 - Provisioning in progress",
-        "order": 0,
-        "enacted": null
-    },
-    "model": "core.flavor",
-    "pk": 3
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:38.778Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:38.778Z",
-        "deleted": false,
-        "backend_register": "{}",
-        "role": "admin",
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.slicerole",
-    "pk": 1
-},
-{
-    "fields": {
-        "updated": "2015-02-17T22:06:38.836Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:38.836Z",
-        "deleted": false,
-        "backend_register": "{}",
-        "role": "access",
-        "backend_status": "0 - Provisioning in progress",
-        "enacted": null
-    },
-    "model": "core.slicerole",
-    "pk": 2
-},
-{
-    "fields": {
-        "shared_network_id": null,
-        "updated": "2015-02-17T22:06:39.419Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:39.419Z",
-        "deleted": false,
-        "description": "A private virtual network",
-        "visibility": "private",
-        "name": "Private",
-        "backend_register": "{}",
-        "topology_kind": "bigswitch",
-        "guaranteed_bandwidth": 0,
-        "translation": "none",
-        "backend_status": "0 - Provisioning in progress",
-        "shared_network_name": null,
-        "controller_kind": null,
-        "enacted": null
-    },
-    "model": "core.networktemplate",
-    "pk": 1
-},
-{
-    "fields": {
-        "shared_network_id": null,
-        "updated": "2015-02-17T22:06:39.477Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:39.477Z",
-        "deleted": false,
-        "description": "Connect a instance to the public network",
-        "visibility": "private",
-        "name": "Public shared IPv4",
-        "backend_register": "{}",
-        "topology_kind": "bigswitch",
-        "guaranteed_bandwidth": 0,
-        "translation": "NAT",
-        "backend_status": "0 - Provisioning in progress",
-        "shared_network_name": "nat-net",
-        "controller_kind": null,
-        "enacted": null
-    },
-    "model": "core.networktemplate",
-    "pk": 2
-},
-{
-    "fields": {
-        "shared_network_id": null,
-        "updated": "2015-02-17T22:06:39.536Z",
-        "policed": null,
-        "created": "2015-02-17T22:06:39.536Z",
-        "deleted": false,
-        "description": "Connect a instance to the public network",
-        "visibility": "public",
-        "name": "Public dedicated IPv4",
-        "backend_register": "{}",
-        "topology_kind": "bigswitch",
-        "guaranteed_bandwidth": 0,
-        "translation": "none",
-        "backend_status": "0 - Provisioning in progress",
-        "shared_network_name": "ext-net",
-        "controller_kind": null,
-        "enacted": null
-    },
-    "model": "core.networktemplate",
-    "pk": 3
 }
 ]
diff --git a/xos/core/migrations/0001_initial.py b/xos/core/migrations/0001_initial.py
index db7dad0..c55a8bf 100644
--- a/xos/core/migrations/0001_initial.py
+++ b/xos/core/migrations/0001_initial.py
@@ -1,15 +1,15 @@
 # -*- coding: utf-8 -*-
 from __future__ import unicode_literals
 
-from django.db import models, migrations
-import timezones.fields
 import core.models.instance
 import core.models.network
-import geoposition.fields
-import encrypted_fields.fields
 import core.models.serviceclass
 import django.utils.timezone
+import encrypted_fields.fields
+import geoposition.fields
+import timezones.fields
 from django.conf import settings
+from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
@@ -22,16 +22,24 @@
         migrations.CreateModel(
             name='User',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('password', models.CharField(max_length=128, verbose_name='password')),
-                ('last_login', models.DateTimeField(default=django.utils.timezone.now, verbose_name='last login')),
-                ('email', models.EmailField(unique=True, max_length=255, verbose_name=b'email address', db_index=True)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('password', models.CharField(
+                    max_length=128, verbose_name='password')),
+                ('last_login', models.DateTimeField(
+                    default=django.utils.timezone.now, verbose_name='last login')),
+                ('email', models.EmailField(unique=True, max_length=255,
+                                            verbose_name=b'email address', db_index=True)),
                 ('username', models.CharField(default=b'Something', max_length=255)),
-                ('firstname', models.CharField(help_text=b"person's given name", max_length=200)),
-                ('lastname', models.CharField(help_text=b"person's surname", max_length=200)),
-                ('phone', models.CharField(help_text=b'phone number contact', max_length=100, null=True, blank=True)),
+                ('firstname', models.CharField(
+                    help_text=b"person's given name", max_length=200)),
+                ('lastname', models.CharField(
+                    help_text=b"person's surname", max_length=200)),
+                ('phone', models.CharField(help_text=b'phone number contact',
+                                           max_length=100, null=True, blank=True)),
                 ('user_url', models.URLField(null=True, blank=True)),
-                ('public_key', models.TextField(help_text=b'Public key string', max_length=1024, null=True, blank=True)),
+                ('public_key', models.TextField(
+                    help_text=b'Public key string', max_length=1024, null=True, blank=True)),
                 ('is_active', models.BooleanField(default=True)),
                 ('is_admin', models.BooleanField(default=True)),
                 ('is_staff', models.BooleanField(default=True)),
@@ -40,9 +48,11 @@
                 ('updated', models.DateTimeField(auto_now=True)),
                 ('enacted', models.DateTimeField(default=None, null=True)),
                 ('policed', models.DateTimeField(default=None, null=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('timezone', timezones.fields.TimeZoneField(default=b'America/New_York', max_length=100, choices=[(b'Pacific/Midway', b'(GMT-1100) Pacific/Midway'), (b'Pacific/Niue', b'(GMT-1100) Pacific/Niue'), (b'Pacific/Pago_Pago', b'(GMT-1100) Pacific/Pago_Pago'), (b'America/Adak', b'(GMT-1000) America/Adak'), (b'Pacific/Honolulu', b'(GMT-1000) Pacific/Honolulu'), (b'Pacific/Johnston', b'(GMT-1000) Pacific/Johnston'), (b'Pacific/Rarotonga', b'(GMT-1000) Pacific/Rarotonga'), (b'Pacific/Tahiti', b'(GMT-1000) Pacific/Tahiti'), (b'US/Hawaii', b'(GMT-1000) US/Hawaii'), (b'Pacific/Marquesas', b'(GMT-0930) Pacific/Marquesas'), (b'America/Anchorage', b'(GMT-0900) America/Anchorage'), (b'America/Juneau', b'(GMT-0900) America/Juneau'), (b'America/Nome', b'(GMT-0900) America/Nome'), (b'America/Sitka', b'(GMT-0900) America/Sitka'), (b'America/Yakutat', b'(GMT-0900) America/Yakutat'), (b'Pacific/Gambier', b'(GMT-0900) Pacific/Gambier'), (b'US/Alaska', b'(GMT-0900) US/Alaska'), (b'America/Dawson', b'(GMT-0800) America/Dawson'), (b'America/Los_Angeles', b'(GMT-0800) America/Los_Angeles'), (b'America/Metlakatla', b'(GMT-0800) America/Metlakatla'), (b'America/Santa_Isabel', b'(GMT-0800) America/Santa_Isabel'), (b'America/Tijuana', b'(GMT-0800) America/Tijuana'), (b'America/Vancouver', b'(GMT-0800) America/Vancouver'), (b'America/Whitehorse', b'(GMT-0800) America/Whitehorse'), (b'Canada/Pacific', b'(GMT-0800) Canada/Pacific'), (b'Pacific/Pitcairn', b'(GMT-0800) Pacific/Pitcairn'), (b'US/Pacific', b'(GMT-0800) US/Pacific'), (b'America/Boise', b'(GMT-0700) America/Boise'), (b'America/Cambridge_Bay', b'(GMT-0700) America/Cambridge_Bay'), (b'America/Chihuahua', b'(GMT-0700) America/Chihuahua'), (b'America/Creston', b'(GMT-0700) America/Creston'), (b'America/Dawson_Creek', b'(GMT-0700) America/Dawson_Creek'), (b'America/Denver', b'(GMT-0700) America/Denver'), (b'America/Edmonton', b'(GMT-0700) America/Edmonton'), (b'America/Hermosillo', b'(GMT-0700) America/Hermosillo'), (b'America/Inuvik', b'(GMT-0700) America/Inuvik'), (b'America/Mazatlan', b'(GMT-0700) America/Mazatlan'), (b'America/Ojinaga', b'(GMT-0700) America/Ojinaga'), (b'America/Phoenix', b'(GMT-0700) America/Phoenix'), (b'America/Shiprock', b'(GMT-0700) America/Shiprock'), (b'America/Yellowknife', b'(GMT-0700) America/Yellowknife'), (b'Canada/Mountain', b'(GMT-0700) Canada/Mountain'), (b'US/Arizona', b'(GMT-0700) US/Arizona'), (b'US/Mountain', b'(GMT-0700) US/Mountain'), (b'America/Bahia_Banderas', b'(GMT-0600) America/Bahia_Banderas'), (b'America/Belize', b'(GMT-0600) America/Belize'), (b'America/Cancun', b'(GMT-0600) America/Cancun'), (b'America/Chicago', b'(GMT-0600) America/Chicago'), (b'America/Costa_Rica', b'(GMT-0600) America/Costa_Rica'), (b'America/El_Salvador', b'(GMT-0600) America/El_Salvador'), (b'America/Guatemala', b'(GMT-0600) America/Guatemala'), (b'America/Indiana/Knox', b'(GMT-0600) America/Indiana/Knox'), (b'America/Indiana/Tell_City', b'(GMT-0600) America/Indiana/Tell_City'), (b'America/Managua', b'(GMT-0600) America/Managua'), (b'America/Matamoros', b'(GMT-0600) America/Matamoros'), (b'America/Menominee', b'(GMT-0600) America/Menominee'), (b'America/Merida', b'(GMT-0600) America/Merida'), (b'America/Mexico_City', b'(GMT-0600) America/Mexico_City'), (b'America/Monterrey', b'(GMT-0600) America/Monterrey'), (b'America/North_Dakota/Beulah', b'(GMT-0600) America/North_Dakota/Beulah'), (b'America/North_Dakota/Center', b'(GMT-0600) America/North_Dakota/Center'), (b'America/North_Dakota/New_Salem', b'(GMT-0600) America/North_Dakota/New_Salem'), (b'America/Rainy_River', b'(GMT-0600) America/Rainy_River'), (b'America/Rankin_Inlet', b'(GMT-0600) America/Rankin_Inlet'), (b'America/Regina', b'(GMT-0600) America/Regina'), (b'America/Resolute', b'(GMT-0600) America/Resolute'), (b'America/Swift_Current', b'(GMT-0600) America/Swift_Current'), (b'America/Tegucigalpa', b'(GMT-0600) America/Tegucigalpa'), (b'America/Winnipeg', b'(GMT-0600) America/Winnipeg'), (b'Canada/Central', b'(GMT-0600) Canada/Central'), (b'Pacific/Galapagos', b'(GMT-0600) Pacific/Galapagos'), (b'US/Central', b'(GMT-0600) US/Central'), (b'America/Atikokan', b'(GMT-0500) America/Atikokan'), (b'America/Bogota', b'(GMT-0500) America/Bogota'), (b'America/Cayman', b'(GMT-0500) America/Cayman'), (b'America/Detroit', b'(GMT-0500) America/Detroit'), (b'America/Eirunepe', b'(GMT-0500) America/Eirunepe'), (b'America/Grand_Turk', b'(GMT-0500) America/Grand_Turk'), (b'America/Guayaquil', b'(GMT-0500) America/Guayaquil'), (b'America/Havana', b'(GMT-0500) America/Havana'), (b'America/Indiana/Indianapolis', b'(GMT-0500) America/Indiana/Indianapolis'), (b'America/Indiana/Marengo', b'(GMT-0500) America/Indiana/Marengo'), (b'America/Indiana/Petersburg', b'(GMT-0500) America/Indiana/Petersburg'), (b'America/Indiana/Vevay', b'(GMT-0500) America/Indiana/Vevay'), (b'America/Indiana/Vincennes', b'(GMT-0500) America/Indiana/Vincennes'), (b'America/Indiana/Winamac', b'(GMT-0500) America/Indiana/Winamac'), (b'America/Iqaluit', b'(GMT-0500) America/Iqaluit'), (b'America/Jamaica', b'(GMT-0500) America/Jamaica'), (b'America/Kentucky/Louisville', b'(GMT-0500) America/Kentucky/Louisville'), (b'America/Kentucky/Monticello', b'(GMT-0500) America/Kentucky/Monticello'), (b'America/Lima', b'(GMT-0500) America/Lima'), (b'America/Montreal', b'(GMT-0500) America/Montreal'), (b'America/Nassau', b'(GMT-0500) America/Nassau'), (b'America/New_York', b'(GMT-0500) America/New_York'), (b'America/Nipigon', b'(GMT-0500) America/Nipigon'), (b'America/Panama', b'(GMT-0500) America/Panama'), (b'America/Pangnirtung', b'(GMT-0500) America/Pangnirtung'), (b'America/Port-au-Prince', b'(GMT-0500) America/Port-au-Prince'), (b'America/Rio_Branco', b'(GMT-0500) America/Rio_Branco'), (b'America/Thunder_Bay', b'(GMT-0500) America/Thunder_Bay'), (b'America/Toronto', b'(GMT-0500) America/Toronto'), (b'Canada/Eastern', b'(GMT-0500) Canada/Eastern'), (b'Pacific/Easter', b'(GMT-0500) Pacific/Easter'), (b'US/Eastern', b'(GMT-0500) US/Eastern'), (b'America/Caracas', b'(GMT-0430) America/Caracas'), (b'America/Anguilla', b'(GMT-0400) America/Anguilla'), (b'America/Antigua', b'(GMT-0400) America/Antigua'), (b'America/Aruba', b'(GMT-0400) America/Aruba'), (b'America/Barbados', b'(GMT-0400) America/Barbados'), (b'America/Blanc-Sablon', b'(GMT-0400) America/Blanc-Sablon'), (b'America/Boa_Vista', b'(GMT-0400) America/Boa_Vista'), (b'America/Curacao', b'(GMT-0400) America/Curacao'), (b'America/Dominica', b'(GMT-0400) America/Dominica'), (b'America/Glace_Bay', b'(GMT-0400) America/Glace_Bay'), (b'America/Goose_Bay', b'(GMT-0400) America/Goose_Bay'), (b'America/Grenada', b'(GMT-0400) America/Grenada'), (b'America/Guadeloupe', b'(GMT-0400) America/Guadeloupe'), (b'America/Guyana', b'(GMT-0400) America/Guyana'), (b'America/Halifax', b'(GMT-0400) America/Halifax'), (b'America/Kralendijk', b'(GMT-0400) America/Kralendijk'), (b'America/La_Paz', b'(GMT-0400) America/La_Paz'), (b'America/Lower_Princes', b'(GMT-0400) America/Lower_Princes'), (b'America/Manaus', b'(GMT-0400) America/Manaus'), (b'America/Marigot', b'(GMT-0400) America/Marigot'), (b'America/Martinique', b'(GMT-0400) America/Martinique'), (b'America/Moncton', b'(GMT-0400) America/Moncton'), (b'America/Montserrat', b'(GMT-0400) America/Montserrat'), (b'America/Port_of_Spain', b'(GMT-0400) America/Port_of_Spain'), (b'America/Porto_Velho', b'(GMT-0400) America/Porto_Velho'), (b'America/Puerto_Rico', b'(GMT-0400) America/Puerto_Rico'), (b'America/Santo_Domingo', b'(GMT-0400) America/Santo_Domingo'), (b'America/St_Barthelemy', b'(GMT-0400) America/St_Barthelemy'), (b'America/St_Kitts', b'(GMT-0400) America/St_Kitts'), (b'America/St_Lucia', b'(GMT-0400) America/St_Lucia'), (b'America/St_Thomas', b'(GMT-0400) America/St_Thomas'), (b'America/St_Vincent', b'(GMT-0400) America/St_Vincent'), (b'America/Thule', b'(GMT-0400) America/Thule'), (b'America/Tortola', b'(GMT-0400) America/Tortola'), (b'Atlantic/Bermuda', b'(GMT-0400) Atlantic/Bermuda'), (b'Canada/Atlantic', b'(GMT-0400) Canada/Atlantic'), (b'America/St_Johns', b'(GMT-0330) America/St_Johns'), (b'Canada/Newfoundland', b'(GMT-0330) Canada/Newfoundland'), (b'America/Araguaina', b'(GMT-0300) America/Araguaina'), (b'America/Argentina/Buenos_Aires', b'(GMT-0300) America/Argentina/Buenos_Aires'), (b'America/Argentina/Catamarca', b'(GMT-0300) America/Argentina/Catamarca'), (b'America/Argentina/Cordoba', b'(GMT-0300) America/Argentina/Cordoba'), (b'America/Argentina/Jujuy', b'(GMT-0300) America/Argentina/Jujuy'), (b'America/Argentina/La_Rioja', b'(GMT-0300) America/Argentina/La_Rioja'), (b'America/Argentina/Mendoza', b'(GMT-0300) America/Argentina/Mendoza'), (b'America/Argentina/Rio_Gallegos', b'(GMT-0300) America/Argentina/Rio_Gallegos'), (b'America/Argentina/Salta', b'(GMT-0300) America/Argentina/Salta'), (b'America/Argentina/San_Juan', b'(GMT-0300) America/Argentina/San_Juan'), (b'America/Argentina/San_Luis', b'(GMT-0300) America/Argentina/San_Luis'), (b'America/Argentina/Tucuman', b'(GMT-0300) America/Argentina/Tucuman'), (b'America/Argentina/Ushuaia', b'(GMT-0300) America/Argentina/Ushuaia'), (b'America/Asuncion', b'(GMT-0300) America/Asuncion'), (b'America/Bahia', b'(GMT-0300) America/Bahia'), (b'America/Belem', b'(GMT-0300) America/Belem'), (b'America/Campo_Grande', b'(GMT-0300) America/Campo_Grande'), (b'America/Cayenne', b'(GMT-0300) America/Cayenne'), (b'America/Cuiaba', b'(GMT-0300) America/Cuiaba'), (b'America/Fortaleza', b'(GMT-0300) America/Fortaleza'), (b'America/Godthab', b'(GMT-0300) America/Godthab'), (b'America/Maceio', b'(GMT-0300) America/Maceio'), (b'America/Miquelon', b'(GMT-0300) America/Miquelon'), (b'America/Paramaribo', b'(GMT-0300) America/Paramaribo'), (b'America/Recife', b'(GMT-0300) America/Recife'), (b'America/Santarem', b'(GMT-0300) America/Santarem'), (b'America/Santiago', b'(GMT-0300) America/Santiago'), (b'Antarctica/Palmer', b'(GMT-0300) Antarctica/Palmer'), (b'Antarctica/Rothera', b'(GMT-0300) Antarctica/Rothera'), (b'Atlantic/Stanley', b'(GMT-0300) Atlantic/Stanley'), (b'America/Montevideo', b'(GMT-0200) America/Montevideo'), (b'America/Noronha', b'(GMT-0200) America/Noronha'), (b'America/Sao_Paulo', b'(GMT-0200) America/Sao_Paulo'), (b'Atlantic/South_Georgia', b'(GMT-0200) Atlantic/South_Georgia'), (b'America/Scoresbysund', b'(GMT-0100) America/Scoresbysund'), (b'Atlantic/Azores', b'(GMT-0100) Atlantic/Azores'), (b'Atlantic/Cape_Verde', b'(GMT-0100) Atlantic/Cape_Verde'), (b'Africa/Abidjan', b'(GMT+0000) Africa/Abidjan'), (b'Africa/Accra', b'(GMT+0000) Africa/Accra'), (b'Africa/Bamako', b'(GMT+0000) Africa/Bamako'), (b'Africa/Banjul', b'(GMT+0000) Africa/Banjul'), (b'Africa/Bissau', b'(GMT+0000) Africa/Bissau'), (b'Africa/Casablanca', b'(GMT+0000) Africa/Casablanca'), (b'Africa/Conakry', b'(GMT+0000) Africa/Conakry'), (b'Africa/Dakar', b'(GMT+0000) Africa/Dakar'), (b'Africa/El_Aaiun', b'(GMT+0000) Africa/El_Aaiun'), (b'Africa/Freetown', b'(GMT+0000) Africa/Freetown'), (b'Africa/Lome', b'(GMT+0000) Africa/Lome'), (b'Africa/Monrovia', b'(GMT+0000) Africa/Monrovia'), (b'Africa/Nouakchott', b'(GMT+0000) Africa/Nouakchott'), (b'Africa/Ouagadougou', b'(GMT+0000) Africa/Ouagadougou'), (b'Africa/Sao_Tome', b'(GMT+0000) Africa/Sao_Tome'), (b'America/Danmarkshavn', b'(GMT+0000) America/Danmarkshavn'), (b'Atlantic/Canary', b'(GMT+0000) Atlantic/Canary'), (b'Atlantic/Faroe', b'(GMT+0000) Atlantic/Faroe'), (b'Atlantic/Madeira', b'(GMT+0000) Atlantic/Madeira'), (b'Atlantic/Reykjavik', b'(GMT+0000) Atlantic/Reykjavik'), (b'Atlantic/St_Helena', b'(GMT+0000) Atlantic/St_Helena'), (b'Europe/Dublin', b'(GMT+0000) Europe/Dublin'), (b'Europe/Guernsey', b'(GMT+0000) Europe/Guernsey'), (b'Europe/Isle_of_Man', b'(GMT+0000) Europe/Isle_of_Man'), (b'Europe/Jersey', b'(GMT+0000) Europe/Jersey'), (b'Europe/Lisbon', b'(GMT+0000) Europe/Lisbon'), (b'Europe/London', b'(GMT+0000) Europe/London'), (b'GMT', b'(GMT+0000) GMT'), (b'UTC', b'(GMT+0000) UTC'), (b'Africa/Algiers', b'(GMT+0100) Africa/Algiers'), (b'Africa/Bangui', b'(GMT+0100) Africa/Bangui'), (b'Africa/Brazzaville', b'(GMT+0100) Africa/Brazzaville'), (b'Africa/Ceuta', b'(GMT+0100) Africa/Ceuta'), (b'Africa/Douala', b'(GMT+0100) Africa/Douala'), (b'Africa/Kinshasa', b'(GMT+0100) Africa/Kinshasa'), (b'Africa/Lagos', b'(GMT+0100) Africa/Lagos'), (b'Africa/Libreville', b'(GMT+0100) Africa/Libreville'), (b'Africa/Luanda', b'(GMT+0100) Africa/Luanda'), (b'Africa/Malabo', b'(GMT+0100) Africa/Malabo'), (b'Africa/Ndjamena', b'(GMT+0100) Africa/Ndjamena'), (b'Africa/Niamey', b'(GMT+0100) Africa/Niamey'), (b'Africa/Porto-Novo', b'(GMT+0100) Africa/Porto-Novo'), (b'Africa/Tunis', b'(GMT+0100) Africa/Tunis'), (b'Arctic/Longyearbyen', b'(GMT+0100) Arctic/Longyearbyen'), (b'Europe/Amsterdam', b'(GMT+0100) Europe/Amsterdam'), (b'Europe/Andorra', b'(GMT+0100) Europe/Andorra'), (b'Europe/Belgrade', b'(GMT+0100) Europe/Belgrade'), (b'Europe/Berlin', b'(GMT+0100) Europe/Berlin'), (b'Europe/Bratislava', b'(GMT+0100) Europe/Bratislava'), (b'Europe/Brussels', b'(GMT+0100) Europe/Brussels'), (b'Europe/Budapest', b'(GMT+0100) Europe/Budapest'), (b'Europe/Copenhagen', b'(GMT+0100) Europe/Copenhagen'), (b'Europe/Gibraltar', b'(GMT+0100) Europe/Gibraltar'), (b'Europe/Ljubljana', b'(GMT+0100) Europe/Ljubljana'), (b'Europe/Luxembourg', b'(GMT+0100) Europe/Luxembourg'), (b'Europe/Madrid', b'(GMT+0100) Europe/Madrid'), (b'Europe/Malta', b'(GMT+0100) Europe/Malta'), (b'Europe/Monaco', b'(GMT+0100) Europe/Monaco'), (b'Europe/Oslo', b'(GMT+0100) Europe/Oslo'), (b'Europe/Paris', b'(GMT+0100) Europe/Paris'), (b'Europe/Podgorica', b'(GMT+0100) Europe/Podgorica'), (b'Europe/Prague', b'(GMT+0100) Europe/Prague'), (b'Europe/Rome', b'(GMT+0100) Europe/Rome'), (b'Europe/San_Marino', b'(GMT+0100) Europe/San_Marino'), (b'Europe/Sarajevo', b'(GMT+0100) Europe/Sarajevo'), (b'Europe/Skopje', b'(GMT+0100) Europe/Skopje'), (b'Europe/Stockholm', b'(GMT+0100) Europe/Stockholm'), (b'Europe/Tirane', b'(GMT+0100) Europe/Tirane'), (b'Europe/Vaduz', b'(GMT+0100) Europe/Vaduz'), (b'Europe/Vatican', b'(GMT+0100) Europe/Vatican'), (b'Europe/Vienna', b'(GMT+0100) Europe/Vienna'), (b'Europe/Warsaw', b'(GMT+0100) Europe/Warsaw'), (b'Europe/Zagreb', b'(GMT+0100) Europe/Zagreb'), (b'Europe/Zurich', b'(GMT+0100) Europe/Zurich'), (b'Africa/Blantyre', b'(GMT+0200) Africa/Blantyre'), (b'Africa/Bujumbura', b'(GMT+0200) Africa/Bujumbura'), (b'Africa/Cairo', b'(GMT+0200) Africa/Cairo'), (b'Africa/Gaborone', b'(GMT+0200) Africa/Gaborone'), (b'Africa/Harare', b'(GMT+0200) Africa/Harare'), (b'Africa/Johannesburg', b'(GMT+0200) Africa/Johannesburg'), (b'Africa/Kigali', b'(GMT+0200) Africa/Kigali'), (b'Africa/Lubumbashi', b'(GMT+0200) Africa/Lubumbashi'), (b'Africa/Lusaka', b'(GMT+0200) Africa/Lusaka'), (b'Africa/Maputo', b'(GMT+0200) Africa/Maputo'), (b'Africa/Maseru', b'(GMT+0200) Africa/Maseru'), (b'Africa/Mbabane', b'(GMT+0200) Africa/Mbabane'), (b'Africa/Tripoli', b'(GMT+0200) Africa/Tripoli'), (b'Africa/Windhoek', b'(GMT+0200) Africa/Windhoek'), (b'Asia/Amman', b'(GMT+0200) Asia/Amman'), (b'Asia/Beirut', b'(GMT+0200) Asia/Beirut'), (b'Asia/Damascus', b'(GMT+0200) Asia/Damascus'), (b'Asia/Gaza', b'(GMT+0200) Asia/Gaza'), (b'Asia/Hebron', b'(GMT+0200) Asia/Hebron'), (b'Asia/Jerusalem', b'(GMT+0200) Asia/Jerusalem'), (b'Asia/Nicosia', b'(GMT+0200) Asia/Nicosia'), (b'Europe/Athens', b'(GMT+0200) Europe/Athens'), (b'Europe/Bucharest', b'(GMT+0200) Europe/Bucharest'), (b'Europe/Chisinau', b'(GMT+0200) Europe/Chisinau'), (b'Europe/Helsinki', b'(GMT+0200) Europe/Helsinki'), (b'Europe/Istanbul', b'(GMT+0200) Europe/Istanbul'), (b'Europe/Kiev', b'(GMT+0200) Europe/Kiev'), (b'Europe/Mariehamn', b'(GMT+0200) Europe/Mariehamn'), (b'Europe/Riga', b'(GMT+0200) Europe/Riga'), (b'Europe/Sofia', b'(GMT+0200) Europe/Sofia'), (b'Europe/Tallinn', b'(GMT+0200) Europe/Tallinn'), (b'Europe/Uzhgorod', b'(GMT+0200) Europe/Uzhgorod'), (b'Europe/Vilnius', b'(GMT+0200) Europe/Vilnius'), (b'Europe/Zaporozhye', b'(GMT+0200) Europe/Zaporozhye'), (b'Africa/Addis_Ababa', b'(GMT+0300) Africa/Addis_Ababa'), (b'Africa/Asmara', b'(GMT+0300) Africa/Asmara'), (b'Africa/Dar_es_Salaam', b'(GMT+0300) Africa/Dar_es_Salaam'), (b'Africa/Djibouti', b'(GMT+0300) Africa/Djibouti'), (b'Africa/Juba', b'(GMT+0300) Africa/Juba'), (b'Africa/Kampala', b'(GMT+0300) Africa/Kampala'), (b'Africa/Khartoum', b'(GMT+0300) Africa/Khartoum'), (b'Africa/Mogadishu', b'(GMT+0300) Africa/Mogadishu'), (b'Africa/Nairobi', b'(GMT+0300) Africa/Nairobi'), (b'Antarctica/Syowa', b'(GMT+0300) Antarctica/Syowa'), (b'Asia/Aden', b'(GMT+0300) Asia/Aden'), (b'Asia/Baghdad', b'(GMT+0300) Asia/Baghdad'), (b'Asia/Bahrain', b'(GMT+0300) Asia/Bahrain'), (b'Asia/Kuwait', b'(GMT+0300) Asia/Kuwait'), (b'Asia/Qatar', b'(GMT+0300) Asia/Qatar'), (b'Asia/Riyadh', b'(GMT+0300) Asia/Riyadh'), (b'Europe/Kaliningrad', b'(GMT+0300) Europe/Kaliningrad'), (b'Europe/Minsk', b'(GMT+0300) Europe/Minsk'), (b'Indian/Antananarivo', b'(GMT+0300) Indian/Antananarivo'), (b'Indian/Comoro', b'(GMT+0300) Indian/Comoro'), (b'Indian/Mayotte', b'(GMT+0300) Indian/Mayotte'), (b'Asia/Tehran', b'(GMT+0330) Asia/Tehran'), (b'Asia/Baku', b'(GMT+0400) Asia/Baku'), (b'Asia/Dubai', b'(GMT+0400) Asia/Dubai'), (b'Asia/Muscat', b'(GMT+0400) Asia/Muscat'), (b'Asia/Tbilisi', b'(GMT+0400) Asia/Tbilisi'), (b'Asia/Yerevan', b'(GMT+0400) Asia/Yerevan'), (b'Europe/Moscow', b'(GMT+0400) Europe/Moscow'), (b'Europe/Samara', b'(GMT+0400) Europe/Samara'), (b'Europe/Simferopol', b'(GMT+0400) Europe/Simferopol'), (b'Europe/Volgograd', b'(GMT+0400) Europe/Volgograd'), (b'Indian/Mahe', b'(GMT+0400) Indian/Mahe'), (b'Indian/Mauritius', b'(GMT+0400) Indian/Mauritius'), (b'Indian/Reunion', b'(GMT+0400) Indian/Reunion'), (b'Asia/Kabul', b'(GMT+0430) Asia/Kabul'), (b'Antarctica/Mawson', b'(GMT+0500) Antarctica/Mawson'), (b'Asia/Aqtau', b'(GMT+0500) Asia/Aqtau'), (b'Asia/Aqtobe', b'(GMT+0500) Asia/Aqtobe'), (b'Asia/Ashgabat', b'(GMT+0500) Asia/Ashgabat'), (b'Asia/Dushanbe', b'(GMT+0500) Asia/Dushanbe'), (b'Asia/Karachi', b'(GMT+0500) Asia/Karachi'), (b'Asia/Oral', b'(GMT+0500) Asia/Oral'), (b'Asia/Samarkand', b'(GMT+0500) Asia/Samarkand'), (b'Asia/Tashkent', b'(GMT+0500) Asia/Tashkent'), (b'Indian/Kerguelen', b'(GMT+0500) Indian/Kerguelen'), (b'Indian/Maldives', b'(GMT+0500) Indian/Maldives'), (b'Asia/Colombo', b'(GMT+0530) Asia/Colombo'), (b'Asia/Kolkata', b'(GMT+0530) Asia/Kolkata'), (b'Asia/Kathmandu', b'(GMT+0545) Asia/Kathmandu'), (b'Antarctica/Vostok', b'(GMT+0600) Antarctica/Vostok'), (b'Asia/Almaty', b'(GMT+0600) Asia/Almaty'), (b'Asia/Bishkek', b'(GMT+0600) Asia/Bishkek'), (b'Asia/Dhaka', b'(GMT+0600) Asia/Dhaka'), (b'Asia/Qyzylorda', b'(GMT+0600) Asia/Qyzylorda'), (b'Asia/Thimphu', b'(GMT+0600) Asia/Thimphu'), (b'Asia/Yekaterinburg', b'(GMT+0600) Asia/Yekaterinburg'), (b'Indian/Chagos', b'(GMT+0600) Indian/Chagos'), (b'Asia/Rangoon', b'(GMT+0630) Asia/Rangoon'), (b'Indian/Cocos', b'(GMT+0630) Indian/Cocos'), (b'Antarctica/Davis', b'(GMT+0700) Antarctica/Davis'), (b'Asia/Bangkok', b'(GMT+0700) Asia/Bangkok'), (b'Asia/Ho_Chi_Minh', b'(GMT+0700) Asia/Ho_Chi_Minh'), (b'Asia/Hovd', b'(GMT+0700) Asia/Hovd'), (b'Asia/Jakarta', b'(GMT+0700) Asia/Jakarta'), (b'Asia/Novokuznetsk', b'(GMT+0700) Asia/Novokuznetsk'), (b'Asia/Novosibirsk', b'(GMT+0700) Asia/Novosibirsk'), (b'Asia/Omsk', b'(GMT+0700) Asia/Omsk'), (b'Asia/Phnom_Penh', b'(GMT+0700) Asia/Phnom_Penh'), (b'Asia/Pontianak', b'(GMT+0700) Asia/Pontianak'), (b'Asia/Vientiane', b'(GMT+0700) Asia/Vientiane'), (b'Indian/Christmas', b'(GMT+0700) Indian/Christmas'), (b'Antarctica/Casey', b'(GMT+0800) Antarctica/Casey'), (b'Asia/Brunei', b'(GMT+0800) Asia/Brunei'), (b'Asia/Choibalsan', b'(GMT+0800) Asia/Choibalsan'), (b'Asia/Chongqing', b'(GMT+0800) Asia/Chongqing'), (b'Asia/Harbin', b'(GMT+0800) Asia/Harbin'), (b'Asia/Hong_Kong', b'(GMT+0800) Asia/Hong_Kong'), (b'Asia/Kashgar', b'(GMT+0800) Asia/Kashgar'), (b'Asia/Krasnoyarsk', b'(GMT+0800) Asia/Krasnoyarsk'), (b'Asia/Kuala_Lumpur', b'(GMT+0800) Asia/Kuala_Lumpur'), (b'Asia/Kuching', b'(GMT+0800) Asia/Kuching'), (b'Asia/Macau', b'(GMT+0800) Asia/Macau'), (b'Asia/Makassar', b'(GMT+0800) Asia/Makassar'), (b'Asia/Manila', b'(GMT+0800) Asia/Manila'), (b'Asia/Shanghai', b'(GMT+0800) Asia/Shanghai'), (b'Asia/Singapore', b'(GMT+0800) Asia/Singapore'), (b'Asia/Taipei', b'(GMT+0800) Asia/Taipei'), (b'Asia/Ulaanbaatar', b'(GMT+0800) Asia/Ulaanbaatar'), (b'Asia/Urumqi', b'(GMT+0800) Asia/Urumqi'), (b'Australia/Perth', b'(GMT+0800) Australia/Perth'), (b'Australia/Eucla', b'(GMT+0845) Australia/Eucla'), (b'Asia/Dili', b'(GMT+0900) Asia/Dili'), (b'Asia/Irkutsk', b'(GMT+0900) Asia/Irkutsk'), (b'Asia/Jayapura', b'(GMT+0900) Asia/Jayapura'), (b'Asia/Pyongyang', b'(GMT+0900) Asia/Pyongyang'), (b'Asia/Seoul', b'(GMT+0900) Asia/Seoul'), (b'Asia/Tokyo', b'(GMT+0900) Asia/Tokyo'), (b'Pacific/Palau', b'(GMT+0900) Pacific/Palau'), (b'Australia/Darwin', b'(GMT+0930) Australia/Darwin'), (b'Antarctica/DumontDUrville', b'(GMT+1000) Antarctica/DumontDUrville'), (b'Asia/Yakutsk', b'(GMT+1000) Asia/Yakutsk'), (b'Australia/Brisbane', b'(GMT+1000) Australia/Brisbane'), (b'Australia/Lindeman', b'(GMT+1000) Australia/Lindeman'), (b'Pacific/Chuuk', b'(GMT+1000) Pacific/Chuuk'), (b'Pacific/Guam', b'(GMT+1000) Pacific/Guam'), (b'Pacific/Port_Moresby', b'(GMT+1000) Pacific/Port_Moresby'), (b'Pacific/Saipan', b'(GMT+1000) Pacific/Saipan'), (b'Australia/Adelaide', b'(GMT+1030) Australia/Adelaide'), (b'Australia/Broken_Hill', b'(GMT+1030) Australia/Broken_Hill'), (b'Antarctica/Macquarie', b'(GMT+1100) Antarctica/Macquarie'), (b'Asia/Sakhalin', b'(GMT+1100) Asia/Sakhalin'), (b'Asia/Vladivostok', b'(GMT+1100) Asia/Vladivostok'), (b'Australia/Currie', b'(GMT+1100) Australia/Currie'), (b'Australia/Hobart', b'(GMT+1100) Australia/Hobart'), (b'Australia/Lord_Howe', b'(GMT+1100) Australia/Lord_Howe'), (b'Australia/Melbourne', b'(GMT+1100) Australia/Melbourne'), (b'Australia/Sydney', b'(GMT+1100) Australia/Sydney'), (b'Pacific/Efate', b'(GMT+1100) Pacific/Efate'), (b'Pacific/Guadalcanal', b'(GMT+1100) Pacific/Guadalcanal'), (b'Pacific/Kosrae', b'(GMT+1100) Pacific/Kosrae'), (b'Pacific/Noumea', b'(GMT+1100) Pacific/Noumea'), (b'Pacific/Pohnpei', b'(GMT+1100) Pacific/Pohnpei'), (b'Pacific/Norfolk', b'(GMT+1130) Pacific/Norfolk'), (b'Asia/Anadyr', b'(GMT+1200) Asia/Anadyr'), (b'Asia/Kamchatka', b'(GMT+1200) Asia/Kamchatka'), (b'Asia/Magadan', b'(GMT+1200) Asia/Magadan'), (b'Pacific/Fiji', b'(GMT+1200) Pacific/Fiji'), (b'Pacific/Funafuti', b'(GMT+1200) Pacific/Funafuti'), (b'Pacific/Kwajalein', b'(GMT+1200) Pacific/Kwajalein'), (b'Pacific/Majuro', b'(GMT+1200) Pacific/Majuro'), (b'Pacific/Nauru', b'(GMT+1200) Pacific/Nauru'), (b'Pacific/Tarawa', b'(GMT+1200) Pacific/Tarawa'), (b'Pacific/Wake', b'(GMT+1200) Pacific/Wake'), (b'Pacific/Wallis', b'(GMT+1200) Pacific/Wallis'), (b'Antarctica/McMurdo', b'(GMT+1300) Antarctica/McMurdo'), (b'Antarctica/South_Pole', b'(GMT+1300) Antarctica/South_Pole'), (b'Pacific/Auckland', b'(GMT+1300) Pacific/Auckland'), (b'Pacific/Enderbury', b'(GMT+1300) Pacific/Enderbury'), (b'Pacific/Fakaofo', b'(GMT+1300) Pacific/Fakaofo'), (b'Pacific/Tongatapu', b'(GMT+1300) Pacific/Tongatapu'), (b'Pacific/Chatham', b'(GMT+1345) Pacific/Chatham'), (b'Pacific/Apia', b'(GMT+1400) Pacific/Apia'), (b'Pacific/Kiritimati', b'(GMT+1400) Pacific/Kiritimati')])),
+                ('timezone', timezones.fields.TimeZoneField(default=b'America/New_York', max_length=100, choices=[(b'Pacific/Midway', b'(GMT-1100) Pacific/Midway'), (b'Pacific/Niue', b'(GMT-1100) Pacific/Niue'), (b'Pacific/Pago_Pago', b'(GMT-1100) Pacific/Pago_Pago'), (b'America/Adak', b'(GMT-1000) America/Adak'), (b'Pacific/Honolulu', b'(GMT-1000) Pacific/Honolulu'), (b'Pacific/Johnston', b'(GMT-1000) Pacific/Johnston'), (b'Pacific/Rarotonga', b'(GMT-1000) Pacific/Rarotonga'), (b'Pacific/Tahiti', b'(GMT-1000) Pacific/Tahiti'), (b'US/Hawaii', b'(GMT-1000) US/Hawaii'), (b'Pacific/Marquesas', b'(GMT-0930) Pacific/Marquesas'), (b'America/Anchorage', b'(GMT-0900) America/Anchorage'), (b'America/Juneau', b'(GMT-0900) America/Juneau'), (b'America/Nome', b'(GMT-0900) America/Nome'), (b'America/Sitka', b'(GMT-0900) America/Sitka'), (b'America/Yakutat', b'(GMT-0900) America/Yakutat'), (b'Pacific/Gambier', b'(GMT-0900) Pacific/Gambier'), (b'US/Alaska', b'(GMT-0900) US/Alaska'), (b'America/Dawson', b'(GMT-0800) America/Dawson'), (b'America/Los_Angeles', b'(GMT-0800) America/Los_Angeles'), (b'America/Metlakatla', b'(GMT-0800) America/Metlakatla'), (b'America/Santa_Isabel', b'(GMT-0800) America/Santa_Isabel'), (b'America/Tijuana', b'(GMT-0800) America/Tijuana'), (b'America/Vancouver', b'(GMT-0800) America/Vancouver'), (b'America/Whitehorse', b'(GMT-0800) America/Whitehorse'), (b'Canada/Pacific', b'(GMT-0800) Canada/Pacific'), (b'Pacific/Pitcairn', b'(GMT-0800) Pacific/Pitcairn'), (b'US/Pacific', b'(GMT-0800) US/Pacific'), (b'America/Boise', b'(GMT-0700) America/Boise'), (b'America/Cambridge_Bay', b'(GMT-0700) America/Cambridge_Bay'), (b'America/Chihuahua', b'(GMT-0700) America/Chihuahua'), (b'America/Creston', b'(GMT-0700) America/Creston'), (b'America/Dawson_Creek', b'(GMT-0700) America/Dawson_Creek'), (b'America/Denver', b'(GMT-0700) America/Denver'), (b'America/Edmonton', b'(GMT-0700) America/Edmonton'), (b'America/Hermosillo', b'(GMT-0700) America/Hermosillo'), (b'America/Inuvik', b'(GMT-0700) America/Inuvik'), (b'America/Mazatlan', b'(GMT-0700) America/Mazatlan'), (b'America/Ojinaga', b'(GMT-0700) America/Ojinaga'), (b'America/Phoenix', b'(GMT-0700) America/Phoenix'), (b'America/Shiprock', b'(GMT-0700) America/Shiprock'), (b'America/Yellowknife', b'(GMT-0700) America/Yellowknife'), (b'Canada/Mountain', b'(GMT-0700) Canada/Mountain'), (b'US/Arizona', b'(GMT-0700) US/Arizona'), (b'US/Mountain', b'(GMT-0700) US/Mountain'), (b'America/Bahia_Banderas', b'(GMT-0600) America/Bahia_Banderas'), (b'America/Belize', b'(GMT-0600) America/Belize'), (b'America/Cancun', b'(GMT-0600) America/Cancun'), (b'America/Chicago', b'(GMT-0600) America/Chicago'), (b'America/Costa_Rica', b'(GMT-0600) America/Costa_Rica'), (b'America/El_Salvador', b'(GMT-0600) America/El_Salvador'), (b'America/Guatemala', b'(GMT-0600) America/Guatemala'), (b'America/Indiana/Knox', b'(GMT-0600) America/Indiana/Knox'), (b'America/Indiana/Tell_City', b'(GMT-0600) America/Indiana/Tell_City'), (b'America/Managua', b'(GMT-0600) America/Managua'), (b'America/Matamoros', b'(GMT-0600) America/Matamoros'), (b'America/Menominee', b'(GMT-0600) America/Menominee'), (b'America/Merida', b'(GMT-0600) America/Merida'), (b'America/Mexico_City', b'(GMT-0600) America/Mexico_City'), (b'America/Monterrey', b'(GMT-0600) America/Monterrey'), (b'America/North_Dakota/Beulah', b'(GMT-0600) America/North_Dakota/Beulah'), (b'America/North_Dakota/Center', b'(GMT-0600) America/North_Dakota/Center'), (b'America/North_Dakota/New_Salem', b'(GMT-0600) America/North_Dakota/New_Salem'), (b'America/Rainy_River', b'(GMT-0600) America/Rainy_River'), (b'America/Rankin_Inlet', b'(GMT-0600) America/Rankin_Inlet'), (b'America/Regina', b'(GMT-0600) America/Regina'), (b'America/Resolute', b'(GMT-0600) America/Resolute'), (b'America/Swift_Current', b'(GMT-0600) America/Swift_Current'), (b'America/Tegucigalpa', b'(GMT-0600) America/Tegucigalpa'), (b'America/Winnipeg', b'(GMT-0600) America/Winnipeg'), (b'Canada/Central', b'(GMT-0600) Canada/Central'), (b'Pacific/Galapagos', b'(GMT-0600) Pacific/Galapagos'), (b'US/Central', b'(GMT-0600) US/Central'), (b'America/Atikokan', b'(GMT-0500) America/Atikokan'), (b'America/Bogota', b'(GMT-0500) America/Bogota'), (b'America/Cayman', b'(GMT-0500) America/Cayman'), (b'America/Detroit', b'(GMT-0500) America/Detroit'), (b'America/Eirunepe', b'(GMT-0500) America/Eirunepe'), (b'America/Grand_Turk', b'(GMT-0500) America/Grand_Turk'), (b'America/Guayaquil', b'(GMT-0500) America/Guayaquil'), (b'America/Havana', b'(GMT-0500) America/Havana'), (b'America/Indiana/Indianapolis', b'(GMT-0500) America/Indiana/Indianapolis'), (b'America/Indiana/Marengo', b'(GMT-0500) America/Indiana/Marengo'), (b'America/Indiana/Petersburg', b'(GMT-0500) America/Indiana/Petersburg'), (b'America/Indiana/Vevay', b'(GMT-0500) America/Indiana/Vevay'), (b'America/Indiana/Vincennes', b'(GMT-0500) America/Indiana/Vincennes'), (b'America/Indiana/Winamac', b'(GMT-0500) America/Indiana/Winamac'), (b'America/Iqaluit', b'(GMT-0500) America/Iqaluit'), (b'America/Jamaica', b'(GMT-0500) America/Jamaica'), (b'America/Kentucky/Louisville', b'(GMT-0500) America/Kentucky/Louisville'), (b'America/Kentucky/Monticello', b'(GMT-0500) America/Kentucky/Monticello'), (b'America/Lima', b'(GMT-0500) America/Lima'), (b'America/Montreal', b'(GMT-0500) America/Montreal'), (b'America/Nassau', b'(GMT-0500) America/Nassau'), (b'America/New_York', b'(GMT-0500) America/New_York'), (b'America/Nipigon', b'(GMT-0500) America/Nipigon'), (b'America/Panama', b'(GMT-0500) America/Panama'), (b'America/Pangnirtung', b'(GMT-0500) America/Pangnirtung'), (b'America/Port-au-Prince', b'(GMT-0500) America/Port-au-Prince'), (b'America/Rio_Branco', b'(GMT-0500) America/Rio_Branco'), (b'America/Thunder_Bay', b'(GMT-0500) America/Thunder_Bay'), (b'America/Toronto', b'(GMT-0500) America/Toronto'), (b'Canada/Eastern', b'(GMT-0500) Canada/Eastern'), (b'Pacific/Easter', b'(GMT-0500) Pacific/Easter'), (b'US/Eastern', b'(GMT-0500) US/Eastern'), (b'America/Caracas', b'(GMT-0430) America/Caracas'), (b'America/Anguilla', b'(GMT-0400) America/Anguilla'), (b'America/Antigua', b'(GMT-0400) America/Antigua'), (b'America/Aruba', b'(GMT-0400) America/Aruba'), (b'America/Barbados', b'(GMT-0400) America/Barbados'), (b'America/Blanc-Sablon', b'(GMT-0400) America/Blanc-Sablon'), (b'America/Boa_Vista', b'(GMT-0400) America/Boa_Vista'), (b'America/Curacao', b'(GMT-0400) America/Curacao'), (b'America/Dominica', b'(GMT-0400) America/Dominica'), (b'America/Glace_Bay', b'(GMT-0400) America/Glace_Bay'), (b'America/Goose_Bay', b'(GMT-0400) America/Goose_Bay'), (b'America/Grenada', b'(GMT-0400) America/Grenada'), (b'America/Guadeloupe', b'(GMT-0400) America/Guadeloupe'), (b'America/Guyana', b'(GMT-0400) America/Guyana'), (b'America/Halifax', b'(GMT-0400) America/Halifax'), (b'America/Kralendijk', b'(GMT-0400) America/Kralendijk'), (b'America/La_Paz', b'(GMT-0400) America/La_Paz'), (b'America/Lower_Princes', b'(GMT-0400) America/Lower_Princes'), (b'America/Manaus', b'(GMT-0400) America/Manaus'), (b'America/Marigot', b'(GMT-0400) America/Marigot'), (b'America/Martinique', b'(GMT-0400) America/Martinique'), (b'America/Moncton', b'(GMT-0400) America/Moncton'), (b'America/Montserrat', b'(GMT-0400) America/Montserrat'), (b'America/Port_of_Spain', b'(GMT-0400) America/Port_of_Spain'), (b'America/Porto_Velho', b'(GMT-0400) America/Porto_Velho'), (b'America/Puerto_Rico', b'(GMT-0400) America/Puerto_Rico'), (b'America/Santo_Domingo', b'(GMT-0400) America/Santo_Domingo'), (b'America/St_Barthelemy', b'(GMT-0400) America/St_Barthelemy'), (b'America/St_Kitts', b'(GMT-0400) America/St_Kitts'), (b'America/St_Lucia', b'(GMT-0400) America/St_Lucia'), (b'America/St_Thomas', b'(GMT-0400) America/St_Thomas'), (b'America/St_Vincent', b'(GMT-0400) America/St_Vincent'), (b'America/Thule', b'(GMT-0400) America/Thule'), (b'America/Tortola', b'(GMT-0400) America/Tortola'), (b'Atlantic/Bermuda', b'(GMT-0400) Atlantic/Bermuda'), (b'Canada/Atlantic', b'(GMT-0400) Canada/Atlantic'), (b'America/St_Johns', b'(GMT-0330) America/St_Johns'), (b'Canada/Newfoundland', b'(GMT-0330) Canada/Newfoundland'), (b'America/Araguaina', b'(GMT-0300) America/Araguaina'), (b'America/Argentina/Buenos_Aires', b'(GMT-0300) America/Argentina/Buenos_Aires'), (b'America/Argentina/Catamarca', b'(GMT-0300) America/Argentina/Catamarca'), (b'America/Argentina/Cordoba', b'(GMT-0300) America/Argentina/Cordoba'), (b'America/Argentina/Jujuy', b'(GMT-0300) America/Argentina/Jujuy'), (b'America/Argentina/La_Rioja', b'(GMT-0300) America/Argentina/La_Rioja'), (b'America/Argentina/Mendoza', b'(GMT-0300) America/Argentina/Mendoza'), (b'America/Argentina/Rio_Gallegos', b'(GMT-0300) America/Argentina/Rio_Gallegos'), (b'America/Argentina/Salta', b'(GMT-0300) America/Argentina/Salta'), (b'America/Argentina/San_Juan', b'(GMT-0300) America/Argentina/San_Juan'), (b'America/Argentina/San_Luis', b'(GMT-0300) America/Argentina/San_Luis'), (b'America/Argentina/Tucuman', b'(GMT-0300) America/Argentina/Tucuman'), (b'America/Argentina/Ushuaia', b'(GMT-0300) America/Argentina/Ushuaia'), (b'America/Asuncion', b'(GMT-0300) America/Asuncion'), (b'America/Bahia', b'(GMT-0300) America/Bahia'), (b'America/Belem', b'(GMT-0300) America/Belem'), (b'America/Campo_Grande', b'(GMT-0300) America/Campo_Grande'), (b'America/Cayenne', b'(GMT-0300) America/Cayenne'), (b'America/Cuiaba', b'(GMT-0300) America/Cuiaba'), (b'America/Fortaleza', b'(GMT-0300) America/Fortaleza'), (b'America/Godthab', b'(GMT-0300) America/Godthab'), (b'America/Maceio', b'(GMT-0300) America/Maceio'), (b'America/Miquelon', b'(GMT-0300) America/Miquelon'), (b'America/Paramaribo', b'(GMT-0300) America/Paramaribo'), (b'America/Recife', b'(GMT-0300) America/Recife'), (b'America/Santarem', b'(GMT-0300) America/Santarem'), (b'America/Santiago', b'(GMT-0300) America/Santiago'), (b'Antarctica/Palmer', b'(GMT-0300) Antarctica/Palmer'), (b'Antarctica/Rothera', b'(GMT-0300) Antarctica/Rothera'), (b'Atlantic/Stanley', b'(GMT-0300) Atlantic/Stanley'), (b'America/Montevideo', b'(GMT-0200) America/Montevideo'), (b'America/Noronha', b'(GMT-0200) America/Noronha'), (b'America/Sao_Paulo', b'(GMT-0200) America/Sao_Paulo'), (b'Atlantic/South_Georgia', b'(GMT-0200) Atlantic/South_Georgia'), (b'America/Scoresbysund', b'(GMT-0100) America/Scoresbysund'), (b'Atlantic/Azores', b'(GMT-0100) Atlantic/Azores'), (b'Atlantic/Cape_Verde', b'(GMT-0100) Atlantic/Cape_Verde'), (b'Africa/Abidjan', b'(GMT+0000) Africa/Abidjan'), (b'Africa/Accra', b'(GMT+0000) Africa/Accra'), (b'Africa/Bamako', b'(GMT+0000) Africa/Bamako'), (b'Africa/Banjul', b'(GMT+0000) Africa/Banjul'), (b'Africa/Bissau', b'(GMT+0000) Africa/Bissau'), (b'Africa/Casablanca', b'(GMT+0000) Africa/Casablanca'), (b'Africa/Conakry', b'(GMT+0000) Africa/Conakry'), (b'Africa/Dakar', b'(GMT+0000) Africa/Dakar'), (b'Africa/El_Aaiun', b'(GMT+0000) Africa/El_Aaiun'), (b'Africa/Freetown', b'(GMT+0000) Africa/Freetown'), (b'Africa/Lome', b'(GMT+0000) Africa/Lome'), (b'Africa/Monrovia', b'(GMT+0000) Africa/Monrovia'), (b'Africa/Nouakchott', b'(GMT+0000) Africa/Nouakchott'), (b'Africa/Ouagadougou', b'(GMT+0000) Africa/Ouagadougou'), (b'Africa/Sao_Tome', b'(GMT+0000) Africa/Sao_Tome'), (b'America/Danmarkshavn', b'(GMT+0000) America/Danmarkshavn'), (b'Atlantic/Canary', b'(GMT+0000) Atlantic/Canary'), (b'Atlantic/Faroe', b'(GMT+0000) Atlantic/Faroe'), (b'Atlantic/Madeira', b'(GMT+0000) Atlantic/Madeira'), (b'Atlantic/Reykjavik', b'(GMT+0000) Atlantic/Reykjavik'), (b'Atlantic/St_Helena', b'(GMT+0000) Atlantic/St_Helena'), (b'Europe/Dublin', b'(GMT+0000) Europe/Dublin'), (b'Europe/Guernsey', b'(GMT+0000) Europe/Guernsey'), (
+                    b'Europe/Isle_of_Man', b'(GMT+0000) Europe/Isle_of_Man'), (b'Europe/Jersey', b'(GMT+0000) Europe/Jersey'), (b'Europe/Lisbon', b'(GMT+0000) Europe/Lisbon'), (b'Europe/London', b'(GMT+0000) Europe/London'), (b'GMT', b'(GMT+0000) GMT'), (b'UTC', b'(GMT+0000) UTC'), (b'Africa/Algiers', b'(GMT+0100) Africa/Algiers'), (b'Africa/Bangui', b'(GMT+0100) Africa/Bangui'), (b'Africa/Brazzaville', b'(GMT+0100) Africa/Brazzaville'), (b'Africa/Ceuta', b'(GMT+0100) Africa/Ceuta'), (b'Africa/Douala', b'(GMT+0100) Africa/Douala'), (b'Africa/Kinshasa', b'(GMT+0100) Africa/Kinshasa'), (b'Africa/Lagos', b'(GMT+0100) Africa/Lagos'), (b'Africa/Libreville', b'(GMT+0100) Africa/Libreville'), (b'Africa/Luanda', b'(GMT+0100) Africa/Luanda'), (b'Africa/Malabo', b'(GMT+0100) Africa/Malabo'), (b'Africa/Ndjamena', b'(GMT+0100) Africa/Ndjamena'), (b'Africa/Niamey', b'(GMT+0100) Africa/Niamey'), (b'Africa/Porto-Novo', b'(GMT+0100) Africa/Porto-Novo'), (b'Africa/Tunis', b'(GMT+0100) Africa/Tunis'), (b'Arctic/Longyearbyen', b'(GMT+0100) Arctic/Longyearbyen'), (b'Europe/Amsterdam', b'(GMT+0100) Europe/Amsterdam'), (b'Europe/Andorra', b'(GMT+0100) Europe/Andorra'), (b'Europe/Belgrade', b'(GMT+0100) Europe/Belgrade'), (b'Europe/Berlin', b'(GMT+0100) Europe/Berlin'), (b'Europe/Bratislava', b'(GMT+0100) Europe/Bratislava'), (b'Europe/Brussels', b'(GMT+0100) Europe/Brussels'), (b'Europe/Budapest', b'(GMT+0100) Europe/Budapest'), (b'Europe/Copenhagen', b'(GMT+0100) Europe/Copenhagen'), (b'Europe/Gibraltar', b'(GMT+0100) Europe/Gibraltar'), (b'Europe/Ljubljana', b'(GMT+0100) Europe/Ljubljana'), (b'Europe/Luxembourg', b'(GMT+0100) Europe/Luxembourg'), (b'Europe/Madrid', b'(GMT+0100) Europe/Madrid'), (b'Europe/Malta', b'(GMT+0100) Europe/Malta'), (b'Europe/Monaco', b'(GMT+0100) Europe/Monaco'), (b'Europe/Oslo', b'(GMT+0100) Europe/Oslo'), (b'Europe/Paris', b'(GMT+0100) Europe/Paris'), (b'Europe/Podgorica', b'(GMT+0100) Europe/Podgorica'), (b'Europe/Prague', b'(GMT+0100) Europe/Prague'), (b'Europe/Rome', b'(GMT+0100) Europe/Rome'), (b'Europe/San_Marino', b'(GMT+0100) Europe/San_Marino'), (b'Europe/Sarajevo', b'(GMT+0100) Europe/Sarajevo'), (b'Europe/Skopje', b'(GMT+0100) Europe/Skopje'), (b'Europe/Stockholm', b'(GMT+0100) Europe/Stockholm'), (b'Europe/Tirane', b'(GMT+0100) Europe/Tirane'), (b'Europe/Vaduz', b'(GMT+0100) Europe/Vaduz'), (b'Europe/Vatican', b'(GMT+0100) Europe/Vatican'), (b'Europe/Vienna', b'(GMT+0100) Europe/Vienna'), (b'Europe/Warsaw', b'(GMT+0100) Europe/Warsaw'), (b'Europe/Zagreb', b'(GMT+0100) Europe/Zagreb'), (b'Europe/Zurich', b'(GMT+0100) Europe/Zurich'), (b'Africa/Blantyre', b'(GMT+0200) Africa/Blantyre'), (b'Africa/Bujumbura', b'(GMT+0200) Africa/Bujumbura'), (b'Africa/Cairo', b'(GMT+0200) Africa/Cairo'), (b'Africa/Gaborone', b'(GMT+0200) Africa/Gaborone'), (b'Africa/Harare', b'(GMT+0200) Africa/Harare'), (b'Africa/Johannesburg', b'(GMT+0200) Africa/Johannesburg'), (b'Africa/Kigali', b'(GMT+0200) Africa/Kigali'), (b'Africa/Lubumbashi', b'(GMT+0200) Africa/Lubumbashi'), (b'Africa/Lusaka', b'(GMT+0200) Africa/Lusaka'), (b'Africa/Maputo', b'(GMT+0200) Africa/Maputo'), (b'Africa/Maseru', b'(GMT+0200) Africa/Maseru'), (b'Africa/Mbabane', b'(GMT+0200) Africa/Mbabane'), (b'Africa/Tripoli', b'(GMT+0200) Africa/Tripoli'), (b'Africa/Windhoek', b'(GMT+0200) Africa/Windhoek'), (b'Asia/Amman', b'(GMT+0200) Asia/Amman'), (b'Asia/Beirut', b'(GMT+0200) Asia/Beirut'), (b'Asia/Damascus', b'(GMT+0200) Asia/Damascus'), (b'Asia/Gaza', b'(GMT+0200) Asia/Gaza'), (b'Asia/Hebron', b'(GMT+0200) Asia/Hebron'), (b'Asia/Jerusalem', b'(GMT+0200) Asia/Jerusalem'), (b'Asia/Nicosia', b'(GMT+0200) Asia/Nicosia'), (b'Europe/Athens', b'(GMT+0200) Europe/Athens'), (b'Europe/Bucharest', b'(GMT+0200) Europe/Bucharest'), (b'Europe/Chisinau', b'(GMT+0200) Europe/Chisinau'), (b'Europe/Helsinki', b'(GMT+0200) Europe/Helsinki'), (b'Europe/Istanbul', b'(GMT+0200) Europe/Istanbul'), (b'Europe/Kiev', b'(GMT+0200) Europe/Kiev'), (b'Europe/Mariehamn', b'(GMT+0200) Europe/Mariehamn'), (b'Europe/Riga', b'(GMT+0200) Europe/Riga'), (b'Europe/Sofia', b'(GMT+0200) Europe/Sofia'), (b'Europe/Tallinn', b'(GMT+0200) Europe/Tallinn'), (b'Europe/Uzhgorod', b'(GMT+0200) Europe/Uzhgorod'), (b'Europe/Vilnius', b'(GMT+0200) Europe/Vilnius'), (b'Europe/Zaporozhye', b'(GMT+0200) Europe/Zaporozhye'), (b'Africa/Addis_Ababa', b'(GMT+0300) Africa/Addis_Ababa'), (b'Africa/Asmara', b'(GMT+0300) Africa/Asmara'), (b'Africa/Dar_es_Salaam', b'(GMT+0300) Africa/Dar_es_Salaam'), (b'Africa/Djibouti', b'(GMT+0300) Africa/Djibouti'), (b'Africa/Juba', b'(GMT+0300) Africa/Juba'), (b'Africa/Kampala', b'(GMT+0300) Africa/Kampala'), (b'Africa/Khartoum', b'(GMT+0300) Africa/Khartoum'), (b'Africa/Mogadishu', b'(GMT+0300) Africa/Mogadishu'), (b'Africa/Nairobi', b'(GMT+0300) Africa/Nairobi'), (b'Antarctica/Syowa', b'(GMT+0300) Antarctica/Syowa'), (b'Asia/Aden', b'(GMT+0300) Asia/Aden'), (b'Asia/Baghdad', b'(GMT+0300) Asia/Baghdad'), (b'Asia/Bahrain', b'(GMT+0300) Asia/Bahrain'), (b'Asia/Kuwait', b'(GMT+0300) Asia/Kuwait'), (b'Asia/Qatar', b'(GMT+0300) Asia/Qatar'), (b'Asia/Riyadh', b'(GMT+0300) Asia/Riyadh'), (b'Europe/Kaliningrad', b'(GMT+0300) Europe/Kaliningrad'), (b'Europe/Minsk', b'(GMT+0300) Europe/Minsk'), (b'Indian/Antananarivo', b'(GMT+0300) Indian/Antananarivo'), (b'Indian/Comoro', b'(GMT+0300) Indian/Comoro'), (b'Indian/Mayotte', b'(GMT+0300) Indian/Mayotte'), (b'Asia/Tehran', b'(GMT+0330) Asia/Tehran'), (b'Asia/Baku', b'(GMT+0400) Asia/Baku'), (b'Asia/Dubai', b'(GMT+0400) Asia/Dubai'), (b'Asia/Muscat', b'(GMT+0400) Asia/Muscat'), (b'Asia/Tbilisi', b'(GMT+0400) Asia/Tbilisi'), (b'Asia/Yerevan', b'(GMT+0400) Asia/Yerevan'), (b'Europe/Moscow', b'(GMT+0400) Europe/Moscow'), (b'Europe/Samara', b'(GMT+0400) Europe/Samara'), (b'Europe/Simferopol', b'(GMT+0400) Europe/Simferopol'), (b'Europe/Volgograd', b'(GMT+0400) Europe/Volgograd'), (b'Indian/Mahe', b'(GMT+0400) Indian/Mahe'), (b'Indian/Mauritius', b'(GMT+0400) Indian/Mauritius'), (b'Indian/Reunion', b'(GMT+0400) Indian/Reunion'), (b'Asia/Kabul', b'(GMT+0430) Asia/Kabul'), (b'Antarctica/Mawson', b'(GMT+0500) Antarctica/Mawson'), (b'Asia/Aqtau', b'(GMT+0500) Asia/Aqtau'), (b'Asia/Aqtobe', b'(GMT+0500) Asia/Aqtobe'), (b'Asia/Ashgabat', b'(GMT+0500) Asia/Ashgabat'), (b'Asia/Dushanbe', b'(GMT+0500) Asia/Dushanbe'), (b'Asia/Karachi', b'(GMT+0500) Asia/Karachi'), (b'Asia/Oral', b'(GMT+0500) Asia/Oral'), (b'Asia/Samarkand', b'(GMT+0500) Asia/Samarkand'), (b'Asia/Tashkent', b'(GMT+0500) Asia/Tashkent'), (b'Indian/Kerguelen', b'(GMT+0500) Indian/Kerguelen'), (b'Indian/Maldives', b'(GMT+0500) Indian/Maldives'), (b'Asia/Colombo', b'(GMT+0530) Asia/Colombo'), (b'Asia/Kolkata', b'(GMT+0530) Asia/Kolkata'), (b'Asia/Kathmandu', b'(GMT+0545) Asia/Kathmandu'), (b'Antarctica/Vostok', b'(GMT+0600) Antarctica/Vostok'), (b'Asia/Almaty', b'(GMT+0600) Asia/Almaty'), (b'Asia/Bishkek', b'(GMT+0600) Asia/Bishkek'), (b'Asia/Dhaka', b'(GMT+0600) Asia/Dhaka'), (b'Asia/Qyzylorda', b'(GMT+0600) Asia/Qyzylorda'), (b'Asia/Thimphu', b'(GMT+0600) Asia/Thimphu'), (b'Asia/Yekaterinburg', b'(GMT+0600) Asia/Yekaterinburg'), (b'Indian/Chagos', b'(GMT+0600) Indian/Chagos'), (b'Asia/Rangoon', b'(GMT+0630) Asia/Rangoon'), (b'Indian/Cocos', b'(GMT+0630) Indian/Cocos'), (b'Antarctica/Davis', b'(GMT+0700) Antarctica/Davis'), (b'Asia/Bangkok', b'(GMT+0700) Asia/Bangkok'), (b'Asia/Ho_Chi_Minh', b'(GMT+0700) Asia/Ho_Chi_Minh'), (b'Asia/Hovd', b'(GMT+0700) Asia/Hovd'), (b'Asia/Jakarta', b'(GMT+0700) Asia/Jakarta'), (b'Asia/Novokuznetsk', b'(GMT+0700) Asia/Novokuznetsk'), (b'Asia/Novosibirsk', b'(GMT+0700) Asia/Novosibirsk'), (b'Asia/Omsk', b'(GMT+0700) Asia/Omsk'), (b'Asia/Phnom_Penh', b'(GMT+0700) Asia/Phnom_Penh'), (b'Asia/Pontianak', b'(GMT+0700) Asia/Pontianak'), (b'Asia/Vientiane', b'(GMT+0700) Asia/Vientiane'), (b'Indian/Christmas', b'(GMT+0700) Indian/Christmas'), (b'Antarctica/Casey', b'(GMT+0800) Antarctica/Casey'), (b'Asia/Brunei', b'(GMT+0800) Asia/Brunei'), (b'Asia/Choibalsan', b'(GMT+0800) Asia/Choibalsan'), (b'Asia/Chongqing', b'(GMT+0800) Asia/Chongqing'), (b'Asia/Harbin', b'(GMT+0800) Asia/Harbin'), (b'Asia/Hong_Kong', b'(GMT+0800) Asia/Hong_Kong'), (b'Asia/Kashgar', b'(GMT+0800) Asia/Kashgar'), (b'Asia/Krasnoyarsk', b'(GMT+0800) Asia/Krasnoyarsk'), (b'Asia/Kuala_Lumpur', b'(GMT+0800) Asia/Kuala_Lumpur'), (b'Asia/Kuching', b'(GMT+0800) Asia/Kuching'), (b'Asia/Macau', b'(GMT+0800) Asia/Macau'), (b'Asia/Makassar', b'(GMT+0800) Asia/Makassar'), (b'Asia/Manila', b'(GMT+0800) Asia/Manila'), (b'Asia/Shanghai', b'(GMT+0800) Asia/Shanghai'), (b'Asia/Singapore', b'(GMT+0800) Asia/Singapore'), (b'Asia/Taipei', b'(GMT+0800) Asia/Taipei'), (b'Asia/Ulaanbaatar', b'(GMT+0800) Asia/Ulaanbaatar'), (b'Asia/Urumqi', b'(GMT+0800) Asia/Urumqi'), (b'Australia/Perth', b'(GMT+0800) Australia/Perth'), (b'Australia/Eucla', b'(GMT+0845) Australia/Eucla'), (b'Asia/Dili', b'(GMT+0900) Asia/Dili'), (b'Asia/Irkutsk', b'(GMT+0900) Asia/Irkutsk'), (b'Asia/Jayapura', b'(GMT+0900) Asia/Jayapura'), (b'Asia/Pyongyang', b'(GMT+0900) Asia/Pyongyang'), (b'Asia/Seoul', b'(GMT+0900) Asia/Seoul'), (b'Asia/Tokyo', b'(GMT+0900) Asia/Tokyo'), (b'Pacific/Palau', b'(GMT+0900) Pacific/Palau'), (b'Australia/Darwin', b'(GMT+0930) Australia/Darwin'), (b'Antarctica/DumontDUrville', b'(GMT+1000) Antarctica/DumontDUrville'), (b'Asia/Yakutsk', b'(GMT+1000) Asia/Yakutsk'), (b'Australia/Brisbane', b'(GMT+1000) Australia/Brisbane'), (b'Australia/Lindeman', b'(GMT+1000) Australia/Lindeman'), (b'Pacific/Chuuk', b'(GMT+1000) Pacific/Chuuk'), (b'Pacific/Guam', b'(GMT+1000) Pacific/Guam'), (b'Pacific/Port_Moresby', b'(GMT+1000) Pacific/Port_Moresby'), (b'Pacific/Saipan', b'(GMT+1000) Pacific/Saipan'), (b'Australia/Adelaide', b'(GMT+1030) Australia/Adelaide'), (b'Australia/Broken_Hill', b'(GMT+1030) Australia/Broken_Hill'), (b'Antarctica/Macquarie', b'(GMT+1100) Antarctica/Macquarie'), (b'Asia/Sakhalin', b'(GMT+1100) Asia/Sakhalin'), (b'Asia/Vladivostok', b'(GMT+1100) Asia/Vladivostok'), (b'Australia/Currie', b'(GMT+1100) Australia/Currie'), (b'Australia/Hobart', b'(GMT+1100) Australia/Hobart'), (b'Australia/Lord_Howe', b'(GMT+1100) Australia/Lord_Howe'), (b'Australia/Melbourne', b'(GMT+1100) Australia/Melbourne'), (b'Australia/Sydney', b'(GMT+1100) Australia/Sydney'), (b'Pacific/Efate', b'(GMT+1100) Pacific/Efate'), (b'Pacific/Guadalcanal', b'(GMT+1100) Pacific/Guadalcanal'), (b'Pacific/Kosrae', b'(GMT+1100) Pacific/Kosrae'), (b'Pacific/Noumea', b'(GMT+1100) Pacific/Noumea'), (b'Pacific/Pohnpei', b'(GMT+1100) Pacific/Pohnpei'), (b'Pacific/Norfolk', b'(GMT+1130) Pacific/Norfolk'), (b'Asia/Anadyr', b'(GMT+1200) Asia/Anadyr'), (b'Asia/Kamchatka', b'(GMT+1200) Asia/Kamchatka'), (b'Asia/Magadan', b'(GMT+1200) Asia/Magadan'), (b'Pacific/Fiji', b'(GMT+1200) Pacific/Fiji'), (b'Pacific/Funafuti', b'(GMT+1200) Pacific/Funafuti'), (b'Pacific/Kwajalein', b'(GMT+1200) Pacific/Kwajalein'), (b'Pacific/Majuro', b'(GMT+1200) Pacific/Majuro'), (b'Pacific/Nauru', b'(GMT+1200) Pacific/Nauru'), (b'Pacific/Tarawa', b'(GMT+1200) Pacific/Tarawa'), (b'Pacific/Wake', b'(GMT+1200) Pacific/Wake'), (b'Pacific/Wallis', b'(GMT+1200) Pacific/Wallis'), (b'Antarctica/McMurdo', b'(GMT+1300) Antarctica/McMurdo'), (b'Antarctica/South_Pole', b'(GMT+1300) Antarctica/South_Pole'), (b'Pacific/Auckland', b'(GMT+1300) Pacific/Auckland'), (b'Pacific/Enderbury', b'(GMT+1300) Pacific/Enderbury'), (b'Pacific/Fakaofo', b'(GMT+1300) Pacific/Fakaofo'), (b'Pacific/Tongatapu', b'(GMT+1300) Pacific/Tongatapu'), (b'Pacific/Chatham', b'(GMT+1345) Pacific/Chatham'), (b'Pacific/Apia', b'(GMT+1400) Pacific/Apia'), (b'Pacific/Kiritimati', b'(GMT+1400) Pacific/Kiritimati')])),
             ],
             options={
             },
@@ -51,12 +61,18 @@
         migrations.CreateModel(
             name='Account',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
             ],
             options={
@@ -67,19 +83,28 @@
         migrations.CreateModel(
             name='Charge',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('kind', models.CharField(default=b'besteffort', max_length=30, choices=[(b'besteffort', b'besteffort'), (b'reservation', b'reservation'), (b'monthlyfee', b'monthlyfee')])),
-                ('state', models.CharField(default=b'pending', max_length=30, choices=[(b'pending', b'pending'), (b'invoiced', b'invoiced')])),
+                ('kind', models.CharField(default=b'besteffort', max_length=30, choices=[
+                 (b'besteffort', b'besteffort'), (b'reservation', b'reservation'), (b'monthlyfee', b'monthlyfee')])),
+                ('state', models.CharField(default=b'pending', max_length=30, choices=[
+                 (b'pending', b'pending'), (b'invoiced', b'invoiced')])),
                 ('date', models.DateTimeField()),
                 ('amount', models.FloatField(default=0.0)),
                 ('coreHours', models.FloatField(default=0.0)),
-                ('account', models.ForeignKey(related_name=b'charges', to='core.Account')),
+                ('account', models.ForeignKey(
+                    related_name=b'charges', to='core.Account')),
             ],
             options={
                 'abstract': False,
@@ -89,20 +114,33 @@
         migrations.CreateModel(
             name='Controller',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.CharField(help_text=b'Name of the Controller', unique=True, max_length=200)),
-                ('backend_type', models.CharField(help_text=b'Type of compute controller, e.g. EC2, OpenStack, or OpenStack version', max_length=200)),
-                ('version', models.CharField(help_text=b'Controller version', max_length=200)),
-                ('auth_url', models.CharField(help_text=b'Auth url for the compute controller', max_length=200, null=True, blank=True)),
-                ('admin_user', models.CharField(help_text=b'Username of an admin user at this controller', max_length=200, null=True, blank=True)),
-                ('admin_password', models.CharField(help_text=b'Password of theadmin user at this controller', max_length=200, null=True, blank=True)),
-                ('admin_tenant', models.CharField(help_text=b'Name of the tenant the admin user belongs to', max_length=200, null=True, blank=True)),
+                ('name', models.CharField(
+                    help_text=b'Name of the Controller', unique=True, max_length=200)),
+                ('backend_type', models.CharField(
+                    help_text=b'Type of compute controller, e.g. EC2, OpenStack, or OpenStack version', max_length=200)),
+                ('version', models.CharField(
+                    help_text=b'Controller version', max_length=200)),
+                ('auth_url', models.CharField(
+                    help_text=b'Auth url for the compute controller', max_length=200, null=True, blank=True)),
+                ('admin_user', models.CharField(
+                    help_text=b'Username of an admin user at this controller', max_length=200, null=True, blank=True)),
+                ('admin_password', models.CharField(
+                    help_text=b'Password of theadmin user at this controller', max_length=200, null=True, blank=True)),
+                ('admin_tenant', models.CharField(
+                    help_text=b'Name of the tenant the admin user belongs to', max_length=200, null=True, blank=True)),
             ],
             options={
                 'abstract': False,
@@ -112,17 +150,27 @@
         migrations.CreateModel(
             name='ControllerCredential',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.SlugField(help_text=b'The credential type, e.g. ec2', max_length=128)),
-                ('key_id', models.CharField(help_text=b'The backend id of this credential', max_length=1024)),
-                ('enc_value', encrypted_fields.fields.EncryptedCharField(help_text=b'The key value of this credential', max_length=1024)),
-                ('controller', models.ForeignKey(related_name=b'controllercredentials', to='core.Controller', help_text=b'The User this credential is associated with')),
+                ('name', models.SlugField(
+                    help_text=b'The credential type, e.g. ec2', max_length=128)),
+                ('key_id', models.CharField(
+                    help_text=b'The backend id of this credential', max_length=1024)),
+                ('enc_value', encrypted_fields.fields.EncryptedCharField(
+                    help_text=b'The key value of this credential', max_length=1024)),
+                ('controller', models.ForeignKey(related_name=b'controllercredentials',
+                                                 to='core.Controller', help_text=b'The User this credential is associated with')),
             ],
             options={
                 'abstract': False,
@@ -132,16 +180,23 @@
         migrations.CreateModel(
             name='ControllerDashboardView',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('enabled', models.BooleanField(default=True)),
                 ('url', models.CharField(help_text=b'URL of Dashboard', max_length=1024)),
-                ('controller', models.ForeignKey(related_name=b'controllerdashboardviews', to='core.Controller')),
+                ('controller', models.ForeignKey(
+                    related_name=b'controllerdashboardviews', to='core.Controller')),
             ],
             options={
                 'abstract': False,
@@ -151,15 +206,23 @@
         migrations.CreateModel(
             name='ControllerImages',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('glance_image_id', models.CharField(help_text=b'Glance image id', max_length=200, null=True, blank=True)),
-                ('controller', models.ForeignKey(related_name=b'controllerimages', to='core.Controller')),
+                ('glance_image_id', models.CharField(
+                    help_text=b'Glance image id', max_length=200, null=True, blank=True)),
+                ('controller', models.ForeignKey(
+                    related_name=b'controllerimages', to='core.Controller')),
             ],
             options={
                 'abstract': False,
@@ -169,18 +232,28 @@
         migrations.CreateModel(
             name='ControllerNetwork',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('net_id', models.CharField(help_text=b'Quantum network', max_length=256, null=True, blank=True)),
-                ('router_id', models.CharField(help_text=b'Quantum router id', max_length=256, null=True, blank=True)),
-                ('subnet_id', models.CharField(help_text=b'Quantum subnet id', max_length=256, null=True, blank=True)),
+                ('net_id', models.CharField(help_text=b'Quantum network',
+                                            max_length=256, null=True, blank=True)),
+                ('router_id', models.CharField(help_text=b'Quantum router id',
+                                               max_length=256, null=True, blank=True)),
+                ('subnet_id', models.CharField(help_text=b'Quantum subnet id',
+                                               max_length=256, null=True, blank=True)),
                 ('subnet', models.CharField(max_length=32, blank=True)),
-                ('controller', models.ForeignKey(related_name=b'controllernetworks', to='core.Controller')),
+                ('controller', models.ForeignKey(
+                    related_name=b'controllernetworks', to='core.Controller')),
             ],
             options={
                 'abstract': False,
@@ -190,14 +263,21 @@
         migrations.CreateModel(
             name='ControllerRole',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('role', models.CharField(unique=True, max_length=30, choices=[(b'admin', b'Admin')])),
+                ('role', models.CharField(unique=True,
+                                          max_length=30, choices=[(b'admin', b'Admin')])),
             ],
             options={
                 'abstract': False,
@@ -207,15 +287,23 @@
         migrations.CreateModel(
             name='ControllerSite',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('tenant_id', models.CharField(help_text=b'Keystone tenant id', max_length=200, null=True, db_index=True, blank=True)),
-                ('controller', models.ForeignKey(related_name=b'controllersite', blank=True, to='core.Controller', null=True)),
+                ('tenant_id', models.CharField(help_text=b'Keystone tenant id',
+                                               max_length=200, null=True, db_index=True, blank=True)),
+                ('controller', models.ForeignKey(related_name=b'controllersite',
+                                                 blank=True, to='core.Controller', null=True)),
             ],
             options={
                 'abstract': False,
@@ -225,15 +313,23 @@
         migrations.CreateModel(
             name='ControllerSitePrivilege',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('role_id', models.CharField(help_text=b'Keystone id', max_length=200, null=True, db_index=True, blank=True)),
-                ('controller', models.ForeignKey(related_name=b'controllersiteprivileges', to='core.Controller')),
+                ('role_id', models.CharField(help_text=b'Keystone id',
+                                             max_length=200, null=True, db_index=True, blank=True)),
+                ('controller', models.ForeignKey(
+                    related_name=b'controllersiteprivileges', to='core.Controller')),
             ],
             options={
                 'abstract': False,
@@ -243,15 +339,23 @@
         migrations.CreateModel(
             name='ControllerSlice',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('tenant_id', models.CharField(help_text=b'Keystone tenant id', max_length=200, null=True, blank=True)),
-                ('controller', models.ForeignKey(related_name=b'controllerslices', to='core.Controller')),
+                ('tenant_id', models.CharField(
+                    help_text=b'Keystone tenant id', max_length=200, null=True, blank=True)),
+                ('controller', models.ForeignKey(
+                    related_name=b'controllerslices', to='core.Controller')),
             ],
             options={
                 'abstract': False,
@@ -261,15 +365,23 @@
         migrations.CreateModel(
             name='ControllerSlicePrivilege',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('role_id', models.CharField(help_text=b'Keystone id', max_length=200, null=True, db_index=True, blank=True)),
-                ('controller', models.ForeignKey(related_name=b'controllersliceprivileges', to='core.Controller')),
+                ('role_id', models.CharField(help_text=b'Keystone id',
+                                             max_length=200, null=True, db_index=True, blank=True)),
+                ('controller', models.ForeignKey(
+                    related_name=b'controllersliceprivileges', to='core.Controller')),
             ],
             options={
                 'abstract': False,
@@ -279,16 +391,25 @@
         migrations.CreateModel(
             name='ControllerUser',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('kuser_id', models.CharField(help_text=b'Keystone user id', max_length=200, null=True, blank=True)),
-                ('controller', models.ForeignKey(related_name=b'controllersusers', to='core.Controller')),
-                ('user', models.ForeignKey(related_name=b'controllerusers', to=settings.AUTH_USER_MODEL)),
+                ('kuser_id', models.CharField(help_text=b'Keystone user id',
+                                              max_length=200, null=True, blank=True)),
+                ('controller', models.ForeignKey(
+                    related_name=b'controllersusers', to='core.Controller')),
+                ('user', models.ForeignKey(
+                    related_name=b'controllerusers', to=settings.AUTH_USER_MODEL)),
             ],
             options={
                 'abstract': False,
@@ -298,17 +419,25 @@
         migrations.CreateModel(
             name='DashboardView',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.CharField(help_text=b'Name of the View', unique=True, max_length=200)),
+                ('name', models.CharField(
+                    help_text=b'Name of the View', unique=True, max_length=200)),
                 ('url', models.CharField(help_text=b'URL of Dashboard', max_length=1024)),
                 ('enabled', models.BooleanField(default=True)),
-                ('controllers', models.ManyToManyField(related_name=b'dashboardviews', through='core.ControllerDashboardView', to='core.Controller', blank=True)),
+                ('controllers', models.ManyToManyField(related_name=b'dashboardviews',
+                                                       through='core.ControllerDashboardView', to='core.Controller', blank=True)),
             ],
             options={
                 'abstract': False,
@@ -318,15 +447,23 @@
         migrations.CreateModel(
             name='Deployment',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.CharField(help_text=b'Name of the Deployment', unique=True, max_length=200)),
-                ('accessControl', models.TextField(default=b'allow all', help_text=b'Access control list that specifies which sites/users may use nodes in this deployment', max_length=200)),
+                ('name', models.CharField(
+                    help_text=b'Name of the Deployment', unique=True, max_length=200)),
+                ('accessControl', models.TextField(default=b'allow all',
+                                                   help_text=b'Access control list that specifies which sites/users may use nodes in this deployment', max_length=200)),
             ],
             options={
                 'abstract': False,
@@ -336,14 +473,21 @@
         migrations.CreateModel(
             name='DeploymentPrivilege',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('deployment', models.ForeignKey(related_name=b'deploymentprivileges', to='core.Deployment')),
+                ('deployment', models.ForeignKey(
+                    related_name=b'deploymentprivileges', to='core.Deployment')),
             ],
             options={
                 'abstract': False,
@@ -353,14 +497,21 @@
         migrations.CreateModel(
             name='DeploymentRole',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('role', models.CharField(unique=True, max_length=30, choices=[(b'admin', b'Admin')])),
+                ('role', models.CharField(unique=True,
+                                          max_length=30, choices=[(b'admin', b'Admin')])),
             ],
             options={
                 'abstract': False,
@@ -370,19 +521,31 @@
         migrations.CreateModel(
             name='Flavor',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.CharField(help_text=b'name of this flavor, as displayed to users', max_length=32)),
-                ('description', models.CharField(max_length=1024, null=True, blank=True)),
-                ('flavor', models.CharField(help_text=b'flavor string used to configure deployments', max_length=32)),
-                ('order', models.IntegerField(default=0, help_text=b'used to order flavors when displayed in a list')),
-                ('default', models.BooleanField(default=False, help_text=b'make this a default flavor to use when creating new instances')),
-                ('deployments', models.ManyToManyField(related_name=b'flavors', to='core.Deployment', blank=True)),
+                ('name', models.CharField(
+                    help_text=b'name of this flavor, as displayed to users', max_length=32)),
+                ('description', models.CharField(
+                    max_length=1024, null=True, blank=True)),
+                ('flavor', models.CharField(
+                    help_text=b'flavor string used to configure deployments', max_length=32)),
+                ('order', models.IntegerField(default=0,
+                                              help_text=b'used to order flavors when displayed in a list')),
+                ('default', models.BooleanField(default=False,
+                                                help_text=b'make this a default flavor to use when creating new instances')),
+                ('deployments', models.ManyToManyField(
+                    related_name=b'flavors', to='core.Deployment', blank=True)),
             ],
             options={
                 'ordering': ('order', 'name'),
@@ -392,17 +555,24 @@
         migrations.CreateModel(
             name='Image',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('name', models.CharField(unique=True, max_length=256)),
                 ('disk_format', models.CharField(max_length=256)),
                 ('container_format', models.CharField(max_length=256)),
-                ('path', models.CharField(help_text=b'Path to image on local disk', max_length=256, null=True, blank=True)),
+                ('path', models.CharField(help_text=b'Path to image on local disk',
+                                          max_length=256, null=True, blank=True)),
             ],
             options={
                 'abstract': False,
@@ -412,15 +582,23 @@
         migrations.CreateModel(
             name='ImageDeployments',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('deployment', models.ForeignKey(related_name=b'imagedeployments', to='core.Deployment')),
-                ('image', models.ForeignKey(related_name=b'imagedeployments', to='core.Image')),
+                ('deployment', models.ForeignKey(
+                    related_name=b'imagedeployments', to='core.Deployment')),
+                ('image', models.ForeignKey(
+                    related_name=b'imagedeployments', to='core.Image')),
             ],
             options={
                 'abstract': False,
@@ -430,15 +608,22 @@
         migrations.CreateModel(
             name='Invoice',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('date', models.DateTimeField()),
-                ('account', models.ForeignKey(related_name=b'invoices', to='core.Account')),
+                ('account', models.ForeignKey(
+                    related_name=b'invoices', to='core.Account')),
             ],
             options={
                 'abstract': False,
@@ -448,25 +633,36 @@
         migrations.CreateModel(
             name='Network',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('name', models.CharField(max_length=32)),
                 ('subnet', models.CharField(max_length=32, blank=True)),
-                ('ports', models.CharField(blank=True, max_length=1024, null=True, validators=[core.models.network.ValidateNatList])),
+                ('ports', models.CharField(blank=True, max_length=1024,
+                                           null=True, validators=[core.models.network.ValidateNatList])),
                 ('labels', models.CharField(max_length=1024, null=True, blank=True)),
                 ('guaranteed_bandwidth', models.IntegerField(default=0)),
                 ('permit_all_slices', models.BooleanField(default=False)),
                 ('topology_parameters', models.TextField(null=True, blank=True)),
-                ('controller_url', models.CharField(max_length=1024, null=True, blank=True)),
+                ('controller_url', models.CharField(
+                    max_length=1024, null=True, blank=True)),
                 ('controller_parameters', models.TextField(null=True, blank=True)),
-                ('network_id', models.CharField(help_text=b'Quantum network', max_length=256, null=True, blank=True)),
-                ('router_id', models.CharField(help_text=b'Quantum router id', max_length=256, null=True, blank=True)),
-                ('subnet_id', models.CharField(help_text=b'Quantum subnet id', max_length=256, null=True, blank=True)),
+                ('network_id', models.CharField(help_text=b'Quantum network',
+                                                max_length=256, null=True, blank=True)),
+                ('router_id', models.CharField(help_text=b'Quantum router id',
+                                               max_length=256, null=True, blank=True)),
+                ('subnet_id', models.CharField(help_text=b'Quantum subnet id',
+                                               max_length=256, null=True, blank=True)),
             ],
             options={
                 'abstract': False,
@@ -476,14 +672,21 @@
         migrations.CreateModel(
             name='NetworkParameter',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('value', models.CharField(help_text=b'The value of this parameter', max_length=1024)),
+                ('value', models.CharField(
+                    help_text=b'The value of this parameter', max_length=1024)),
                 ('object_id', models.PositiveIntegerField()),
                 ('content_type', models.ForeignKey(to='contenttypes.ContentType')),
             ],
@@ -495,14 +698,21 @@
         migrations.CreateModel(
             name='NetworkParameterType',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.SlugField(help_text=b'The name of this parameter', max_length=128)),
+                ('name', models.SlugField(
+                    help_text=b'The name of this parameter', max_length=128)),
                 ('description', models.CharField(max_length=1024)),
             ],
             options={
@@ -513,14 +723,21 @@
         migrations.CreateModel(
             name='NetworkSlice',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('network', models.ForeignKey(related_name=b'networkslices', to='core.Network')),
+                ('network', models.ForeignKey(
+                    related_name=b'networkslices', to='core.Network')),
             ],
             options={
                 'abstract': False,
@@ -530,16 +747,25 @@
         migrations.CreateModel(
             name='NetworkInstance',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('ip', models.GenericIPAddressField(help_text=b'Instance ip address', null=True, blank=True)),
-                ('port_id', models.CharField(help_text=b'Quantum port id', max_length=256, null=True, blank=True)),
-                ('network', models.ForeignKey(related_name=b'networkinstances', to='core.Network')),
+                ('ip', models.GenericIPAddressField(
+                    help_text=b'Instance ip address', null=True, blank=True)),
+                ('port_id', models.CharField(help_text=b'Quantum port id',
+                                             max_length=256, null=True, blank=True)),
+                ('network', models.ForeignKey(
+                    related_name=b'networkinstances', to='core.Network')),
             ],
             options={
                 'abstract': False,
@@ -549,22 +775,35 @@
         migrations.CreateModel(
             name='NetworkTemplate',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('name', models.CharField(max_length=32)),
-                ('description', models.CharField(max_length=1024, null=True, blank=True)),
+                ('description', models.CharField(
+                    max_length=1024, null=True, blank=True)),
                 ('guaranteed_bandwidth', models.IntegerField(default=0)),
-                ('visibility', models.CharField(default=b'private', max_length=30, choices=[(b'public', b'public'), (b'private', b'private')])),
-                ('translation', models.CharField(default=b'none', max_length=30, choices=[(b'none', b'none'), (b'NAT', b'NAT')])),
-                ('shared_network_name', models.CharField(max_length=30, null=True, blank=True)),
-                ('shared_network_id', models.CharField(help_text=b'Quantum network', max_length=256, null=True, blank=True)),
-                ('topology_kind', models.CharField(default=b'BigSwitch', max_length=30, choices=[(b'bigswitch', b'BigSwitch'), (b'physical', b'Physical'), (b'custom', b'Custom')])),
-                ('controller_kind', models.CharField(default=None, max_length=30, null=True, blank=True, choices=[(None, b'None'), (b'onos', b'ONOS'), (b'custom', b'Custom')])),
+                ('visibility', models.CharField(default=b'private', max_length=30,
+                                                choices=[(b'public', b'public'), (b'private', b'private')])),
+                ('translation', models.CharField(default=b'none', max_length=30,
+                                                 choices=[(b'none', b'none'), (b'NAT', b'NAT')])),
+                ('shared_network_name', models.CharField(
+                    max_length=30, null=True, blank=True)),
+                ('shared_network_id', models.CharField(
+                    help_text=b'Quantum network', max_length=256, null=True, blank=True)),
+                ('topology_kind', models.CharField(default=b'BigSwitch', max_length=30, choices=[
+                 (b'bigswitch', b'BigSwitch'), (b'physical', b'Physical'), (b'custom', b'Custom')])),
+                ('controller_kind', models.CharField(default=None, max_length=30, null=True,
+                                                     blank=True, choices=[(None, b'None'), (b'onos', b'ONOS'), (b'custom', b'Custom')])),
             ],
             options={
                 'abstract': False,
@@ -574,14 +813,21 @@
         migrations.CreateModel(
             name='Node',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.CharField(help_text=b'Name of the Node', unique=True, max_length=200)),
+                ('name', models.CharField(
+                    help_text=b'Name of the Node', unique=True, max_length=200)),
             ],
             options={
                 'abstract': False,
@@ -591,16 +837,23 @@
         migrations.CreateModel(
             name='Payment',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('amount', models.FloatField(default=0.0)),
                 ('date', models.DateTimeField(default=django.utils.timezone.now)),
-                ('account', models.ForeignKey(related_name=b'payments', to='core.Account')),
+                ('account', models.ForeignKey(
+                    related_name=b'payments', to='core.Account')),
             ],
             options={
                 'abstract': False,
@@ -610,14 +863,21 @@
         migrations.CreateModel(
             name='PlanetStack',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('description', models.CharField(default=b'PlanetStack', help_text=b'Used for scoping of roles at the PlanetStack Application level', unique=True, max_length=200)),
+                ('description', models.CharField(default=b'PlanetStack',
+                                                 help_text=b'Used for scoping of roles at the PlanetStack Application level', unique=True, max_length=200)),
             ],
             options={
                 'verbose_name_plural': 'PlanetStack',
@@ -627,14 +887,21 @@
         migrations.CreateModel(
             name='PlanetStackPrivilege',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('planetstack', models.ForeignKey(related_name=b'planetstackprivileges', default=1, to='core.PlanetStack')),
+                ('planetstack', models.ForeignKey(
+                    related_name=b'planetstackprivileges', default=1, to='core.PlanetStack')),
             ],
             options={
                 'abstract': False,
@@ -644,14 +911,21 @@
         migrations.CreateModel(
             name='PlanetStackRole',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('role', models.CharField(unique=True, max_length=30, choices=[(b'admin', b'Admin')])),
+                ('role', models.CharField(unique=True,
+                                          max_length=30, choices=[(b'admin', b'Admin')])),
             ],
             options={
                 'abstract': False,
@@ -661,14 +935,21 @@
         migrations.CreateModel(
             name='Project',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.CharField(help_text=b'Name of Project', unique=True, max_length=200)),
+                ('name', models.CharField(
+                    help_text=b'Name of Project', unique=True, max_length=200)),
             ],
             options={
                 'abstract': False,
@@ -678,12 +959,18 @@
         migrations.CreateModel(
             name='Reservation',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('startTime', models.DateTimeField()),
                 ('duration', models.IntegerField(default=1)),
@@ -696,15 +983,22 @@
         migrations.CreateModel(
             name='ReservedResource',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('quantity', models.IntegerField(default=1)),
-                ('reservationSet', models.ForeignKey(related_name=b'reservedresources', to='core.Reservation')),
+                ('reservationSet', models.ForeignKey(
+                    related_name=b'reservedresources', to='core.Reservation')),
             ],
             options={
                 'abstract': False,
@@ -715,17 +1009,26 @@
         migrations.CreateModel(
             name='Role',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('role_type', models.CharField(max_length=80, verbose_name=b'Name')),
-                ('role', models.CharField(max_length=80, null=True, verbose_name=b'Keystone role id', blank=True)),
-                ('description', models.CharField(max_length=120, verbose_name=b'Description')),
-                ('content_type', models.ForeignKey(verbose_name=b'Role Scope', to='contenttypes.ContentType')),
+                ('role', models.CharField(max_length=80, null=True,
+                                          verbose_name=b'Keystone role id', blank=True)),
+                ('description', models.CharField(
+                    max_length=120, verbose_name=b'Description')),
+                ('content_type', models.ForeignKey(
+                    verbose_name=b'Role Scope', to='contenttypes.ContentType')),
             ],
             options={
                 'abstract': False,
@@ -735,15 +1038,22 @@
         migrations.CreateModel(
             name='Router',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('name', models.CharField(max_length=32)),
-                ('networks', models.ManyToManyField(related_name=b'routers', to='core.Network', blank=True)),
+                ('networks', models.ManyToManyField(
+                    related_name=b'routers', to='core.Network', blank=True)),
             ],
             options={
                 'abstract': False,
@@ -753,17 +1063,25 @@
         migrations.CreateModel(
             name='Service',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('description', models.TextField(help_text=b'Description of Service', max_length=254, null=True, blank=True)),
+                ('description', models.TextField(
+                    help_text=b'Description of Service', max_length=254, null=True, blank=True)),
                 ('enabled', models.BooleanField(default=True)),
                 ('name', models.CharField(help_text=b'Service Name', max_length=30)),
-                ('versionNumber', models.CharField(help_text=b'Version of Service Definition', max_length=30)),
+                ('versionNumber', models.CharField(
+                    help_text=b'Version of Service Definition', max_length=30)),
                 ('published', models.BooleanField(default=True)),
             ],
             options={
@@ -774,16 +1092,24 @@
         migrations.CreateModel(
             name='ServiceAttribute',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('name', models.SlugField(help_text=b'Attribute Name', max_length=128)),
-                ('value', models.CharField(help_text=b'Attribute Value', max_length=1024)),
-                ('service', models.ForeignKey(related_name=b'serviceattributes', to='core.Service', help_text=b'The Service this attribute is associated with')),
+                ('value', models.CharField(
+                    help_text=b'Attribute Value', max_length=1024)),
+                ('service', models.ForeignKey(related_name=b'serviceattributes',
+                                              to='core.Service', help_text=b'The Service this attribute is associated with')),
             ],
             options={
                 'abstract': False,
@@ -793,12 +1119,18 @@
         migrations.CreateModel(
             name='ServiceClass',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('name', models.CharField(max_length=32)),
                 ('description', models.CharField(max_length=255)),
@@ -806,7 +1138,8 @@
                 ('membershipFee', models.IntegerField(default=0)),
                 ('membershipFeeMonths', models.IntegerField(default=12)),
                 ('upgradeRequiresApproval', models.BooleanField(default=False)),
-                ('upgradeFrom', models.ManyToManyField(related_name='upgradeFrom_rel_+', null=True, to='core.ServiceClass', blank=True)),
+                ('upgradeFrom', models.ManyToManyField(
+                    related_name='upgradeFrom_rel_+', null=True, to='core.ServiceClass', blank=True)),
             ],
             options={
                 'abstract': False,
@@ -817,12 +1150,18 @@
         migrations.CreateModel(
             name='ServiceResource',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('name', models.CharField(max_length=32)),
                 ('maxUnitsDeployment', models.IntegerField(default=1)),
@@ -832,7 +1171,8 @@
                 ('bucketMaxSize', models.IntegerField(default=0)),
                 ('cost', models.IntegerField(default=0)),
                 ('calendarReservable', models.BooleanField(default=True)),
-                ('serviceClass', models.ForeignKey(related_name=b'serviceresources', to='core.ServiceClass')),
+                ('serviceClass', models.ForeignKey(
+                    related_name=b'serviceresources', to='core.ServiceClass')),
             ],
             options={
                 'abstract': False,
@@ -842,21 +1182,32 @@
         migrations.CreateModel(
             name='Site',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.CharField(help_text=b'Name for this Site', max_length=200)),
-                ('site_url', models.URLField(help_text=b"Site's Home URL Page", max_length=512, null=True, blank=True)),
-                ('enabled', models.BooleanField(default=True, help_text=b'Status for this Site')),
+                ('name', models.CharField(
+                    help_text=b'Name for this Site', max_length=200)),
+                ('site_url', models.URLField(help_text=b"Site's Home URL Page",
+                                             max_length=512, null=True, blank=True)),
+                ('enabled', models.BooleanField(
+                    default=True, help_text=b'Status for this Site')),
                 ('location', geoposition.fields.GeopositionField(max_length=42)),
                 ('longitude', models.FloatField(null=True, blank=True)),
                 ('latitude', models.FloatField(null=True, blank=True)),
-                ('login_base', models.CharField(help_text=b'Prefix for Slices associated with this Site', unique=True, max_length=50)),
-                ('is_public', models.BooleanField(default=True, help_text=b'Indicates the visibility of this site to other members')),
+                ('login_base', models.CharField(
+                    help_text=b'Prefix for Slices associated with this Site', unique=True, max_length=50)),
+                ('is_public', models.BooleanField(
+                    default=True, help_text=b'Indicates the visibility of this site to other members')),
                 ('abbreviated_name', models.CharField(max_length=80)),
             ],
             options={
@@ -867,17 +1218,27 @@
         migrations.CreateModel(
             name='SiteCredential',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.SlugField(help_text=b'The credential type, e.g. ec2', max_length=128)),
-                ('key_id', models.CharField(help_text=b'The backend id of this credential', max_length=1024)),
-                ('enc_value', encrypted_fields.fields.EncryptedCharField(help_text=b'The key value of this credential', max_length=1024)),
-                ('site', models.ForeignKey(related_name=b'sitecredentials', to='core.Site', help_text=b'The User this credential is associated with')),
+                ('name', models.SlugField(
+                    help_text=b'The credential type, e.g. ec2', max_length=128)),
+                ('key_id', models.CharField(
+                    help_text=b'The backend id of this credential', max_length=1024)),
+                ('enc_value', encrypted_fields.fields.EncryptedCharField(
+                    help_text=b'The key value of this credential', max_length=1024)),
+                ('site', models.ForeignKey(related_name=b'sitecredentials', to='core.Site',
+                                           help_text=b'The User this credential is associated with')),
             ],
             options={
                 'abstract': False,
@@ -887,17 +1248,27 @@
         migrations.CreateModel(
             name='SiteDeployment',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('availability_zone', models.CharField(help_text=b'OpenStack availability zone', max_length=200, null=True, blank=True)),
-                ('controller', models.ForeignKey(related_name=b'sitedeployments', blank=True, to='core.Controller', null=True)),
-                ('deployment', models.ForeignKey(related_name=b'sitedeployments', to='core.Deployment')),
-                ('site', models.ForeignKey(related_name=b'sitedeployments', to='core.Site')),
+                ('availability_zone', models.CharField(
+                    help_text=b'OpenStack availability zone', max_length=200, null=True, blank=True)),
+                ('controller', models.ForeignKey(
+                    related_name=b'sitedeployments', blank=True, to='core.Controller', null=True)),
+                ('deployment', models.ForeignKey(
+                    related_name=b'sitedeployments', to='core.Deployment')),
+                ('site', models.ForeignKey(
+                    related_name=b'sitedeployments', to='core.Site')),
             ],
             options={
                 'abstract': False,
@@ -907,12 +1278,18 @@
         migrations.CreateModel(
             name='SitePrivilege',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
             ],
             options={
@@ -923,14 +1300,21 @@
         migrations.CreateModel(
             name='SiteRole',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('role', models.CharField(unique=True, max_length=30, choices=[(b'admin', b'Admin'), (b'pi', b'PI'), (b'tech', b'Tech'), (b'billing', b'Billing')])),
+                ('role', models.CharField(unique=True, max_length=30, choices=[
+                 (b'admin', b'Admin'), (b'pi', b'PI'), (b'tech', b'Tech'), (b'billing', b'Billing')])),
             ],
             options={
                 'abstract': False,
@@ -940,27 +1324,44 @@
         migrations.CreateModel(
             name='Slice',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.CharField(help_text=b'The Name of the Slice', unique=True, max_length=80)),
-                ('enabled', models.BooleanField(default=True, help_text=b'Status for this Slice')),
+                ('name', models.CharField(
+                    help_text=b'The Name of the Slice', unique=True, max_length=80)),
+                ('enabled', models.BooleanField(
+                    default=True, help_text=b'Status for this Slice')),
                 ('omf_friendly', models.BooleanField(default=False)),
-                ('description', models.TextField(help_text=b'High level description of the slice and expected activities', max_length=1024, blank=True)),
+                ('description', models.TextField(
+                    help_text=b'High level description of the slice and expected activities', max_length=1024, blank=True)),
                 ('slice_url', models.URLField(max_length=512, blank=True)),
                 ('max_instances', models.IntegerField(default=10)),
-                ('network', models.CharField(default=b'Private Only', max_length=256, null=True, blank=True)),
-                ('mount_data_sets', models.CharField(default=b'GenBank', max_length=256, null=True, blank=True)),
-                ('creator', models.ForeignKey(related_name=b'slices', blank=True, to=settings.AUTH_USER_MODEL, null=True)),
-                ('default_flavor', models.ForeignKey(related_name=b'slices', blank=True, to='core.Flavor', null=True)),
-                ('default_image', models.ForeignKey(related_name=b'slices', blank=True, to='core.Image', null=True)),
-                ('service', models.ForeignKey(related_name=b'service', blank=True, to='core.Service', null=True)),
-                ('serviceClass', models.ForeignKey(related_name=b'slices', default=core.models.serviceclass.get_default_serviceclass, to='core.ServiceClass', null=True)),
-                ('site', models.ForeignKey(related_name=b'slices', to='core.Site', help_text=b'The Site this Slice belongs to')),
+                ('network', models.CharField(default=b'Private Only',
+                                             max_length=256, null=True, blank=True)),
+                ('mount_data_sets', models.CharField(
+                    default=b'GenBank', max_length=256, null=True, blank=True)),
+                ('creator', models.ForeignKey(related_name=b'slices',
+                                              blank=True, to=settings.AUTH_USER_MODEL, null=True)),
+                ('default_flavor', models.ForeignKey(
+                    related_name=b'slices', blank=True, to='core.Flavor', null=True)),
+                ('default_image', models.ForeignKey(
+                    related_name=b'slices', blank=True, to='core.Image', null=True)),
+                ('service', models.ForeignKey(related_name=b'service',
+                                              blank=True, to='core.Service', null=True)),
+                ('serviceClass', models.ForeignKey(related_name=b'slices',
+                                                   default=core.models.serviceclass.get_default_serviceclass, to='core.ServiceClass', null=True)),
+                ('site', models.ForeignKey(related_name=b'slices',
+                                           to='core.Site', help_text=b'The Site this Slice belongs to')),
             ],
             options={
                 'abstract': False,
@@ -970,17 +1371,27 @@
         migrations.CreateModel(
             name='SliceCredential',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.SlugField(help_text=b'The credential type, e.g. ec2', max_length=128)),
-                ('key_id', models.CharField(help_text=b'The backend id of this credential', max_length=1024)),
-                ('enc_value', encrypted_fields.fields.EncryptedCharField(help_text=b'The key value of this credential', max_length=1024)),
-                ('slice', models.ForeignKey(related_name=b'slicecredentials', to='core.Slice', help_text=b'The User this credential is associated with')),
+                ('name', models.SlugField(
+                    help_text=b'The credential type, e.g. ec2', max_length=128)),
+                ('key_id', models.CharField(
+                    help_text=b'The backend id of this credential', max_length=1024)),
+                ('enc_value', encrypted_fields.fields.EncryptedCharField(
+                    help_text=b'The key value of this credential', max_length=1024)),
+                ('slice', models.ForeignKey(related_name=b'slicecredentials',
+                                            to='core.Slice', help_text=b'The User this credential is associated with')),
             ],
             options={
                 'abstract': False,
@@ -990,12 +1401,18 @@
         migrations.CreateModel(
             name='SlicePrivilege',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
             ],
             options={
@@ -1006,14 +1423,21 @@
         migrations.CreateModel(
             name='SliceRole',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('role', models.CharField(unique=True, max_length=30, choices=[(b'admin', b'Admin'), (b'default', b'Default')])),
+                ('role', models.CharField(unique=True, max_length=30,
+                                          choices=[(b'admin', b'Admin'), (b'default', b'Default')])),
             ],
             options={
                 'abstract': False,
@@ -1023,16 +1447,25 @@
         migrations.CreateModel(
             name='SliceTag',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.CharField(help_text=b'The name of this tag', max_length=30, choices=[(b'privatekey', b'Private Key'), (b'publickey', b'Public Key')])),
-                ('value', models.CharField(help_text=b'The value of this tag', max_length=1024)),
-                ('slice', models.ForeignKey(related_name=b'slicetags', to='core.Slice')),
+                ('name', models.CharField(help_text=b'The name of this tag', max_length=30, choices=[
+                 (b'privatekey', b'Private Key'), (b'publickey', b'Public Key')])),
+                ('value', models.CharField(
+                    help_text=b'The value of this tag', max_length=1024)),
+                ('slice', models.ForeignKey(
+                    related_name=b'slicetags', to='core.Slice')),
             ],
             options={
                 'abstract': False,
@@ -1042,26 +1475,43 @@
         migrations.CreateModel(
             name='Instance',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('instance_id', models.CharField(help_text=b'Nova instance id', max_length=200, null=True, blank=True)),
-                ('instance_uuid', models.CharField(help_text=b'Nova instance uuid', max_length=200, null=True, blank=True)),
+                ('instance_id', models.CharField(
+                    help_text=b'Nova instance id', max_length=200, null=True, blank=True)),
+                ('instance_uuid', models.CharField(
+                    help_text=b'Nova instance uuid', max_length=200, null=True, blank=True)),
                 ('name', models.CharField(help_text=b'Instance name', max_length=200)),
-                ('instance_name', models.CharField(help_text=b'OpenStack generated name', max_length=200, null=True, blank=True)),
-                ('ip', models.GenericIPAddressField(help_text=b'Instance ip address', null=True, blank=True)),
-                ('numberCores', models.IntegerField(default=0, help_text=b'Number of cores for instance', verbose_name=b'Number of Cores')),
-                ('userData', models.TextField(help_text=b'user_data passed to instance during creation', null=True, blank=True)),
-                ('creator', models.ForeignKey(related_name=b'instances', blank=True, to=settings.AUTH_USER_MODEL, null=True)),
-                ('deployment', models.ForeignKey(related_name=b'instance_deployment', verbose_name=b'deployment', to='core.Deployment')),
-                ('flavor', models.ForeignKey(default=core.models.instance.get_default_flavor, to='core.Flavor', help_text=b'Flavor of this instance')),
-                ('image', models.ForeignKey(related_name=b'instances', to='core.Image')),
+                ('instance_name', models.CharField(
+                    help_text=b'OpenStack generated name', max_length=200, null=True, blank=True)),
+                ('ip', models.GenericIPAddressField(
+                    help_text=b'Instance ip address', null=True, blank=True)),
+                ('numberCores', models.IntegerField(
+                    default=0, help_text=b'Number of cores for instance', verbose_name=b'Number of Cores')),
+                ('userData', models.TextField(
+                    help_text=b'user_data passed to instance during creation', null=True, blank=True)),
+                ('creator', models.ForeignKey(related_name=b'instances',
+                                              blank=True, to=settings.AUTH_USER_MODEL, null=True)),
+                ('deployment', models.ForeignKey(related_name=b'instance_deployment',
+                                                 verbose_name=b'deployment', to='core.Deployment')),
+                ('flavor', models.ForeignKey(default=core.models.instance.get_default_flavor,
+                                             to='core.Flavor', help_text=b'Flavor of this instance')),
+                ('image', models.ForeignKey(
+                    related_name=b'instances', to='core.Image')),
                 ('node', models.ForeignKey(related_name=b'instances', to='core.Node')),
-                ('slice', models.ForeignKey(related_name=b'instances', to='core.Slice')),
+                ('slice', models.ForeignKey(
+                    related_name=b'instances', to='core.Slice')),
             ],
             options={
                 'abstract': False,
@@ -1071,18 +1521,27 @@
         migrations.CreateModel(
             name='Tag',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.SlugField(help_text=b'The name of this tag', max_length=128)),
-                ('value', models.CharField(help_text=b'The value of this tag', max_length=1024)),
+                ('name', models.SlugField(
+                    help_text=b'The name of this tag', max_length=128)),
+                ('value', models.CharField(
+                    help_text=b'The value of this tag', max_length=1024)),
                 ('object_id', models.PositiveIntegerField()),
                 ('content_type', models.ForeignKey(to='contenttypes.ContentType')),
-                ('service', models.ForeignKey(related_name=b'tags', to='core.Service', help_text=b'The Service this Tag is associated with')),
+                ('service', models.ForeignKey(related_name=b'tags', to='core.Service',
+                                              help_text=b'The Service this Tag is associated with')),
             ],
             options={
                 'abstract': False,
@@ -1092,12 +1551,18 @@
         migrations.CreateModel(
             name='UsableObject',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('name', models.CharField(max_length=1024)),
             ],
@@ -1109,17 +1574,27 @@
         migrations.CreateModel(
             name='UserCredential',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
-                ('name', models.SlugField(help_text=b'The credential type, e.g. ec2', max_length=128)),
-                ('key_id', models.CharField(help_text=b'The backend id of this credential', max_length=1024)),
-                ('enc_value', encrypted_fields.fields.EncryptedCharField(help_text=b'The key value of this credential', max_length=1024)),
-                ('user', models.ForeignKey(related_name=b'usercredentials', to=settings.AUTH_USER_MODEL, help_text=b'The User this credential is associated with')),
+                ('name', models.SlugField(
+                    help_text=b'The credential type, e.g. ec2', max_length=128)),
+                ('key_id', models.CharField(
+                    help_text=b'The backend id of this credential', max_length=1024)),
+                ('enc_value', encrypted_fields.fields.EncryptedCharField(
+                    help_text=b'The key value of this credential', max_length=1024)),
+                ('user', models.ForeignKey(related_name=b'usercredentials', to=settings.AUTH_USER_MODEL,
+                                           help_text=b'The User this credential is associated with')),
             ],
             options={
                 'abstract': False,
@@ -1129,16 +1604,70 @@
         migrations.CreateModel(
             name='UserDashboardView',
             fields=[
-                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
-                ('created', models.DateTimeField(default=django.utils.timezone.now, auto_now_add=True)),
-                ('updated', models.DateTimeField(default=django.utils.timezone.now, auto_now=True)),
-                ('enacted', models.DateTimeField(default=None, null=True, blank=True)),
-                ('policed', models.DateTimeField(default=None, null=True, blank=True)),
-                ('backend_status', models.CharField(default=b'Provisioning in progress', max_length=140)),
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
                 ('deleted', models.BooleanField(default=False)),
                 ('order', models.IntegerField(default=0)),
-                ('dashboardView', models.ForeignKey(related_name=b'userdashboardviews', to='core.DashboardView')),
-                ('user', models.ForeignKey(related_name=b'userdashboardviews', to=settings.AUTH_USER_MODEL)),
+                ('dashboardView', models.ForeignKey(
+                    related_name=b'userdashboardviews', to='core.DashboardView')),
+                ('user', models.ForeignKey(
+                    related_name=b'userdashboardviews', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'abstract': False,
+            },
+            bases=(models.Model,),
+        ),
+        migrations.CreateModel(
+            name='TenantPrivilege',
+            fields=[
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
+                ('deleted', models.BooleanField(default=False)),
+            ],
+            options={
+                'abstract': False,
+            },
+            bases=(models.Model,),
+        ),
+        migrations.CreateModel(
+            name='TenantRole',
+            fields=[
+                ('id', models.AutoField(verbose_name='ID',
+                                        serialize=False, auto_created=True, primary_key=True)),
+                ('created', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now_add=True)),
+                ('updated', models.DateTimeField(
+                    default=django.utils.timezone.now, auto_now=True)),
+                ('enacted', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('policed', models.DateTimeField(
+                    default=None, null=True, blank=True)),
+                ('backend_status', models.CharField(
+                    default=b'Provisioning in progress', max_length=140)),
+                ('deleted', models.BooleanField(default=False)),
+                ('role', models.CharField(unique=True, max_length=30,
+                                          choices=[(b'admin', b'Admin'), (b'access', b'Access')])),
             ],
             options={
                 'abstract': False,
@@ -1148,43 +1677,50 @@
         migrations.AddField(
             model_name='sliceprivilege',
             name='role',
-            field=models.ForeignKey(related_name=b'sliceprivileges', to='core.SliceRole'),
+            field=models.ForeignKey(
+                related_name=b'sliceprivileges', to='core.SliceRole'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='sliceprivilege',
             name='slice',
-            field=models.ForeignKey(related_name=b'sliceprivileges', to='core.Slice'),
+            field=models.ForeignKey(
+                related_name=b'sliceprivileges', to='core.Slice'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='sliceprivilege',
             name='user',
-            field=models.ForeignKey(related_name=b'sliceprivileges', to=settings.AUTH_USER_MODEL),
+            field=models.ForeignKey(
+                related_name=b'sliceprivileges', to=settings.AUTH_USER_MODEL),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='siteprivilege',
             name='role',
-            field=models.ForeignKey(related_name=b'siteprivileges', to='core.SiteRole'),
+            field=models.ForeignKey(
+                related_name=b'siteprivileges', to='core.SiteRole'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='siteprivilege',
             name='site',
-            field=models.ForeignKey(related_name=b'siteprivileges', to='core.Site'),
+            field=models.ForeignKey(
+                related_name=b'siteprivileges', to='core.Site'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='siteprivilege',
             name='user',
-            field=models.ForeignKey(related_name=b'siteprivileges', to=settings.AUTH_USER_MODEL),
+            field=models.ForeignKey(
+                related_name=b'siteprivileges', to=settings.AUTH_USER_MODEL),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='site',
             name='deployments',
-            field=models.ManyToManyField(help_text=b'Select which sites are allowed to host nodes in this deployment', related_name=b'sites', through='core.SiteDeployment', to='core.Deployment', blank=True),
+            field=models.ManyToManyField(help_text=b'Select which sites are allowed to host nodes in this deployment',
+                                         related_name=b'sites', through='core.SiteDeployment', to='core.Deployment', blank=True),
             preserve_default=True,
         ),
         migrations.AddField(
@@ -1196,25 +1732,29 @@
         migrations.AddField(
             model_name='router',
             name='permittedNetworks',
-            field=models.ManyToManyField(related_name=b'availableRouters', to='core.Network', blank=True),
+            field=models.ManyToManyField(
+                related_name=b'availableRouters', to='core.Network', blank=True),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='reservedresource',
             name='resource',
-            field=models.ForeignKey(related_name=b'reservedresources', to='core.ServiceResource'),
+            field=models.ForeignKey(
+                related_name=b'reservedresources', to='core.ServiceResource'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='reservedresource',
             name='instance',
-            field=models.ForeignKey(related_name=b'reservedresources', to='core.Instance'),
+            field=models.ForeignKey(
+                related_name=b'reservedresources', to='core.Instance'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='reservation',
             name='slice',
-            field=models.ForeignKey(related_name=b'reservations', to='core.Slice'),
+            field=models.ForeignKey(
+                related_name=b'reservations', to='core.Slice'),
             preserve_default=True,
         ),
         migrations.AddField(
@@ -1226,61 +1766,71 @@
         migrations.AddField(
             model_name='planetstackprivilege',
             name='user',
-            field=models.ForeignKey(related_name=b'planetstackprivileges', to=settings.AUTH_USER_MODEL),
+            field=models.ForeignKey(
+                related_name=b'planetstackprivileges', to=settings.AUTH_USER_MODEL),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='node',
             name='site',
-            field=models.ForeignKey(related_name=b'nodes', blank=True, to='core.Site', null=True),
+            field=models.ForeignKey(
+                related_name=b'nodes', blank=True, to='core.Site', null=True),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='node',
             name='site_deployment',
-            field=models.ForeignKey(related_name=b'nodes', to='core.SiteDeployment'),
+            field=models.ForeignKey(
+                related_name=b'nodes', to='core.SiteDeployment'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='networkinstance',
             name='instance',
-            field=models.ForeignKey(related_name=b'networkinstances', to='core.Instance'),
+            field=models.ForeignKey(
+                related_name=b'networkinstances', to='core.Instance'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='networkslice',
             name='slice',
-            field=models.ForeignKey(related_name=b'networkslices', to='core.Slice'),
+            field=models.ForeignKey(
+                related_name=b'networkslices', to='core.Slice'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='networkparameter',
             name='parameter',
-            field=models.ForeignKey(related_name=b'networkparameters', to='core.NetworkParameterType', help_text=b'The type of the parameter'),
+            field=models.ForeignKey(related_name=b'networkparameters',
+                                    to='core.NetworkParameterType', help_text=b'The type of the parameter'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='network',
             name='owner',
-            field=models.ForeignKey(related_name=b'ownedNetworks', to='core.Slice', help_text=b'Slice that owns control of this Network'),
+            field=models.ForeignKey(related_name=b'ownedNetworks', to='core.Slice',
+                                    help_text=b'Slice that owns control of this Network'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='network',
             name='permitted_slices',
-            field=models.ManyToManyField(related_name=b'availableNetworks', to='core.Slice', blank=True),
+            field=models.ManyToManyField(
+                related_name=b'availableNetworks', to='core.Slice', blank=True),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='network',
             name='slices',
-            field=models.ManyToManyField(related_name=b'networks', through='core.NetworkSlice', to='core.Slice', blank=True),
+            field=models.ManyToManyField(
+                related_name=b'networks', through='core.NetworkSlice', to='core.Slice', blank=True),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='network',
             name='instances',
-            field=models.ManyToManyField(related_name=b'networks', through='core.NetworkInstance', to='core.Instance', blank=True),
+            field=models.ManyToManyField(
+                related_name=b'networks', through='core.NetworkInstance', to='core.Instance', blank=True),
             preserve_default=True,
         ),
         migrations.AddField(
@@ -1292,67 +1842,78 @@
         migrations.AddField(
             model_name='image',
             name='deployments',
-            field=models.ManyToManyField(help_text=b'Select which images should be instantiated on this deployment', related_name=b'images', through='core.ImageDeployments', to='core.Deployment', blank=True),
+            field=models.ManyToManyField(help_text=b'Select which images should be instantiated on this deployment',
+                                         related_name=b'images', through='core.ImageDeployments', to='core.Deployment', blank=True),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='deploymentprivilege',
             name='role',
-            field=models.ForeignKey(related_name=b'deploymentprivileges', to='core.DeploymentRole'),
+            field=models.ForeignKey(
+                related_name=b'deploymentprivileges', to='core.DeploymentRole'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='deploymentprivilege',
             name='user',
-            field=models.ForeignKey(related_name=b'deploymentprivileges', to=settings.AUTH_USER_MODEL),
+            field=models.ForeignKey(
+                related_name=b'deploymentprivileges', to=settings.AUTH_USER_MODEL),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='controllersliceprivilege',
             name='slice_privilege',
-            field=models.ForeignKey(related_name=b'controllersliceprivileges', to='core.SlicePrivilege'),
+            field=models.ForeignKey(
+                related_name=b'controllersliceprivileges', to='core.SlicePrivilege'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='controllerslice',
             name='slice',
-            field=models.ForeignKey(related_name=b'controllerslices', to='core.Slice'),
+            field=models.ForeignKey(
+                related_name=b'controllerslices', to='core.Slice'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='controllersiteprivilege',
             name='site_privilege',
-            field=models.ForeignKey(related_name=b'controllersiteprivileges', to='core.SitePrivilege'),
+            field=models.ForeignKey(
+                related_name=b'controllersiteprivileges', to='core.SitePrivilege'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='controllersite',
             name='site',
-            field=models.ForeignKey(related_name=b'controllersite', to='core.Site'),
+            field=models.ForeignKey(
+                related_name=b'controllersite', to='core.Site'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='controllernetwork',
             name='network',
-            field=models.ForeignKey(related_name=b'controllernetworks', to='core.Network'),
+            field=models.ForeignKey(
+                related_name=b'controllernetworks', to='core.Network'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='controllerimages',
             name='image',
-            field=models.ForeignKey(related_name=b'controllerimages', to='core.Image'),
+            field=models.ForeignKey(
+                related_name=b'controllerimages', to='core.Image'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='controllerdashboardview',
             name='dashboardView',
-            field=models.ForeignKey(related_name=b'controllerdashboardviews', to='core.DashboardView'),
+            field=models.ForeignKey(
+                related_name=b'controllerdashboardviews', to='core.DashboardView'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='charge',
             name='invoice',
-            field=models.ForeignKey(related_name=b'charges', blank=True, to='core.Invoice', null=True),
+            field=models.ForeignKey(
+                related_name=b'charges', blank=True, to='core.Invoice', null=True),
             preserve_default=True,
         ),
         migrations.AddField(
@@ -1364,25 +1925,29 @@
         migrations.AddField(
             model_name='charge',
             name='slice',
-            field=models.ForeignKey(related_name=b'charges', blank=True, to='core.Slice', null=True),
+            field=models.ForeignKey(
+                related_name=b'charges', blank=True, to='core.Slice', null=True),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='account',
             name='site',
-            field=models.ForeignKey(related_name=b'accounts', to='core.Site', help_text=b'Site for this account'),
+            field=models.ForeignKey(
+                related_name=b'accounts', to='core.Site', help_text=b'Site for this account'),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='user',
             name='dashboards',
-            field=models.ManyToManyField(to='core.DashboardView', through='core.UserDashboardView', blank=True),
+            field=models.ManyToManyField(
+                to='core.DashboardView', through='core.UserDashboardView', blank=True),
             preserve_default=True,
         ),
         migrations.AddField(
             model_name='user',
             name='site',
-            field=models.ForeignKey(related_name=b'users', to='core.Site', help_text=b'Site this user will be homed too', null=True),
+            field=models.ForeignKey(related_name=b'users', to='core.Site',
+                                    help_text=b'Site this user will be homed too', null=True),
             preserve_default=True,
         ),
     ]
diff --git a/xos/core/models/__init__.py b/xos/core/models/__init__.py
index 6fad0f1..5b0ad4b 100644
--- a/xos/core/models/__init__.py
+++ b/xos/core/models/__init__.py
@@ -1,7 +1,7 @@
 from .plcorebase import PlCoreBase,PlCoreBaseManager,PlCoreBaseDeletionManager,PlModelMixIn
 from .project import Project
 from .singletonmodel import SingletonModel
-from .service import Service, Tenant, TenantWithContainer, CoarseTenant, ServicePrivilege, TenantRoot, TenantRootPrivilege, TenantRootRole, Subscriber, Provider
+from .service import Service, Tenant, TenantWithContainer, CoarseTenant, ServicePrivilege, TenantRoot, TenantRootPrivilege, TenantRootRole, TenantPrivilege, TenantRole, Subscriber, Provider
 from .service import ServiceAttribute, TenantAttribute, ServiceRole
 from .tag import Tag
 from .role import Role
diff --git a/xos/core/models/network.py b/xos/core/models/network.py
index 6af72bf..8373814 100644
--- a/xos/core/models/network.py
+++ b/xos/core/models/network.py
@@ -2,7 +2,7 @@
 import socket
 import sys
 from django.db import models, transaction
-from core.models import PlCoreBase, Site, Slice, Instance, Controller
+from core.models import PlCoreBase, Site, Slice, Instance, Controller, Service
 from core.models import ControllerLinkManager,ControllerLinkDeletionManager
 from django.contrib.contenttypes.models import ContentType
 from django.contrib.contenttypes import generic
@@ -350,7 +350,11 @@
 class AddressPool(PlCoreBase):
     name = models.CharField(max_length=32)
     addresses = models.TextField(blank=True, null=True)
+    gateway_ip = models.CharField(max_length=32, null=True)
+    gateway_mac = models.CharField(max_length=32, null=True)
+    cidr = models.CharField(max_length=32, null=True)
     inuse = models.TextField(blank=True, null=True)
+    service = models.ForeignKey(Service, related_name="addresspools", null=True, blank=True)
 
     def __unicode__(self): return u'%s' % (self.name)
 
diff --git a/xos/core/models/plcorebase.py b/xos/core/models/plcorebase.py
index 4170697..060570d 100644
--- a/xos/core/models/plcorebase.py
+++ b/xos/core/models/plcorebase.py
@@ -2,6 +2,7 @@
 import json
 import os
 import sys
+import threading
 from django import db
 from django.db import models
 from django.forms.models import model_to_dict
@@ -198,7 +199,7 @@
     # default values for created and updated are only there to keep evolution
     # from failing.
     created = models.DateTimeField(auto_now_add=True, default=timezone.now)
-    updated = models.DateTimeField(auto_now=True, default=timezone.now)
+    updated = models.DateTimeField(default=timezone.now)
     enacted = models.DateTimeField(null=True, blank=True, default=None)
     policed = models.DateTimeField(null=True, blank=True, default=None)
 
@@ -211,7 +212,8 @@
     deleted = models.BooleanField(default=False)
     write_protect = models.BooleanField(default=False)
     lazy_blocked = models.BooleanField(default=False)
-    no_sync = models.BooleanField(default=False)
+    no_sync = models.BooleanField(default=False)     # prevent object sync
+    no_policy = models.BooleanField(default=False)   # prevent model_policy run
 
     class Meta:
         # Changing abstract to False would require the managers of subclasses of
@@ -269,6 +271,9 @@
                 if not (field in ["backend_register", "backend_status", "deleted", "enacted", "updated"]):
                     ignore_composite_key_check=False
 
+        if 'synchronizer' not in threading.current_thread().name:
+            self.updated = datetime.datetime.now()
+
         super(PlCoreBase, self).save(*args, **kwargs)
 
         # This is a no-op if observer_disabled is set
diff --git a/xos/core/models/service.py b/xos/core/models/service.py
index aca4bb0..1c19e56 100644
--- a/xos/core/models/service.py
+++ b/xos/core/models/service.py
@@ -1,14 +1,18 @@
-from django.db import models
-from core.models import PlCoreBase,SingletonModel,PlCoreBaseManager
-from core.models.plcorebase import StrippedCharField
-from xos.exceptions import *
-from operator import attrgetter
 import json
+from operator import attrgetter
 
-COARSE_KIND="coarse"
+from core.models import PlCoreBase, PlCoreBaseManager, SingletonModel
+from core.models.plcorebase import StrippedCharField
+from django.db import models
+from xos.exceptions import *
+
+COARSE_KIND = "coarse"
+
 
 class AttributeMixin(object):
-    # helper for extracting things from a json-encoded service_specific_attribute
+    # helper for extracting things from a json-encoded
+    # service_specific_attribute
+
     def get_attribute(self, name, default=None):
         if self.service_specific_attribute:
             attributes = json.loads(self.service_specific_attribute)
@@ -21,12 +25,13 @@
             attributes = json.loads(self.service_specific_attribute)
         else:
             attributes = {}
-        attributes[name]=value
+        attributes[name] = value
         self.service_specific_attribute = json.dumps(attributes)
 
     def get_initial_attribute(self, name, default=None):
         if self._initial["service_specific_attribute"]:
-            attributes = json.loads(self._initial["service_specific_attribute"])
+            attributes = json.loads(
+                self._initial["service_specific_attribute"])
         else:
             attributes = {}
         return attributes.get(name, default)
@@ -34,9 +39,9 @@
     @classmethod
     def get_default_attribute(cls, name):
         for (attrname, default) in cls.simple_attributes:
-            if attrname==name:
+            if attrname == name:
                 return default
-        if hasattr(cls,"default_attributes"):
+        if hasattr(cls, "default_attributes"):
             if name in cls.default_attributes:
                 return cls.default_attributes[name]
 
@@ -46,27 +51,34 @@
     def setup_simple_attributes(cls):
         for (attrname, default) in cls.simple_attributes:
             setattr(cls, attrname, property(lambda self, attrname=attrname, default=default: self.get_attribute(attrname, default),
-                                            lambda self, value, attrname=attrname: self.set_attribute(attrname, value),
+                                            lambda self, value, attrname=attrname: self.set_attribute(
+                                                attrname, value),
                                             None,
                                             attrname))
 
+
 class Service(PlCoreBase, AttributeMixin):
     # when subclassing a service, redefine KIND to describe the new service
     KIND = "generic"
 
-    description = models.TextField(max_length=254,null=True, blank=True,help_text="Description of Service")
+    description = models.TextField(
+        max_length=254, null=True, blank=True, help_text="Description of Service")
     enabled = models.BooleanField(default=True)
-    kind = StrippedCharField(max_length=30, help_text="Kind of service", default=KIND)
+    kind = StrippedCharField(
+        max_length=30, help_text="Kind of service", default=KIND)
     name = StrippedCharField(max_length=30, help_text="Service Name")
-    versionNumber = StrippedCharField(max_length=30, help_text="Version of Service Definition")
+    versionNumber = StrippedCharField(
+        max_length=30, help_text="Version of Service Definition")
     published = models.BooleanField(default=True)
     view_url = StrippedCharField(blank=True, null=True, max_length=1024)
     icon_url = StrippedCharField(blank=True, null=True, max_length=1024)
-    public_key = models.TextField(null=True, blank=True, max_length=1024, help_text="Public key string")
+    public_key = models.TextField(
+        null=True, blank=True, max_length=1024, help_text="Public key string")
     private_key_fn = StrippedCharField(blank=True, null=True, max_length=1024)
 
     # Service_specific_attribute and service_specific_id are opaque to XOS
-    service_specific_id = StrippedCharField(max_length=30, blank=True, null=True)
+    service_specific_id = StrippedCharField(
+        max_length=30, blank=True, null=True)
     service_specific_attribute = models.TextField(blank=True, null=True)
 
     def __init__(self, *args, **kwargs):
@@ -76,22 +88,23 @@
 
     @classmethod
     def get_service_objects(cls):
-        return cls.objects.filter(kind = cls.KIND)
+        return cls.objects.filter(kind=cls.KIND)
 
     @classmethod
     def get_deleted_service_objects(cls):
-        return cls.deleted_objects.filter(kind = cls.KIND)
+        return cls.deleted_objects.filter(kind=cls.KIND)
 
     @classmethod
     def get_service_objects_by_user(cls, user):
-        return cls.select_by_user(user).filter(kind = cls.KIND)
+        return cls.select_by_user(user).filter(kind=cls.KIND)
 
     @classmethod
     def select_by_user(cls, user):
         if user.is_admin:
             return cls.objects.all()
         else:
-            service_ids = [sp.slice.id for sp in ServicePrivilege.objects.filter(user=user)]
+            service_ids = [
+                sp.slice.id for sp in ServicePrivilege.objects.filter(user=user)]
             return cls.objects.filter(id__in=service_ids)
 
     @property
@@ -115,12 +128,15 @@
                 exclusive_slices - list of slices that must have no nodes in common with 'slice'.
         """
 
-        from core.models import Node, Instance # late import to get around order-of-imports constraint in __init__.py
+        # late import to get around order-of-imports constraint in __init__.py
+        from core.models import Node, Instance
 
         nodes = list(Node.objects.all())
 
-        conflicting_instances = Instance.objects.filter(slice__in = exclusive_slices)
-        conflicting_nodes = Node.objects.filter(instances__in = conflicting_instances)
+        conflicting_instances = Instance.objects.filter(
+            slice__in=exclusive_slices)
+        conflicting_nodes = Node.objects.filter(
+            instances__in=conflicting_instances)
 
         nodes = [x for x in nodes if x not in conflicting_nodes]
 
@@ -146,7 +162,8 @@
         return nodes[0]
 
     def adjust_scale(self, slice_hint, scale, max_per_node=None, exclusive_slices=[]):
-        from core.models import Instance # late import to get around order-of-imports constraint in __init__.py
+        # late import to get around order-of-imports constraint in __init__.py
+        from core.models import Instance
 
         slices = [x for x in self.slices.all() if slice_hint in x.name]
         for slice in slices:
@@ -163,24 +180,26 @@
 
                 image = slice.default_image
                 if not image:
-                    raise XOSConfigurationError("No default_image for slice %s" % slice.name)
+                    raise XOSConfigurationError(
+                        "No default_image for slice %s" % slice.name)
 
                 flavor = slice.default_flavor
                 if not flavor:
-                    raise XOSConfigurationError("No default_flavor for slice %s" % slice.name)
+                    raise XOSConfigurationError(
+                        "No default_flavor for slice %s" % slice.name)
 
                 s = Instance(slice=slice,
-                           node=node,
-                           creator=slice.creator,
-                           image=image,
-                           flavor=flavor,
-                           deployment=node.site_deployment.deployment)
+                             node=node,
+                             creator=slice.creator,
+                             image=image,
+                             flavor=flavor,
+                             deployment=node.site_deployment.deployment)
                 s.save()
 
                 # print "add instance", s
 
     def get_vtn_src_nets(self):
-        nets=[]
+        nets = []
         for slice in self.slices.all():
             for ns in slice.networkslices.all():
                 if not ns.network:
@@ -188,6 +207,9 @@
 #                if ns.network.template.access in ["direct", "indirect"]:
 #                    # skip access networks; we want to use the private network
 #                    continue
+                if "management" in ns.network.name:
+                    # don't try to connect the management network to anything
+                    continue
                 if ns.network.name in ["wan_network", "lan_network"]:
                     # we don't want to attach to the vCPE's lan or wan network
                     # we only want to attach to its private network
@@ -200,7 +222,7 @@
         return nets
 
     def get_vtn_nets(self):
-        nets=[]
+        nets = []
         for slice in self.slices.all():
             for ns in slice.networkslices.all():
                 if not ns.network:
@@ -227,35 +249,39 @@
         return [x["net_id"] for x in self.get_vtn_dependencies_nets()]
 
     def get_vtn_dependencies_names(self):
-        return [x["name"]+"_"+x["net_id"] for x in self.get_vtn_dependencies_nets()]
+        return [x["name"] + "_" + x["net_id"] for x in self.get_vtn_dependencies_nets()]
 
     def get_vtn_src_ids(self):
         return [x["net_id"] for x in self.get_vtn_src_nets()]
 
     def get_vtn_src_names(self):
-        return [x["name"]+"_"+x["net_id"] for x in self.get_vtn_src_nets()]
+        return [x["name"] + "_" + x["net_id"] for x in self.get_vtn_src_nets()]
 
 
 class ServiceAttribute(PlCoreBase):
     name = models.CharField(help_text="Attribute Name", max_length=128)
     value = StrippedCharField(help_text="Attribute Value", max_length=1024)
-    service = models.ForeignKey(Service, related_name='serviceattributes', help_text="The Service this attribute is associated with")
+    service = models.ForeignKey(Service, related_name='serviceattributes',
+                                help_text="The Service this attribute is associated with")
+
 
 class ServiceRole(PlCoreBase):
-    ROLE_CHOICES = (('admin','Admin'),)
+    ROLE_CHOICES = (('admin', 'Admin'),)
     role = StrippedCharField(choices=ROLE_CHOICES, unique=True, max_length=30)
 
-    def __unicode__(self):  return u'%s' % (self.role)
+    def __unicode__(self): return u'%s' % (self.role)
+
 
 class ServicePrivilege(PlCoreBase):
     user = models.ForeignKey('User', related_name='serviceprivileges')
     service = models.ForeignKey('Service', related_name='serviceprivileges')
-    role = models.ForeignKey('ServiceRole',related_name='serviceprivileges')
+    role = models.ForeignKey('ServiceRole', related_name='serviceprivileges')
 
     class Meta:
-        unique_together =  ('user', 'service', 'role')
+        unique_together = ('user', 'service', 'role')
 
-    def __unicode__(self):  return u'%s %s %s' % (self.service, self.user, self.role)
+    def __unicode__(self): return u'%s %s %s' % (
+        self.service, self.user, self.role)
 
     def can_update(self, user):
         if not self.service.enabled:
@@ -280,17 +306,20 @@
             qs = cls.objects.filter(user=user)
         return qs
 
+
 class TenantRoot(PlCoreBase, AttributeMixin):
     """ A tenantRoot is one of the things that can sit at the root of a chain
         of tenancy. This object represents a node.
     """
 
-    KIND= "generic"
+    KIND = "generic"
     kind = StrippedCharField(max_length=30, default=KIND)
-    name = StrippedCharField(max_length=255, help_text="name", blank=True, null=True)
+    name = StrippedCharField(
+        max_length=255, help_text="name", blank=True, null=True)
 
     service_specific_attribute = models.TextField(blank=True, null=True)
-    service_specific_id = StrippedCharField(max_length=30, blank=True, null=True)
+    service_specific_id = StrippedCharField(
+        max_length=30, blank=True, null=True)
 
     def __init__(self, *args, **kwargs):
         # for subclasses, set the default kind appropriately
@@ -308,7 +337,7 @@
 
     def get_subscribed_tenants(self, tenant_class):
         ids = self.subscribed_tenants.filter(kind=tenant_class.KIND)
-        return tenant_class.objects.filter(id__in = ids)
+        return tenant_class.objects.filter(id__in=ids)
 
     def get_newest_subscribed_tenant(self, kind):
         st = list(self.get_subscribed_tenants(kind))
@@ -318,31 +347,37 @@
 
     @classmethod
     def get_tenant_objects(cls):
-        return cls.objects.filter(kind = cls.KIND)
+        return cls.objects.filter(kind=cls.KIND)
 
     @classmethod
     def get_tenant_objects_by_user(cls, user):
-        return cls.select_by_user(user).filter(kind = cls.KIND)
+        return cls.select_by_user(user).filter(kind=cls.KIND)
 
     @classmethod
     def select_by_user(cls, user):
         if user.is_admin:
             return cls.objects.all()
         else:
-            tr_ids = [trp.tenant_root.id for trp in TenantRootPrivilege.objects.filter(user=user)]
+            tr_ids = [
+                trp.tenant_root.id for trp in TenantRootPrivilege.objects.filter(user=user)]
             return cls.objects.filter(id__in=tr_ids)
 
-    # helper function to be used in subclasses that want to ensure service_specific_id is unique
+    # helper function to be used in subclasses that want to ensure
+    # service_specific_id is unique
     def validate_unique_service_specific_id(self, none_okay=False):
         if not none_okay and (self.service_specific_id is None):
-            raise XOSMissingField("subscriber_specific_id is None, and it's a required field", fields={"service_specific_id": "cannot be none"})
+            raise XOSMissingField("subscriber_specific_id is None, and it's a required field", fields={
+                                  "service_specific_id": "cannot be none"})
 
         if self.service_specific_id:
-            conflicts = self.get_tenant_objects().filter(service_specific_id=self.service_specific_id)
+            conflicts = self.get_tenant_objects().filter(
+                service_specific_id=self.service_specific_id)
             if self.pk:
                 conflicts = conflicts.exclude(pk=self.pk)
             if conflicts:
-                raise XOSDuplicateKey("service_specific_id %s already exists" % self.service_specific_id, fields={"service_specific_id": "duplicate key"})
+                raise XOSDuplicateKey("service_specific_id %s already exists" % self.service_specific_id, fields={
+                                      "service_specific_id": "duplicate key"})
+
 
 class Tenant(PlCoreBase, AttributeMixin):
     """ A tenant is a relationship between two entities, a subscriber and a
@@ -355,27 +390,38 @@
         TODO: rename "Tenant" to "Tenancy"
     """
 
-    CONNECTIVITY_CHOICES = (('public', 'Public'), ('private', 'Private'), ('na', 'Not Applicable'))
+    CONNECTIVITY_CHOICES = (('public', 'Public'),
+                            ('private', 'Private'), ('na', 'Not Applicable'))
 
     # when subclassing a service, redefine KIND to describe the new service
     KIND = "generic"
 
     kind = StrippedCharField(max_length=30, default=KIND)
-    provider_service = models.ForeignKey(Service, related_name='provided_tenants')
+    provider_service = models.ForeignKey(
+        Service, related_name='provided_tenants')
 
     # The next four things are the various type of objects that can be subscribers of this Tenancy
     # relationship. One and only one can be used at a time.
-    subscriber_service = models.ForeignKey(Service, related_name='subscribed_tenants', blank=True, null=True)
-    subscriber_tenant = models.ForeignKey("Tenant", related_name='subscribed_tenants', blank=True, null=True)
-    subscriber_user = models.ForeignKey("User", related_name='subscribed_tenants', blank=True, null=True)
-    subscriber_root = models.ForeignKey("TenantRoot", related_name="subscribed_tenants", blank=True, null=True)
+    # XXX these should really be changed to GenericForeignKey
+    subscriber_service = models.ForeignKey(
+        Service, related_name='subscribed_tenants', blank=True, null=True)
+    subscriber_tenant = models.ForeignKey(
+        "Tenant", related_name='subscribed_tenants', blank=True, null=True)
+    subscriber_user = models.ForeignKey(
+        "User", related_name='subscribed_tenants', blank=True, null=True)
+    subscriber_root = models.ForeignKey(
+        "TenantRoot", related_name="subscribed_tenants", blank=True, null=True)
+    subscriber_network = models.ForeignKey(
+        "Network", related_name="subscribed_tenants", blank=True, null=True)
 
     # Service_specific_attribute and service_specific_id are opaque to XOS
-    service_specific_id = StrippedCharField(max_length=30, blank=True, null=True)
+    service_specific_id = StrippedCharField(
+        max_length=30, blank=True, null=True)
     service_specific_attribute = models.TextField(blank=True, null=True)
 
     # Connect_method is only used by Coarse tenants
-    connect_method = models.CharField(null=False, blank=False, max_length=30, choices=CONNECTIVITY_CHOICES, default="na")
+    connect_method = models.CharField(
+        null=False, blank=False, max_length=30, choices=CONNECTIVITY_CHOICES, default="na")
 
     def __init__(self, *args, **kwargs):
         # for subclasses, set the default kind appropriately
@@ -387,15 +433,15 @@
 
     @classmethod
     def get_tenant_objects(cls):
-        return cls.objects.filter(kind = cls.KIND)
+        return cls.objects.filter(kind=cls.KIND)
 
     @classmethod
     def get_tenant_objects_by_user(cls, user):
-        return cls.select_by_user(user).filter(kind = cls.KIND)
+        return cls.select_by_user(user).filter(kind=cls.KIND)
 
     @classmethod
     def get_deleted_tenant_objects(cls):
-        return cls.deleted_objects.filter(kind = cls.KIND)
+        return cls.deleted_objects.filter(kind=cls.KIND)
 
     @property
     def tenantattribute_dict(self):
@@ -404,26 +450,32 @@
             attrs[attr.name] = attr.value
         return attrs
 
-    # helper function to be used in subclasses that want to ensure service_specific_id is unique
+    # helper function to be used in subclasses that want to ensure
+    # service_specific_id is unique
     def validate_unique_service_specific_id(self):
         if self.pk is None:
             if self.service_specific_id is None:
-                raise XOSMissingField("subscriber_specific_id is None, and it's a required field", fields={"service_specific_id": "cannot be none"})
+                raise XOSMissingField("subscriber_specific_id is None, and it's a required field", fields={
+                                      "service_specific_id": "cannot be none"})
 
-            conflicts = self.get_tenant_objects().filter(service_specific_id=self.service_specific_id)
+            conflicts = self.get_tenant_objects().filter(
+                service_specific_id=self.service_specific_id)
             if conflicts:
-                raise XOSDuplicateKey("service_specific_id %s already exists" % self.service_specific_id, fields={"service_specific_id": "duplicate key"})
+                raise XOSDuplicateKey("service_specific_id %s already exists" % self.service_specific_id, fields={
+                                      "service_specific_id": "duplicate key"})
 
     def save(self, *args, **kwargs):
-        subCount = sum( [1 for e in [self.subscriber_service, self.subscriber_tenant, self.subscriber_user, self.subscriber_root] if e is not None])
+        subCount = sum([1 for e in [self.subscriber_service, self.subscriber_tenant,
+                                    self.subscriber_user, self.subscriber_root] if e is not None])
         if (subCount > 1):
-            raise XOSConflictingField("Only one of subscriber_service, subscriber_tenant, subscriber_user, subscriber_root should be set")
+            raise XOSConflictingField(
+                "Only one of subscriber_service, subscriber_tenant, subscriber_user, subscriber_root should be set")
 
         super(Tenant, self).save(*args, **kwargs)
 
     def get_subscribed_tenants(self, tenant_class):
         ids = self.subscribed_tenants.filter(kind=tenant_class.KIND)
-        return tenant_class.objects.filter(id__in = ids)
+        return tenant_class.objects.filter(id__in=ids)
 
     def get_newest_subscribed_tenant(self, kind):
         st = list(self.get_subscribed_tenants(kind))
@@ -431,6 +483,7 @@
             return None
         return sorted(st, key=attrgetter('id'))[0]
 
+
 class Scheduler(object):
     # XOS Scheduler Abstract Base Class
     # Used to implement schedulers that pick which node to put instances on
@@ -446,8 +499,10 @@
 
         raise Exception("Abstract Base")
 
+
 class LeastLoadedNodeScheduler(Scheduler):
-    # This scheduler always return the node with the fewest number of instances.
+    # This scheduler always return the node with the fewest number of
+    # instances.
 
     def __init__(self, slice, label=None):
         super(LeastLoadedNodeScheduler, self).__init__(slice)
@@ -458,28 +513,30 @@
         nodes = Node.objects.all()
 
         if self.label:
-           nodes = nodes.filter(nodelabels__name=self.label)
+            nodes = nodes.filter(nodelabels__name=self.label)
 
         nodes = list(nodes)
 
         if not nodes:
-            raise Exception("LeastLoadedNodeScheduler: No suitable nodes to pick from")
+            raise Exception(
+                "LeastLoadedNodeScheduler: No suitable nodes to pick from")
 
         # TODO: logic to filter nodes by which nodes are up, and which
         #   nodes the slice can instantiate on.
         nodes = sorted(nodes, key=lambda node: node.instances.all().count())
         return [nodes[0], None]
 
+
 class ContainerVmScheduler(Scheduler):
     # This scheduler picks a VM in the slice with the fewest containers inside
     # of it. If no VMs are suitable, then it creates a VM.
 
     # this is a hack and should be replaced by something smarter...
-    LOOK_FOR_IMAGES=["ubuntu-vcpe4",        # ONOS demo machine -- preferred vcpe image
-                     "Ubuntu 14.04 LTS",    # portal
-                     "Ubuntu-14.04-LTS",    # ONOS demo machine
-                     "trusty-server-multi-nic", # CloudLab
-                    ]
+    LOOK_FOR_IMAGES = ["ubuntu-vcpe4",        # ONOS demo machine -- preferred vcpe image
+                       "Ubuntu 14.04 LTS",    # portal
+                       "Ubuntu-14.04-LTS",    # ONOS demo machine
+                       "trusty-server-multi-nic",  # CloudLab
+                       ]
 
     MAX_VM_PER_CONTAINER = 10
 
@@ -492,11 +549,12 @@
 
         look_for_images = self.LOOK_FOR_IMAGES
         for image_name in look_for_images:
-            images = Image.objects.filter(name = image_name)
+            images = Image.objects.filter(name=image_name)
             if images:
                 return images[0]
 
-        raise XOSProgrammingError("No ContainerVM image (looked for %s)" % str(look_for_images))
+        raise XOSProgrammingError(
+            "No ContainerVM image (looked for %s)" % str(look_for_images))
 
     def make_new_instance(self):
         from core.models import Instance, Flavor
@@ -505,16 +563,16 @@
         if not flavors:
             raise XOSConfigurationError("No m1.small flavor")
 
-        (node,parent) = LeastLoadedNodeScheduler(self.slice).pick()
+        (node, parent) = LeastLoadedNodeScheduler(self.slice).pick()
 
-        instance = Instance(slice = self.slice,
-                        node = node,
-                        image = self.image,
-                        creator = self.slice.creator,
-                        deployment = node.site_deployment.deployment,
-                        flavor = flavors[0],
-                        isolation = "vm",
-                        parent = parent)
+        instance = Instance(slice=self.slice,
+                            node=node,
+                            image=self.image,
+                            creator=self.slice.creator,
+                            deployment=node.site_deployment.deployment,
+                            flavor=flavors[0],
+                            isolation="vm",
+                            parent=parent)
         instance.save()
         # We rely on a special naming convention to identify the VMs that will
         # hole containers.
@@ -530,9 +588,9 @@
             if (vm.name.startswith("%s-outer-" % self.slice.name)):
                 container_count = Instance.objects.filter(parent=vm).count()
                 if (container_count < self.MAX_VM_PER_CONTAINER):
-                    avail_vms.append( (vm, container_count) )
+                    avail_vms.append((vm, container_count))
             # sort by least containers-per-vm
-            avail_vms = sorted(avail_vms, key = lambda x: x[1])
+            avail_vms = sorted(avail_vms, key=lambda x: x[1])
             print "XXX", avail_vms
             if avail_vms:
                 instance = avail_vms[0][0]
@@ -541,24 +599,25 @@
         instance = self.make_new_instance()
         return (instance.node, instance)
 
+
 class TenantWithContainer(Tenant):
     """ A tenant that manages a container """
 
     # this is a hack and should be replaced by something smarter...
-    LOOK_FOR_IMAGES=["ubuntu-vcpe4",        # ONOS demo machine -- preferred vcpe image
-                     "Ubuntu 14.04 LTS",    # portal
-                     "Ubuntu-14.04-LTS",    # ONOS demo machine
-                     "trusty-server-multi-nic", # CloudLab
-                    ]
+    LOOK_FOR_IMAGES = ["ubuntu-vcpe4",        # ONOS demo machine -- preferred vcpe image
+                       "Ubuntu 14.04 LTS",    # portal
+                       "Ubuntu-14.04-LTS",    # ONOS demo machine
+                       "trusty-server-multi-nic",  # CloudLab
+                       ]
 
-    LOOK_FOR_CONTAINER_IMAGES=["docker-vcpe"]
+    LOOK_FOR_CONTAINER_IMAGES = ["docker-vcpe"]
 
     class Meta:
         proxy = True
 
     def __init__(self, *args, **kwargs):
         super(TenantWithContainer, self).__init__(*args, **kwargs)
-        self.cached_instance=None
+        self.cached_instance = None
         self.orig_instance_id = self.get_initial_attribute("instance_id")
 
     @property
@@ -566,13 +625,13 @@
         from core.models import Instance
         if getattr(self, "cached_instance", None):
             return self.cached_instance
-        instance_id=self.get_attribute("instance_id")
+        instance_id = self.get_attribute("instance_id")
         if not instance_id:
             return None
-        instances=Instance.objects.filter(id=instance_id)
+        instances = Instance.objects.filter(id=instance_id)
         if not instances:
             return None
-        instance=instances[0]
+        instance = instances[0]
         instance.caller = self.creator
         self.cached_instance = instance
         return instance
@@ -582,7 +641,7 @@
         if value:
             value = value.id
         if (value != self.get_attribute("instance_id", None)):
-            self.cached_instance=None
+            self.cached_instance = None
         self.set_attribute("instance_id", value)
 
     @property
@@ -606,13 +665,13 @@
         from core.models import User
         if getattr(self, "cached_creator", None):
             return self.cached_creator
-        creator_id=self.get_attribute("creator_id")
+        creator_id = self.get_attribute("creator_id")
         if not creator_id:
             return None
-        users=User.objects.filter(id=creator_id)
+        users = User.objects.filter(id=creator_id)
         if not users:
             return None
-        user=users[0]
+        user = users[0]
         self.cached_creator = users[0]
         return user
 
@@ -621,7 +680,7 @@
         if value:
             value = value.id
         if (value != self.get_attribute("creator_id", None)):
-            self.cached_creator=None
+            self.cached_creator = None
         self.set_attribute("creator_id", value)
 
     @property
@@ -641,11 +700,12 @@
             look_for_images = self.LOOK_FOR_IMAGES
 
         for image_name in look_for_images:
-            images = Image.objects.filter(name = image_name)
+            images = Image.objects.filter(name=image_name)
             if images:
                 return images[0]
 
-        raise XOSProgrammingError("No VPCE image (looked for %s)" % str(look_for_images))
+        raise XOSProgrammingError(
+            "No VPCE image (looked for %s)" % str(look_for_images))
 
     def save_instance(self, instance):
         # Override this function to do custom pre-save or post-save processing,
@@ -656,14 +716,14 @@
         for slice in slices:
             if slice.instances.all().count() > 0:
                 for instance in slice.instances.all():
-                     #Pick the first instance that has lesser than 5 tenants 
-                     if self.count_of_tenants_of_an_instance(instance) < 5:
-                         return instance
+                    # Pick the first instance that has lesser than 5 tenants
+                    if self.count_of_tenants_of_an_instance(instance) < 5:
+                        return instance
         return None
 
-    #TODO: Ideally the tenant count for an instance should be maintained using a 
-    #many-to-one relationship attribute, however this model being proxy, it does 
-    #not permit any new attributes to be defined. Find if any better solutions 
+    # TODO: Ideally the tenant count for an instance should be maintained using a
+    # many-to-one relationship attribute, however this model being proxy, it does
+    # not permit any new attributes to be defined. Find if any better solutions
     def count_of_tenants_of_an_instance(self, instance):
         tenant_count = 0
         for tenant in self.get_tenant_objects().all():
@@ -688,7 +748,7 @@
             new_instance_created = False
             instance = None
             if self.get_attribute("use_same_instance_for_multiple_tenants", default=False):
-                #Find if any existing instances can be used for this tenant
+                # Find if any existing instances can be used for this tenant
                 slices = self.provider_service.slices.all()
                 instance = self.pick_least_loaded_instance_in_slice(slices)
 
@@ -707,14 +767,14 @@
                 else:
                     (node, parent) = LeastLoadedNodeScheduler(slice).pick()
 
-                instance = Instance(slice = slice,
-                                node = node,
-                                image = self.image,
-                                creator = self.creator,
-                                deployment = node.site_deployment.deployment,
-                                flavor = flavor,
-                                isolation = slice.default_isolation,
-                                parent = parent)
+                instance = Instance(slice=slice,
+                                    node=node,
+                                    image=self.image,
+                                    creator=self.creator,
+                                    deployment=node.site_deployment.deployment,
+                                    flavor=flavor,
+                                    isolation=slice.default_isolation,
+                                    parent=parent)
                 self.save_instance(instance)
                 new_instance_created = True
 
@@ -729,8 +789,10 @@
     def cleanup_container(self):
         if self.instance:
             if self.get_attribute("use_same_instance_for_multiple_tenants", default=False):
-                #Delete the instance only if this is last tenant in that instance
-                tenant_count = self.count_of_tenants_of_an_instance(self.instance)
+                # Delete the instance only if this is last tenant in that
+                # instance
+                tenant_count = self.count_of_tenants_of_an_instance(
+                    self.instance)
                 if tenant_count == 0:
                     self.instance.delete()
             else:
@@ -742,6 +804,7 @@
             self.creator = self.caller
         super(TenantWithContainer, self).save(*args, **kwargs)
 
+
 class CoarseTenant(Tenant):
     """ TODO: rename "CoarseTenant" --> "StaticTenant" """
     class Meta:
@@ -753,9 +816,11 @@
         if (not self.subscriber_service):
             raise XOSValidationError("subscriber_service cannot be null")
         if (self.subscriber_tenant or self.subscriber_user):
-            raise XOSValidationError("subscriber_tenant and subscriber_user must be null")
+            raise XOSValidationError(
+                "subscriber_tenant and subscriber_user must be null")
 
-        super(CoarseTenant,self).save()
+        super(CoarseTenant, self).save()
+
 
 class Subscriber(TenantRoot):
     """ Intermediate class for TenantRoots that are to be Subscribers """
@@ -765,6 +830,7 @@
 
     KIND = "Subscriber"
 
+
 class Provider(TenantRoot):
     """ Intermediate class for TenantRoots that are to be Providers """
 
@@ -773,29 +839,36 @@
 
     KIND = "Provider"
 
+
 class TenantAttribute(PlCoreBase):
     name = models.CharField(help_text="Attribute Name", max_length=128)
     value = models.TextField(help_text="Attribute Value")
-    tenant = models.ForeignKey(Tenant, related_name='tenantattributes', help_text="The Tenant this attribute is associated with")
+    tenant = models.ForeignKey(Tenant, related_name='tenantattributes',
+                               help_text="The Tenant this attribute is associated with")
 
     def __unicode__(self): return u'%s-%s' % (self.name, self.id)
 
+
 class TenantRootRole(PlCoreBase):
-    ROLE_CHOICES = (('admin','Admin'), ('access','Access'))
+    ROLE_CHOICES = (('admin', 'Admin'), ('access', 'Access'))
 
     role = StrippedCharField(choices=ROLE_CHOICES, unique=True, max_length=30)
 
-    def __unicode__(self):  return u'%s' % (self.role)
+    def __unicode__(self): return u'%s' % (self.role)
+
 
 class TenantRootPrivilege(PlCoreBase):
     user = models.ForeignKey('User', related_name="tenant_root_privileges")
-    tenant_root = models.ForeignKey('TenantRoot', related_name="tenant_root_privileges")
-    role = models.ForeignKey('TenantRootRole', related_name="tenant_root_privileges")
+    tenant_root = models.ForeignKey(
+        'TenantRoot', related_name="tenant_root_privileges")
+    role = models.ForeignKey(
+        'TenantRootRole', related_name="tenant_root_privileges")
 
     class Meta:
         unique_together = ('user', 'tenant_root', 'role')
 
-    def __unicode__(self):  return u'%s %s %s' % (self.tenant_root, self.user, self.role)
+    def __unicode__(self): return u'%s %s %s' % (
+        self.tenant_root, self.user, self.role)
 
     def save(self, *args, **kwds):
         if not self.user.is_active:
@@ -815,8 +888,56 @@
 
             # A slice admin can see the SlicePrivileges for his Slice
             for priv in cls.objects.filter(user=user, role__role="admin"):
-                trp_ids.extend( [trp.id for trp in cls.objects.filter(tenant_root=priv.tenant_root)] )
+                trp_ids.extend(
+                    [trp.id for trp in cls.objects.filter(tenant_root=priv.tenant_root)])
 
             return cls.objects.filter(id__in=trp_ids)
 
 
+class TenantRole(PlCoreBase):
+    """A TenantRole option."""
+    ROLE_CHOICES = (('admin', 'Admin'), ('access', 'Access'))
+    role = StrippedCharField(choices=ROLE_CHOICES, unique=True, max_length=30)
+
+    def __unicode__(self): return u'%s' % (self.role)
+
+
+class TenantPrivilege(PlCoreBase):
+    """"A TenantPrivilege which defines how users can access a particular Tenant.
+
+    Attributes:
+        id (models.AutoField): The ID of the privilege.
+        user (models.ForeignKey): A Foreign Key to the a User.
+        tenant (models.ForeignKey): A ForeignKey to the Tenant.
+        role (models.ForeignKey): A ForeignKey to the TenantRole.
+    """
+    id = models.AutoField(primary_key=True)
+    user = models.ForeignKey('User', related_name="tenantprivileges")
+    tenant = models.ForeignKey('Tenant', related_name="tenantprivileges")
+    role = models.ForeignKey('TenantRole', related_name="tenantprivileges")
+
+    def __unicode__(self): return u'%s %s %s' % (
+        self.tenant, self.user, self.role)
+
+    def save(self, *args, **kwds):
+        if not self.user.is_active:
+            raise PermissionDenied, "Cannot modify role(s) of a disabled user"
+        super(TenantPrivilege, self).save(*args, **kwds)
+
+    def can_update(self, user):
+        return user.can_update_tenant_privilege(self)
+
+    @classmethod
+    def select_by_user(cls, user):
+        if user.is_admin:
+            return cls.objects.all()
+        else:
+            # User can see his own privilege
+            trp_ids = [trp.id for trp in cls.objects.filter(user=user)]
+
+            # A tenant admin can see the TenantPrivileges for their Tenants
+            for priv in cls.objects.filter(user=user, role__role="admin"):
+                trp_ids.extend(
+                    [trp.id for trp in cls.objects.filter(tenant=priv.tenant)])
+
+            return cls.objects.filter(id__in=trp_ids)
diff --git a/xos/core/models/user.py b/xos/core/models/user.py
index 0b8e3af..715c670 100644
--- a/xos/core/models/user.py
+++ b/xos/core/models/user.py
@@ -1,21 +1,22 @@
-import os
 import datetime
-import sys
 import hashlib
+import os
+import sys
 from collections import defaultdict
-from django.forms.models import model_to_dict
+from operator import attrgetter, itemgetter
+
+import synchronizers.model_policy
+from core.middleware import get_request
+from core.models import DashboardView, PlCoreBase, PlModelMixIn, Site
+from core.models.plcorebase import StrippedCharField
+from django.contrib.auth.models import AbstractBaseUser, BaseUserManager
+from django.core.exceptions import PermissionDenied
+from django.core.mail import EmailMultiAlternatives
 from django.db import models
 from django.db.models import F, Q
+from django.forms.models import model_to_dict
 from django.utils import timezone
-from django.contrib.auth.models import AbstractBaseUser, BaseUserManager
-from django.core.mail import EmailMultiAlternatives
-from django.core.exceptions import PermissionDenied
-from core.models import PlCoreBase,Site, DashboardView, PlModelMixIn
-from core.models.plcorebase import StrippedCharField
 from timezones.fields import TimeZoneField
-from operator import itemgetter, attrgetter
-from core.middleware import get_request
-import synchronizers.model_policy
 
 # ------ from plcorebase.py ------
 try:
@@ -32,7 +33,10 @@
 # ------ ------
 
 # Create your models here.
+
+
 class UserManager(BaseUserManager):
+
     def create_user(self, email, firstname, lastname, password=None):
         """
         Creates and saves a User with the given email, date of
@@ -47,7 +51,7 @@
             lastname=lastname,
             password=password
         )
-        #user.set_password(password)
+        # user.set_password(password)
         user.is_admin = True
         user.save(using=self._db)
         return user
@@ -58,16 +62,16 @@
         birth and password.
         """
         user = self.create_user(email,
-            password=password,
-            firstname=firstname,
-            lastname=lastname
-        )
+                                password=password,
+                                firstname=firstname,
+                                lastname=lastname
+                                )
         user.is_admin = True
         user.save(using=self._db)
         return user
 
     def get_queryset(self):
-        parent=super(UserManager, self)
+        parent = super(UserManager, self)
         if hasattr(parent, "get_queryset"):
             return parent.get_queryset().filter(deleted=False)
         else:
@@ -77,7 +81,9 @@
     def get_query_set(self):
         return self.get_queryset()
 
+
 class DeletedUserManager(UserManager):
+
     def get_queryset(self):
         return super(UserManager, self).get_query_set().filter(deleted=True)
 
@@ -85,7 +91,9 @@
     def get_query_set(self):
         return self.get_queryset()
 
+
 class User(AbstractBaseUser, PlModelMixIn):
+
     @property
     def remote_password(self):
         return hashlib.md5(self.password).hexdigest()[:12]
@@ -100,15 +108,19 @@
         db_index=True,
     )
 
-    username = StrippedCharField(max_length=255, default="Something" )
+    username = StrippedCharField(max_length=255, default="Something")
 
-    firstname = StrippedCharField(help_text="person's given name", max_length=200)
+    firstname = StrippedCharField(
+        help_text="person's given name", max_length=200)
     lastname = StrippedCharField(help_text="person's surname", max_length=200)
 
-    phone = StrippedCharField(null=True, blank=True, help_text="phone number contact", max_length=100)
+    phone = StrippedCharField(null=True, blank=True,
+                              help_text="phone number contact", max_length=100)
     user_url = models.URLField(null=True, blank=True)
-    site = models.ForeignKey(Site, related_name='users', help_text="Site this user will be homed too")
-    public_key = models.TextField(null=True, blank=True, max_length=1024, help_text="Public key string")
+    site = models.ForeignKey(Site, related_name='users',
+                             help_text="Site this user will be homed too")
+    public_key = models.TextField(
+        null=True, blank=True, max_length=1024, help_text="Public key string")
 
     is_active = models.BooleanField(default=True)
     is_admin = models.BooleanField(default=False)
@@ -117,20 +129,25 @@
     is_registering = models.BooleanField(default=False)
     is_appuser = models.BooleanField(default=False)
 
-    login_page = StrippedCharField(help_text="send this user to a specific page on login", max_length=200, null=True, blank=True)
+    login_page = StrippedCharField(
+        help_text="send this user to a specific page on login", max_length=200, null=True, blank=True)
 
     created = models.DateTimeField(auto_now_add=True)
     updated = models.DateTimeField(auto_now=True)
     enacted = models.DateTimeField(null=True, default=None)
     policed = models.DateTimeField(null=True, default=None)
     backend_status = StrippedCharField(max_length=1024,
-                                      default="Provisioning in progress")
+                                       default="Provisioning in progress")
     deleted = models.BooleanField(default=False)
     write_protect = models.BooleanField(default=False)
+    lazy_blocked = models.BooleanField(default=False)
+    no_sync = models.BooleanField(default=False)     # prevent object sync
+    no_policy = models.BooleanField(default=False)   # prevent model_policy run
 
     timezone = TimeZoneField()
 
-    dashboards = models.ManyToManyField('DashboardView', through='UserDashboardView', blank=True)
+    dashboards = models.ManyToManyField(
+        'DashboardView', through='UserDashboardView', blank=True)
 
     objects = UserManager()
     deleted_objects = DeletedUserManager()
@@ -139,11 +156,12 @@
     REQUIRED_FIELDS = ['firstname', 'lastname']
 
     PI_FORBIDDEN_FIELDS = ["is_admin", "site", "is_staff"]
-    USER_FORBIDDEN_FIELDS = ["is_admin", "is_active", "site", "is_staff", "is_readonly"]
+    USER_FORBIDDEN_FIELDS = ["is_admin", "is_active",
+                             "site", "is_staff", "is_readonly"]
 
     def __init__(self, *args, **kwargs):
         super(User, self).__init__(*args, **kwargs)
-        self._initial = self._dict # for PlModelMixIn
+        self._initial = self._dict  # for PlModelMixIn
 
     def isReadOnlyUser(self):
         return self.is_readonly
@@ -158,21 +176,21 @@
 
     def delete(self, *args, **kwds):
         # so we have something to give the observer
-        purge = kwds.get('purge',False)
+        purge = kwds.get('purge', False)
         if purge:
             del kwds['purge']
         try:
             purge = purge or observer_disabled
         except NameError:
             pass
-            
+
         if (purge):
             super(User, self).delete(*args, **kwds)
         else:
             if (not self.write_protect):
-                    self.deleted = True
-                    self.enacted=None
-                    self.save(update_fields=['enacted','deleted'])
+                self.deleted = True
+                self.enacted = None
+                self.save(update_fields=['enacted', 'deleted'])
 
     @property
     def keyname(self):
@@ -195,9 +213,10 @@
         return False
 
     def get_dashboards(self):
-        DEFAULT_DASHBOARDS=["Tenant"]
+        DEFAULT_DASHBOARDS = ["Tenant"]
 
-        dashboards = sorted(list(self.userdashboardviews.all()), key=attrgetter('order'))
+        dashboards = sorted(
+            list(self.userdashboardviews.all()), key=attrgetter('order'))
         dashboards = [x.dashboardView for x in dashboards]
 
         if (not dashboards) and (not self.is_appuser):
@@ -219,14 +238,14 @@
 #            roles[site_privilege.role.role_type].append(site_privilege.site.login_base)
 #        for slice_membership in slice_memberships:
 #            roles[slice_membership.role.role_type].append(slice_membership.slice.name)
-#        return roles   
+#        return roles
 
     def save(self, *args, **kwds):
         if not self.id:
             self.set_password(self.password)
         if self.is_active and self.is_registering:
             self.send_temporary_password()
-            self.is_registering=False
+            self.is_registering = False
 
         self.username = self.email
         super(User, self).save(*args, **kwds)
@@ -236,11 +255,14 @@
     def send_temporary_password(self):
         password = User.objects.make_random_password()
         self.set_password(password)
-        subject, from_email, to = 'OpenCloud Account Credentials', 'support@opencloud.us', str(self.email)
+        subject, from_email, to = 'OpenCloud Account Credentials', 'support@opencloud.us', str(
+            self.email)
         text_content = 'This is an important message.'
-        userUrl="http://%s/" % get_request().get_host()
-        html_content = """<p>Your account has been created on OpenCloud. Please log in <a href="""+userUrl+""">here</a> to activate your account<br><br>Username: """+self.email+"""<br>Temporary Password: """+password+"""<br>Please change your password once you successully login into the site.</p>"""
-        msg = EmailMultiAlternatives(subject,text_content, from_email, [to])
+        userUrl = "http://%s/" % get_request().get_host()
+        html_content = """<p>Your account has been created on OpenCloud. Please log in <a href=""" + userUrl + """>here</a> to activate your account<br><br>Username: """ + \
+            self.email + """<br>Temporary Password: """ + password + \
+            """<br>Please change your password once you successully login into the site.</p>"""
+        msg = EmailMultiAlternatives(subject, text_content, from_email, [to])
         msg.attach_alternative(html_content, "text/html")
         msg.send()
 
@@ -254,7 +276,7 @@
         site_privs = SitePrivilege.objects.filter(user=user, site=self.site)
         for site_priv in site_privs:
             if site_priv.role.role == 'admin':
-                return True 
+                return True
             if site_priv.role.role == 'pi':
                 for fieldName in self.diff.keys():
                     if fieldName in self.PI_FORBIDDEN_FIELDS:
@@ -279,29 +301,29 @@
         if self.is_admin:
             return True
 
-        return False 
+        return False
 
     def can_update_deployment(self, deployment):
         from core.models.site import DeploymentPrivilege
         if self.can_update_root():
-            return True    
-                          
-        if DeploymentPrivilege.objects.filter(
-            deployment=deployment,
-            user=self,
-            role__role__in=['admin', 'Admin']):
             return True
-        return False    
+
+        if DeploymentPrivilege.objects.filter(
+                deployment=deployment,
+                user=self,
+                role__role__in=['admin', 'Admin']):
+            return True
+        return False
 
     def can_update_site(self, site, allow=[]):
         from core.models.site import SitePrivilege
         if self.can_update_root():
             return True
         if SitePrivilege.objects.filter(
-            site=site, user=self, role__role__in=['admin', 'Admin']+allow):
+                site=site, user=self, role__role__in=['admin', 'Admin'] + allow):
             return True
         return False
-    
+
     def can_update_slice(self, slice):
         from core.models.slice import SlicePrivilege
         if self.can_update_root():
@@ -310,9 +332,9 @@
             return True
         if self.can_update_site(slice.site, allow=['pi']):
             return True
-                     
+
         if SlicePrivilege.objects.filter(
-            slice=slice, user=self, role__role__in=['admin', 'Admin']):
+                slice=slice, user=self, role__role__in=['admin', 'Admin']):
             return True
         return False
 
@@ -321,7 +343,7 @@
         if self.can_update_root():
             return True
         if ServicePrivilege.objects.filter(
-            service=service, user=self, role__role__in=['admin', 'Admin']+allow):
+                service=service, user=self, role__role__in=['admin', 'Admin'] + allow):
             return True
         return False
 
@@ -330,39 +352,52 @@
         if self.can_update_root():
             return True
         if TenantRootPrivilege.objects.filter(
-            tenant_root=tenant_root, user=self, role__role__in=['admin', 'Admin']+allow):
+                tenant_root=tenant_root, user=self, role__role__in=['admin', 'Admin'] + allow):
+            return True
+        return False
+
+    def can_update_tenant(self, tenant, allow=[]):
+        from core.models.service import Tenant, TenantPrivilege
+        if self.can_update_root():
+            return True
+        if TenantPrivilege.objects.filter(
+                tenant=tenant, user=self, role__role__in=['admin', 'Admin'] + allow):
             return True
         return False
 
     def can_update_tenant_root_privilege(self, tenant_root_privilege, allow=[]):
         return self.can_update_tenant_root(tenant_root_privilege.tenant_root, allow)
 
+    def can_update_tenant_privilege(self, tenant_privilege, allow=[]):
+        return self.can_update_tenant(tenant_privilege.tenant, allow)
+
     def get_readable_objects(self, filter_by=None):
-       """ Returns a list of objects that the user is allowed to read. """
-       from core.models import Deployment, Flavor, Image, Network, NetworkTemplate, Node, PlModelMixIn, Site, Slice, SliceTag, Instance, Tag, User, DeploymentPrivilege, SitePrivilege, SlicePrivilege
-       models = []
-       if filter_by and isinstance(filter_by, list):
-           models = [m for m in filter_by if issubclass(m, PlModelMixIn)]
-       if not models:
-           models = [Deployment, Network, Site, Slice, SliceTag, Instance, Tag, User]
-       readable_objects = []
-       for model in models:
-           readable_objects.extend(model.select_by_user(self))
-       return readable_objects
+        """ Returns a list of objects that the user is allowed to read. """
+        from core.models import Deployment, Flavor, Image, Network, NetworkTemplate, Node, PlModelMixIn, Site, Slice, SliceTag, Instance, Tag, User, DeploymentPrivilege, SitePrivilege, SlicePrivilege
+        models = []
+        if filter_by and isinstance(filter_by, list):
+            models = [m for m in filter_by if issubclass(m, PlModelMixIn)]
+        if not models:
+            models = [Deployment, Network, Site,
+                      Slice, SliceTag, Instance, Tag, User]
+        readable_objects = []
+        for model in models:
+            readable_objects.extend(model.select_by_user(self))
+        return readable_objects
 
     def get_permissions(self, filter_by=None):
         """ Return a list of objects for which the user has read or read/write 
         access. The object will be an instance of a django model object. 
         Permissions will be either 'r' or 'rw'.
-         
+
         e.g.
         [{'object': django_object_instance, 'permissions': 'rw'}, ...]
 
         Returns:
           list of dicts  
-       
+
         """
-        from core.models import Deployment, Flavor, Image, Network, NetworkTemplate, Node, PlModelMixIn, Site, Slice, SliceTag, Instance, Tag, User, DeploymentPrivilege, SitePrivilege, SlicePrivilege   
+        from core.models import Deployment, Flavor, Image, Network, NetworkTemplate, Node, PlModelMixIn, Site, Slice, SliceTag, Instance, Tag, User, DeploymentPrivilege, SitePrivilege, SlicePrivilege
         READ = 'r'
         READWRITE = 'rw'
         models = []
@@ -371,35 +406,35 @@
 
         deployment_priv_objs = [Image, NetworkTemplate, Flavor]
         site_priv_objs = [Node, Slice, User]
-        slice_priv_objs = [Instance, Network] 
-        
+        slice_priv_objs = [Instance, Network]
+
         # maps the set of objects a paticular role has write access
         write_map = {
-            DeploymentPrivilege : {
+            DeploymentPrivilege: {
                 'admin': deployment_priv_objects,
             },
-            SitePrivilege : {
-                'admin' : site_priv_objs,
-                'pi' : [Slice, User],
+            SitePrivilege: {
+                'admin': site_priv_objs,
+                'pi': [Slice, User],
                 'tech': [Node],
-            },     
-            SlicePrivilege : {
-                'admin': slice_priv_objs, 
-            }, 
+            },
+            SlicePrivilege: {
+                'admin': slice_priv_objs,
+            },
         }
-            
+
         privilege_map = {
-            DeploymentPrivilege : (Deployment, deployment_priv_objs),
-            SitePrivilege : (Site, site_priv_objs),
-            SlicePrivilege : (Slice, slice_priv_objs)
+            DeploymentPrivilege: (Deployment, deployment_priv_objs),
+            SitePrivilege: (Site, site_priv_objs),
+            SlicePrivilege: (Slice, slice_priv_objs)
         }
         permissions = []
-        permission_dict = lambda x,y: {'object': x, 'permission': y}
+        permission_dict = lambda x, y: {'object': x, 'permission': y}
         for privilege_model, (model, affected_models) in privileg_map.items():
             if models and model not in models:
                 continue
 
-            # get the objects affected by this privilege model   
+            # get the objects affected by this privilege model
             affected_objects = []
             for affected_model in affected_models:
                 affected_objects.extend(affected_model.select_by_user(self))
@@ -407,10 +442,11 @@
             if self.is_admin:
                 # assume admin users have read/write access to all objects
                 for affected_object in affected_objects:
-                    permissions.append(permission_dict(affected_object, READWRITE))
+                    permissions.append(permission_dict(
+                        affected_object, READWRITE))
             else:
                 # create a dict of the user's per object privileges
-                # ex:  {princeton_tmack : ['admin']  
+                # ex:  {princeton_tmack : ['admin']
                 privileges = privilege_model.objects.filter(user=self)
                 for privilege in privileges:
                     object_roles = defaultdict(list)
@@ -421,32 +457,33 @@
                             obj = getattr(privilege, field)
                     if obj:
                         object_roles[obj].append(privilege.role.role)
-                        
+
                 # loop through all objects the user has access to and determine
                 # if they also have write access
                 for affected_object in affected_objects:
                     if affected_object not in objects_roles:
-                        permissions.append(permission_dict(affected_object, READ))
+                        permissions.append(
+                            permission_dict(affected_object, READ))
                     else:
                         has_write_permission = False
                         for write_role, models in write_dict.items():
                             if affected_object._meta.model in models and \
-                                write_role in object_roles[affected_object]:
-                                    has_write_permission = True
-                                    break
+                                    write_role in object_roles[affected_object]:
+                                has_write_permission = True
+                                break
                         if has_write_permission:
-                            permissions.append(permission_dict(affected_object, WRITE))
+                            permissions.append(
+                                permission_dict(affected_object, WRITE))
                         else:
-                            permissions.append(permission_dict(affected_object, READ))
-                                
-        return permissions                          
-                     
+                            permissions.append(
+                                permission_dict(affected_object, READ))
+
+        return permissions
 
     def get_tenant_permissions(self):
         from core.models import Site, Slice
-        return self.get_object_permissions(filter_by=[Site,Slice])
+        return self.get_object_permissions(filter_by=[Site, Slice])
 
-    
     @staticmethod
     def select_by_user(user):
         if user.is_admin:
@@ -455,7 +492,8 @@
             # can see all users at any site where this user has pi role
             from core.models.site import SitePrivilege
             site_privs = SitePrivilege.objects.filter(user=user)
-            sites = [sp.site for sp in site_privs if sp.role.role in ['Admin', 'admin', 'pi']]
+            sites = [sp.site for sp in site_privs if sp.role.role in [
+                'Admin', 'admin', 'pi']]
             # get site privs of users at these sites
             site_privs = SitePrivilege.objects.filter(site__in=sites)
             user_ids = [sp.user.id for sp in site_privs] + [user.id]
@@ -465,29 +503,34 @@
     def save_by_user(self, user, *args, **kwds):
         if not self.can_update(user):
             if getattr(self, "_cant_update_fieldName", None) is not None:
-                raise PermissionDenied("You do not have permission to update field %s on object %s" % (self._cant_update_fieldName, self.__class__.__name__))
+                raise PermissionDenied("You do not have permission to update field %s on object %s" % (
+                    self._cant_update_fieldName, self.__class__.__name__))
             else:
-                raise PermissionDenied("You do not have permission to update %s objects" % self.__class__.__name__)
+                raise PermissionDenied(
+                    "You do not have permission to update %s objects" % self.__class__.__name__)
 
         self.save(*args, **kwds)
 
     def delete_by_user(self, user, *args, **kwds):
         if not self.can_update(user):
-            raise PermissionDenied("You do not have permission to delete %s objects" % self.__class__.__name__)
+            raise PermissionDenied(
+                "You do not have permission to delete %s objects" % self.__class__.__name__)
         self.delete(*args, **kwds)
 
     def apply_profile(self, profile):
-        if profile=="regular":
+        if profile == "regular":
             self.is_appuser = False
             self.is_admin = False
 
-        elif profile=="cp":
+        elif profile == "cp":
             self.is_appuser = True
             self.is_admin = False
             for db in self.userdashboardviews.all():
                 db.delete()
 
+
 class UserDashboardView(PlCoreBase):
-     user = models.ForeignKey(User, related_name='userdashboardviews')
-     dashboardView = models.ForeignKey(DashboardView, related_name='userdashboardviews')
-     order = models.IntegerField(default=0)
+    user = models.ForeignKey(User, related_name='userdashboardviews')
+    dashboardView = models.ForeignKey(
+        DashboardView, related_name='userdashboardviews')
+    order = models.IntegerField(default=0)
diff --git a/xos/core/xoslib/dashboards/helloworld.html b/xos/core/xoslib/dashboards/helloworld.html
deleted file mode 100644
index 91dde39..0000000
--- a/xos/core/xoslib/dashboards/helloworld.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<!-- /opt/xos/templates/admin/dashboard/helloworld.html -->
-<div>Hello, {{ user.firstname }} {{ user.lastname }}.</div>
-<div>This is the hello world view. The value of foobar is {{ foobar }}.</div>
-<div id="dynamicTableOfInterestingThings"></div>
-<p>Type a new description for the the first slice in the collection:</p>
-<input type="text" name="newDescription" id="newDescription">
-<input type="button" name="submitNewDescription" value="submit new description"  id="submitNewDescription">
-
-<script src="{{ STATIC_URL }}/js/vendor/underscore-min.js"></script>
-<script src="{{ STATIC_URL }}/js/vendor/backbone.js"></script>
-<script src="{{ STATIC_URL }}/js/xoslib/xos-defaults.js"></script>
-<script src="{{ STATIC_URL }}/js/xoslib/xos-backbone.js"></script>
-
-<script src="{{ STATIC_URL }}/js/helloworld.js"></script>
diff --git a/xos/core/xoslib/dashboards/xosOpenVPNDashboard.html b/xos/core/xoslib/dashboards/xosOpenVPNDashboard.html
new file mode 100644
index 0000000..eb1c9c6
--- /dev/null
+++ b/xos/core/xoslib/dashboards/xosOpenVPNDashboard.html
@@ -0,0 +1,14 @@
+<!-- browserSync -->
+
+<!-- inject:css -->
+<link rel="stylesheet" href="/static/css/xosOpenVPNDashboard.css">
+<!-- endinject -->
+
+<div id="xosOpenVPNDashboard">
+    <div ui-view></div>
+</div>
+
+
+<!-- inject:js -->
+<script src="/static/js/xosOpenVPNDashboard.js"></script>
+<!-- endinject -->
diff --git a/xos/core/xoslib/methods/loginview.py b/xos/core/xoslib/methods/loginview.py
old mode 100755
new mode 100644
index 69ee289..2dc79c6
--- a/xos/core/xoslib/methods/loginview.py
+++ b/xos/core/xoslib/methods/loginview.py
@@ -62,8 +62,8 @@
         return self.do_login(request, username, password)
 
     def post(self, request, format=None):
-        username = request.DATA.get("username", None)
-        password = request.DATA.get("password", None)
+        username = request.data.get("username", None)
+        password = request.data.get("password", None)
 
         return self.do_login(request, username, password)
 
@@ -97,5 +97,5 @@
         return self.do_logout(request, sessionid)
 
     def post(self, request, format=None):
-        sessionid = request.DATA.get("xossessionid", None)
+        sessionid = request.data.get("xossessionid", None)
         return self.do_logout(request, sessionid)
\ No newline at end of file
diff --git a/xos/core/xoslib/methods/openvpnview.py b/xos/core/xoslib/methods/openvpnview.py
new file mode 100644
index 0000000..d8cf39e
--- /dev/null
+++ b/xos/core/xoslib/methods/openvpnview.py
@@ -0,0 +1,84 @@
+import jinja2
+from core.models import TenantPrivilege
+from plus import PlusSerializerMixin
+from rest_framework import serializers
+from services.openvpn.models import OpenVPNService, OpenVPNTenant
+from xos.apibase import XOSListCreateAPIView
+
+if hasattr(serializers, "ReadOnlyField"):
+    # rest_framework 3.x
+    ReadOnlyField = serializers.ReadOnlyField
+else:
+    # rest_framework 2.x
+    ReadOnlyField = serializers.Field
+
+
+def get_default_openvpn_service():
+    openvpn_services = OpenVPNService.get_service_objects().all()
+    if openvpn_services:
+        return openvpn_services[0].id
+    return None
+
+
+class OpenVPNTenantSerializer(serializers.ModelSerializer, PlusSerializerMixin):
+    """A Serializer for the OpenVPNTenant that has the minimum information required for clients.
+
+    Attributes:
+        id (ReadOnlyField): The ID of OpenVPNTenant.
+        server_network (ReadOnlyField): The network of the VPN.
+        vpn_subnet (ReadOnlyField): The subnet of the VPN.
+        script_text (SerializerMethodField): The text of the script for the client to use to
+            connect.
+    """
+    id = ReadOnlyField()
+    server_network = ReadOnlyField()
+    vpn_subnet = ReadOnlyField()
+    script_text = serializers.SerializerMethodField()
+
+    class Meta:
+        model = OpenVPNTenant
+        fields = ('id', 'service_specific_attribute', 'vpn_subnet',
+                  'server_network', 'script_text')
+
+    def get_script_text(self, obj):
+        """Gets the text of the client script for the requesting user.
+
+        Parameters:
+            obj (services.openvpn.models.OpenVPNTenant): The OpenVPNTenant to connect to.
+
+        Returns:
+            str: The client script as a str.
+        """
+        env = jinja2.Environment(
+            loader=jinja2.FileSystemLoader("/opt/xos/services/openvpn/templates"))
+        template = env.get_template("connect.vpn.j2")
+        client_name = self.context['request'].user.email + "-" + str(obj.id)
+        remote_ids = list(obj.failover_server_ids)
+        remote_ids.insert(0, obj.id)
+        remotes = OpenVPNTenant.get_tenant_objects().filter(pk__in=remote_ids)
+        pki_dir = OpenVPNService.get_pki_dir(obj)
+        fields = {"client_name": client_name,
+                  "remotes": remotes,
+                  "is_persistent": obj.is_persistent,
+                  "ca_crt": obj.get_ca_crt(pki_dir),
+                  "client_crt": obj.get_client_cert(client_name, pki_dir),
+                  "client_key": obj.get_client_key(client_name, pki_dir)
+                 }
+        return template.render(fields)
+
+
+class OpenVPNTenantList(XOSListCreateAPIView):
+    """Class that provides a list of OpenVPNTenants that the user has permission to access."""
+    serializer_class = OpenVPNTenantSerializer
+    method_kind = "list"
+    method_name = "openvpntenant"
+
+    def get_queryset(self):
+        # Get every privilege for this user
+        tenants_privs = TenantPrivilege.objects.all().filter(
+            user=self.request.user)
+        vpn_tenants = []
+        for priv in tenants_privs:
+            vpn_tenants.append(
+                OpenVPNTenant.get_tenant_objects().filter(pk=priv.tenant.pk)[0])
+        return vpn_tenants
diff --git a/xos/core/xoslib/methods/vtn.py b/xos/core/xoslib/methods/vtn.py
index 1a2af53..c9dbf3a 100644
--- a/xos/core/xoslib/methods/vtn.py
+++ b/xos/core/xoslib/methods/vtn.py
@@ -57,7 +57,8 @@
         for xos_service in Service.objects.all():
             if service in xos_service.get_vtn_src_ids():
                 return Response(xos_service.get_vtn_dependencies_ids())
-        raise DoesNotExist()
+        return Response([])
+        # raise DoesNotExist()
 
     def list(self, request):
         raise Exception("Not Implemented")
diff --git a/xos/core/xoslib/static/css/xosOpenVPNDashboard.css b/xos/core/xoslib/static/css/xosOpenVPNDashboard.css
new file mode 100644
index 0000000..d9d966e
--- /dev/null
+++ b/xos/core/xoslib/static/css/xosOpenVPNDashboard.css
@@ -0,0 +1 @@
+#xosOpenVPNDashboard{width:70%;margin:auto}.vpn-row{display:table-row}.vpn-cell{display:table-cell;padding:5px}.vpn-header{font-weight:700}
\ No newline at end of file
diff --git a/xos/core/xoslib/static/js/helloworld.js b/xos/core/xoslib/static/js/helloworld.js
deleted file mode 100644
index 166d183..0000000
--- a/xos/core/xoslib/static/js/helloworld.js
+++ /dev/null
@@ -1,38 +0,0 @@
-/* eslint-disable guard-for-in, space-before-blocks */
-
-// helloworld.js
-function updateHelloWorldData() {
-  var html = '<table class="table table-bordered table-striped">';
-
-  for (var slicekey in xos.slices.models) {
-    var slice = xos.slices.models[slicekey];
-
-    html = html + '<tr><td>' + slice.get('name') + '</td><td>' + slice.get('description') + '</td></tr>';
-  }
-  html = html + '</table>';
-  $('#dynamicTableOfInterestingThings').html(html);
-}
-
-$(document).ready(function() {
-  xos.slices.on('change', function() {
-    updateHelloWorldData();
-  });
-  xos.slices.on('remove', function() {
-    updateHelloWorldData();
-  });
-  xos.slices.on('sort', function() {
-    updateHelloWorldData();
-  });
-
-  xos.slices.startPolling();
-});
-
-// helloworld.js
-$(document).ready(function() {
-  $('#submitNewDescription').bind('click', function() {
-    var newDescription = $('#newDescription').val();
-
-    xos.slices.models[0].set('description', newDescription);
-    xos.slices.models[0].save();
-  });
-});
diff --git a/xos/core/xoslib/static/js/xosOpenVPNDashboard.js b/xos/core/xoslib/static/js/xosOpenVPNDashboard.js
new file mode 100644
index 0000000..8723888
--- /dev/null
+++ b/xos/core/xoslib/static/js/xosOpenVPNDashboard.js
@@ -0,0 +1 @@
+"use strict";angular.module("xos.openVPNDashboard",["ngResource","ngCookies","ngLodash","ui.router","xos.helpers"]).config(["$stateProvider",function(n){n.state("openVPNList",{url:"/",template:"<vpn-list></vpn-list>"})}]).config(["$compileProvider",function(n){n.aHrefSanitizationWhitelist(/^\s*(https?|ftp|mailto|tel|file|blob):/)}]).service("Vpn",["$http","$q",function(n,e){this.getOpenVpnTenants=function(){var t=e.defer();return n.get("/xoslib/openvpntenant/").then(function(n){t.resolve(n.data)})["catch"](function(n){t.reject(n)}),t.promise}}]).config(["$httpProvider",function(n){n.interceptors.push("NoHyperlinks")}]).directive("vpnList",function(){return{restrict:"E",scope:{},bindToController:!0,controllerAs:"vm",templateUrl:"templates/openvpn-list.tpl.html",controller:["Vpn",function(n){var e=this;n.getOpenVpnTenants().then(function(n){e.vpns=n;for(var t=0;t<e.vpns.length;t++){var i=new Blob([e.vpns[t].script_text],{type:"text/plain"});e.vpns[t].script_text=(window.URL||window.webkitURL).createObjectURL(i)}})["catch"](function(n){throw new Error(n)})}]}}),angular.module("xos.openVPNDashboard").run(["$templateCache",function(n){n.put("templates/openvpn-list.tpl.html",'<div style="display: table;">\n  <div class="vpn-row">\n    <h1 class="vpn-cell">VPN List</h1>\n  </div>\n  <div class="vpn-row">\n    <div class="vpn-cell vpn-header">ID</div>\n    <div class="vpn-cell vpn-header">VPN Network</div>\n    <div class="vpn-cell vpn-header">VPN Subnet</div>\n    <div class="vpn-cell vpn-header">Script Link</div>\n  </div>\n  <div class="vpn-row" ng-repeat="vpn in vm.vpns">\n    <div class="vpn-cell">{{ vpn.id }}</div>\n    <div class="vpn-cell">{{ vpn.server_network }}</div>\n    <div class="vpn-cell">{{ vpn.vpn_subnet }}</div>\n    <div class="vpn-cell">\n      <a download="connect-{{ vpn.id }}.vpn" ng-href="{{ vpn.script_text }}">Script</a>\n    </div>\n  </div>\n</div>\n')}]),angular.module("xos.openVPNDashboard").run(["$location",function(n){n.path("/")}]),angular.bootstrap(angular.element("#xosOpenVPNDashboard"),["xos.openVPNDashboard"]);
\ No newline at end of file
diff --git a/xos/services/cord/admin.py b/xos/services/cord/admin.py
index 3cccc6c..e7704d3 100644
--- a/xos/services/cord/admin.py
+++ b/xos/services/cord/admin.py
@@ -104,9 +104,6 @@
     bbs_server = forms.CharField(required=False)
     backend_network_label = forms.CharField(required=False)
     bbs_slice = forms.ModelChoiceField(queryset=Slice.objects.all(), required=False)
-    wan_container_gateway_ip = forms.CharField(required=False)
-    wan_container_gateway_mac = forms.CharField(required=False)
-    wan_container_netbits = forms.CharField(required=False)
     dns_servers = forms.CharField(required=False)
     url_filter_kind = forms.ChoiceField(choices=VSGService.URL_FILTER_KIND_CHOICES, required=False)
     node_label = forms.CharField(required=False)
@@ -119,9 +116,6 @@
             self.fields['bbs_server'].initial = self.instance.bbs_server
             self.fields['backend_network_label'].initial = self.instance.backend_network_label
             self.fields['bbs_slice'].initial = self.instance.bbs_slice
-            self.fields['wan_container_gateway_ip'].initial = self.instance.wan_container_gateway_ip
-            self.fields['wan_container_gateway_mac'].initial = self.instance.wan_container_gateway_mac
-            self.fields['wan_container_netbits'].initial = self.instance.wan_container_netbits
             self.fields['dns_servers'].initial = self.instance.dns_servers
             self.fields['url_filter_kind']. initial = self.instance.url_filter_kind
             self.fields['node_label'].initial = self.instance.node_label
@@ -132,9 +126,6 @@
         self.instance.bbs_server = self.cleaned_data.get("bbs_server")
         self.instance.backend_network_label = self.cleaned_data.get("backend_network_label")
         self.instance.bbs_slice = self.cleaned_data.get("bbs_slice")
-        self.instance.wan_container_gateway_ip = self.cleaned_data.get("wan_container_gateway_ip")
-        self.instance.wan_container_gateway_mac = self.cleaned_data.get("wan_container_gateway_mac")
-        self.instance.wan_container_netbits = self.cleaned_data.get("wan_container_netbits")
         self.instance.dns_servers = self.cleaned_data.get("dns_servers")
         self.instance.url_filter_kind = self.cleaned_data.get("url_filter_kind")
         self.instance.node_label = self.cleaned_data.get("node_label")
@@ -153,7 +144,7 @@
                                      'classes':['suit-tab suit-tab-general']}),
                  ("backend config", {'fields': [ "backend_network_label", "url_filter_kind", "bbs_api_hostname", "bbs_api_port", "bbs_server", "bbs_slice"],
                                      'classes':['suit-tab suit-tab-backend']}),
-                 ("vSG config", {'fields': [ "wan_container_gateway_ip", "wan_container_gateway_mac", "wan_container_netbits", "dns_servers"],
+                 ("vSG config", {'fields': ["dns_servers"],
                                      'classes':['suit-tab suit-tab-vsg']}) ]
     readonly_fields = ('backend_status_text', "service_specific_attribute")
     inlines = [SliceInline,ServiceAttrAsTabInline,ServicePrivilegeInline]
diff --git a/xos/services/cord/models.py b/xos/services/cord/models.py
index 07c169d..c57d9fb 100644
--- a/xos/services/cord/models.py
+++ b/xos/services/cord/models.py
@@ -8,6 +8,7 @@
 from operator import itemgetter, attrgetter, methodcaller
 from core.models import Tag
 from core.models.service import LeastLoadedNodeScheduler
+from services.vrouter.models import VRouterService, VRouterTenant
 import traceback
 from xos.exceptions import *
 from xos.config import Config
@@ -371,9 +372,6 @@
                           ("bbs_api_port", None),
                           ("bbs_server", None),
                           ("backend_network_label", "hpc_client"),
-                          ("wan_container_gateway_ip", ""),
-                          ("wan_container_gateway_mac", ""),
-                          ("wan_container_netbits", "24"),
                           ("dns_servers", "8.8.8.8"),
                           ("url_filter_kind", None),
                           ("node_label", None) )
@@ -418,25 +416,15 @@
 
 VSGService.setup_simple_attributes()
 
-#class STagBlock(PlCoreBase):
-#    instance = models.ForeignKey(Instance, related_name="s_tags")
-#    s_tag = models.CharField(null=false, blank=false, unique=true, max_length=10)
-#    #c_tags = models.TextField(null=true, blank=true)
-#
-#    def __unicode__(self): return u'%s' % (self.s_tag)
-
 class VSGTenant(TenantWithContainer):
     class Meta:
         proxy = True
 
     KIND = VCPE_KIND
 
-    sync_attributes = ("nat_ip", "nat_mac",
-                       "lan_ip", "lan_mac",
-                       "wan_ip", "wan_mac",
-                       "wan_container_ip", "wan_container_mac",
-                       "private_ip", "private_mac",
-                       "hpc_client_ip", "hpc_client_mac")
+    sync_attributes = ("wan_container_ip", "wan_container_mac", "wan_container_netbits",
+                       "wan_container_gateway_ip", "wan_container_gateway_mac",
+                       "wan_vm_ip", "wan_vm_mac")
 
     default_attributes = {"instance_id": None,
                           "container_id": None,
@@ -447,27 +435,36 @@
 
     def __init__(self, *args, **kwargs):
         super(VSGTenant, self).__init__(*args, **kwargs)
-        self.cached_vbng=None
+        self.cached_vrouter=None
 
     @property
     def vbng(self):
-        vbng = self.get_newest_subscribed_tenant(VBNGTenant)
-        if not vbng:
-            return None
-
-        # always return the same object when possible
-        if (self.cached_vbng) and (self.cached_vbng.id == vbng.id):
-            return self.cached_vbng
-
-        vbng.caller = self.creator
-        self.cached_vbng = vbng
-        return vbng
+        # not supported
+        return None
 
     @vbng.setter
     def vbng(self, value):
         raise XOSConfigurationError("vCPE.vBNG cannot be set this way -- create a new vBNG object and set it's subscriber_tenant instead")
 
     @property
+    def vrouter(self):
+        vrouter = self.get_newest_subscribed_tenant(VRouterTenant)
+        if not vrouter:
+            return None
+
+        # always return the same object when possible
+        if (self.cached_vrouter) and (self.cached_vrouter.id == vrouter.id):
+            return self.cached_vrouter
+
+        vrouter.caller = self.creator
+        self.cached_vrouter = vrouter
+        return vrouter
+
+    @vrouter.setter
+    def vrouter(self, value):
+        raise XOSConfigurationError("vCPE.vRouter cannot be set this way -- create a new vRuter object and set its subscriber_tenant instead")
+
+    @property
     def volt(self):
         if not self.subscriber_tenant:
             return None
@@ -503,104 +500,49 @@
     def ssh_command(self, value):
         pass
 
-    @property
-    def addresses(self):
-        if self.instance:
-            ports = self.instance.ports.all()
-        elif self.container:
-            ports = self.container.ports.all()
+    def get_vrouter_field(self, name, default=None):
+        if self.vrouter:
+            return getattr(self.vrouter, name, default)
         else:
-            return {}
-
-        addresses = {}
-        for ns in ports:
-            if "lan" in ns.network.name.lower():
-                addresses["lan"] = (ns.ip, ns.mac)
-            elif "wan" in ns.network.name.lower():
-                addresses["wan"] = (ns.ip, ns.mac)
-            elif "private" in ns.network.name.lower():
-                addresses["private"] = (ns.ip, ns.mac)
-            elif "nat" in ns.network.name.lower():
-                addresses["nat"] = (ns.ip, ns.mac)
-            elif "hpc_client" in ns.network.name.lower():
-                addresses["hpc_client"] = (ns.ip, ns.mac)
-        return addresses
-
-    # ------------------------------------------------------------------------
-    # The following IP addresses all come from the VM
-    # Note: They might not be useful for the VTN-vSG
-
-    @property
-    def nat_ip(self):
-        return self.addresses.get("nat", (None,None) )[0]
-
-    @property
-    def nat_mac(self):
-        return self.addresses.get("nat", (None,None) )[1]
-
-    @property
-    def lan_ip(self):
-        return self.addresses.get("lan", (None, None) )[0]
-
-    @property
-    def lan_mac(self):
-        return self.addresses.get("lan", (None, None) )[1]
-
-    @property
-    def wan_ip(self):
-        return self.addresses.get("wan", (None, None) )[0]
-
-    @property
-    def wan_mac(self):
-        return self.addresses.get("wan", (None, None) )[1]
-
-    # end of VM IP address stubs
-    # ------------------------------------------------------------------------
+            return default
 
     @property
     def wan_container_ip(self):
-        if CORD_USE_VTN:
-            # When using VTN, wan_container_ip is stored and maintained inside
-            # of the vSG object.
-            return self.get_attribute("wan_container_ip", self.default_attributes["wan_container_ip"])
-        else:
-            # When not using VTN, wan_container_ip is the same as wan_ip.
-            # XXX Is this broken for multiple-containers-per-VM?
-            return self.wan_ip
+        return self.get_vrouter_field("public_ip", None)
 
-    @wan_container_ip.setter
-    def wan_container_ip(self, value):
-        if CORD_USE_VTN:
-            self.set_attribute("wan_container_ip", value)
-        else:
-            raise Exception("wan_container_ip.setter called on non-VTN CORD")
-
-    def ip_to_mac(self, ip):
-        (a, b, c, d) = ip.split('.')
-        return "02:42:%02x:%02x:%02x:%02x" % (int(a), int(b), int(c), int(d))
-
-    # Generate the MAC for the container interface connected to WAN
     @property
     def wan_container_mac(self):
-        if not self.wan_container_ip:
-            return None
-        return self.ip_to_mac(self.wan_container_ip)
+        return self.get_vrouter_field("public_mac", None)
 
     @property
-    def private_ip(self):
-        return self.addresses.get("private", (None, None) )[0]
+    def wan_container_netbits(self):
+        return self.get_vrouter_field("netbits", None)
 
     @property
-    def private_mac(self):
-        return self.addresses.get("private", (None, None) )[1]
+    def wan_container_gateway_ip(self):
+        return self.get_vrouter_field("gateway_ip", None)
 
     @property
-    def hpc_client_ip(self):
-        return self.addresses.get("hpc_client", (None, None) )[0]
+    def wan_container_gateway_mac(self):
+        return self.get_vrouter_field("gateway_mac", None)
 
     @property
-    def hpc_client_mac(self):
-        return self.addresses.get("hpc_client", (None, None) )[1]
+    def wan_vm_ip(self):
+        tags = Tag.select_by_content_object(self.instance).filter(name="vm_vrouter_tenant")
+        if tags:
+            tenant = VRouterTenant.objects.get(id=tags[0].value)
+            return tenant.public_ip
+        else:
+            raise Exception("no vm_vrouter_tenant tag for instance %s" % o.instance)
+
+    @property
+    def wan_vm_mac(self):
+        tags = Tag.select_by_content_object(self.instance).filter(name="vm_vrouter_tenant")
+        if tags:
+            tenant = VRouterTenant.objects.get(id=tags[0].value)
+            return tenant.public_mac
+        else:
+            raise Exception("no vm_vrouter_tenant tag for instance %s" % o.instance)
 
     @property
     def is_synced(self):
@@ -610,34 +552,35 @@
     def is_synced(self, value):
         pass
 
-    def manage_vbng(self):
-        # Each vCPE object owns exactly one vBNG object
+    def get_vrouter_service(self):
+        vrouterServices = VRouterService.get_service_objects().all()
+        if not vrouterServices:
+            raise XOSConfigurationError("No VROUTER Services available")
+        return vrouterServices[0]
+
+    def manage_vrouter(self):
+        # Each vCPE object owns exactly one vRouterTenant object
 
         if self.deleted:
             return
 
-        if self.vbng is None:
-            vbngServices = VBNGService.get_service_objects().all()
-            if not vbngServices:
-                raise XOSConfigurationError("No VBNG Services available")
+        if self.vrouter is None:
+            vrouter = self.get_vrouter_service().get_tenant(address_pool_name="addresses_vsg", subscriber_tenant = self)
+            vrouter.caller = self.creator
+            vrouter.save()
 
-            vbng = VBNGTenant(provider_service = vbngServices[0],
-                              subscriber_tenant = self)
-            vbng.caller = self.creator
-            vbng.save()
-
-    def cleanup_vbng(self):
-        if self.vbng:
-            # print "XXX cleanup vnbg", self.vbng
-            self.vbng.delete()
+    def cleanup_vrouter(self):
+        if self.vrouter:
+            # print "XXX cleanup vrouter", self.vrouter
+            self.vrouter.delete()
 
     def cleanup_orphans(self):
-        # ensure vCPE only has one vBNG
-        cur_vbng = self.vbng
-        for vbng in list(self.get_subscribed_tenants(VBNGTenant)):
-            if (not cur_vbng) or (vbng.id != cur_vbng.id):
-                # print "XXX clean up orphaned vbng", vbng
-                vbng.delete()
+        # ensure vCPE only has one vRouter
+        cur_vrouter = self.vrouter
+        for vrouter in list(self.get_subscribed_tenants(VRouterTenant)):
+            if (not cur_vrouter) or (vrouter.id != cur_vrouter.id):
+                # print "XXX clean up orphaned vrouter", vrouter
+                vrouter.delete()
 
         if self.orig_instance_id and (self.orig_instance_id != self.get_attribute("instance_id")):
             instances=Instance.objects.filter(id=self.orig_instance_id)
@@ -741,33 +684,6 @@
                 self.bbs_account = None
                 super(VSGTenant, self).save()
 
-    def get_wan_address_from_pool(self):
-        ap = AddressPool.objects.filter(name="public_addresses")
-        if not ap:
-            raise Exception("AddressPool 'public_addresses' does not exist. Please configure it.")
-        ap = ap[0]
-
-        addr = ap.get_address()
-        if not addr:
-            raise Exception("AddressPool 'public_addresses' has run out of addresses.")
-        return addr
-
-    def put_wan_address_to_pool(self, addr):
-        AddressPool.objects.filter(name="public_addresses")[0].put_address(addr)
-
-    def manage_wan_container_ip(self):
-        if CORD_USE_VTN:
-            if not self.wan_container_ip:
-                addr = self.get_wan_address_from_pool()
-
-                self.wan_container_ip = addr
-                super(TenantWithContainer, self).save()
-
-    def cleanup_wan_container_ip(self):
-        if CORD_USE_VTN and self.wan_container_ip:
-            self.put_wan_address_to_pool(self.wan_container_ip)
-            self.wan_container_ip = None
-
     def find_or_make_port(self, instance, network, **kwargs):
         port = Port.objects.filter(instance=instance, network=network)
         if port:
@@ -829,10 +745,12 @@
             # VTN-CORD needs a WAN address for the VM, so that the VM can
             # be configured.
             if CORD_USE_VTN:
-                tags = Tag.select_by_content_object(instance).filter(name="vm_wan_addr")
+                tags = Tag.select_by_content_object(instance).filter(name="vm_vrouter_tenant")
                 if not tags:
-                    address = self.get_wan_address_from_pool()
-                    tag = Tag(service=self.provider_service, content_object=instance, name="vm_wan_addr", value="%s,%s,%s" % ("public_addresses", address, self.ip_to_mac(address)))
+                    vrouter = self.get_vrouter_service().get_tenant(address_pool_name="addresses_vsg", subscriber_service = self.provider_service)
+                    vrouter.set_attribute("tenant_for_instance_id", instance.id)
+                    vrouter.save()
+                    tag = Tag(service=self.provider_service, content_object=instance, name="vm_vrouter_tenant", value="%d" % vrouter.id)
                     tag.save()
 
     def save(self, *args, **kwargs):
@@ -848,9 +766,8 @@
         model_policy_vcpe(self.pk)
 
     def delete(self, *args, **kwargs):
-        self.cleanup_vbng()
+        self.cleanup_vrouter()
         self.cleanup_container()
-        self.cleanup_wan_container_ip()
         super(VSGTenant, self).delete(*args, **kwargs)
 
 def model_policy_vcpe(pk):
@@ -860,9 +777,8 @@
         if not vcpe:
             return
         vcpe = vcpe[0]
-        vcpe.manage_wan_container_ip()
         vcpe.manage_container()
-        vcpe.manage_vbng()
+        vcpe.manage_vrouter()
         vcpe.manage_bbs_account()
         vcpe.cleanup_orphans()
 
diff --git a/xos/services/fabric/__init__.py b/xos/services/fabric/__init__.py
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/xos/services/fabric/__init__.py
@@ -0,0 +1 @@
+
diff --git a/xos/services/fabric/admin.py b/xos/services/fabric/admin.py
new file mode 100644
index 0000000..5dc5923
--- /dev/null
+++ b/xos/services/fabric/admin.py
@@ -0,0 +1,63 @@
+from django.contrib import admin
+
+from services.fabric.models import *
+from django import forms
+from django.utils.safestring import mark_safe
+from django.contrib.auth.admin import UserAdmin
+from django.contrib.admin.widgets import FilteredSelectMultiple
+from django.contrib.auth.forms import ReadOnlyPasswordHashField
+from django.contrib.auth.signals import user_logged_in
+from django.utils import timezone
+from django.contrib.contenttypes import generic
+from suit.widgets import LinkedSelect
+from core.models import AddressPool
+from core.admin import ServiceAppAdmin,SliceInline,ServiceAttrAsTabInline, ReadOnlyAwareAdmin, XOSTabularInline, ServicePrivilegeInline, TenantRootTenantInline, TenantRootPrivilegeInline
+from core.middleware import get_request
+
+from functools import update_wrapper
+from django.contrib.admin.views.main import ChangeList
+from django.core.urlresolvers import reverse
+from django.contrib.admin.utils import quote
+
+class FabricServiceForm(forms.ModelForm):
+    def __init__(self,*args,**kwargs):
+        super (FabricServiceForm,self ).__init__(*args,**kwargs)
+
+    def save(self, commit=True):
+        return super(FabricServiceForm, self).save(commit=commit)
+
+    class Meta:
+        model = FabricService
+
+class FabricServiceAdmin(ReadOnlyAwareAdmin):
+    model = FabricService
+    verbose_name = "Fabric Service"
+    verbose_name_plural = "Fabric Services"
+    list_display = ("backend_status_icon", "name", "enabled")
+    list_display_links = ('backend_status_icon', 'name', )
+    fieldsets = [(None, {'fields': ['backend_status_text', 'name','enabled','versionNumber', 'description', "view_url", "icon_url", ],
+                         'classes':['suit-tab suit-tab-general']})]
+    readonly_fields = ('backend_status_text', )
+    inlines = [SliceInline,ServiceAttrAsTabInline,ServicePrivilegeInline]
+    form = FabricServiceForm
+
+    extracontext_registered_admins = True
+
+    user_readonly_fields = ["name", "enabled", "versionNumber", "description"]
+
+    suit_form_tabs =(('general', 'Fabric Service Details'),
+        ('administration', 'Administration'),
+        #('tools', 'Tools'),
+        ('slices','Slices'),
+        ('serviceattrs','Additional Attributes'),
+        ('serviceprivileges','Privileges'),
+    )
+
+    suit_form_includes = (('fabricadmin.html', 'top', 'administration'),
+                           )
+
+    def queryset(self, request):
+        return FabricService.get_service_objects_by_user(request.user)
+
+admin.site.register(FabricService, FabricServiceAdmin)
+
diff --git a/xos/services/fabric/models.py b/xos/services/fabric/models.py
new file mode 100644
index 0000000..0bf6a14
--- /dev/null
+++ b/xos/services/fabric/models.py
@@ -0,0 +1,30 @@
+from django.db import models
+from core.models import Service, PlCoreBase, Slice, Instance, Tenant, TenantWithContainer, Node, Image, User, Flavor, Subscriber, NetworkParameter, NetworkParameterType, Port, AddressPool
+from core.models.plcorebase import StrippedCharField
+import os
+from django.db import models, transaction
+from django.forms.models import model_to_dict
+from django.db.models import Q
+from operator import itemgetter, attrgetter, methodcaller
+from core.models import Tag
+from core.models.service import LeastLoadedNodeScheduler
+import traceback
+from xos.exceptions import *
+from xos.config import Config
+
+class ConfigurationError(Exception):
+    pass
+
+FABRIC_KIND = "fabric"
+
+CORD_USE_VTN = getattr(Config(), "networking_use_vtn", False)
+
+class FabricService(Service):
+    KIND = FABRIC_KIND
+
+    class Meta:
+        app_label = "fabric"
+        verbose_name = "Fabric Service"
+        proxy = True
+
+
diff --git a/xos/services/helloworld/models.py b/xos/services/helloworld/models.py
deleted file mode 100644
index 9bb343e..0000000
--- a/xos/services/helloworld/models.py
+++ /dev/null
@@ -1,18 +0,0 @@
-from django.db import models
-from core.models import User, Service, SingletonModel, PlCoreBase, Instance
-from core.models.plcorebase import StrippedCharField
-import os
-from django.db import models
-from django.forms.models import model_to_dict
-from django.db.models import Q
-
-
-# Create your models here.
-
-class Hello(PlCoreBase):
-    name = models.CharField(max_length=254,help_text="Salutation e.g. Hello or Bonjour")
-    instance_backref = models.ForeignKey(Instance,related_name="hellos")
-    
-class World(PlCoreBase):
-    name = models.CharField(max_length=254,help_text="Name of planet")
-    hello = models.ForeignKey(Hello) 
diff --git a/xos/services/helloworld/view.py b/xos/services/helloworld/view.py
deleted file mode 100644
index 6ad9ae1..0000000
--- a/xos/services/helloworld/view.py
+++ /dev/null
@@ -1,57 +0,0 @@
-from django.http import HttpResponse
-from django.views.generic import TemplateView, View
-from django import template
-from core.models import *
-from services.helloworld.models import *
-import json
-import os
-import time
-import tempfile
-
-class HelloWorldView(TemplateView):
-    head_template = r"""{% extends "admin/dashboard/dashboard_base.html" %}
-       {% load admin_static %}
-       {% block content %}
-    """
-
-    tail_template = r"{% endblock %}"
-
-    def get(self, request, name="root", *args, **kwargs):
-        head_template = self.head_template
-        tail_template = self.tail_template
-
-        try:
-            hello_name = request.GET['hello_name']
-            world_name = request.GET['world_name']
-            instance_id_str = request.GET['instance_id']
-            instance_id = int(instance_id_str)
-
-            i = Instance.objects.get(pk=instance_id)
-            i.pk=None
-            i.userData=None
-            i.instance_id=None
-            i.instance_name=None
-            i.enacted=None
-            i.save()
-            h = Hello(name=hello_name,instance_backref=i)
-            h.save()
-            w = World(hello=h,name=world_name)
-            w.save()
-
-            t = template.Template(head_template + 'Done. New instance id: %r'%i.pk + self.tail_template)
-        except KeyError:
-            html = """<form>
-                Hello string: <input type="text" name="hello_name" placeholder="Planet"><br>
-                World string: <input type="text" name="world_name" placeholder="Earth"><br>
-                Id of instance to copy: <input type="text" name="instance_id" placeholder="3"><br>
-                <input type="submit" value="Submit">
-                  </form>"""
-
-            t = template.Template(head_template + html + self.tail_template)
-
-        response_kwargs = {}
-        response_kwargs.setdefault('content_type', self.content_type)
-        return self.response_class(
-            request = request,
-            template = t,
-            **response_kwargs)
diff --git a/xos/services/helloworldservice_complete/__init__.py b/xos/services/helloworldservice_complete/__init__.py
deleted file mode 100644
index e69de29..0000000
--- a/xos/services/helloworldservice_complete/__init__.py
+++ /dev/null
diff --git a/xos/services/helloworldservice_complete/admin.py b/xos/services/helloworldservice_complete/admin.py
deleted file mode 100644
index 3c8e793..0000000
--- a/xos/services/helloworldservice_complete/admin.py
+++ /dev/null
@@ -1,141 +0,0 @@
-
-from core.admin import ReadOnlyAwareAdmin, SliceInline
-from core.middleware import get_request
-from core.models import User
-from django import forms
-from django.contrib import admin
-from services.helloworldservice_complete.models import HelloWorldServiceComplete, HelloWorldTenantComplete, HELLO_WORLD_KIND
-
-# The class to provide an admin interface on the web for the service.
-# We do only configuration here and don't change any logic because the logic
-# is taken care of for us by ReadOnlyAwareAdmin
-class HelloWorldServiceCompleteAdmin(ReadOnlyAwareAdmin):
-    # We must set the model so that the admin knows what fields to use
-    model = HelloWorldServiceComplete
-    verbose_name = "Hello World Service"
-    verbose_name_plural = "Hello World Services"
-
-    # Setting list_display creates columns on the admin page, each value here
-    # is a column, the column is populated for every instance of the model.
-    list_display = ("backend_status_icon", "name", "enabled")
-
-    # Used to indicate which values in the columns of the admin form are links.
-    list_display_links = ('backend_status_icon', 'name', )
-
-    # Denotes the sections of the form, the fields in the section, and the
-    # CSS classes used to style them. We represent this as a set of tuples, each
-    # tuple as a name (or None) and a set of fields and classes.
-    # Here the first section does not have a name so we use none. That first
-    # section has several fields indicated in the 'fields' attribute, and styled
-    # by the classes indicated in the 'classes' attribute. The classes given
-    # here are important for rendering the tabs on the form. To give the tabs
-    # we must assign the classes suit-tab and suit-tab-<name> where
-    # where <name> will be used later.
-    fieldsets = [(None, {'fields': ['backend_status_text', 'name', 'enabled',
-                                    'versionNumber', 'description', "view_url"],
-                         'classes':['suit-tab suit-tab-general']})]
-
-    # Denotes the fields that are readonly and cannot be changed.
-    readonly_fields = ('backend_status_text', )
-
-    # Inlines are used to denote other models that can be edited on the same
-    # form as this one. In this case the service form also allows changes
-    # to slices.
-    inlines = [SliceInline]
-
-    extracontext_registered_admins = True
-
-    # Denotes the fields that can be changed by an admin but not be all users
-    user_readonly_fields = ["name", "enabled", "versionNumber", "description"]
-
-    # Associates fieldsets from this form and from the inlines.
-    # The format here are tuples, of (<name>, tab title). <name> comes from the
-    # <name> in the fieldsets.
-    suit_form_tabs = (('general', 'Hello World Service Details'),
-                      ('administration', 'Tenants'),
-                      ('slices', 'Slices'),)
-
-    # Used to include a template for a tab. Here we include the
-    # helloworldserviceadmin template in the top position for the administration
-    # tab.
-    suit_form_includes = (('helloworldserviceadmin.html',
-                           'top',
-                           'administration'),)
-
-    # Used to get the objects for this model that are associated with the
-    # requesting user.
-    def queryset(self, request):
-        return HelloWorldServiceComplete.get_service_objects_by_user(request.user)
-
-# Class to represent the form to add and edit tenants.
-# We need to define this instead of just using an admin like we did for the
-# service because tenants vary more than services and there isn't a common form.
-# This allows us to change the python behavior for the admin form to save extra
-# fields and control defaults.
-class HelloWorldTenantCompleteForm(forms.ModelForm):
-    # Defines a field for the creator of this service. It is a dropdown which
-    # is populated with all of the users.
-    creator = forms.ModelChoiceField(queryset=User.objects.all())
-    # Defines a text field for the display message, it is not required.
-    display_message = forms.CharField(required=False)
-
-    def __init__(self, *args, **kwargs):
-        super(HelloWorldTenantCompleteForm, self).__init__(*args, **kwargs)
-        # Set the kind field to readonly
-        self.fields['kind'].widget.attrs['readonly'] = True
-        # Define the logic for obtaining the objects for the provider_service
-        # dropdown of the tenant form.
-        self.fields[
-            'provider_service'].queryset = HelloWorldServiceComplete.get_service_objects().all()
-        # Set the initial kind to HELLO_WORLD_KIND for this tenant.
-        self.fields['kind'].initial = HELLO_WORLD_KIND
-        # If there is an instance of this model then we can set the initial
-        # form values to the existing values.
-        if self.instance:
-            self.fields['creator'].initial = self.instance.creator
-            self.fields[
-                'display_message'].initial = self.instance.display_message
-
-        # If there is not an instance then we need to set initial values.
-        if (not self.instance) or (not self.instance.pk):
-            self.fields['creator'].initial = get_request().user
-            if HelloWorldServiceComplete.get_service_objects().exists():
-                self.fields["provider_service"].initial = HelloWorldServiceComplete.get_service_objects().all()[0]
-
-    # This function describes what happens when the save button is pressed on
-    # the tenant form. In this case we set the values for the instance that were
-    # entered.
-    def save(self, commit=True):
-        self.instance.creator = self.cleaned_data.get("creator")
-        self.instance.display_message = self.cleaned_data.get(
-            "display_message")
-        return super(HelloWorldTenantCompleteForm, self).save(commit=commit)
-
-    class Meta:
-        model = HelloWorldTenantComplete
-
-# Define the admin form for the tenant. This uses a similar structure as the
-# service but uses HelloWorldTenantCompleteForm to change the python behavior.
-
-
-class HelloWorldTenantCompleteAdmin(ReadOnlyAwareAdmin):
-    verbose_name = "Hello World Tenant"
-    verbose_name_plural = "Hello World Tenants"
-    list_display = ('id', 'backend_status_icon', 'instance', 'display_message')
-    list_display_links = ('backend_status_icon', 'instance', 'display_message',
-                          'id')
-    fieldsets = [(None, {'fields': ['backend_status_text', 'kind',
-                                    'provider_service', 'instance', 'creator',
-                                    'display_message'],
-                         'classes': ['suit-tab suit-tab-general']})]
-    readonly_fields = ('backend_status_text', 'instance',)
-    form = HelloWorldTenantCompleteForm
-
-    suit_form_tabs = (('general', 'Details'),)
-
-    def queryset(self, request):
-        return HelloWorldTenantComplete.get_tenant_objects_by_user(request.user)
-
-# Associate the admin forms with the models.
-admin.site.register(HelloWorldServiceComplete, HelloWorldServiceCompleteAdmin)
-admin.site.register(HelloWorldTenantComplete, HelloWorldTenantCompleteAdmin)
diff --git a/xos/services/helloworldservice_complete/models.py b/xos/services/helloworldservice_complete/models.py
deleted file mode 100644
index 8a4ce59..0000000
--- a/xos/services/helloworldservice_complete/models.py
+++ /dev/null
@@ -1,113 +0,0 @@
-from core.models import Service, TenantWithContainer
-from django.db import transaction
-
-HELLO_WORLD_KIND = "helloworldservice_complete"
-
-# The class to represent the service. Most of the service logic is given for us
-# in the Service class but, we have some configuration that is specific for
-# this example.
-class HelloWorldServiceComplete(Service):
-    KIND = HELLO_WORLD_KIND
-
-    class Meta:
-        # When the proxy field is set to True the model is represented as
-        # it's superclass in the database, but we can still change the python
-        # behavior. In this case HelloWorldServiceComplete is a Service in the
-        # database.
-        proxy = True
-        # The name used to find this service, all directories are named this
-        app_label = "helloworldservice_complete"
-        verbose_name = "Hello World Service"
-
-# This is the class to represent the tenant. Most of the logic is given to use
-# in TenantWithContainer, however there is some configuration and logic that
-# we need to define for this example.
-class HelloWorldTenantComplete(TenantWithContainer):
-
-    class Meta:
-        # Same as a above, HelloWorldTenantComplete is represented as a
-        # TenantWithContainer, but we change the python behavior.
-        proxy = True
-        verbose_name = "Hello World Tenant"
-
-    # The kind of the service is used on forms to differentiate this service
-    # from the other services.
-    KIND = HELLO_WORLD_KIND
-
-    # Ansible requires that the sync_attributes field contain nat_ip and nat_mac
-    # these will be used to determine where to SSH to for ansible.
-    # Getters must be defined for every attribute specified here.
-    sync_attributes = ("nat_ip", "nat_mac",)
-
-    # default_attributes is used cleanly indicate what the default values for
-    # the fields are.
-    default_attributes = {'display_message': 'Hello World!'}
-
-    def __init__(self, *args, **kwargs):
-        helloworld_services = HelloWorldServiceComplete.get_service_objects().all()
-        # When the tenant is created the default service in the form is set
-        # to be the first created HelloWorldServiceComplete
-        if helloworld_services:
-            self._meta.get_field(
-                "provider_service").default = helloworld_services[0].id
-        super(HelloWorldTenantComplete, self).__init__(*args, **kwargs)
-
-    def save(self, *args, **kwargs):
-        super(HelloWorldTenantComplete, self).save(*args, **kwargs)
-        # This call needs to happen so that an instance is created for this
-        # tenant is created in the slice. One instance is created per tenant.
-        model_policy_helloworld_tenant(self.pk)
-
-    def delete(self, *args, **kwargs):
-        # Delete the instance that was created for this tenant
-        self.cleanup_container()
-        super(HelloWorldTenantComplete, self).delete(*args, **kwargs)
-
-    # Getter for the message that will appear on the webpage
-    # By default it is "Hello World!"
-    @property
-    def display_message(self):
-        return self.get_attribute(
-            "display_message",
-            self.default_attributes['display_message'])
-
-    # Setter for the message that will appear on the webpage
-    @display_message.setter
-    def display_message(self, value):
-        self.set_attribute("display_message", value)
-
-    @property
-    def addresses(self):
-        if (not self.id) or (not self.instance):
-            return {}
-
-        addresses = {}
-        # The ports field refers to networks for the instance.
-        # This loop stores the details for the NAT network that will be
-        # necessary for ansible.
-        for ns in self.instance.ports.all():
-            if "nat" in ns.network.name.lower():
-                addresses["nat"] = (ns.ip, ns.mac)
-        return addresses
-
-    # This getter is necessary because nat_ip is a sync_attribute
-    @property
-    def nat_ip(self):
-        return self.addresses.get("nat", (None, None))[0]
-
-    # This getter is necessary because nat_mac is a sync_attribute
-    @property
-    def nat_mac(self):
-        return self.addresses.get("nat", (None, None))[1]
-
-
-def model_policy_helloworld_tenant(pk):
-    # This section of code is atomic to prevent race conditions
-    with transaction.atomic():
-        # We find all of the tenants that are waiting to update
-        tenant = HelloWorldTenantComplete.objects.select_for_update().filter(pk=pk)
-        if not tenant:
-            return
-        # Since this code is atomic it is safe to always use the first tenant
-        tenant = tenant[0]
-        tenant.manage_container()
diff --git a/xos/services/helloworldservice_complete/templates/helloworldserviceadmin.html b/xos/services/helloworldservice_complete/templates/helloworldserviceadmin.html
deleted file mode 100644
index ba418ee..0000000
--- a/xos/services/helloworldservice_complete/templates/helloworldserviceadmin.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!-- Template used to for the button leading to the HelloWorldTenantComplete form. -->
-<div class = "left-nav">
-  <ul>
-    <li>
-      <a href="/admin/helloworldservice_complete/helloworldtenantcomplete/">
-        Hello World Tenants
-      </a>
-    </li>
-  </ul>
-</div>
diff --git a/xos/services/helloworld/__init__.py b/xos/services/openvpn/__init__.py
similarity index 100%
rename from xos/services/helloworld/__init__.py
rename to xos/services/openvpn/__init__.py
diff --git a/xos/services/openvpn/admin.py b/xos/services/openvpn/admin.py
new file mode 100644
index 0000000..28e778d
--- /dev/null
+++ b/xos/services/openvpn/admin.py
@@ -0,0 +1,229 @@
+from django import forms
+from django.contrib import admin
+
+from core.admin import ReadOnlyAwareAdmin, SliceInline, TenantPrivilegeInline
+from core.middleware import get_request
+from core.models import User
+from services.openvpn.models import OPENVPN_KIND, OpenVPNService, OpenVPNTenant
+from xos.exceptions import XOSValidationError
+
+
+class OpenVPNServiceForm(forms.ModelForm):
+
+    exposed_ports = forms.CharField(required=True)
+
+    def __init__(self, *args, **kwargs):
+        super(OpenVPNServiceForm, self).__init__(*args, **kwargs)
+
+        if self.instance:
+            self.fields['exposed_ports'].initial = (
+                self.instance.exposed_ports_str)
+
+    def save(self, commit=True):
+        self.instance.exposed_ports = self.cleaned_data['exposed_ports']
+        return super(OpenVPNServiceForm, self).save(commit=commit)
+
+    def clean_exposed_ports(self):
+        exposed_ports = self.cleaned_data['exposed_ports']
+        self.instance.exposed_ports_str = exposed_ports
+        port_mapping = {"udp": [], "tcp": []}
+        parts = exposed_ports.split(",")
+        for part in parts:
+            part = part.strip()
+            if "/" in part:
+                (protocol, ports) = part.split("/", 1)
+            elif " " in part:
+                (protocol, ports) = part.split(None, 1)
+            else:
+                raise XOSValidationError(
+                    'malformed port specifier %s, format example: ' +
+                    '"tcp 123, tcp 201:206, udp 333"' % part)
+
+            protocol = protocol.strip()
+            ports = ports.strip()
+
+            if not (protocol in ["udp", "tcp"]):
+                raise XOSValidationError('unknown protocol %s' % protocol)
+
+            if "-" in ports:
+                port_mapping[protocol].extend(
+                    self.parse_port_range(ports, "-"))
+            elif ":" in ports:
+                port_mapping[protocol].extend(
+                    self.parse_port_range(ports, ":"))
+            else:
+                port_mapping[protocol].append(int(ports))
+
+        return port_mapping
+
+    def parse_port_range(self, port_str, split_str):
+        (first, last) = port_str.split(split_str)
+        first = int(first.strip())
+        last = int(last.strip())
+        return list(range(first, last))
+
+    class Meta:
+        model = OpenVPNService
+
+
+class OpenVPNServiceAdmin(ReadOnlyAwareAdmin):
+    """Defines the admin for the OpenVPNService."""
+    model = OpenVPNService
+    form = OpenVPNServiceForm
+    verbose_name = "OpenVPN Service"
+
+    list_display = ("backend_status_icon", "name", "enabled")
+
+    list_display_links = ('backend_status_icon', 'name', )
+
+    fieldsets = [(None, {'fields': ['backend_status_text', 'name', 'enabled',
+                                    'versionNumber', 'description', "view_url",
+                                    'exposed_ports'],
+                         'classes':['suit-tab suit-tab-general']})]
+
+    readonly_fields = ('backend_status_text', )
+
+    inlines = [SliceInline]
+
+    extracontext_registered_admins = True
+
+    user_readonly_fields = ["name", "enabled", "versionNumber", "description"]
+
+    suit_form_tabs = (('general', 'VPN Service Details'),
+                      ('slices', 'Slices'),)
+
+    def queryset(self, request):
+        return OpenVPNService.get_service_objects_by_user(request.user)
+
+
+class OpenVPNTenantForm(forms.ModelForm):
+    """The form used to create and edit a OpenVPNTenant.
+
+    Attributes:
+        creator (forms.ModelChoiceField): The XOS user that created this
+            tenant.
+        server_network (forms.GenericIPAddressField): The IP address of the VPN network.
+        vpn_subnet (forms.GenericIPAddressField): The subnet used by the VPN network.
+        is_persistent (forms.BooleanField): Determines if this Tenant keeps
+            this connection alive through failures.
+        clients_can_see_each_other (forms.BooleanField): Determines if the clients on the VPN can
+            communicate with each other.
+        failover_servers (forms.ModelMultipleChoiceField): The other OpenVPNTenants to use as failover
+            servers.
+        protocol (forms.ChoiceField): The protocol to use.
+        use_ca_from (forms.ModelChoiceField): Another OpenVPNTenant to use the CA of, this is a very
+            hacky way to let VPNs have the same clients.
+    """
+    creator = forms.ModelChoiceField(queryset=User.objects.all())
+    server_network = forms.GenericIPAddressField(
+        protocol="IPv4", required=True)
+    vpn_subnet = forms.GenericIPAddressField(protocol="IPv4", required=True)
+    is_persistent = forms.BooleanField(required=False)
+    clients_can_see_each_other = forms.BooleanField(required=False)
+    failover_servers = forms.ModelMultipleChoiceField(
+        required=False, queryset=OpenVPNTenant.get_tenant_objects())
+    protocol = forms.ChoiceField(required=True, choices=[
+        ("tcp", "tcp"), ("udp", "udp")])
+    use_ca_from = forms.ModelChoiceField(
+        queryset=OpenVPNTenant.get_tenant_objects(), required=False)
+
+    def __init__(self, *args, **kwargs):
+        super(OpenVPNTenantForm, self).__init__(*args, **kwargs)
+        self.fields['kind'].widget.attrs['readonly'] = True
+        self.fields['failover_servers'].widget.attrs['rows'] = 300
+        self.fields[
+            'provider_service'].queryset = (
+                OpenVPNService.get_service_objects().all())
+
+        self.fields['kind'].initial = OPENVPN_KIND
+
+        if self.instance:
+            self.fields['creator'].initial = self.instance.creator
+            self.fields['vpn_subnet'].initial = self.instance.vpn_subnet
+            self.fields[
+                'server_network'].initial = self.instance.server_network
+            self.fields[
+                'clients_can_see_each_other'].initial = (
+                    self.instance.clients_can_see_each_other)
+            self.fields['is_persistent'].initial = self.instance.is_persistent
+            self.initial['protocol'] = self.instance.protocol
+            self.fields['failover_servers'].queryset = (
+                OpenVPNTenant.get_tenant_objects().exclude(pk=self.instance.pk))
+            self.initial['failover_servers'] = OpenVPNTenant.get_tenant_objects().filter(
+                pk__in=self.instance.failover_server_ids)
+            self.fields['use_ca_from'].queryset = (
+                OpenVPNTenant.get_tenant_objects().exclude(pk=self.instance.pk))
+            if (self.instance.use_ca_from_id):
+                self.initial['use_ca_from'] = (
+                    OpenVPNTenant.get_tenant_objects().filter(pk=self.instance.use_ca_from_id)[0])
+
+        if (not self.instance) or (not self.instance.pk):
+            self.fields['creator'].initial = get_request().user
+            self.fields['vpn_subnet'].initial = "255.255.255.0"
+            self.fields['server_network'].initial = "10.66.77.0"
+            self.fields['clients_can_see_each_other'].initial = True
+            self.fields['is_persistent'].initial = True
+            self.fields['failover_servers'].queryset = (
+                OpenVPNTenant.get_tenant_objects())
+            if OpenVPNService.get_service_objects().exists():
+                self.fields["provider_service"].initial = (
+                    OpenVPNService.get_service_objects().all()[0])
+
+    def save(self, commit=True):
+        self.instance.creator = self.cleaned_data.get("creator")
+        self.instance.is_persistent = self.cleaned_data.get('is_persistent')
+        self.instance.vpn_subnet = self.cleaned_data.get("vpn_subnet")
+        self.instance.server_network = self.cleaned_data.get('server_network')
+        self.instance.clients_can_see_each_other = self.cleaned_data.get(
+            'clients_can_see_each_other')
+
+        self.instance.failover_server_ids = [
+            tenant.id for tenant in self.cleaned_data.get('failover_servers')]
+
+        # Do not aquire a new port number if the protocol hasn't changed
+        if ((not self.instance.protocol) or
+                (self.instance.protocol != self.cleaned_data.get("protocol"))):
+            self.instance.protocol = self.cleaned_data.get("protocol")
+            self.instance.port_number = (
+                self.instance.provider_service.get_next_available_port(
+                    self.instance.protocol))
+
+        if (self.cleaned_data.get('use_ca_from')):
+            self.instance.use_ca_from_id = self.cleaned_data.get(
+                'use_ca_from').id
+        else:
+            self.instance.use_ca_from_id = None
+
+        return super(OpenVPNTenantForm, self).save(commit=commit)
+
+    class Meta:
+        model = OpenVPNTenant
+
+
+class OpenVPNTenantAdmin(ReadOnlyAwareAdmin):
+    verbose_name = "OpenVPN Tenant Admin"
+    list_display = ('id', 'backend_status_icon', 'instance',
+                    'server_network', 'vpn_subnet')
+    list_display_links = ('id', 'backend_status_icon',
+                          'instance', 'server_network', 'vpn_subnet')
+    fieldsets = [(None, {'fields': ['backend_status_text', 'kind',
+                                    'provider_service', 'instance', 'creator',
+                                    'server_network', 'vpn_subnet',
+                                    'is_persistent', 'use_ca_from',
+                                    'clients_can_see_each_other',
+                                    'failover_servers', "protocol"],
+                         'classes': ['suit-tab suit-tab-general']})]
+    readonly_fields = ('backend_status_text', 'instance')
+    form = OpenVPNTenantForm
+    inlines = [TenantPrivilegeInline]
+
+    suit_form_tabs = (('general', 'Details'),
+                      ('tenantprivileges', 'Privileges'))
+
+    def queryset(self, request):
+        return OpenVPNTenant.get_tenant_objects_by_user(request.user)
+
+
+# Associate the admin forms with the models.
+admin.site.register(OpenVPNService, OpenVPNServiceAdmin)
+admin.site.register(OpenVPNTenant, OpenVPNTenantAdmin)
diff --git a/xos/services/openvpn/models.py b/xos/services/openvpn/models.py
new file mode 100644
index 0000000..8aaa825
--- /dev/null
+++ b/xos/services/openvpn/models.py
@@ -0,0 +1,316 @@
+from subprocess import PIPE, Popen
+
+from django.db import transaction
+
+from core.models import Service, TenantWithContainer
+from xos.exceptions import XOSConfigurationError, XOSValidationError
+
+OPENVPN_KIND = "openvpn"
+
+
+class OpenVPNService(Service):
+    """Defines the Service for creating VPN servers."""
+    KIND = OPENVPN_KIND
+    OPENVPN_PREFIX = "/opt/openvpn/"
+    """The location of the openvpn EASY RSA files and PKIs."""
+    SERVER_PREFIX = OPENVPN_PREFIX + "server-"
+    """The prefix for server PKIs."""
+    VARS = OPENVPN_PREFIX + "vars"
+    """The location of the vars file with information for using EASY RSA."""
+    EASYRSA_LOC = OPENVPN_PREFIX + "easyrsa3/easyrsa"
+    """The location of the EASY RSA binary."""
+    EASYRSA_COMMAND_PREFIX = EASYRSA_LOC + " --vars=" + VARS
+    """Prefix for EASY RSA commands."""
+
+    @classmethod
+    def execute_easyrsa_command(cls, pki_dir, command):
+        """Executes the given EASY RSA command using the given PKI.
+
+        Parameters:
+            pki_dir (str): The directory for the pki to execute the command on.
+            command (str): The command to execute using ESAY RSA.
+        """
+        full_command = (
+            OpenVPNService.EASYRSA_COMMAND_PREFIX + " --pki-dir=" +
+            pki_dir + " " + command)
+        proc = Popen(
+            full_command, shell=True, stdout=PIPE, stderr=PIPE
+        )
+        (stdout, stderr) = proc.communicate()
+        if (proc.returncode != 0):
+            raise XOSConfigurationError(
+                full_command + " failed with standard out:" + str(stdout) +
+                " and stderr: " + str(stderr))
+
+    @classmethod
+    def get_pki_dir(cls, tenant):
+        """Gets the directory of the PKI for the given tenant.
+
+        Parameters:
+            tenant (services.openvpn.models.OpenVPNTenant): The tenant to get the PKI directory for.
+
+        Returns:
+            str: The pki directory for the tenant.
+        """
+        return OpenVPNService.SERVER_PREFIX + str(tenant.id)
+
+    class Meta:
+        proxy = True
+        # The name used to find this service, all directories are named this
+        app_label = "openvpn"
+        verbose_name = "OpenVPN Service"
+
+    default_attributes = {'exposed_ports': None,
+                          'exposed_ports_str': None}
+
+    @property
+    def exposed_ports(self):
+        """Mapping[str, list(str)]: maps protocols to a list of ports for that protocol."""
+        return self.get_attribute("exposed_ports",
+                                  self.default_attributes["exposed_ports"])
+
+    @exposed_ports.setter
+    def exposed_ports(self, value):
+        self.set_attribute("exposed_ports", value)
+
+    @property
+    def exposed_ports_str(self):
+        """str: a raw str representing the exposed ports."""
+        return self.get_attribute("exposed_ports_str",
+                                  self.default_attributes["exposed_ports_str"])
+
+    @exposed_ports_str.setter
+    def exposed_ports_str(self, value):
+        self.set_attribute("exposed_ports_str", value)
+
+    def get_next_available_port(self, protocol):
+        """Gets the next free port for the given protocol.
+
+        Parameters:
+            protocol (str): The protocol to get a port for, must be tcp or udp.
+
+        Returns:
+            int: a port number.
+
+        Raises:
+            xos.exceptions.XOSValidationError: If there the protocol is not udp or tcp.
+            xos.exceptions.XOSValidationError: If there are no available ports for the protocol.
+        """
+        if protocol != "udp" and protocol != "tcp":
+            raise XOSValidationError("Port protocol must be udp or tcp")
+        if not self.exposed_ports[protocol]:
+            raise XOSValidationError(
+                "No availble ports for protocol: " + protocol)
+        tenants = [
+            tenant for tenant in OpenVPNTenant.get_tenant_objects().all()
+            if tenant.protocol == protocol]
+        port_numbers = self.exposed_ports[protocol]
+        for port_number in port_numbers:
+            if (
+                len([
+                    tenant for tenant in tenants
+                    if tenant.port_number == port_number]) == 0):
+                return port_number
+
+
+class OpenVPNTenant(TenantWithContainer):
+    """Defines the Tenant for creating VPN servers."""
+
+    class Meta:
+        proxy = True
+        verbose_name = "OpenVPN Tenant"
+
+    KIND = OPENVPN_KIND
+
+    sync_attributes = ("nat_ip", "nat_mac",)
+
+    default_attributes = {'vpn_subnet': None,
+                          'server_network': None,
+                          'clients_can_see_each_other': True,
+                          'is_persistent': True,
+                          'port': None,
+                          'use_ca_from_id': None,
+                          'failover_server_ids': list(),
+                          'protocol': None}
+
+    def __init__(self, *args, **kwargs):
+        vpn_services = OpenVPNService.get_service_objects().all()
+        if vpn_services:
+            self._meta.get_field(
+                "provider_service").default = vpn_services[0].id
+        super(OpenVPNTenant, self).__init__(*args, **kwargs)
+
+    def save(self, *args, **kwargs):
+        super(OpenVPNTenant, self).save(*args, **kwargs)
+        model_policy_vpn_tenant(self.pk)
+
+    def delete(self, *args, **kwargs):
+        self.cleanup_container()
+        super(OpenVPNTenant, self).delete(*args, **kwargs)
+
+    @property
+    def protocol(self):
+        """str: The protocol that this tenant is listening on."""
+        return self.get_attribute(
+            "protocol", self.default_attributes["protocol"])
+
+    @protocol.setter
+    def protocol(self, value):
+        self.set_attribute("protocol", value)
+
+    @property
+    def use_ca_from_id(self):
+        """int: The ID of OpenVPNTenant to use to obtain a CA."""
+        return self.get_attribute(
+            "use_ca_from_id", self.default_attributes["use_ca_from_id"])
+
+    @use_ca_from_id.setter
+    def use_ca_from_id(self, value):
+        self.set_attribute("use_ca_from_id", value)
+
+    @property
+    def addresses(self):
+        """Mapping[str, str]: The ip, mac address, and subnet of the NAT
+            network of this Tenant."""
+        if (not self.id) or (not self.instance):
+            return {}
+
+        addresses = {}
+        for ns in self.instance.ports.all():
+            if "nat" in ns.network.name.lower():
+                addresses["ip"] = ns.ip
+                addresses["mac"] = ns.mac
+                break
+
+        return addresses
+
+    # This getter is necessary because nat_ip is a sync_attribute
+    @property
+    def nat_ip(self):
+        """str: The IP of this Tenant on the NAT network."""
+        return self.addresses.get("ip", None)
+
+    # This getter is necessary because nat_mac is a sync_attribute
+    @property
+    def nat_mac(self):
+        """str: The MAC address of this Tenant on the NAT network."""
+        return self.addresses.get("mac", None)
+
+    @property
+    def server_network(self):
+        """str: The IP address of the server on the VPN."""
+        return self.get_attribute(
+            'server_network',
+            self.default_attributes['server_network'])
+
+    @server_network.setter
+    def server_network(self, value):
+        self.set_attribute("server_network", value)
+
+    @property
+    def vpn_subnet(self):
+        """str: The IP address of the client on the VPN."""
+        return self.get_attribute(
+            'vpn_subnet',
+            self.default_attributes['vpn_subnet'])
+
+    @vpn_subnet.setter
+    def vpn_subnet(self, value):
+        self.set_attribute("vpn_subnet", value)
+
+    @property
+    def is_persistent(self):
+        """bool: True if the VPN connection is persistence, false otherwise."""
+        return self.get_attribute(
+            "is_persistent",
+            self.default_attributes['is_persistent'])
+
+    @is_persistent.setter
+    def is_persistent(self, value):
+        self.set_attribute("is_persistent", value)
+
+    @property
+    def failover_server_ids(self):
+        """list(int): The IDs of the OpenVPNTenants to use as failover servers."""
+        return self.get_attribute(
+            "failover_server_ids", self.default_attributes["failover_server_ids"])
+
+    @failover_server_ids.setter
+    def failover_server_ids(self, value):
+        self.set_attribute("failover_server_ids", value)
+
+    @property
+    def clients_can_see_each_other(self):
+        """bool: True if the client can see the subnet of the server, false
+            otherwise."""
+        return self.get_attribute(
+            "clients_can_see_each_other",
+            self.default_attributes['clients_can_see_each_other'])
+
+    @clients_can_see_each_other.setter
+    def clients_can_see_each_other(self, value):
+        self.set_attribute("clients_can_see_each_other", value)
+
+    @property
+    def port_number(self):
+        """int: the integer representing the port number for this server"""
+        return self.get_attribute("port", self.default_attributes['port'])
+
+    @port_number.setter
+    def port_number(self, value):
+        self.set_attribute("port", value)
+
+    def get_ca_crt(self, pki_dir):
+        """Gets the lines fo the ca.crt file for this OpenVPNTenant.
+
+        Parameters:
+            pki_dir (str): The PKI directory to look in.
+
+        Returns:
+            list(str): The lines of the ca.crt file for this OpenVPNTenant.
+        """
+        with open(pki_dir + "/ca.crt", 'r') as f:
+            return f.readlines()
+
+    def get_client_cert(self, client_name, pki_dir):
+        """Gets the lines fo the crt file for a client.
+
+        Parameters:
+            pki_dir (str): The PKI directory to look in.
+            client_name (str): The client name to use.
+
+        Returns:
+            list(str): The lines of the crt file for the client.
+        """
+        with open(pki_dir + "/issued/" + client_name + ".crt", 'r') as f:
+            return f.readlines()
+
+    def get_client_key(self, client_name, pki_dir):
+        """Gets the lines fo the key file for a client.
+
+        Parameters:
+            pki_dir (str): The PKI directory to look in.
+            client_name (str): The client name to use.
+
+        Returns:
+            list(str): The lines of the key file for the client.
+        """
+        with open(pki_dir + "/private/" + client_name + ".key", 'r') as f:
+            return f.readlines()
+
+
+def model_policy_vpn_tenant(pk):
+    """Manages the container for the VPN Tenant.
+
+    Parameters
+        pk (int): The ID of this OpenVPNTenant.
+    """
+    # This section of code is atomic to prevent race conditions
+    with transaction.atomic():
+        # We find all of the tenants that are waiting to update
+        tenant = OpenVPNTenant.objects.select_for_update().filter(pk=pk)
+        if not tenant:
+            return
+        # Since this code is atomic it is safe to always use the first tenant
+        tenant = tenant[0]
+        tenant.manage_container()
diff --git a/xos/services/openvpn/templates/connect.vpn.j2 b/xos/services/openvpn/templates/connect.vpn.j2
new file mode 100644
index 0000000..2028cd9
--- /dev/null
+++ b/xos/services/openvpn/templates/connect.vpn.j2
@@ -0,0 +1,24 @@
+#! /bin/bash
+# This file autogenerated by OpenVPNTenant.
+# It contains a script used to generate the OPENVPN client files.
+printf "%b" "client
+dev tun
+remote-cert-tls server
+resolv-retry 60
+nobind
+ca ca.crt
+cert {{ client_name }}.crt
+key {{ client_name }}.key
+verb 3
+{% for tenant in remotes %}remote {{ tenant.nat_ip }} {{ tenant.port_number }} {{ tenant.protocol }}{% endfor %}
+{% if is_persistent %}
+persist-tun
+persist-key
+{% endif %}
+" > client.conf
+printf "%b" "{% for line in ca_crt %}{{ line }}{% endfor %}" > ca.crt
+printf "%b" "{% for line in client_crt %}{{ line }}{% endfor %}" > {{ client_name }}.crt
+printf "%b" "{% for line in client_key %}{{ line }}{% endfor %}" > {{ client_name }}.key
+apt-get update
+apt-get install openvpn -y
+openvpn client.conf
diff --git a/xos/services/vrouter/__init__.py b/xos/services/vrouter/__init__.py
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/xos/services/vrouter/__init__.py
@@ -0,0 +1 @@
+
diff --git a/xos/services/vrouter/admin.py b/xos/services/vrouter/admin.py
new file mode 100644
index 0000000..318b3dc
--- /dev/null
+++ b/xos/services/vrouter/admin.py
@@ -0,0 +1,113 @@
+from django.contrib import admin
+
+from services.vrouter.models import *
+from django import forms
+from django.utils.safestring import mark_safe
+from django.contrib.auth.admin import UserAdmin
+from django.contrib.admin.widgets import FilteredSelectMultiple
+from django.contrib.auth.forms import ReadOnlyPasswordHashField
+from django.contrib.auth.signals import user_logged_in
+from django.utils import timezone
+from django.contrib.contenttypes import generic
+from suit.widgets import LinkedSelect
+from core.models import AddressPool
+from core.admin import ServiceAppAdmin,SliceInline,ServiceAttrAsTabInline, ReadOnlyAwareAdmin, XOSTabularInline, ServicePrivilegeInline, TenantRootTenantInline, TenantRootPrivilegeInline
+from core.middleware import get_request
+
+from functools import update_wrapper
+from django.contrib.admin.views.main import ChangeList
+from django.core.urlresolvers import reverse
+from django.contrib.admin.utils import quote
+
+class VRouterServiceForm(forms.ModelForm):
+    def __init__(self,*args,**kwargs):
+        super (VRouterServiceForm,self ).__init__(*args,**kwargs)
+
+    def save(self, commit=True):
+        return super(VRouterServiceForm, self).save(commit=commit)
+
+    class Meta:
+        model = VRouterService
+
+class VRouterServiceAdmin(ReadOnlyAwareAdmin):
+    model = VRouterService
+    verbose_name = "vRouter Service"
+    verbose_name_plural = "vRouter Service"
+    list_display = ("backend_status_icon", "name", "enabled")
+    list_display_links = ('backend_status_icon', 'name', )
+    fieldsets = [(None, {'fields': ['backend_status_text', 'name','enabled','versionNumber', 'description', "view_url", "icon_url", ],
+                         'classes':['suit-tab suit-tab-general']})]
+    readonly_fields = ('backend_status_text', )
+    inlines = [SliceInline,ServiceAttrAsTabInline,ServicePrivilegeInline]
+    form = VRouterServiceForm
+
+    extracontext_registered_admins = True
+
+    user_readonly_fields = ["name", "enabled", "versionNumber", "description"]
+
+    suit_form_tabs =(('general', 'vRouter Service Details'),
+        ('administration', 'Administration'),
+        #('tools', 'Tools'),
+        ('slices','Slices'),
+        ('serviceattrs','Additional Attributes'),
+        ('serviceprivileges','Privileges'),
+    )
+
+    suit_form_includes = (('vrouteradmin.html', 'top', 'administration'),
+                           ) #('hpctools.html', 'top', 'tools') )
+
+    def queryset(self, request):
+        return VRouterService.get_service_objects_by_user(request.user)
+
+class VRouterTenantForm(forms.ModelForm):
+    public_ip = forms.CharField(required=True)
+    public_mac = forms.CharField(required=True)
+    gateway_ip = forms.CharField(required=False)
+    gateway_mac = forms.CharField(required=False)
+    cidr = forms.CharField(required=False)
+    address_pool = forms.ModelChoiceField(queryset=AddressPool.objects.all(),required=False)
+
+    def __init__(self,*args,**kwargs):
+        super (VRouterTenantForm,self ).__init__(*args,**kwargs)
+        self.fields['kind'].widget.attrs['readonly'] = True
+        self.fields['provider_service'].queryset = VRouterService.get_service_objects().all()
+        if self.instance:
+            # fields for the attributes
+            self.fields['address_pool'].initial = self.instance.address_pool
+            self.fields['public_ip'].initial = self.instance.public_ip
+            self.fields['public_mac'].initial = self.instance.public_mac
+            self.fields['gateway_ip'].initial = self.instance.gateway_ip
+            self.fields['gateway_mac'].initial = self.instance.gateway_mac
+            self.fields['cidr'].initial = self.instance.cidr
+        if (not self.instance) or (not self.instance.pk):
+            # default fields for an 'add' form
+            self.fields['kind'].initial = VROUTER_KIND
+            if VRouterService.get_service_objects().exists():
+               self.fields["provider_service"].initial = VRouterService.get_service_objects().all()[0]
+
+    def save(self, commit=True):
+        self.instance.public_ip = self.cleaned_data.get("public_ip")
+        self.instance.public_mac = self.cleaned_data.get("public_mac")
+        self.instance.address_pool = self.cleaned_data.get("address_pool")
+        return super(VRouterTenantForm, self).save(commit=commit)
+
+    class Meta:
+        model = VRouterTenant
+
+class VRouterTenantAdmin(ReadOnlyAwareAdmin):
+    list_display = ('backend_status_icon', 'id', 'subscriber_tenant', 'public_ip' )
+    list_display_links = ('backend_status_icon', 'id')
+    fieldsets = [ (None, {'fields': ['backend_status_text', 'kind', 'provider_service', 'subscriber_tenant', 'subscriber_service',
+                                     'address_pool', 'public_ip', 'public_mac', 'gateway_ip', 'gateway_mac', 'cidr'],
+                          'classes':['suit-tab suit-tab-general']})]
+    readonly_fields = ('backend_status_text', 'service_specific_attribute', 'gateway_ip', 'gateway_mac', 'cidr')
+    form = VRouterTenantForm
+
+    suit_form_tabs = (('general','Details'),)
+
+    def queryset(self, request):
+        return VRouterTenant.get_tenant_objects_by_user(request.user)
+
+admin.site.register(VRouterService, VRouterServiceAdmin)
+admin.site.register(VRouterTenant, VRouterTenantAdmin)
+
diff --git a/xos/services/vrouter/models.py b/xos/services/vrouter/models.py
new file mode 100644
index 0000000..05b57e2
--- /dev/null
+++ b/xos/services/vrouter/models.py
@@ -0,0 +1,139 @@
+from django.db import models
+from core.models import Service, PlCoreBase, Slice, Instance, Tenant, TenantWithContainer, Node, Image, User, Flavor, Subscriber, NetworkParameter, NetworkParameterType, Port, AddressPool
+from core.models.plcorebase import StrippedCharField
+import os
+from django.db import models, transaction
+from django.forms.models import model_to_dict
+from django.db.models import Q
+from operator import itemgetter, attrgetter, methodcaller
+from core.models import Tag
+from core.models.service import LeastLoadedNodeScheduler
+import traceback
+from xos.exceptions import *
+from xos.config import Config
+
+class ConfigurationError(Exception):
+    pass
+
+VROUTER_KIND = "vROUTER"
+
+CORD_USE_VTN = getattr(Config(), "networking_use_vtn", False)
+
+class VRouterService(Service):
+    KIND = VROUTER_KIND
+
+    class Meta:
+        app_label = "vrouter"
+        verbose_name = "vRouter Service"
+        proxy = True
+
+    def ip_to_mac(self, ip):
+        (a, b, c, d) = ip.split('.')
+        return "02:42:%02x:%02x:%02x:%02x" % (int(a), int(b), int(c), int(d))
+
+    def get_gateways(self):
+        gateways=[]
+
+        aps = self.addresspools.all()
+        for ap in aps:
+            gateways.append( {"gateway_ip": ap.gateway_ip, "gateway_mac": ap.gateway_mac} )
+
+        return gateways
+
+    def get_address_pool(self, name):
+        ap = AddressPool.objects.filter(name=name, service=self)
+        if not ap:
+            raise Exception("vRouter unable to find addresspool %s" % name)
+        return ap[0]
+
+    def get_tenant(self, **kwargs):
+        address_pool_name = kwargs.pop("address_pool_name")
+
+        ap = self.get_address_pool(address_pool_name)
+
+        ip = ap.get_address()
+        if not ip:
+            raise Exception("AddressPool '%s' has run out of addresses." % ap.name)
+
+        t = VRouterTenant(provider_service=self, **kwargs)
+        t.public_ip = ip
+        t.public_mac = self.ip_to_mac(ip)
+        t.address_pool_id = ap.id
+        t.save()
+
+        return t
+
+#VRouterService.setup_simple_attributes()
+
+class VRouterTenant(Tenant):
+    class Meta:
+        proxy = True
+
+    KIND = VROUTER_KIND
+
+    simple_attributes = ( ("public_ip", None),
+                          ("public_mac", None),
+                          ("address_pool_id", None),
+                          )
+
+    @property
+    def gateway_ip(self):
+        if not self.address_pool:
+            return None
+        return self.address_pool.gateway_ip
+
+    @property
+    def gateway_mac(self):
+        if not self.address_pool:
+            return None
+        return self.address_pool.gateway_mac
+
+    @property
+    def cidr(self):
+        if not self.address_pool:
+            return None
+        return self.address_pool.cidr
+
+    @property
+    def netbits(self):
+        # return number of bits in the network portion of the cidr
+        if self.cidr:
+            parts = self.cidr.split("/")
+            if len(parts)==2:
+                return int(parts[1].strip())
+        return None
+
+    @property
+    def address_pool(self):
+        if getattr(self, "cached_address_pool", None):
+            return self.cached_address_pool
+        if not self.address_pool_id:
+            return None
+        aps=AddressPool.objects.filter(id=self.address_pool_id)
+        if not aps:
+            return None
+        ap=aps[0]
+        self.cached_address_pool = ap
+        return ap
+
+    @address_pool.setter
+    def address_pool(self, value):
+        if value:
+            value = value.id
+        if (value != self.get_attribute("address_pool_id", None)):
+            self.cached_address_pool=None
+        self.set_attribute("address_pool_id", value)
+
+    def cleanup_addresspool(self):
+        if self.address_pool_id:
+            ap = AddressPool.objects.filter(id=self.address_pool_id)
+            if ap:
+                ap[0].put_address(self.public_ip)
+                self.public_ip = None
+
+    def delete(self, *args, **kwargs):
+        self.cleanup_addresspool()
+        super(VRouterTenant, self).delete(*args, **kwargs)
+
+VRouterTenant.setup_simple_attributes()
+
diff --git a/xos/services/vtn/__init__.py b/xos/services/vtn/__init__.py
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/xos/services/vtn/__init__.py
@@ -0,0 +1 @@
+
diff --git a/xos/services/vtn/admin.py b/xos/services/vtn/admin.py
new file mode 100644
index 0000000..03ff5cd
--- /dev/null
+++ b/xos/services/vtn/admin.py
@@ -0,0 +1,95 @@
+from django.contrib import admin
+
+from services.cord.models import *
+from django import forms
+from django.utils.safestring import mark_safe
+from django.contrib.auth.admin import UserAdmin
+from django.contrib.admin.widgets import FilteredSelectMultiple
+from django.contrib.auth.forms import ReadOnlyPasswordHashField
+from django.contrib.auth.signals import user_logged_in
+from django.utils import timezone
+from django.contrib.contenttypes import generic
+from suit.widgets import LinkedSelect
+from core.admin import ServiceAppAdmin,SliceInline,ServiceAttrAsTabInline, ReadOnlyAwareAdmin, XOSTabularInline, ServicePrivilegeInline, TenantRootTenantInline, TenantRootPrivilegeInline
+from core.middleware import get_request
+
+from services.vtn.models import *
+from services.cord.models import CordSubscriberRoot
+
+from functools import update_wrapper
+from django.contrib.admin.views.main import ChangeList
+from django.core.urlresolvers import reverse
+from django.contrib.admin.utils import quote
+
+class VTNServiceForm(forms.ModelForm):
+    privateGatewayMac = forms.CharField(required=False)
+    localManagementIp = forms.CharField(required=False)
+    ovsdbPort = forms.CharField(required=False)
+    sshPort = forms.CharField(required=False)
+    sshUser = forms.CharField(required=False)
+    sshKeyFile = forms.CharField(required=False)
+    mgmtSubnetBits = forms.CharField(required=False)
+    xosEndpoint = forms.CharField(required=False)
+    xosUser = forms.CharField(required=False)
+    xosPassword = forms.CharField(required=False)
+
+    def __init__(self,*args,**kwargs):
+        super (VTNServiceForm,self ).__init__(*args,**kwargs)
+        if self.instance:
+            self.fields['privateGatewayMac'].initial = self.instance.privateGatewayMac
+            self.fields['localManagementIp'].initial = self.instance.localManagementIp
+            self.fields['ovsdbPort'].initial = self.instance.ovsdbPort
+            self.fields['sshPort'].initial = self.instance.sshPort
+            self.fields['sshUser'].initial = self.instance.sshUser
+            self.fields['sshKeyFile'].initial = self.instance.sshKeyFile
+            self.fields['mgmtSubnetBits'].initial = self.instance.mgmtSubnetBits
+            self.fields['xosEndpoint'].initial = self.instance.xosEndpoint
+            self.fields['xosUser'].initial = self.instance.xosUser
+            self.fields['xosPassword'].initial = self.instance.xosPassword
+
+    def save(self, commit=True):
+        self.instance.privateGatewayMac = self.cleaned_data.get("privateGatewayMac")
+        self.instance.localManagementIp = self.cleaned_data.get("localManagementIp")
+        self.instance.ovsdbPort = self.cleaned_data.get("ovsdbPort")
+        self.instance.sshPort = self.cleaned_data.get("sshPort")
+        self.instance.sshUser = self.cleaned_data.get("sshUser")
+        self.instance.sshKeyFile = self.cleaned_data.get("sshKeyFile")
+        self.instance.mgmtSubnetBits = self.cleaned_data.get("mgmtSubnetBits")
+        self.instance.xosEndpoint = self.cleaned_data.get("xosEndpoint")
+        self.instance.xosUser = self.cleaned_data.get("xosUser")
+        self.instance.xosPassword = self.cleaned_data.get("xosPassword")
+        return super(VTNServiceForm, self).save(commit=commit)
+
+    class Meta:
+        model = VTNService
+
+class VTNServiceAdmin(ReadOnlyAwareAdmin):
+    model = VTNService
+    form = VTNServiceForm
+    verbose_name = "VTN Service"
+    verbose_name_plural = "VTN Service"
+    list_display = ("backend_status_icon", "name", "enabled")
+    list_display_links = ('backend_status_icon', 'name', )
+    fieldsets = [(None, {'fields': ['backend_status_text', 'name','enabled','versionNumber','description',"view_url","icon_url",
+                                    'privateGatewayMac', 'localManagementIp', 'ovsdbPort', 'sshPort', 'sshUser', 'sshKeyFile', 'mgmtSubnetBits', 'xosEndpoint', 'xosUser', 'xosPassword' ], 'classes':['suit-tab suit-tab-general']})]
+    readonly_fields = ('backend_status_text', )
+    inlines = [SliceInline,ServiceAttrAsTabInline,ServicePrivilegeInline]
+
+    extracontext_registered_admins = True
+
+    user_readonly_fields = ["name", "enabled", "versionNumber", "description"]
+
+    suit_form_tabs =(('general', 'VTN Service Details'),
+#        ('administration', 'Administration'),
+        ('slices','Slices'),
+        ('serviceattrs','Additional Attributes'),
+        ('serviceprivileges','Privileges'),
+    )
+
+    suit_form_includes = ( # ('vtnadmin.html', 'top', 'administration'),
+                           ) #('hpctools.html', 'top', 'tools') )
+
+    def queryset(self, request):
+        return VTNService.get_service_objects_by_user(request.user)
+
+admin.site.register(VTNService, VTNServiceAdmin)
diff --git a/xos/services/vtn/models.py b/xos/services/vtn/models.py
new file mode 100644
index 0000000..52b1633
--- /dev/null
+++ b/xos/services/vtn/models.py
@@ -0,0 +1,46 @@
+from django.db import models
+from core.models import Service, PlCoreBase, Slice, Instance, Tenant, TenantWithContainer, Node, Image, User, Flavor, Subscriber, NetworkParameter, NetworkParameterType, Port, AddressPool
+from core.models.plcorebase import StrippedCharField
+import os
+from django.db import models, transaction
+from django.forms.models import model_to_dict
+from django.db.models import Q
+from operator import itemgetter, attrgetter, methodcaller
+from core.models import Tag
+from core.models.service import LeastLoadedNodeScheduler
+from services.cord.models import CordSubscriberRoot
+import traceback
+from xos.exceptions import *
+from xos.config import Config
+
+class ConfigurationError(Exception):
+    pass
+
+VTN_KIND = "VTN"
+
+# -------------------------------------------
+# VTN
+# -------------------------------------------
+
+class VTNService(Service):
+    KIND = VTN_KIND
+
+    class Meta:
+        app_label = "vtn"
+        verbose_name = "VTN Service"
+        proxy = True
+
+    simple_attributes = ( ("privateGatewayMac", "00:00:00:00:00:01"),
+                          ("localManagementIp", "172.27.0.1/24"),
+                          ("ovsdbPort", "6641"),
+                          ("sshPort", "22"),
+                          ("sshUser", "root"),
+                          ("sshKeyFile", "/root/node_key") ,
+                          ("mgmtSubnetBits", "24"),
+                          ("xosEndpoint", "http://xos/"),
+                          ("xosUser", "padmin@vicci.org"),
+                          ("xosPassword", "letmein"),
+
+                         )
+
+VTNService.setup_simple_attributes()
diff --git a/xos/services/vtn/templates/vtnadmin.html b/xos/services/vtn/templates/vtnadmin.html
new file mode 100644
index 0000000..a3a2a52
--- /dev/null
+++ b/xos/services/vtn/templates/vtnadmin.html
@@ -0,0 +1,5 @@
+<div class = "row text-center">
+    <div class="col-xs-12">
+        <a href="/admin/vtn/vnrtenant/">vTN Tenants</a>
+    </div>
+</div>
diff --git a/xos/synchronizers/base/backend.py b/xos/synchronizers/base/backend.py
index 5f11d46..d7307fa 100644
--- a/xos/synchronizers/base/backend.py
+++ b/xos/synchronizers/base/backend.py
@@ -15,7 +15,7 @@
     def run(self):
         # start the openstack observer
         observer = XOSObserver()
-        observer_thread = threading.Thread(target=observer.run)
+        observer_thread = threading.Thread(target=observer.run,name='synchronizer')
         observer_thread.start()
 
         # start model policies thread
diff --git a/xos/synchronizers/base/event_loop.py b/xos/synchronizers/base/event_loop.py
index f224380..4f7d436 100644
--- a/xos/synchronizers/base/event_loop.py
+++ b/xos/synchronizers/base/event_loop.py
@@ -521,7 +521,12 @@
 
                         loop_end = time.time()
 
-                        diag = Diag.objects.filter(name=Config().observer_name).first()
+                        try:
+                            observer_name = Config().observer_name
+                        except:
+                            observer_name = ''
+
+                        diag = Diag.objects.filter(name=observer_name).first()
                         if (diag):
                             br_str = diag.backend_register
                             br = json.loads(br_str)
diff --git a/xos/synchronizers/helloworld/helloworld-synchronizer.py b/xos/synchronizers/helloworld/helloworld-synchronizer.py
deleted file mode 100755
index 84bec4f..0000000
--- a/xos/synchronizers/helloworld/helloworld-synchronizer.py
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/usr/bin/env python
-
-# This imports and runs ../../xos-observer.py
-
-import importlib
-import os
-import sys
-observer_path = os.path.join(os.path.dirname(os.path.realpath(__file__)),"../../synchronizers/base")
-sys.path.append(observer_path)
-mod = importlib.import_module("xos-synchronizer")
-mod.main()
diff --git a/xos/synchronizers/helloworld/helloworld_config b/xos/synchronizers/helloworld/helloworld_config
deleted file mode 100644
index 1f67242..0000000
--- a/xos/synchronizers/helloworld/helloworld_config
+++ /dev/null
@@ -1,47 +0,0 @@
-[plc]
-name=plc
-deployment=plc
-
-[db]
-name=xos
-user=postgres
-password=password
-host=localhost
-port=5432
-
-[api]
-host=localhost
-port=8000
-ssl_key=None
-ssl_cert=None
-ca_ssl_cert=None
-ratelimit_enabled=0
-omf_enabled=0
-mail_support_address=support@localhost
-nova_enabled=True
-logfile=/var/log/xos.log
-
-[nova]
-admin_user=admin@domain.com
-admin_password=admin
-admin_tenant=admin
-url=http://localhost:5000/v2.0/
-default_image=None
-default_flavor=m1.small
-default_security_group=default
-ca_ssl_cert=/etc/ssl/certs/ca-certificates.crt
-
-[observer]
-pretend=False
-backoff_disabled=False
-images_directory=/opt/xos/images
-dependency_graph=/opt/xos/model-deps
-logfile=/var/log/xos_backend.log
-steps_dir=/opt/xos/synchronizers/helloworld/steps
-applist=helloworld
-
-[gui]
-disable_minidashboard=True
-#branding_name=CORD
-#branding_css=/static/cord.css
-#branding_icon=/static/onos-logo.png
diff --git a/xos/synchronizers/helloworld/model-deps b/xos/synchronizers/helloworld/model-deps
deleted file mode 100644
index 63188f0..0000000
--- a/xos/synchronizers/helloworld/model-deps
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-    "OriginServer": [
-        "ContentProvider"
-    ], 
-    "ContentProvider": [
-        "ServiceProvider"
-    ], 
-    "CDNPrefix": [
-        "ContentProvider"
-    ], 
-    "AccessMap": [
-        "ContentProvider"
-    ], 
-    "SiteMap": [
-        "ContentProvider", 
-        "ServiceProvider", 
-        "CDNPrefix"
-    ]
-}
diff --git a/xos/synchronizers/helloworld/nohup.out b/xos/synchronizers/helloworld/nohup.out
deleted file mode 100644
index 74072c6..0000000
--- a/xos/synchronizers/helloworld/nohup.out
+++ /dev/null
@@ -1 +0,0 @@
-python: can't open file 'helloworld-observer.py': [Errno 2] No such file or directory
diff --git a/xos/synchronizers/helloworld/run.sh b/xos/synchronizers/helloworld/run.sh
deleted file mode 100755
index 1b9d834..0000000
--- a/xos/synchronizers/helloworld/run.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#if [[ ! -e ./hpc-backend.py ]]; then
-#    ln -s ../xos-observer.py hpc-backend.py
-#fi
-
-export XOS_DIR=/opt/xos
-python helloworld-synchronizer.py  -C $XOS_DIR/synchronizers/helloworld/helloworld_config
diff --git a/xos/synchronizers/helloworld/start.sh b/xos/synchronizers/helloworld/start.sh
deleted file mode 100755
index 7945db3..0000000
--- a/xos/synchronizers/helloworld/start.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-export XOS_DIR=/opt/xos
-
-echo $XOS_DIR/synchronizers/helloworld/helloworld_config
-python helloworld-synchronizer.py -C $XOS_DIR/synchronizers/helloworld/helloworld_config
diff --git a/xos/synchronizers/helloworld/steps/sync_hello.py b/xos/synchronizers/helloworld/steps/sync_hello.py
deleted file mode 100644
index 55d318a..0000000
--- a/xos/synchronizers/helloworld/steps/sync_hello.py
+++ /dev/null
@@ -1,26 +0,0 @@
-import os
-import sys
-import base64
-from django.db.models import F, Q
-from xos.config import Config
-from synchronizers.base.syncstep import SyncStep
-from services.helloworld.models import Hello,World
-from xos.logger import Logger, logging
-
-parentdir = os.path.join(os.path.dirname(__file__),"..")
-sys.path.insert(0,parentdir)
-
-logger = Logger(level=logging.INFO)
-
-class SyncHello(SyncStep):
-    provides=[Hello]
-    observes=Hello
-    requested_interval=0
-    
-    def sync_record(self, record):
-        instance = record.instance_backref        
-        instance.userData="packages:\n  - apache2\nruncmd:\n  - update-rc.d apache2 enable\n  - service apache2 start\nwrite_files:\n-   content: Hello %s\n    path: /var/www/html/hello.txt"%record.name
-        instance.save()
-        
-    def delete_record(self, m):
-        return
diff --git a/xos/synchronizers/helloworld/steps/sync_world.py b/xos/synchronizers/helloworld/steps/sync_world.py
deleted file mode 100644
index a4e7e3c..0000000
--- a/xos/synchronizers/helloworld/steps/sync_world.py
+++ /dev/null
@@ -1,25 +0,0 @@
-import os
-import sys
-import base64
-from django.db.models import F, Q
-from xos.config import Config
-from synchronizers.base.syncstep import SyncStep
-from services.helloworld.models import Hello,World
-from xos.logger import Logger, logging
-
-# hpclibrary will be in steps/..
-parentdir = os.path.join(os.path.dirname(__file__),"..")
-sys.path.insert(0,parentdir)
-
-logger = Logger(level=logging.INFO)
-
-class SyncWorld(SyncStep):
-    provides=[World]
-    observes=World
-    requested_interval=0
-    
-    def sync_record(self, record):
-        open('/tmp/hello-synchronizer','w').write(record.name)	
-        
-    def delete_record(self, m):
-        return
diff --git a/xos/synchronizers/helloworld/stop.sh b/xos/synchronizers/helloworld/stop.sh
deleted file mode 100755
index a0b4a8e..0000000
--- a/xos/synchronizers/helloworld/stop.sh
+++ /dev/null
@@ -1 +0,0 @@
-pkill -9 -f hpc-observer.py
diff --git a/xos/synchronizers/helloworldservice_complete/helloworldservice_config b/xos/synchronizers/helloworldservice_complete/helloworldservice_config
deleted file mode 100644
index 69894fc..0000000
--- a/xos/synchronizers/helloworldservice_complete/helloworldservice_config
+++ /dev/null
@@ -1,36 +0,0 @@
-# Required by XOS
-[db]
-name=xos
-user=postgres
-password=password
-host=localhost
-port=5432
-
-# Required by XOS
-[api]
-nova_enabled=True
-
-# Sets options for the observer
-[observer]
-# Optional name
-name=helloworldservice
-# This is the location to the dependency graph you generate
-dependency_graph=/opt/xos/synchronizers/helloworldservice_complete/model-deps
-# The location of your SyncSteps
-steps_dir=/opt/xos/synchronizers/helloworldservice_complete/steps
-# A temporary directory that will be used by ansible
-sys_dir=/opt/xos/synchronizers/helloworldservice_complete/sys
-# Location of the file to save logging messages to the backend log is often used
-logfile=/var/log/xos_backend.log
-# If this option is true, then nothing will change, we simply pretend to run
-pretend=False
-# If this is False then XOS will use an exponential backoff when the observer
-# fails, since we will be waiting for an instance, we don't want this.
-backoff_disabled=True
-# We want the output from ansible to be logged
-save_ansible_output=True
-# This determines how we SSH to a client, if this is set to True then we try
-# to ssh using the instance name as a proxy, if this is disabled we ssh using
-# the NAT IP of the instance. On CloudLab the first option will fail so we must
-# set this to False
-proxy_ssh=False
diff --git a/xos/synchronizers/helloworldservice_complete/run.sh b/xos/synchronizers/helloworldservice_complete/run.sh
deleted file mode 100755
index 331f8ae..0000000
--- a/xos/synchronizers/helloworldservice_complete/run.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-# Runs the XOS observer using helloworldservice_config
-export XOS_DIR=/opt/xos
-python helloworldservice-synchronizer.py  -C $XOS_DIR/synchronizers/helloworldservice_complete/helloworldservice_config
diff --git a/xos/synchronizers/helloworldservice_complete/steps/sync_helloworldtenant.py b/xos/synchronizers/helloworldservice_complete/steps/sync_helloworldtenant.py
deleted file mode 100644
index 69a08f5..0000000
--- a/xos/synchronizers/helloworldservice_complete/steps/sync_helloworldtenant.py
+++ /dev/null
@@ -1,48 +0,0 @@
-import os
-import sys
-from django.db.models import Q, F
-from services.helloworldservice_complete.models import HelloWorldServiceComplete, HelloWorldTenantComplete
-from synchronizers.base.SyncInstanceUsingAnsible import SyncInstanceUsingAnsible
-
-parentdir = os.path.join(os.path.dirname(__file__), "..")
-sys.path.insert(0, parentdir)
-
-# Class to define how we sync a tenant. Using SyncInstanceUsingAnsible we
-# indicate where the find the YAML for ansible, where to find the SSH key,
-# and the logic for determining what tenant needs updating, what additional
-# attributes are needed, and how to delete an instance.
-class SyncHelloWorldTenantComplete(SyncInstanceUsingAnsible):
-    # Indicates the position in the data model, this will run when XOS needs to
-    # enact a HelloWorldTenantComplete
-    provides = [HelloWorldTenantComplete]
-    # The actual model being enacted, usually the same as provides.
-    observes = HelloWorldTenantComplete
-    # Number of milliseconds between interruptions of the observer
-    requested_interval = 0
-    # The ansible template to run
-    template_name = "sync_helloworldtenant.yaml"
-    # The location of the SSH private key to use when ansible connects to
-    # instances.
-    service_key_name = "/opt/xos/synchronizers/helloworldservice_complete/helloworldservice_private_key"
-
-    def __init__(self, *args, **kwargs):
-        super(SyncHelloWorldTenantComplete, self).__init__(*args, **kwargs)
-
-    # Defines the logic for determining what HelloWorldTenantCompletes need to be
-    # enacted.
-    def fetch_pending(self, deleted):
-        # If the update is not a deletion, then we get all of the instnaces that
-        # have been updated or have not been enacted.
-        if (not deleted):
-            objs = HelloWorldTenantComplete.get_tenant_objects().filter(
-                Q(enacted__lt=F('updated')) | Q(enacted=None), Q(lazy_blocked=False))
-        else:
-            # If this is a deletion we get all of the deleted tenants..
-            objs = HelloWorldTenantComplete.get_deleted_tenant_objects()
-
-        return objs
-
-    # Gets the attributes that are used by the Ansible template but are not
-    # part of the set of default attributes.
-    def get_extra_attributes(self, o):
-        return {"display_message": o.display_message}
diff --git a/xos/synchronizers/helloworldservice_complete/steps/sync_helloworldtenant.yaml b/xos/synchronizers/helloworldservice_complete/steps/sync_helloworldtenant.yaml
deleted file mode 100644
index 719c75f..0000000
--- a/xos/synchronizers/helloworldservice_complete/steps/sync_helloworldtenant.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- hosts: {{ instance_name }}
-  gather_facts: False
-  connection: ssh
-  user: ubuntu
-  sudo: yes
-  tasks:
-  - name: install apache
-    apt: name=apache2 state=present update_cache=yes
-
-  - name: write message
-    shell: echo "{{ display_message }}" > /var/www/html/index.html
-
-  - name: stop apache
-    service: name=apache2 state=stopped
-
-  - name: start apache
-    service: name=apache2 state=started
diff --git a/xos/synchronizers/helloworldservice_complete/stop.sh b/xos/synchronizers/helloworldservice_complete/stop.sh
deleted file mode 100755
index 76e68d9..0000000
--- a/xos/synchronizers/helloworldservice_complete/stop.sh
+++ /dev/null
@@ -1,2 +0,0 @@
-# Kill the observer
-pkill -9 -f helloworldservice-observer.py
diff --git a/xos/synchronizers/model_policy.py b/xos/synchronizers/model_policy.py
index e2121ec..8faae81 100644
--- a/xos/synchronizers/model_policy.py
+++ b/xos/synchronizers/model_policy.py
@@ -110,7 +110,7 @@
         deleted_objects = []
 
         for m in models:
-            res = m.objects.filter(Q(policed__lt=F('updated')) | Q(policed=None))
+            res = m.objects.filter((Q(policed__lt=F('updated')) | Q(policed=None)) & Q(no_policy=False))
             objects.extend(res)
             res = m.deleted_objects.filter(Q(policed__lt=F('updated')) | Q(policed=None))
             deleted_objects.extend(res)
diff --git a/xos/synchronizers/onos/steps/sync_onosapp.py b/xos/synchronizers/onos/steps/sync_onosapp.py
index 2dfdfbd..7b80641 100644
--- a/xos/synchronizers/onos/steps/sync_onosapp.py
+++ b/xos/synchronizers/onos/steps/sync_onosapp.py
@@ -1,7 +1,6 @@
 import hashlib
 import os
 import socket
-import socket
 import sys
 import base64
 import time
@@ -14,9 +13,11 @@
 from synchronizers.base.syncstep import SyncStep
 from synchronizers.base.ansible import run_template_ssh
 from synchronizers.base.SyncInstanceUsingAnsible import SyncInstanceUsingAnsible
-from core.models import Service, Slice, ControllerSlice, ControllerUser
+from core.models import Service, Slice, Controller, ControllerSlice, ControllerUser, Node, TenantAttribute, Tag
 from services.onos.models import ONOSService, ONOSApp
 from xos.logger import Logger, logging
+from services.vrouter.models import VRouterService
+from services.vtn.models import VTNService
 
 # hpclibrary will be in steps/..
 parentdir = os.path.join(os.path.dirname(__file__),"..")
@@ -117,6 +118,130 @@
                 raise Exception("Controller user object for %s does not exist" % instance.creator)
             return cuser.kuser_id
 
+    def get_node_tag(self, o, node, tagname):
+        tags = Tag.select_by_content_object(node).filter(name=tagname)
+        return tags[0].value
+
+    # Scan attrs for attribute name
+    # If it's not present, save it as a TenantAttribute
+    def attribute_default(self, tenant, attrs, name, default):
+        if name in attrs:
+            value = attrs[name]
+        else:
+            value = default
+            logger.info("saving default value %s for attribute %s" % (value, name))
+            ta = TenantAttribute(tenant=tenant, name=name, value=value)
+            ta.save()
+        return value
+
+    # This function currently assumes a single Deployment and Site
+    def get_vtn_config(self, o, attrs):
+
+        privateGatewayMac = None
+        localManagementIp = None
+        ovsdbPort = None
+        sshPort = None
+        sshUser = None
+        sshKeyFile = None
+        mgmtSubnetBits = None
+        xosEndpoint = None
+        xosUser = None
+        xosPassword = None
+
+        # VTN-specific configuration from the VTN Service
+        vtns = VTNService.get_service_objects().all()
+        if vtns:
+            vtn = vtns[0]
+            privateGatewayMac = vtn.privateGatewayMac
+            localManagementIp = vtn.localManagementIp
+            ovsdbPort = vtn.ovsdbPort
+            sshPort = vtn.sshPort
+            sshUser = vtn.sshUser
+            sshKeyFile = vtn.sshKeyFile
+            mgmtSubnetBits = vtn.mgmtSubnetBits
+            xosEndpoint = vtn.xosEndpoint
+            xosUser = vtn.xosUser
+            xosPassword = vtn.xosPassword
+
+        # OpenStack endpoints and credentials
+        keystone_server = "http://keystone:5000/v2.0/"
+        user_name = "admin"
+        password = "ADMIN_PASS"
+        controllers = Controller.objects.all()
+        if controllers:
+            controller = controllers[0]
+            keystone_server = controller.auth_url
+            user_name = controller.admin_user
+            tenant_name = controller.admin_tenant
+            password = controller.admin_password
+
+        data = {
+            "apps" : {
+                "org.onosproject.cordvtn" : {
+                    "cordvtn" : {
+                        "privateGatewayMac" : privateGatewayMac,
+                        "localManagementIp": localManagementIp,
+                        "ovsdbPort": ovsdbPort,
+                        "ssh": {
+                            "sshPort": sshPort,
+                            "sshUser": sshUser,
+                            "sshKeyFile": sshKeyFile
+                        },
+                        "openstack": {
+                            "endpoint": keystone_server,
+                            "tenant": tenant_name,
+                            "user": user_name,
+                            "password": password
+                        },
+                        "xos": {
+                            "endpoint": xosEndpoint,
+                            "user": xosUser,
+                            "password": xosPassword
+                        },
+                        "publicGateways": [],
+                        "nodes" : []
+                    }
+                }
+            }
+        }
+
+        # Generate apps->org.onosproject.cordvtn->cordvtn->nodes
+        nodes = Node.objects.all()
+        for node in nodes:
+            nodeip = socket.gethostbyname(node.name)
+
+            try:
+                bridgeId = self.get_node_tag(o, node, "bridgeId")
+                dataPlaneIntf = self.get_node_tag(o, node, "dataPlaneIntf")
+                dataPlaneIp = self.get_node_tag(o, node, "dataPlaneIp")
+            except:
+                logger.error("not adding node %s to the VTN configuration" % node.name)
+                continue
+
+            node_dict = {
+                "hostname": node.name,
+                "hostManagementIp": "%s/%s" % (nodeip, mgmtSubnetBits),
+                "bridgeId": bridgeId,
+                "dataPlaneIntf": dataPlaneIntf,
+                "dataPlaneIp": dataPlaneIp
+            }
+            data["apps"]["org.onosproject.cordvtn"]["cordvtn"]["nodes"].append(node_dict)
+
+        # Generate apps->org.onosproject.cordvtn->cordvtn->publicGateways
+        # Pull the gateway information from vRouter
+        vrouters = VRouterService.get_service_objects().all()
+        if vrouters:
+            for gateway in vrouters[0].get_gateways():
+                gatewayIp = gateway['gateway_ip'].split('/',1)[0]
+                gatewayMac = gateway['gateway_mac']
+                gateway_dict = {
+                    "gatewayIp": gatewayIp,
+                    "gatewayMac": gatewayMac
+                }
+                data["apps"]["org.onosproject.cordvtn"]["cordvtn"]["publicGateways"].append(gateway_dict)
+
+        return json.dumps(data, indent=4, sort_keys=True)
+
     def write_configs(self, o):
         o.config_fns = []
         o.rest_configs = []
@@ -153,6 +278,33 @@
             file(os.path.join(o.files_dir, fn),"w").write(" " +value)
             o.early_rest_configs.append( {"endpoint": endpoint, "fn": fn} )
 
+        # Generate config files and save them to the appropriate tenant attributes
+        autogen = []
+        for key, value in attrs.iteritems():
+            if key == "autogenerate" and value:
+                autogen.append(value)
+        for label in autogen:
+            config = None
+            value = None
+            if label == "vtn-network-cfg":
+            # Generate the VTN config file... where should this live?
+                config = "rest_onos/v1/network/configuration/"
+                value = self.get_vtn_config(o, attrs)
+            if config:
+                tas = TenantAttribute.objects.filter(tenant=o, name=config)
+                if tas:
+                    ta = tas[0]
+                    if ta.value != value:
+                        logger.info("updating %s with autogenerated config" % config)
+                        ta.value = value
+                        ta.save()
+                        attrs[config] = value
+                else:
+                    logger.info("saving autogenerated config %s" % config)
+                    ta = TenantAttribute(tenant=o, name=config, value=value)
+                    ta.save()
+                    attrs[config] = value
+
         for name in attrs.keys():
             value = attrs[name]
             if name.startswith("config_"):
diff --git a/xos/synchronizers/openstack/steps/sync_images.py b/xos/synchronizers/openstack/steps/sync_images.py
index 8049ac1..1638fd0 100644
--- a/xos/synchronizers/openstack/steps/sync_images.py
+++ b/xos/synchronizers/openstack/steps/sync_images.py
@@ -27,7 +27,7 @@
         if os.path.exists(images_path):
             for f in os.listdir(images_path):
                 filename = os.path.join(images_path, f)
-                if os.path.isfile(filename):
+                if os.path.isfile(filename) and filename.endswith(".img"):
                     available_images[f] = filename
 
         logger.info("SyncImages: available_images = %s" % str(available_images))
diff --git a/xos/services/helloworld/__init__.py b/xos/synchronizers/openvpn/__init__.py
similarity index 100%
copy from xos/services/helloworld/__init__.py
copy to xos/synchronizers/openvpn/__init__.py
diff --git a/xos/synchronizers/helloworldservice_complete/model-deps b/xos/synchronizers/openvpn/model-deps
similarity index 100%
rename from xos/synchronizers/helloworldservice_complete/model-deps
rename to xos/synchronizers/openvpn/model-deps
diff --git a/xos/synchronizers/helloworldservice_complete/helloworldservice-synchronizer.py b/xos/synchronizers/openvpn/openvpn-synchronizer.py
similarity index 76%
rename from xos/synchronizers/helloworldservice_complete/helloworldservice-synchronizer.py
rename to xos/synchronizers/openvpn/openvpn-synchronizer.py
index 95f4081..3227ed9 100755
--- a/xos/synchronizers/helloworldservice_complete/helloworldservice-synchronizer.py
+++ b/xos/synchronizers/openvpn/openvpn-synchronizer.py
@@ -1,8 +1,5 @@
 #!/usr/bin/env python
 
-# This imports and runs ../../xos-observer.py
-# Runs the standard XOS observer
-
 import importlib
 import os
 import sys
diff --git a/xos/synchronizers/openvpn/openvpn_config b/xos/synchronizers/openvpn/openvpn_config
new file mode 100644
index 0000000..8a58b52
--- /dev/null
+++ b/xos/synchronizers/openvpn/openvpn_config
@@ -0,0 +1,23 @@
+# Required by XOS
+[db]
+name=xos
+user=postgres
+password=password
+host=localhost
+port=5432
+
+# Required by XOS
+[api]
+nova_enabled=True
+
+# Sets options for the synchronizer
+[observer]
+name=openvpn
+dependency_graph=/opt/xos/synchronizers/openvpn/model-deps
+steps_dir=/opt/xos/synchronizers/openvpn/steps
+sys_dir=/opt/xos/synchronizers/openvpn/sys
+logfile=/var/log/xos_backend.log
+pretend=False
+backoff_disabled=True
+save_ansible_output=True
+proxy_ssh=False
diff --git a/xos/synchronizers/openvpn/run.sh b/xos/synchronizers/openvpn/run.sh
new file mode 100755
index 0000000..a5d90c9
--- /dev/null
+++ b/xos/synchronizers/openvpn/run.sh
@@ -0,0 +1,2 @@
+export XOS_DIR=/opt/xos
+python openvpn-synchronizer.py  -C $XOS_DIR/synchronizers/openvpn/openvpn_config
diff --git a/xos/services/helloworld/__init__.py b/xos/synchronizers/openvpn/steps/__init__.py
similarity index 100%
copy from xos/services/helloworld/__init__.py
copy to xos/synchronizers/openvpn/steps/__init__.py
diff --git a/xos/synchronizers/openvpn/steps/roles/openvpn/handlers/main.yml b/xos/synchronizers/openvpn/steps/roles/openvpn/handlers/main.yml
new file mode 100644
index 0000000..8725e29
--- /dev/null
+++ b/xos/synchronizers/openvpn/steps/roles/openvpn/handlers/main.yml
@@ -0,0 +1,4 @@
+---
+
+- name: restart openvpn
+  shell: (kill -9 $(cat {{ pki_dir }}/pid) || true) && (openvpn {{ pki_dir }}/server.conf &)
diff --git a/xos/synchronizers/openvpn/steps/roles/openvpn/tasks/main.yml b/xos/synchronizers/openvpn/steps/roles/openvpn/tasks/main.yml
new file mode 100644
index 0000000..47093b2
--- /dev/null
+++ b/xos/synchronizers/openvpn/steps/roles/openvpn/tasks/main.yml
@@ -0,0 +1,38 @@
+---
+
+- name: install openvpn
+  apt: name=openvpn state=present update_cache=yes
+
+- name: make sure /opt/openvpn exists
+  file: path=/opt/openvpn state=directory
+
+- name: make sure directory for this server exists
+  file: path={{ pki_dir }} state=directory
+
+- name: get server key
+  copy: src={{ pki_dir }}/private/server.key dest={{ pki_dir }}/server.key
+  notify:
+  - restart openvpn
+
+- name: get server crt
+  copy: src={{ pki_dir }}/issued/server.crt dest={{ pki_dir }}/server.crt
+  notify:
+  - restart openvpn
+
+- name: get ca crt
+  copy: src={{ pki_dir }}/ca.crt dest={{ pki_dir }}/ca.crt
+  notify:
+  - restart openvpn
+
+- name: get crl
+  copy: src={{ pki_dir }}/crl.pem dest={{ pki_dir }}/crl.pem
+
+- name: get dh
+  copy: src={{ pki_dir }}/dh.pem dest={{ pki_dir }}/dh.pem
+  notify:
+  - restart openvpn
+
+- name: write config
+  template: src=server.conf.j2 dest={{ pki_dir }}/server.conf owner=root group=root
+  notify:
+  - restart openvpn
diff --git a/xos/synchronizers/openvpn/steps/roles/openvpn/templates/server.conf.j2 b/xos/synchronizers/openvpn/steps/roles/openvpn/templates/server.conf.j2
new file mode 100644
index 0000000..4766e7b
--- /dev/null
+++ b/xos/synchronizers/openvpn/steps/roles/openvpn/templates/server.conf.j2
@@ -0,0 +1,24 @@
+# This file autogenerated by OpenVPNTenant synchronizer
+# It contains the OPENVPN config file for the server
+script-security 3 system
+port {{ port_number }}
+proto {{ protocol }}
+dev tun
+writepid {{ pki_dir }}/pid
+ca {{ pki_dir }}/ca.crt
+cert {{ pki_dir }}/server.crt
+key {{ pki_dir }}/server.key
+dh {{ pki_dir }}/dh.pem
+crl-verify {{ pki_dir }}/crl.pem
+server {{ server_network }} {{ vpn_subnet }}
+ifconfig-pool-persist {{ pki_dir }}/ipp.txt
+status {{ pki_dir }}/openvpn-status.log
+verb 3
+{% if is_persistent %}
+keepalive 10 60
+persist-tun
+persist-key
+{% endif %}
+{% if clients_can_see_each_other %}
+client-to-client
+{% endif %}
diff --git a/xos/synchronizers/openvpn/steps/sync_openvpntenant.py b/xos/synchronizers/openvpn/steps/sync_openvpntenant.py
new file mode 100644
index 0000000..b58dd94
--- /dev/null
+++ b/xos/synchronizers/openvpn/steps/sync_openvpntenant.py
@@ -0,0 +1,75 @@
+import os
+import shutil
+import sys
+
+from django.db.models import F, Q
+
+from services.openvpn.models import OpenVPNService, OpenVPNTenant
+from synchronizers.base.SyncInstanceUsingAnsible import \
+    SyncInstanceUsingAnsible
+
+parentdir = os.path.join(os.path.dirname(__file__), "..")
+sys.path.insert(0, parentdir)
+
+
+class SyncOpenVPNTenant(SyncInstanceUsingAnsible):
+    """Class for syncing a OpenVPNTenant using Ansible.
+
+    This SyncStep creates any necessary files for the OpenVPNTenant using ESAY RSA and then runs the
+    Ansible template to start the server on an instance.
+    """
+    provides = [OpenVPNTenant]
+    observes = OpenVPNTenant
+    requested_interval = 0
+    template_name = "sync_openvpntenant.yaml"
+    service_key_name = "/opt/xos/synchronizers/openvpn/openvpn_private_key"
+
+    def fetch_pending(self, deleted):
+        if (not deleted):
+            objs = OpenVPNTenant.get_tenant_objects().filter(
+                Q(enacted__lt=F('updated')) |
+                Q(enacted=None), Q(lazy_blocked=False))
+        else:
+            objs = OpenVPNTenant.get_deleted_tenant_objects()
+
+        return objs
+
+    def get_extra_attributes(self, tenant):
+        return {"is_persistent": tenant.is_persistent,
+                "vpn_subnet": tenant.vpn_subnet,
+                "server_network": tenant.server_network,
+                "clients_can_see_each_other": (
+                    tenant.clients_can_see_each_other),
+                "port_number": tenant.port_number,
+                "protocol": tenant.protocol,
+                "pki_dir": OpenVPNService.get_pki_dir(tenant)
+                }
+
+    def sync_fields(self, o, fields):
+        pki_dir = OpenVPNService.get_pki_dir(o)
+
+        if (not os.path.isdir(pki_dir)):
+            OpenVPNService.execute_easyrsa_command(pki_dir, "init-pki")
+            OpenVPNService.execute_easyrsa_command(
+                pki_dir, "--req-cn=XOS build-ca nopass")
+
+        # Very hacky way to handle VPNs that need to share CAs
+        if (o.use_ca_from_id):
+            tenant = OpenVPNTenant.get_tenant_objects().filter(
+                pk=o.use_ca_from_id)[0]
+            other_pki_dir = OpenVPNService.get_pki_dir(tenant)
+            shutil.copy2(other_pki_dir + "/ca.crt", pki_dir)
+            shutil.copy2(other_pki_dir + "/private/ca.key",
+                         pki_dir + "/private")
+
+        # If the server has to be built then we need to build it
+        if (not os.path.isfile(pki_dir + "/issued/server.crt")):
+            OpenVPNService.execute_easyrsa_command(
+                pki_dir, "build-server-full server nopass")
+            OpenVPNService.execute_easyrsa_command(pki_dir, "gen-dh")
+
+        # Get the most recent list of revoked clients
+        OpenVPNService.execute_easyrsa_command(pki_dir, "gen-crl")
+
+        # Super runs the playbook
+        super(SyncOpenVPNTenant, self).sync_fields(o, fields)
diff --git a/xos/synchronizers/openvpn/steps/sync_openvpntenant.yaml b/xos/synchronizers/openvpn/steps/sync_openvpntenant.yaml
new file mode 100644
index 0000000..e36f51b
--- /dev/null
+++ b/xos/synchronizers/openvpn/steps/sync_openvpntenant.yaml
@@ -0,0 +1,17 @@
+---
+- hosts: {{ instance_name }}
+  gather_facts: False
+  connection: ssh
+  user: ubuntu
+  sudo: yes
+  vars:
+    server_network: {{ server_network }}
+    is_persistent: {{ is_persistent }}
+    vpn_subnet: {{ vpn_subnet }}
+    clients_can_see_each_other: {{ clients_can_see_each_other }}
+    port_number: {{ port_number }}
+    protocol: {{ protocol }}
+    pki_dir: {{ pki_dir }}
+
+  roles:
+    - openvpn
diff --git a/xos/synchronizers/openvpn/steps/sync_tenantprivilege.py b/xos/synchronizers/openvpn/steps/sync_tenantprivilege.py
new file mode 100644
index 0000000..51ee6df
--- /dev/null
+++ b/xos/synchronizers/openvpn/steps/sync_tenantprivilege.py
@@ -0,0 +1,79 @@
+import os
+import sys
+
+from core.models import TenantPrivilege
+from services.openvpn.models import OPENVPN_KIND, OpenVPNService, OpenVPNTenant
+from synchronizers.base.syncstep import DeferredException, SyncStep
+
+parentdir = os.path.join(os.path.dirname(__file__), "..")
+sys.path.insert(0, parentdir)
+
+
+class SyncTenantPrivilege(SyncStep):
+    """Class for syncing a TenantPrivilege for a OpenVPNTenant.
+
+    This SyncStep isolates the updated TenantPrivileges that are for OpenVPNTenants and performs
+    actions if the TenantPrivilege has been added or deleted. For added privileges a new client
+    certificate and key are made, signed with the ca.crt file used by this OpenVPNTenant. For deleted
+    privileges the client certificate is revoked and the files associated are deleted. In both
+    cases the associated OpenVPNTenant is saved causing the OpenVPNTenant synchronizer to run.
+    """
+    provides = [TenantPrivilege]
+    observes = TenantPrivilege
+    requested_interval = 0
+
+    def fetch_pending(self, deleted):
+        privs = super(SyncTenantPrivilege, self).fetch_pending(deleted)
+        # Get only the TenantPrivileges that relate to OpenVPNTenants
+        privs = [priv for priv in privs if priv.tenant.kind == OPENVPN_KIND]
+        return privs
+
+    def sync_record(self, record):
+        if (not record.tenant.id):
+            raise DeferredException("Privilege waiting on VPN Tenant ID")
+        certificate = self.get_certificate_name(record)
+        tenant = OpenVPNTenant.get_tenant_objects().filter(pk=record.tenant.id)[0]
+        if (not tenant):
+            raise DeferredException("Privilege waiting on VPN Tenant")
+        # Only add a certificate if ones does not yet exist
+        pki_dir = OpenVPNService.get_pki_dir(tenant)
+        if (not os.path.isfile(pki_dir + "/issued/" + certificate + ".crt")):
+            OpenVPNService.execute_easyrsa_command(
+                pki_dir, "build-client-full " + certificate + " nopass")
+            tenant.save()
+        record.save()
+
+    def delete_record(self, record):
+        if (not record.tenant.id):
+            return
+        certificate = self.get_certificate_name(record)
+        tenant = OpenVPNTenant.get_tenant_objects().filter(pk=record.tenant.id)[0]
+        if (not tenant):
+            return
+        # If the client has already been reovked don't do it again
+        pki_dir = OpenVPNService.get_pki_dir(tenant)
+        if (os.path.isfile(pki_dir + "/issued/" + certificate + ".crt")):
+            OpenVPNService.execute_easyrsa_command(
+                pki_dir, "revoke " + certificate)
+            # Revoking a client cert does not delete any of the files
+            # to make sure that we can add this user again we need to
+            # delete all of the files created by easyrsa
+            os.remove(pki_dir + "/issued/" + certificate + ".crt")
+            os.remove(pki_dir + "/private/" + certificate + ".key")
+            os.remove(pki_dir + "/reqs/" + certificate + ".req")
+            tenant.save()
+
+        record.delete()
+
+    def get_certificate_name(self, tenant_privilege):
+        """Gets the name of a certificate for the given TenantPrivilege
+
+        Parameters:
+            tenant_privilege (core.models.TenantPrivilege): The TenantPrivilege to use to generate
+                the certificate name.
+
+        Returns:
+            str: The certificate name.
+        """
+        return (str(tenant_privilege.user.email) +
+                "-" + str(tenant_privilege.tenant.id))
diff --git a/xos/synchronizers/openvpn/stop.sh b/xos/synchronizers/openvpn/stop.sh
new file mode 100755
index 0000000..4a83aca
--- /dev/null
+++ b/xos/synchronizers/openvpn/stop.sh
@@ -0,0 +1,2 @@
+# Kill the observer
+pkill -9 -f openvpn-synchronizer.py
diff --git a/xos/synchronizers/vcpe/steps/sync_vcpetenant.py b/xos/synchronizers/vcpe/steps/sync_vcpetenant.py
index d52f075..9e3dfac 100644
--- a/xos/synchronizers/vcpe/steps/sync_vcpetenant.py
+++ b/xos/synchronizers/vcpe/steps/sync_vcpetenant.py
@@ -153,19 +153,6 @@
                         if mac:
                             safe_macs.append(mac)
 
-        wan_vm_ip=""
-        wan_vm_mac=""
-        tags = Tag.select_by_content_object(o.instance).filter(name="vm_wan_addr")
-        if tags:
-            parts=tags[0].value.split(",")
-            if len(parts)!=3:
-                raise Exception("vm_wan_addr tag is malformed: %s" % value)
-            wan_vm_ip = parts[1]
-            wan_vm_mac = parts[2]
-        else:
-            if CORD_USE_VTN:
-                raise Exception("no vm_wan_addr tag for instance %s" % o.instance)
-
         fields = {"vlan_ids": vlan_ids,   # XXX remove this
                 "s_tags": s_tags,
                 "c_tags": c_tags,
@@ -174,11 +161,6 @@
                 "bbs_addrs": bbs_addrs,
                 "full_setup": full_setup,
                 "isolation": o.instance.isolation,
-                "wan_container_gateway_mac": vcpe_service.wan_container_gateway_mac,
-                "wan_container_gateway_ip": vcpe_service.wan_container_gateway_ip,
-                "wan_container_netbits": vcpe_service.wan_container_netbits,
-                "wan_vm_mac": wan_vm_mac,
-                "wan_vm_ip": wan_vm_ip,
                 "safe_browsing_macs": safe_macs,
                 "container_name": "vcpe-%s-%s" % (s_tags[0], c_tags[0]),
                 "dns_servers": [x.strip() for x in vcpe_service.dns_servers.split(",")],
diff --git a/xos/synchronizers/vcpe/steps/sync_vcpetenant_vtn.yaml b/xos/synchronizers/vcpe/steps/sync_vcpetenant_vtn.yaml
index 04521dc..618e9de 100644
--- a/xos/synchronizers/vcpe/steps/sync_vcpetenant_vtn.yaml
+++ b/xos/synchronizers/vcpe/steps/sync_vcpetenant_vtn.yaml
@@ -294,7 +294,7 @@
     service: name={{ container_name }} state=started
 
   - name: reload ufw
-    shell: docker exec {{ container_name }} bash -c "/sbin/iptables -t nat -F PREROUTING; /usr/sbin/ufw reload"
+    shell: docker exec {{ container_name }} bash -c "/sbin/iptables -t nat -F PREROUTING; /sbin/iptables -t nat -F POSTROUTING; /usr/sbin/ufw reload"
 
   - name: rerun /etc/rc.local
     shell: docker exec {{ container_name }} bash -c "/etc/rc.local"
diff --git a/xos/synchronizers/vtn/steps/sync_port_addresses.py b/xos/synchronizers/vtn/steps/sync_port_addresses.py
index 6b48911..bbc6c99 100644
--- a/xos/synchronizers/vtn/steps/sync_port_addresses.py
+++ b/xos/synchronizers/vtn/steps/sync_port_addresses.py
@@ -70,14 +70,11 @@
 
             # now do the VM_WAN_IP from the instance
             if vsg.instance:
-                tags=Tag.select_by_content_object(vsg.instance).filter(name="vm_wan_addr")
-                if tags:
-                    parts=tags[0].value.split(",")
-                    if len(parts)!=3:
-                        raise Exception("vm_wan_addr tag is malformed: %s" % value)
-                    entry = {"mac_address": parts[2], "ip_address": parts[1]}
-                    if not entry in addr_pairs:
-                        addr_pairs.append(entry)
+                wan_vm_ip = vsg.wan_vm_ip
+                wan_vm_mac = vsg.wan_vm_mac
+                entry = {"mac_address": wan_vm_mac, "ip_address": wan_vm_ip}
+                if not entry in addr_pairs:
+                    addr_pairs.append(entry)
 
         # Get all ports in all controllers
         ports_by_id = {}
diff --git a/xos/synchronizers/vtr/steps/sync_vtrtenant.py b/xos/synchronizers/vtr/steps/sync_vtrtenant.py
index d2ec209..c66f19c 100644
--- a/xos/synchronizers/vtr/steps/sync_vtrtenant.py
+++ b/xos/synchronizers/vtr/steps/sync_vtrtenant.py
@@ -84,35 +84,22 @@
             s_tags.append(o.target.volt.s_tag)
             c_tags.append(o.target.volt.c_tag)
 
-        wan_vm_ip=""
-        wan_vm_mac=""
-        tags = Tag.select_by_content_object(instance).filter(name="vm_wan_addr")
-        if tags:
-            parts=tags[0].value.split(",")
-            if len(parts)!=3:
-                raise Exception("vm_wan_addr tag is malformed: %s" % value)
-            wan_vm_ip = parts[1]
-            wan_vm_mac = parts[2]
-        else:
-            if CORD_USE_VTN:
-                raise Exception("no vm_wan_addr tag for instance %s" % instance)
-
         fields = {"s_tags": s_tags,
                 "c_tags": c_tags,
                 "isolation": instance.isolation,
-                "wan_container_gateway_mac": vcpe_service.wan_container_gateway_mac,
-                "wan_container_gateway_ip": vcpe_service.wan_container_gateway_ip,
-                "wan_container_netbits": vcpe_service.wan_container_netbits,
-                "wan_vm_mac": wan_vm_mac,
-                "wan_vm_ip": wan_vm_ip,
                 "container_name": "vcpe-%s-%s" % (s_tags[0], c_tags[0]),
                 "dns_servers": [x.strip() for x in vcpe_service.dns_servers.split(",")],
 
                 "result_fn": "%s-vcpe-%s-%s" % (o.test, s_tags[0], c_tags[0]),
                 "resultcode_fn": "code-%s-vcpe-%s-%s" % (o.test, s_tags[0], c_tags[0]) }
 
-        # add in the sync_attributes that come from the SubscriberRoot object
+        # add in the sync_attributes that come from the vSG object
+        # this will be wan_ip, wan_mac, wan_container_ip, wan_container_mac, ...
+        if o.target and o.target.volt and o.target.volt.vcpe:
+            for attribute_name in o.target.volt.vcpe.sync_attributes:
+                fields[attribute_name] = getattr(o.target.volt.vcpe, attribute_name)
 
+        # add in the sync_attributes that come from the SubscriberRoot object
         if o.target and hasattr(o.target, "sync_attributes"):
             for attribute_name in o.target.sync_attributes:
                 fields[attribute_name] = getattr(o.target, attribute_name)
diff --git a/xos/tests/api/.gitignore b/xos/tests/api/.gitignore
index 3c3629e..99e7d87 100644
--- a/xos/tests/api/.gitignore
+++ b/xos/tests/api/.gitignore
@@ -1 +1 @@
-node_modules
+apiary.apib
\ No newline at end of file
diff --git a/xos/tests/api/gulpfile.js b/xos/tests/api/gulpfile.js
index 2e82210..988dd8c 100644
--- a/xos/tests/api/gulpfile.js
+++ b/xos/tests/api/gulpfile.js
@@ -12,6 +12,6 @@
       './source/base.md',
       './source/**/*.md'
     ])
-    .pipe(concat('apiary.apib', {newLine: '\n \n \n'}))
+    .pipe(concat('../../../apiary.apib', {newLine: '\n \n \n'}))
     .pipe(gulp.dest('./'));
 });
diff --git a/xos/tests/api/helpers/subscriber.py b/xos/tests/api/helpers/subscriber.py
index 0ff02c2..4ede030 100644
--- a/xos/tests/api/helpers/subscriber.py
+++ b/xos/tests/api/helpers/subscriber.py
@@ -60,6 +60,9 @@
     for s in NetworkSlice.objects.all():
         s.delete(purge=True)
 
+    for s in AddressPool.objects.all():
+        s.delete(purge=True)
+
     print 'DB Cleaned'
 
 
@@ -79,6 +82,22 @@
     subscriber = CordSubscriberRoot(name='Test Subscriber 1', id=1)
     subscriber.save()
 
+    # vRouter service
+    vrouter_service = VRouterService()
+    vrouter_service.name = 'service_vrouter'
+    vrouter_service.save()
+
+    # address pools
+    ap_vsg = AddressPool()
+    ap_vsg.service = vrouter_service
+    ap_vsg.name = 'addresses_vsg'
+    ap_vsg.addresses = '10.168.0.0'
+    ap_vsg.gateway_ip = '10.168.0.1'
+    ap_vsg.gateway_mac = '02:42:0a:a8:00:01'
+    ap_vsg.save()
+
+    print 'vRouter created'
+
     # Site
     site = Site.objects.get(name='MySite')
 
@@ -102,6 +121,7 @@
     volt_service.name = 'service_volt'
     volt_service.save()
 
+
     # vcpe slice
     vcpe_slice = Slice()
     vcpe_slice.name = site.login_base + "_testVcpe"
@@ -110,7 +130,7 @@
     vcpe_slice.caller = user
     vcpe_slice.save()
 
-    print 'vcpe_slice created'
+    # print 'vcpe_slice created'
 
     # create a lan network
     lan_net = Network()
@@ -119,7 +139,7 @@
     lan_net.template = private_template
     lan_net.save()
 
-    print 'lan_network created'
+    # print 'lan_network created'
 
     # add relation between vcpe slice and lan network
     vcpe_network = NetworkSlice()
@@ -127,14 +147,14 @@
     vcpe_network.slice = vcpe_slice
     vcpe_network.save()
 
-    print 'vcpe network relation added'
+    # print 'vcpe network relation added'
 
     # vbng service
     vbng_service = VBNGService()
     vbng_service.name = 'service_vbng'
     vbng_service.save()
 
-    print 'vbng_service creater'
+    # print 'vbng_service creater'
 
     # volt tenant
     vt = VOLTTenant(subscriber=subscriber.id, id=1)
diff --git a/xos/tests/api/hooks.py b/xos/tests/api/hooks.py
index 562798a..ccf0c6c 100644
--- a/xos/tests/api/hooks.py
+++ b/xos/tests/api/hooks.py
@@ -51,6 +51,9 @@
     for s in NetworkSlice.objects.all():
         s.delete(purge=True)
 
+    for s in AddressPool.objects.all():
+        s.delete(purge=True)
+
     # print 'DB Cleaned'
 
 
@@ -70,6 +73,22 @@
     subscriber = CordSubscriberRoot(name='Test Subscriber 1', id=1)
     subscriber.save()
 
+    # vRouter service
+    vrouter_service = VRouterService()
+    vrouter_service.name = 'service_vrouter'
+    vrouter_service.save()
+
+    # address pools
+    ap_vsg = AddressPool()
+    ap_vsg.service = vrouter_service
+    ap_vsg.name = 'addresses_vsg'
+    ap_vsg.addresses = '10.168.0.0'
+    ap_vsg.gateway_ip = '10.168.0.1'
+    ap_vsg.gateway_mac = '02:42:0a:a8:00:01'
+    ap_vsg.save()
+
+    # print 'vRouter created'
+
     # Site
     site = Site.objects.get(name='MySite')
 
@@ -164,6 +183,7 @@
 @hooks.before_each
 def my_before_each_hook(transaction):
     # print "-------------------------------- Before Each Hook --------------------------------"
+    # print transaction['name']
     auth = doLogin('padmin@vicci.org', 'letmein')
     transaction['request']['headers']['X-CSRFToken'] = auth['token']
     transaction['request']['headers']['Cookie'] = "xossessionid=%s; xoscsrftoken=%s" % (auth['sessionid'], auth['token'])
@@ -192,3 +212,8 @@
 def test4(transaction):
     # transaction['skip'] = True
     VOLTTenant.objects.get(kind='vOLT').delete()
+
+
+@hooks.before("Example > Example Services Collection > List all Example Services")
+def exampleTest(transaction):
+    transaction['skip'] = True
diff --git a/xos/tests/api/source/service/exampleservice.md b/xos/tests/api/source/service/exampleservice.md
new file mode 100644
index 0000000..96a19c7
--- /dev/null
+++ b/xos/tests/api/source/service/exampleservice.md
@@ -0,0 +1,15 @@
+# Group Example
+
+## Example Services Collection [/api/service/exampleservice/]
+
+### List all Example Services [GET]
+
++ Response 200 (application/json)
+
+        [
+            {
+                "humanReadableName": "MyExample",
+                "id": 1,
+                "service_message": "This is the test message"
+            }
+        ]
\ No newline at end of file
diff --git a/xos/tests/api/source/service/vsg.md b/xos/tests/api/source/service/vsg.md
index 9247450..1a0569a 100644
--- a/xos/tests/api/source/service/vsg.md
+++ b/xos/tests/api/source/service/vsg.md
@@ -10,8 +10,6 @@
             {
                 "humanReadableName": "service_vsg",
                 "id": 2,
-                "wan_container_gateway_ip": "",
-                "wan_container_gateway_mac": "",
                 "dns_servers": "8.8.8.8",
                 "url_filter_kind": null,
                 "node_label": null
diff --git a/xos/tools/xos-manage b/xos/tools/xos-manage
index 5410f37..709882b 100755
--- a/xos/tools/xos-manage
+++ b/xos/tools/xos-manage
@@ -60,13 +60,13 @@
         echo Waiting for postgres to start
         sleep 1
         sudo -u postgres psql -c '\q'
-    done 
+    done
 }
 
 function db_exists {
-   sudo -u postgres psql $DBNAME -c '\q' 2>/dev/null    
+   sudo -u postgres psql $DBNAME -c '\q' 2>/dev/null
    return $?
-} 
+}
 
 function createdb {
     wait_postgres
@@ -144,9 +144,12 @@
     python ./manage.py makemigrations syndicate_storage
     python ./manage.py makemigrations cord
     python ./manage.py makemigrations ceilometer
-    python ./manage.py makemigrations helloworldservice_complete
     python ./manage.py makemigrations onos
+    python ./manage.py makemigrations openvpn
     python ./manage.py makemigrations vtr
+    python ./manage.py makemigrations vrouter
+    python ./manage.py makemigrations vtn
+    python ./manage.py makemigrations fabric
     #python ./manage.py makemigrations servcomp
 }
 
diff --git a/xos/tosca/custom_types/xos.m4 b/xos/tosca/custom_types/xos.m4
index d903190..e6d77f1 100644
--- a/xos/tosca/custom_types/xos.m4
+++ b/xos/tosca/custom_types/xos.m4
@@ -204,6 +204,9 @@
             rest_onos/v1/network/configuration/:
                 type: string
                 required: false
+            autogenerate:
+                type: string
+                required: false
 
     tosca.nodes.VSGService:
         description: >
@@ -218,15 +221,6 @@
                 type: string
                 required: false
                 description: Label that matches network used to connect HPC and BBS services.
-            wan_container_gateway_ip:
-                type: string
-                required: false
-            wan_container_gateway_mac:
-                type: string
-                required: false
-            wan_container_netbits:
-                type: string
-                required: false
             dns_servers:
                 type: string
                 required: false
@@ -248,6 +242,67 @@
                 required: false
                 description: URL of REST API endpoint for vBNG Service.
 
+    tosca.nodes.VRouterService:
+        derived_from: tosca.nodes.Root
+        description: >
+            CORD: The vRouter Service.
+        capabilities:
+            xos_base_service_caps
+        properties:
+            xos_base_props
+            xos_base_service_props
+
+    tosca.nodes.FabricService:
+        derived_from: tosca.nodes.Root
+        description: >
+            CORD: The Fabric Service.
+        capabilities:
+            xos_base_service_caps
+        properties:
+            xos_base_props
+            xos_base_service_props
+
+    tosca.nodes.VTNService:
+        derived_from: tosca.nodes.Root
+        description: >
+            CORD: The vRouter Service.
+        capabilities:
+            xos_base_service_caps
+        properties:
+            xos_base_props
+            xos_base_service_props
+            privateGatewayMac:
+                type: string
+                required: false
+            localManagementIp:
+                type: string
+                required: false
+            ovsdbPort:
+                type: string
+                required: false
+            sshPort:
+                type: string
+                required: false
+            sshUser:
+                type: string
+                required: false
+            sshKeyFile:
+                type: string
+                required: false
+            mgmtSubnetBits:
+                type: string
+                required: false
+            xosEndpoint:
+                type: string
+                required: false
+            xosUser:
+                type: string
+                required: false
+            xosPassword:
+                type: string
+                required: false
+
+
     tosca.nodes.CDNService:
         derived_from: tosca.nodes.Root
         description: >
@@ -350,16 +405,17 @@
                 type: tosca.capabilities.xos.User
 
         properties:
+            xos_base_props
             password:
                 type: string
                 required: false
             firstname:
                 type: string
-                required: true
+                required: false
                 description: First name of User.
             lastname:
                 type: string
-                required: true
+                required: false
                 description: Last name of User.
             phone:
                 type: string
@@ -375,11 +431,13 @@
                 description: Public key that will be installed in Instances.
             is_active:
                 type: boolean
-                default: true
+                required: false
+                #default: true
                 description: If True, the user may log in.
             is_admin:
                 type: boolean
-                default: false
+                required: false
+                #default: false
                 description: If True, the user has root admin privileges.
             login_page:
                 type: string
@@ -393,6 +451,9 @@
             An XOS network parameter type. May be applied to Networks and/or
             Ports.
 
+        properties:
+            xos_base_props
+
         capabilities:
             network_parameter_type:
                 type: tosca.capabilities.xos.NetworkParameterType
@@ -409,13 +470,14 @@
                 type: tosca.capabilities.xos.NetworkTemplate
 
         properties:
+            xos_base_props
             visibility:
                 type: string
-                default: private
+                required: false
                 description: Indicates whether network is publicly routable.
             translation:
                 type: string
-                default: none
+                required: false
                 description: Indicates whether network uses address translation.
             shared_network_name:
                 type: string
@@ -427,7 +489,7 @@
                 description: Attaches this template to a specific OpenStack network.
             topology_kind:
                 type: string
-                default: BigSwitch
+                required: false
                 description: Describes the topology of the network.
             controller_kind:
                 type: string
@@ -553,12 +615,23 @@
         derived_from: tosca.nodes.Root
         description: >
             A pool of addresses
+        capabilities:
+            addresspool:
+                type: tosca.capabilities.xos.AddressPool
         properties:
             xos_base_props
             addresses:
                 type: string
                 required: false
                 description: space-separated list of addresses
+            gateway_ip:
+                type: string
+                required: false
+                description: gateway ip address
+            gateway_mac:
+                type: string
+                required: false
+                description: gateway mac address
 
     tosca.nodes.Image:
         derived_from: tosca.nodes.Root
@@ -702,13 +775,6 @@
                 type: string
                 required: false
                 description: default isolation to use when bringing up instances (default to 'vm')
-            default_flavor:
-                # Note: we should probably formally introduce flavors to Tosca
-                # at some point, and use a requirement/relationship instead of
-                # a text string.
-                type: string
-                required: false
-                description: default flavor to use for slice
             network:
                 type: string
                 required: false
@@ -739,6 +805,60 @@
             node:
                 type: tosca.capabilities.xos.NodeLabel
 
+    tosca.nodes.Flavor:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Flavor.
+        properties:
+            xos_base_props
+            flavor:
+                type: string
+                required: false
+                description: openstack flavor name
+        capabilities:
+            flavor:
+                type: tosca.capabilities.xos.Flavor
+
+    tosca.nodes.SiteRole:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Site Role.
+        properties:
+            xos_base_props
+        capabilities:
+            siterole:
+                type: tosca.capabilities.xos.SiteRole
+
+    tosca.nodes.SliceRole:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Slice Role.
+        properties:
+            xos_base_props
+        capabilities:
+            slicerole:
+                type: tosca.capabilities.xos.SliceRole
+
+    tosca.nodes.TenantRole:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Tenant Role.
+        properties:
+            xos_base_props
+        capabilities:
+            tenantrole:
+                type: tosca.capabilities.xos.TenantRole
+
+    tosca.nodes.DeploymentRole:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Deployment Role.
+        properties:
+            xos_base_props
+        capabilities:
+            deploymentrole:
+                type: tosca.capabilities.xos.DeploymentRole
+
     tosca.nodes.DashboardView:
         derived_from: tosca.nodes.Root
         description: >
@@ -756,6 +876,21 @@
                 required: false
                 description: URL to the dashboard
 
+    tosca.nodes.Tag:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Tag
+        properties:
+            xos_base_props
+            name:
+                type: string
+                required: true
+                descrption: name of tag
+            value:
+                type: string
+                required: false
+                descrption: value of tag
+
     tosca.nodes.Compute.Container:
       derived_from: tosca.nodes.Compute
       description: >
@@ -877,9 +1012,24 @@
         derived_from: tosca.relationships.Root
         valid_target_types: [ tosca.capabilities.xos.NodeLabel ]
 
+    tosca.relationships.SupportsFlavor:
+        derived_from: tosca.relationships.Root
+        valid_target_types: [ tosca.capabilities.xos.Flavor ]
+
+    tosca.relationships.DefaultFlavor:
+        derived_from: tosca.relationships.Root
+        valid_target_types: [ tosca.capabilities.xos.Flavor ]
+
+    tosca.relationships.ProvidesAddresses:
+        derived_from: tosca.relationships.Root
+        valid_target_types: [ tosca.capabilities.xos.AddressPool ]
+
     tosca.relationships.DependsOn:
         derived_from: tosca.relationships.Root
 
+    tosca.relationships.TagsObject:
+        derived_from: tosca.relationships.Root
+
     tosca.capabilities.xos.Service:
         derived_from: tosca.capabilities.Root
         description: An XOS Service
@@ -928,6 +1078,26 @@
         derived_from: tosca.capabilities.Root
         description: An XOS NodeLabel
 
+    tosca.capabilities.xos.Flavor:
+        derived_from: tosca.capabilities.Root
+        description: An XOS Flavor
+
+    tosca.capabilities.xos.DeploymentRole:
+        derived_from: tosca.capabilities.Root
+        description: An XOS DeploymentRole
+
+    tosca.capabilities.xos.SliceRole:
+        derived_from: tosca.capabilities.Root
+        description: An XOS SliceRole
+
+    tosca.capabilities.xos.SiteRole:
+        derived_from: tosca.capabilities.Root
+        description: An XOS SiteRole
+
+    tosca.capabilities.xos.TenantRole:
+        derived_from: tosca.capabilities.Root
+        description: An XOS TenantRole
+
     tosca.capabilities.xos.Image:
         derived_from: tosca.capabilities.Root
         description: An XOS Image
@@ -939,3 +1109,7 @@
     tosca.capabilities.xos.NetworkParameterType:
         derived_from: tosca.capabilities.Root
         description: An XOS NetworkParameterType
+
+    tosca.capabilities.xos.AddressPool:
+        derived_from: tosca.capabilities.Root
+        description: An XOS AddressPool
diff --git a/xos/tosca/custom_types/xos.yaml b/xos/tosca/custom_types/xos.yaml
index adc1bf1..2bca51e 100644
--- a/xos/tosca/custom_types/xos.yaml
+++ b/xos/tosca/custom_types/xos.yaml
@@ -262,6 +262,9 @@
             rest_onos/v1/network/configuration/:
                 type: string
                 required: false
+            autogenerate:
+                type: string
+                required: false
 
     tosca.nodes.VSGService:
         description: >
@@ -320,15 +323,6 @@
                 type: string
                 required: false
                 description: Label that matches network used to connect HPC and BBS services.
-            wan_container_gateway_ip:
-                type: string
-                required: false
-            wan_container_gateway_mac:
-                type: string
-                required: false
-            wan_container_netbits:
-                type: string
-                required: false
             dns_servers:
                 type: string
                 required: false
@@ -394,6 +388,199 @@
                 required: false
                 description: URL of REST API endpoint for vBNG Service.
 
+    tosca.nodes.VRouterService:
+        derived_from: tosca.nodes.Root
+        description: >
+            CORD: The vRouter Service.
+        capabilities:
+            scalable:
+                type: tosca.capabilities.Scalable
+            service:
+                type: tosca.capabilities.xos.Service
+        properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
+            kind:
+                type: string
+                default: generic
+                description: Type of service.
+            view_url:
+                type: string
+                required: false
+                description: URL to follow when icon is clicked in the Service Directory.
+            icon_url:
+                type: string
+                required: false
+                description: ICON to display in the Service Directory.
+            enabled:
+                type: boolean
+                default: true
+            published:
+                type: boolean
+                default: true
+                description: If True then display this Service in the Service Directory.
+            public_key:
+                type: string
+                required: false
+                description: Public key to install into Instances to allows Services to SSH into them.
+            private_key_fn:
+                type: string
+                required: false
+                description: Location of private key file
+            versionNumber:
+                type: string
+                required: false
+                description: Version number of Service.
+
+    tosca.nodes.FabricService:
+        derived_from: tosca.nodes.Root
+        description: >
+            CORD: The Fabric Service.
+        capabilities:
+            scalable:
+                type: tosca.capabilities.Scalable
+            service:
+                type: tosca.capabilities.xos.Service
+        properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
+            kind:
+                type: string
+                default: generic
+                description: Type of service.
+            view_url:
+                type: string
+                required: false
+                description: URL to follow when icon is clicked in the Service Directory.
+            icon_url:
+                type: string
+                required: false
+                description: ICON to display in the Service Directory.
+            enabled:
+                type: boolean
+                default: true
+            published:
+                type: boolean
+                default: true
+                description: If True then display this Service in the Service Directory.
+            public_key:
+                type: string
+                required: false
+                description: Public key to install into Instances to allows Services to SSH into them.
+            private_key_fn:
+                type: string
+                required: false
+                description: Location of private key file
+            versionNumber:
+                type: string
+                required: false
+                description: Version number of Service.
+
+    tosca.nodes.VTNService:
+        derived_from: tosca.nodes.Root
+        description: >
+            CORD: The vRouter Service.
+        capabilities:
+            scalable:
+                type: tosca.capabilities.Scalable
+            service:
+                type: tosca.capabilities.xos.Service
+        properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
+            kind:
+                type: string
+                default: generic
+                description: Type of service.
+            view_url:
+                type: string
+                required: false
+                description: URL to follow when icon is clicked in the Service Directory.
+            icon_url:
+                type: string
+                required: false
+                description: ICON to display in the Service Directory.
+            enabled:
+                type: boolean
+                default: true
+            published:
+                type: boolean
+                default: true
+                description: If True then display this Service in the Service Directory.
+            public_key:
+                type: string
+                required: false
+                description: Public key to install into Instances to allows Services to SSH into them.
+            private_key_fn:
+                type: string
+                required: false
+                description: Location of private key file
+            versionNumber:
+                type: string
+                required: false
+                description: Version number of Service.
+            privateGatewayMac:
+                type: string
+                required: false
+            localManagementIp:
+                type: string
+                required: false
+            ovsdbPort:
+                type: string
+                required: false
+            sshPort:
+                type: string
+                required: false
+            sshUser:
+                type: string
+                required: false
+            sshKeyFile:
+                type: string
+                required: false
+            mgmtSubnetBits:
+                type: string
+                required: false
+            xosEndpoint:
+                type: string
+                required: false
+            xosUser:
+                type: string
+                required: false
+            xosPassword:
+                type: string
+                required: false
+
+
     tosca.nodes.CDNService:
         derived_from: tosca.nodes.Root
         description: >
@@ -607,16 +794,28 @@
                 type: tosca.capabilities.xos.User
 
         properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
             password:
                 type: string
                 required: false
             firstname:
                 type: string
-                required: true
+                required: false
                 description: First name of User.
             lastname:
                 type: string
-                required: true
+                required: false
                 description: Last name of User.
             phone:
                 type: string
@@ -632,11 +831,13 @@
                 description: Public key that will be installed in Instances.
             is_active:
                 type: boolean
-                default: true
+                required: false
+                #default: true
                 description: If True, the user may log in.
             is_admin:
                 type: boolean
-                default: false
+                required: false
+                #default: false
                 description: If True, the user has root admin privileges.
             login_page:
                 type: string
@@ -650,6 +851,20 @@
             An XOS network parameter type. May be applied to Networks and/or
             Ports.
 
+        properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
+
         capabilities:
             network_parameter_type:
                 type: tosca.capabilities.xos.NetworkParameterType
@@ -666,13 +881,25 @@
                 type: tosca.capabilities.xos.NetworkTemplate
 
         properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
             visibility:
                 type: string
-                default: private
+                required: false
                 description: Indicates whether network is publicly routable.
             translation:
                 type: string
-                default: none
+                required: false
                 description: Indicates whether network uses address translation.
             shared_network_name:
                 type: string
@@ -684,7 +911,7 @@
                 description: Attaches this template to a specific OpenStack network.
             topology_kind:
                 type: string
-                default: BigSwitch
+                required: false
                 description: Describes the topology of the network.
             controller_kind:
                 type: string
@@ -832,6 +1059,9 @@
         derived_from: tosca.nodes.Root
         description: >
             A pool of addresses
+        capabilities:
+            addresspool:
+                type: tosca.capabilities.xos.AddressPool
         properties:
             no-delete:
                 type: boolean
@@ -849,6 +1079,14 @@
                 type: string
                 required: false
                 description: space-separated list of addresses
+            gateway_ip:
+                type: string
+                required: false
+                description: gateway ip address
+            gateway_mac:
+                type: string
+                required: false
+                description: gateway mac address
 
     tosca.nodes.Image:
         derived_from: tosca.nodes.Root
@@ -1025,13 +1263,6 @@
                 type: string
                 required: false
                 description: default isolation to use when bringing up instances (default to 'vm')
-            default_flavor:
-                # Note: we should probably formally introduce flavors to Tosca
-                # at some point, and use a requirement/relationship instead of
-                # a text string.
-                type: string
-                required: false
-                description: default flavor to use for slice
             network:
                 type: string
                 required: false
@@ -1084,6 +1315,115 @@
             node:
                 type: tosca.capabilities.xos.NodeLabel
 
+    tosca.nodes.Flavor:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Flavor.
+        properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
+            flavor:
+                type: string
+                required: false
+                description: openstack flavor name
+        capabilities:
+            flavor:
+                type: tosca.capabilities.xos.Flavor
+
+    tosca.nodes.SiteRole:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Site Role.
+        properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
+        capabilities:
+            siterole:
+                type: tosca.capabilities.xos.SiteRole
+
+    tosca.nodes.SliceRole:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Slice Role.
+        properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
+        capabilities:
+            slicerole:
+                type: tosca.capabilities.xos.SliceRole
+
+    tosca.nodes.TenantRole:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Tenant Role.
+        properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
+        capabilities:
+            tenantrole:
+                type: tosca.capabilities.xos.TenantRole
+
+    tosca.nodes.DeploymentRole:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Deployment Role.
+        properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
+        capabilities:
+            deploymentrole:
+                type: tosca.capabilities.xos.DeploymentRole
+
     tosca.nodes.DashboardView:
         derived_from: tosca.nodes.Root
         description: >
@@ -1112,6 +1452,32 @@
                 required: false
                 description: URL to the dashboard
 
+    tosca.nodes.Tag:
+        derived_from: tosca.nodes.Root
+        description: >
+            An XOS Tag
+        properties:
+            no-delete:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to delete this object
+            no-create:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to create this object
+            no-update:
+                type: boolean
+                default: false
+                description: Do not allow Tosca to update this object
+            name:
+                type: string
+                required: true
+                descrption: name of tag
+            value:
+                type: string
+                required: false
+                descrption: value of tag
+
     tosca.nodes.Compute.Container:
       derived_from: tosca.nodes.Compute
       description: >
@@ -1233,9 +1599,24 @@
         derived_from: tosca.relationships.Root
         valid_target_types: [ tosca.capabilities.xos.NodeLabel ]
 
+    tosca.relationships.SupportsFlavor:
+        derived_from: tosca.relationships.Root
+        valid_target_types: [ tosca.capabilities.xos.Flavor ]
+
+    tosca.relationships.DefaultFlavor:
+        derived_from: tosca.relationships.Root
+        valid_target_types: [ tosca.capabilities.xos.Flavor ]
+
+    tosca.relationships.ProvidesAddresses:
+        derived_from: tosca.relationships.Root
+        valid_target_types: [ tosca.capabilities.xos.AddressPool ]
+
     tosca.relationships.DependsOn:
         derived_from: tosca.relationships.Root
 
+    tosca.relationships.TagsObject:
+        derived_from: tosca.relationships.Root
+
     tosca.capabilities.xos.Service:
         derived_from: tosca.capabilities.Root
         description: An XOS Service
@@ -1284,6 +1665,26 @@
         derived_from: tosca.capabilities.Root
         description: An XOS NodeLabel
 
+    tosca.capabilities.xos.Flavor:
+        derived_from: tosca.capabilities.Root
+        description: An XOS Flavor
+
+    tosca.capabilities.xos.DeploymentRole:
+        derived_from: tosca.capabilities.Root
+        description: An XOS DeploymentRole
+
+    tosca.capabilities.xos.SliceRole:
+        derived_from: tosca.capabilities.Root
+        description: An XOS SliceRole
+
+    tosca.capabilities.xos.SiteRole:
+        derived_from: tosca.capabilities.Root
+        description: An XOS SiteRole
+
+    tosca.capabilities.xos.TenantRole:
+        derived_from: tosca.capabilities.Root
+        description: An XOS TenantRole
+
     tosca.capabilities.xos.Image:
         derived_from: tosca.capabilities.Root
         description: An XOS Image
@@ -1295,3 +1696,7 @@
     tosca.capabilities.xos.NetworkParameterType:
         derived_from: tosca.capabilities.Root
         description: An XOS NetworkParameterType
+
+    tosca.capabilities.xos.AddressPool:
+        derived_from: tosca.capabilities.Root
+        description: An XOS AddressPool
diff --git a/xos/tosca/resources/CORDUser.py b/xos/tosca/resources/CORDUser.py
index 566e205..705a895 100644
--- a/xos/tosca/resources/CORDUser.py
+++ b/xos/tosca/resources/CORDUser.py
@@ -28,12 +28,12 @@
         if not sub:
            return []
         for user in sub.users:
-            if user["name"] == self.nodetemplate.name:
+            if user["name"] == self.obj_name:
                 result.append(user)
         return result
 
     def get_xos_args(self):
-        args = {"name": self.nodetemplate.name,
+        args = {"name": self.obj_name,
                 "level": self.get_property("level"),
                 "mac": self.get_property("mac")}
         return args
@@ -46,7 +46,7 @@
         sub.create_user(**xos_args)
         sub.save()
 
-        self.info("Created CORDUser %s for Subscriber %s" % (self.nodetemplate.name, sub.name))
+        self.info("Created CORDUser %s for Subscriber %s" % (self.obj_name, sub.name))
 
     def update(self, obj):
         pass
diff --git a/xos/tosca/resources/addresspool.py b/xos/tosca/resources/addresspool.py
index e8577a2..8cd3e83 100644
--- a/xos/tosca/resources/addresspool.py
+++ b/xos/tosca/resources/addresspool.py
@@ -14,7 +14,7 @@
 class XOSAddressPool(XOSResource):
     provides = "tosca.nodes.AddressPool"
     xos_model = AddressPool
-    copyin_props = ["addresses"]
+    copyin_props = ["addresses", "gateway_ip", "gateway_mac"]
 
     def expand_cidr(self, cidr):
         (network, bits) = cidr.split("/")
@@ -31,20 +31,31 @@
             ip = ip & netmask | i
             dest.append( socket.inet_ntoa(struct.pack("!L", ip)) )
 
-        return dest
+        return (dest, bits)
 
     def get_xos_args(self):
         args = super(XOSAddressPool, self).get_xos_args()
 
         if "addresses" in args:
-            dest = []
-            for addr in args["addresses"].split():
-                addr=addr.strip()
-                if "/" in addr:
-                    dest.extend(self.expand_cidr(addr))
-                else:
-                    dest.append(addr)
-            args["addresses"] = " ".join(dest)
+            addr = args["addresses"]
+            if "," in addr:
+                raise Exception("Only one cidr per AddressPool")
+            if not "/" in addr:
+                raise Exception("AddressPool addresses must be a cidr")
+            (cidr_addrs, cidr_netbits) = self.expand_cidr(addr)
+            args["addresses"] = " ".join(cidr_addrs)
+            args["cidr"] = addr
+
+#        if "addresses" in args:
+#            dest = []
+#            for addr in args["addresses"].split():
+#                addr=addr.strip()
+#                if "/" in addr:
+#                    (cidr_addrs, cidr_netbits) = self.expand_cidr(addr)
+#                    dest.extend(cidr_addrs)
+#                else:
+#                    dest.append(addr)
+#            args["addresses"] = " ".join(dest)
 
         return args
 
diff --git a/xos/tosca/resources/cdnprefix.py b/xos/tosca/resources/cdnprefix.py
index 5faaca8..8daf7fb 100644
--- a/xos/tosca/resources/cdnprefix.py
+++ b/xos/tosca/resources/cdnprefix.py
@@ -16,7 +16,7 @@
     copyin_props = []
 
     def get_xos_args(self):
-        args = {"prefix": self.nodetemplate.name}
+        args = {"prefix": self.obj_name}
 
         cp_name = self.get_requirement("tosca.relationships.MemberOfContentProvider")
         if cp_name:
diff --git a/xos/tosca/resources/compute.py b/xos/tosca/resources/compute.py
index 37ba390..2af010a 100644
--- a/xos/tosca/resources/compute.py
+++ b/xos/tosca/resources/compute.py
@@ -39,7 +39,7 @@
         nodetemplate = self.nodetemplate
 
         if not name:
-            name = nodetemplate.name
+            name = self.obj_name
 
         args = {"name": name}
 
@@ -105,7 +105,7 @@
         if scalable:
             default_instances = scalable.get("default_instances",1)
             for i in range(0, default_instances):
-                name = "%s-%d" % (self.nodetemplate.name, i)
+                name = "%s-%d" % (self.obj_name, i)
                 existing_instances = Instance.objects.filter(name=name)
                 if existing_instances:
                     self.info("%s %s already exists" % (self.xos_model.__name__, name))
@@ -121,7 +121,7 @@
             existing_instances = []
             max_instances = scalable.get("max_instances",1)
             for i in range(0, max_instances):
-                name = "%s-%d" % (self.nodetemplate.name, i)
+                name = "%s-%d" % (self.obj_name, i)
                 existing_instances = existing_instances + list(Instance.objects.filter(name=name))
             return existing_instances
         else:
diff --git a/xos/tosca/resources/contentprovider.py b/xos/tosca/resources/contentprovider.py
index 06ca02e..66742ea 100644
--- a/xos/tosca/resources/contentprovider.py
+++ b/xos/tosca/resources/contentprovider.py
@@ -17,7 +17,7 @@
     def get_xos_args(self):
         sp_name = self.get_requirement("tosca.relationships.MemberOfServiceProvider", throw_exception=True)
         sp = self.get_xos_object(ServiceProvider, name=sp_name)
-        return {"name": self.nodetemplate.name,
+        return {"name": self.obj_name,
                 "serviceProvider": sp}
 
     def can_delete(self, obj):
diff --git a/xos/tosca/resources/dashboardview.py b/xos/tosca/resources/dashboardview.py
index 9f7687c..3bce58d 100644
--- a/xos/tosca/resources/dashboardview.py
+++ b/xos/tosca/resources/dashboardview.py
@@ -17,6 +17,14 @@
     def get_xos_args(self):
         return super(XOSDashboardView, self).get_xos_args()
 
+    def postprocess(self, obj):
+        for deployment_name in self.get_requirements("tosca.relationships.SupportsDeployment"):
+            deployment = self.get_xos_object(Deployment, deployment_name)
+            if not deployment in obj.deployments.all():
+                print "attaching dashboardview %s to deployment %s" % (obj, deployment)
+                obj.deployments.add(deployment)
+                obj.save()
+
     def can_delete(self, obj):
         return super(XOSDashboardView, self).can_delete(obj)
 
diff --git a/xos/tosca/resources/deployment.py b/xos/tosca/resources/deployment.py
index ed6734c..e5ab4b1 100644
--- a/xos/tosca/resources/deployment.py
+++ b/xos/tosca/resources/deployment.py
@@ -31,9 +31,8 @@
                 imageDep = ImageDeployments(deployment=obj, image=image)
                 imageDep.save()
 
-        # Be a little more lightweight with 'flavors'. Since we install flavors
-        # as a fixture rather than using TOSCA, we can just let the user
-        # use a comma-separated list.
+        # DEPRECATED - should switch to using a requirement, so tosca can do
+        # the topsort properly
 
         flavors = self.get_property("flavors")
         if flavors:
@@ -47,6 +46,15 @@
                     flavor.deployments.add(obj)
                     flavor.save()
 
+        # The new, right way
+        for flavor in self.get_requirements("tosca.relationships.SupportsFlavor"):
+            flavor = self.get_xos_object(Flavor, name=flavor)
+            if not flavor.deployments.filter(id=obj.id).exists():
+                self.info("Attached flavor %s to deployment %s" % (flavor, obj))
+                flavor.deployments.add(obj)
+                flavor.save()
+
+
         rolemap = ( ("tosca.relationships.AdminPrivilege", "admin"), )
         self.postprocess_privileges(DeploymentRole, DeploymentPrivilege, rolemap, obj, "deployment")
 
diff --git a/xos/tosca/resources/deploymentrole.py b/xos/tosca/resources/deploymentrole.py
new file mode 100644
index 0000000..4339026
--- /dev/null
+++ b/xos/tosca/resources/deploymentrole.py
@@ -0,0 +1,29 @@
+# note: this module named xossite.py instead of site.py due to conflict with
+#    /usr/lib/python2.7/site.py
+
+import os
+import pdb
+import sys
+import tempfile
+sys.path.append("/opt/tosca")
+from translator.toscalib.tosca_template import ToscaTemplate
+
+from core.models import User, Deployment, DeploymentRole
+
+from xosresource import XOSResource
+
+class XOSDeploymentRole(XOSResource):
+    provides = "tosca.nodes.DeploymentRole"
+    xos_model = DeploymentRole
+    name_field = "role"
+
+    def get_xos_args(self):
+        args = super(XOSDeploymentRole, self).get_xos_args()
+
+        return args
+
+    def delete(self, obj):
+        super(XOSDeploymentRole, self).delete(obj)
+
+
+
diff --git a/xos/tosca/resources/fabricservice.py b/xos/tosca/resources/fabricservice.py
new file mode 100644
index 0000000..0c9cfb4
--- /dev/null
+++ b/xos/tosca/resources/fabricservice.py
@@ -0,0 +1,16 @@
+import os
+import pdb
+import sys
+import tempfile
+sys.path.append("/opt/tosca")
+from translator.toscalib.tosca_template import ToscaTemplate
+
+from services.fabric.models import FabricService
+
+from service import XOSService
+
+class FabricService(XOSService):
+    provides = "tosca.nodes.FabricService"
+    xos_model = FabricService
+    copyin_props = ["view_url", "icon_url", "enabled", "published", "public_key", "versionNumber"]
+
diff --git a/xos/tosca/resources/flavor.py b/xos/tosca/resources/flavor.py
new file mode 100644
index 0000000..f61ccad
--- /dev/null
+++ b/xos/tosca/resources/flavor.py
@@ -0,0 +1,37 @@
+# note: this module named xossite.py instead of site.py due to conflict with
+#    /usr/lib/python2.7/site.py
+
+import os
+import pdb
+import sys
+import tempfile
+sys.path.append("/opt/tosca")
+from translator.toscalib.tosca_template import ToscaTemplate
+
+from core.models import User, Deployment, Flavor
+
+from xosresource import XOSResource
+
+class XOSFlavor(XOSResource):
+    provides = "tosca.nodes.Flavor"
+    xos_model = Flavor
+    copyin_props = ["flavor"]
+
+    def get_xos_args(self):
+        args = super(XOSFlavor, self).get_xos_args()
+
+        # Support the default where the OpenStack flavor is the same as the
+        # flavor name
+        if "flavor" not in args:
+            args["flavor"] = args["name"]
+
+        return args
+
+    def delete(self, obj):
+        if obj.instance_set.exists():
+            self.info("Flavor %s has active instances; skipping delete" % obj.name)
+            return
+        super(XOSFlavor, self).delete(obj)
+
+
+
diff --git a/xos/tosca/resources/network.py b/xos/tosca/resources/network.py
index 7b513c3..32e3fc1 100644
--- a/xos/tosca/resources/network.py
+++ b/xos/tosca/resources/network.py
@@ -6,7 +6,7 @@
 from translator.toscalib.tosca_template import ToscaTemplate
 import pdb
 
-from core.models import Slice,User,Network,NetworkTemplate,NetworkSlice
+from core.models import Slice,User,Network,NetworkTemplate,NetworkSlice,Service,Tenant
 
 from xosresource import XOSResource
 
@@ -35,7 +35,7 @@
                 if v:
                     args[prop] = v
         else:
-            # tosca.nodes.network.Netwrok is not as rich as an XOS network. So
+            # tosca.nodes.network.Network is not as rich as an XOS network. So
             # we have to manually fill in some defaults.
             args["permit_all_slices"] = True
 
@@ -54,6 +54,24 @@
                 ns = NetworkSlice(network = obj, slice=slice)
                 ns.save()
 
+        # this is really for vRouter
+        for provider_service_name in self.get_requirements("tosca.relationships.TenantOfService"):
+            provider_service = self.get_xos_object(Service, name=provider_service_name)
+
+            existing_tenancy = Tenant.objects.filter(provider_service = provider_service, subscriber_network = obj)
+            if existing_tenancy:
+                self.info("Tenancy relationship from %s to %s already exists" % (str(obj), str(provider_service)))
+            else:
+                from services.vrouter.models import VROUTER_KIND, VRouterService
+                if provider_service.kind == VROUTER_KIND:
+                    tenancy = VRouterService.objects.get(id=provider_service.id).get_tenant(address_pool_name="addresses_"+obj.name, subscriber_network=obj)
+                    tenancy.save()
+                    obj.subnet = tenancy.cidr
+                else:
+                    raise Exception("The only network tenancy relationships that are allowed are to vRouter services")
+
+                self.info("Created Tenancy relationship from %s to %s" % (str(obj), str(provider_service)))
+
 #        v = self.get_property("permitted_slices")
 #        if v:
 #            for slicename in v.split(","):
@@ -72,12 +90,21 @@
         if not xos_args.get("template", None):
             raise Exception("Must specify network template when creating network")
 
+        # XXX TODO: investigate using transaction.atomic instead of setting
+        #   no_sync and no_policy
+
         network = Network(**xos_args)
         network.caller = self.user
+        network.no_sync = True        # postprocess might set the cidr
+        network.no_policy = True
         network.save()
 
         self.postprocess(network)
 
+        network.no_sync = False
+        network.no_policy = False
+        network.save()
+
         self.info("Created Network '%s' owned by Slice '%s'" % (str(network), str(network.owner)))
 
     def delete(self, obj):
diff --git a/xos/tosca/resources/node.py b/xos/tosca/resources/node.py
index 99e756f..128aaed 100644
--- a/xos/tosca/resources/node.py
+++ b/xos/tosca/resources/node.py
@@ -14,7 +14,7 @@
     xos_model = Node
 
     def get_xos_args(self):
-        args = {"name": self.nodetemplate.name}
+        args = {"name": self.obj_name}
 
         site = None
         siteName = self.get_requirement("tosca.relationships.MemberOfSite", throw_exception=False)
@@ -44,9 +44,6 @@
             obj.save()
 
     def create(self):
-        nodetemplate = self.nodetemplate
-        sliceName = nodetemplate.name
-
         xos_args = self.get_xos_args()
 
         if not xos_args.get("site", None):
diff --git a/xos/tosca/resources/onosapp.py b/xos/tosca/resources/onosapp.py
index 321600d..dccc8db 100644
--- a/xos/tosca/resources/onosapp.py
+++ b/xos/tosca/resources/onosapp.py
@@ -33,7 +33,7 @@
 
     def get_existing_objs(self):
         objs = ONOSApp.get_tenant_objects().all()
-        objs = [x for x in objs if x.name == self.nodetemplate.name]
+        objs = [x for x in objs if x.name == self.obj_name]
         return objs
 
     def set_tenant_attr(self, obj, prop_name, value):
@@ -61,7 +61,8 @@
                 self.set_tenant_attr(obj, k, v)
             elif k.startswith("component_config"):
                 self.set_tenant_attr(obj, k, v)
+            elif k == "autogenerate":
+                self.set_tenant_attr(obj, k, v)
 
     def can_delete(self, obj):
         return super(XOSONOSApp, self).can_delete(obj)
-
diff --git a/xos/tosca/resources/originserver.py b/xos/tosca/resources/originserver.py
index 196ce2e..46cf87e 100644
--- a/xos/tosca/resources/originserver.py
+++ b/xos/tosca/resources/originserver.py
@@ -15,18 +15,18 @@
     name_field = "url"
     copyin_props = []
 
-    def nodetemplate_name_to_url(self):
-        url = self.nodetemplate.name
+    def obj_name_to_url(self):
+        url = self.obj_name
         if url.startswith("http_"):
             url = url[5:]
         return url
 
     def get_existing_objs(self):
-        url = self.nodetemplate_name_to_url()
+        url = self.obj_name_to_url()
         return self.xos_model.objects.filter(**{self.name_field: url})
 
     def get_xos_args(self):
-        url = self.nodetemplate_name_to_url()
+        url = self.obj_name_to_url()
         cp_name = self.get_requirement("tosca.relationships.MemberOfContentProvider", throw_exception=True)
         cp = self.get_xos_object(ContentProvider, name=cp_name)
         return {"url": url,
diff --git a/xos/tosca/resources/service.py b/xos/tosca/resources/service.py
index 247be08..5a57418 100644
--- a/xos/tosca/resources/service.py
+++ b/xos/tosca/resources/service.py
@@ -6,7 +6,7 @@
 from translator.toscalib.tosca_template import ToscaTemplate
 import pdb
 
-from core.models import Service,User,CoarseTenant
+from core.models import Service,User,CoarseTenant,AddressPool
 
 from xosresource import XOSResource
 
@@ -29,6 +29,11 @@
 
                 self.info("Created Tenancy relationship  from %s to %s" % (str(obj), str(provider_service)))
 
+        for ap_name in self.get_requirements("tosca.relationships.ProvidesAddresses"):
+            ap = self.get_xos_object(AddressPool, name=ap_name)
+            ap.service = obj
+            ap.save()
+
     def can_delete(self, obj):
         if obj.slices.exists():
             self.info("Service %s has active slices; skipping delete" % obj.name)
diff --git a/xos/tosca/resources/serviceprovider.py b/xos/tosca/resources/serviceprovider.py
index 8faec6c..2c9a167 100644
--- a/xos/tosca/resources/serviceprovider.py
+++ b/xos/tosca/resources/serviceprovider.py
@@ -17,7 +17,7 @@
     def get_xos_args(self):
         hpc_service_name = self.get_requirement("tosca.relationships.MemberOfService", throw_exception=True)
         hpc_service = self.get_xos_object(HpcService, name=hpc_service_name)
-        return {"name": self.nodetemplate.name,
+        return {"name": self.obj_name,
                 "hpcService": hpc_service}
 
     def can_delete(self, obj):
diff --git a/xos/tosca/resources/siterole.py b/xos/tosca/resources/siterole.py
new file mode 100644
index 0000000..abb1f0d
--- /dev/null
+++ b/xos/tosca/resources/siterole.py
@@ -0,0 +1,29 @@
+# note: this module named xossite.py instead of site.py due to conflict with
+#    /usr/lib/python2.7/site.py
+
+import os
+import pdb
+import sys
+import tempfile
+sys.path.append("/opt/tosca")
+from translator.toscalib.tosca_template import ToscaTemplate
+
+from core.models import User, Deployment, SiteRole
+
+from xosresource import XOSResource
+
+class XOSSiteRole(XOSResource):
+    provides = "tosca.nodes.SiteRole"
+    xos_model = SiteRole
+    name_field = "role"
+
+    def get_xos_args(self):
+        args = super(XOSSiteRole, self).get_xos_args()
+
+        return args
+
+    def delete(self, obj):
+        super(XOSSiteRole, self).delete(obj)
+
+
+
diff --git a/xos/tosca/resources/slice.py b/xos/tosca/resources/slice.py
index 48e5eb0..0add5ac 100644
--- a/xos/tosca/resources/slice.py
+++ b/xos/tosca/resources/slice.py
@@ -31,7 +31,7 @@
             default_image = self.get_xos_object(Image, name=default_image_name, throw_exception=True)
             args["default_image"] = default_image
 
-        default_flavor_name = self.get_property_default("default_flavor", None)
+        default_flavor_name = self.get_requirement("tosca.relationships.DefaultFlavor", throw_exception=False)
         if default_flavor_name:
             default_flavor = self.get_xos_object(Flavor, name=default_flavor_name, throw_exception=True)
             args["default_flavor"] = default_flavor
@@ -50,19 +50,6 @@
                     ("tosca.relationships.PIPrivilege", "pi"), ("tosca.relationships.TechPrivilege", "tech") )
         self.postprocess_privileges(SliceRole, SlicePrivilege, rolemap, obj, "slice")
 
-    def create(self):
-        nodetemplate = self.nodetemplate
-        sliceName = nodetemplate.name
-
-        xos_args = self.get_xos_args()
-        slice = Slice(**xos_args)
-        slice.caller = self.user
-        slice.save()
-
-        self.postprocess(slice)
-
-        self.info("Created Slice '%s' on Site '%s'" % (str(slice), str(slice.site)))
-
     def delete(self, obj):
         if obj.instances.exists():
             self.info("Slice %s has active instances; skipping delete" % obj.name)
diff --git a/xos/tosca/resources/slicerole.py b/xos/tosca/resources/slicerole.py
new file mode 100644
index 0000000..fc7d3f1
--- /dev/null
+++ b/xos/tosca/resources/slicerole.py
@@ -0,0 +1,29 @@
+# note: this module named xossite.py instead of site.py due to conflict with
+#    /usr/lib/python2.7/site.py
+
+import os
+import pdb
+import sys
+import tempfile
+sys.path.append("/opt/tosca")
+from translator.toscalib.tosca_template import ToscaTemplate
+
+from core.models import User, Deployment, SliceRole
+
+from xosresource import XOSResource
+
+class XOSSliceRole(XOSResource):
+    provides = "tosca.nodes.SliceRole"
+    xos_model = SliceRole
+    name_field = "role"
+
+    def get_xos_args(self):
+        args = super(XOSSliceRole, self).get_xos_args()
+
+        return args
+
+    def delete(self, obj):
+        super(XOSSliceRole, self).delete(obj)
+
+
+
diff --git a/xos/tosca/resources/tag.py b/xos/tosca/resources/tag.py
new file mode 100644
index 0000000..001cba8
--- /dev/null
+++ b/xos/tosca/resources/tag.py
@@ -0,0 +1,57 @@
+import importlib
+import os
+import sys
+import tempfile
+sys.path.append("/opt/tosca")
+from translator.toscalib.tosca_template import ToscaTemplate
+from django.contrib.contenttypes.models import ContentType
+
+from core.models import Tag, Service
+
+from xosresource import XOSResource
+
+class XOSTag(XOSResource):
+    provides = "tosca.nodes.Tag"
+    xos_model = Tag
+    name_field = None
+    copyin_props = ("name", "value")
+
+    def get_xos_args(self, throw_exception=True):
+        args = super(XOSTag, self).get_xos_args()
+
+        # Find the Tosca object that this Tag is pointing to, and return its
+        # content_type and object_id, which will be used in the GenericForeignKey
+        # django relation.
+
+        target_name = self.get_requirement("tosca.relationships.TagsObject", throw_exception=throw_exception)
+        if target_name:
+            target_model = self.engine.name_to_xos_model(self.user, target_name)
+            args["content_type"] = ContentType.objects.get_for_model(target_model)
+            args["object_id"] = target_model.id
+
+        service_name = self.get_requirement("tosca.relationships.MemberOfService", throw_exception=throw_exception)
+        if service_name:
+            args["service"] = self.get_xos_object(Service, name=service_name)
+
+        # To uniquely identify a Tag, we must know the object that it is attached
+        # to as well as the name of the Tag.
+
+        if ("content_type" not in args) or ("object_id" not in args) or ("name" not in args):
+           if throw_exception:
+               raise Exception("Tag must specify TagsObject requirement and Name property")
+
+        return args
+
+    def get_existing_objs(self):
+        args = self.get_xos_args(throw_exception=True)
+
+        return Tag.objects.filter(content_type=args["content_type"],
+                                  object_id=args["object_id"],
+                                  name=args["name"])
+
+    def postprocess(self, obj):
+        pass
+
+    def can_delete(self, obj):
+        return super(XOSTag, self).can_delete(obj)
+
diff --git a/xos/tosca/resources/tenantrole.py b/xos/tosca/resources/tenantrole.py
new file mode 100644
index 0000000..316a5a3
--- /dev/null
+++ b/xos/tosca/resources/tenantrole.py
@@ -0,0 +1,29 @@
+# note: this module named xossite.py instead of site.py due to conflict with
+#    /usr/lib/python2.7/site.py
+
+import os
+import pdb
+import sys
+import tempfile
+sys.path.append("/opt/tosca")
+from translator.toscalib.tosca_template import ToscaTemplate
+
+from core.models import User, Deployment, TenantRole
+
+from xosresource import XOSResource
+
+class XOSTenantRole(XOSResource):
+    provides = "tosca.nodes.TenantRole"
+    xos_model = TenantRole
+    name_field = "role"
+
+    def get_xos_args(self):
+        args = super(XOSTenantRole, self).get_xos_args()
+
+        return args
+
+    def delete(self, obj):
+        super(XOSTenantRole, self).delete(obj)
+
+
+
diff --git a/xos/tosca/resources/user.py b/xos/tosca/resources/user.py
index 8587c89..55c0423 100644
--- a/xos/tosca/resources/user.py
+++ b/xos/tosca/resources/user.py
@@ -25,7 +25,7 @@
         return args
 
     def get_existing_objs(self):
-        return self.xos_model.objects.filter(email = self.nodetemplate.name)
+        return self.xos_model.objects.filter(email = self.obj_name)
 
     def postprocess(self, obj):
         rolemap = ( ("tosca.relationships.AdminPrivilege", "admin"), ("tosca.relationships.AccessPrivilege", "access"),
@@ -62,12 +62,12 @@
                         udv.save()
 
     def create(self):
-        nodetemplate = self.nodetemplate
-
         xos_args = self.get_xos_args()
 
         if not xos_args.get("site",None):
              raise Exception("Site name must be specified when creating user")
+        if ("firstname" not in xos_args) or ("lastname" not in xos_args):
+             raise Exception("firstname and lastname must be specified when creating user")
 
         user = User(**xos_args)
         user.save()
diff --git a/xos/tosca/resources/vcpeservice.py b/xos/tosca/resources/vcpeservice.py
index 2a6a56d..972c13c 100644
--- a/xos/tosca/resources/vcpeservice.py
+++ b/xos/tosca/resources/vcpeservice.py
@@ -14,6 +14,5 @@
     xos_model = VSGService
     copyin_props = ["view_url", "icon_url", "enabled", "published", "public_key",
                     "private_key_fn", "versionNumber", "backend_network_label",
-                    "wan_container_gateway_ip", "wan_container_gateway_mac",
-                    "wan_container_netbits", "dns_servers", "node_label"]
+                    "dns_servers", "node_label"]
 
diff --git a/xos/tosca/resources/vrouterservice.py b/xos/tosca/resources/vrouterservice.py
new file mode 100644
index 0000000..14dabcc
--- /dev/null
+++ b/xos/tosca/resources/vrouterservice.py
@@ -0,0 +1,16 @@
+import os
+import pdb
+import sys
+import tempfile
+sys.path.append("/opt/tosca")
+from translator.toscalib.tosca_template import ToscaTemplate
+
+from services.vrouter.models import VRouterService
+
+from service import XOSService
+
+class XOSVRouterService(XOSService):
+    provides = "tosca.nodes.VRouterService"
+    xos_model = VRouterService
+    copyin_props = ["view_url", "icon_url", "enabled", "published", "public_key", "versionNumber"]
+
diff --git a/xos/tosca/resources/vtnservice.py b/xos/tosca/resources/vtnservice.py
new file mode 100644
index 0000000..2a5738f
--- /dev/null
+++ b/xos/tosca/resources/vtnservice.py
@@ -0,0 +1,15 @@
+import os
+import pdb
+import sys
+import tempfile
+sys.path.append("/opt/tosca")
+from translator.toscalib.tosca_template import ToscaTemplate
+
+from services.vtn.models import VTNService
+
+from service import XOSService
+
+class XOSVTNService(XOSService):
+    provides = "tosca.nodes.VTNService"
+    xos_model = VTNService
+    copyin_props = ["view_url", "icon_url", "enabled", "published", "public_key", "versionNumber", 'privateGatewayMac', 'localManagementIp', 'ovsdbPort', 'sshPort', 'sshUser', 'sshKeyFile', 'mgmtSubnetBits', 'xosEndpoint', 'xosUser', 'xosPassword']
diff --git a/xos/tosca/resources/xosresource.py b/xos/tosca/resources/xosresource.py
index cc4672b..82514c9 100644
--- a/xos/tosca/resources/xosresource.py
+++ b/xos/tosca/resources/xosresource.py
@@ -19,6 +19,17 @@
         self.nodetemplate = nodetemplate
         self.engine = engine
 
+    @property
+    def full_name(self):
+        return self.nodetemplate.name
+
+    @property
+    def obj_name(self):
+        if "#" in self.nodetemplate.name:
+            return self.nodetemplate.name.split("#",1)[1]
+        else:
+            return self.nodetemplate.name
+
     def get_all_required_node_names(self):
         results = []
         for reqs in self.nodetemplate.requirements:
@@ -38,7 +49,7 @@
                     results.append(v["node"])
 
         if (not results) and throw_exception:
-            raise Exception("Failed to find requirement in %s using relationship %s" % (self.nodetemplate.name, relationship_name))
+            raise Exception("Failed to find requirement in %s using relationship %s" % (self.full_name, relationship_name))
 
         return results
 
@@ -67,6 +78,11 @@
         return default
 
     def get_xos_object(self, cls, throw_exception=True, **kwargs):
+        # do the same parsing that we do for objname
+        for (k,v) in kwargs.items():
+            if (k=="name") and ("#" in v):
+                kwargs[k] = v.split("#",1)[1]
+
         objs = cls.objects.filter(**kwargs)
         if not objs:
             if throw_exception:
@@ -75,7 +91,7 @@
         return objs[0]
 
     def get_existing_objs(self):
-        return self.xos_model.objects.filter(**{self.name_field: self.nodetemplate.name})
+        return self.xos_model.objects.filter(**{self.name_field: self.obj_name})
 
     def get_model_class_name(self):
         return self.xos_model.__name__
@@ -84,19 +100,19 @@
         existing_objs = self.get_existing_objs()
         if existing_objs:
             if self.get_property_default("no-update", False):
-                self.info("%s %s already exists. Skipping update due to 'no-update' property" % (self.get_model_class_name(), self.nodetemplate.name))
+                self.info("%s:%s (%s) already exists. Skipping update due to 'no-update' property" % (self.get_model_class_name(), self.obj_name, self.full_name))
             else:
-                self.info("%s %s already exists" % (self.get_model_class_name(), self.nodetemplate.name))
+                self.info("%s:%s (%s) already exists" % (self.get_model_class_name(), self.obj_name, self.full_name))
                 self.update(existing_objs[0])
         else:
             if self.get_property_default("no-create", False):
-                self.info("%s %s does not exist, but 'no-create' is specified" % (self.get_model_class_name(), self.nodetemplate.name))
+                self.info("%s:%s (%s) does not exist, but 'no-create' is specified" % (self.get_model_class_name(), self.obj_name, self.full_name))
             else:
                 self.create()
 
     def can_delete(self, obj):
         if self.get_property_default("no-delete",False):
-            self.info("%s %s is marked 'no-delete'. Skipping delete." % (self.get_model_class_name(), self.nodetemplate.name))
+            self.info("%s:%s %s is marked 'no-delete'. Skipping delete." % (self.get_model_class_name(), self.obj_name, self.full_name))
             return False
         return True
 
@@ -170,7 +186,7 @@
         args = {}
 
         if self.name_field:
-            args[self.name_field] = self.nodetemplate.name
+            args[self.name_field] = self.obj_name
 
         # copy simple string properties from the template into the arguments
         for prop in self.copyin_props:
@@ -186,7 +202,8 @@
     def create(self):
         xos_args = self.get_xos_args()
         xos_obj = self.xos_model(**xos_args)
-        xos_obj.caller = self.user
+        if self.user:
+            xos_obj.caller = self.user
         xos_obj.save()
 
         self.info("Created %s '%s'" % (self.xos_model.__name__,str(xos_obj)))
diff --git a/xos/tosca/resources/xossite.py b/xos/tosca/resources/xossite.py
index 0db2705..9b03bc5 100644
--- a/xos/tosca/resources/xossite.py
+++ b/xos/tosca/resources/xossite.py
@@ -19,9 +19,9 @@
     def get_xos_args(self):
         display_name = self.get_property("display_name")
         if not display_name:
-            display_name = self.nodetemplate.name
+            display_name = self.obj_name
 
-        args = {"login_base": self.nodetemplate.name,
+        args = {"login_base": self.obj_name,
                 "name": display_name}
 
         # copy simple string properties from the template into the arguments
@@ -33,7 +33,7 @@
         return args
 
     def get_existing_objs(self):
-        return self.xos_model.objects.filter(login_base = self.nodetemplate.name)
+        return self.xos_model.objects.filter(login_base = self.obj_name)
 
     def postprocess(self, obj):
         results = []
@@ -44,19 +44,20 @@
                     deployment = self.get_xos_object(Deployment, name=deployment_name)
 
                     controller_name = None
-                    for sd_req in v["requirements"]:
+                    for sd_req in v.get("requirements", []):
                         for (sd_req_k, sd_req_v) in sd_req.items():
                             if sd_req_v["relationship"] == "tosca.relationships.UsesController":
                                 controller_name = sd_req_v["node"]
-                    if not controller_name:
-                        raise Exception("Controller must be specified in SiteDeployment relationship")
-
-                    controller = self.get_xos_object(Controller, name=controller_name, throw_exception=True)
+                    if controller_name:
+                        controller = self.get_xos_object(Controller, name=controller_name, throw_exception=True)
+                    else:
+                        controller = None
+                        # raise Exception("Controller must be specified in SiteDeployment relationship")
 
                     existing_sitedeps = SiteDeployment.objects.filter(deployment=deployment, site=obj)
                     if existing_sitedeps:
                         sd = existing_sitedeps[0]
-                        if sd.controller != controller:
+                        if (sd.controller != controller) and (controller != None):
                             sd.controller = controller
                             sd.save()
                             self.info("SiteDeployment from %s to %s updated controller" % (str(obj), str(deployment)))
@@ -67,20 +68,6 @@
                         sitedep.save()
                         self.info("Created SiteDeployment from %s to %s" % (str(obj), str(deployment)))
 
-    def create(self):
-        nodetemplate = self.nodetemplate
-        siteName = nodetemplate.name
-
-        xos_args = self.get_xos_args()
-
-        site = Site(**xos_args)
-        site.caller = self.user
-        site.save()
-
-        self.postprocess(site)
-
-        self.info("Created Site '%s'" % (str(site), ))
-
     def delete(self, obj):
         if obj.slices.exists():
             self.info("Site %s has active slices; skipping delete" % obj.name)
diff --git a/xos/tosca/run.py b/xos/tosca/run.py
index 591582b..58dc22b 100644
--- a/xos/tosca/run.py
+++ b/xos/tosca/run.py
@@ -25,7 +25,10 @@
     username = sys.argv[1]
     template_name = sys.argv[2]
 
-    u = User.objects.get(email=username)
+    if username.lower()=="none":
+        u=None
+    else:
+        u = User.objects.get(email=username)
 
     xt = XOSTosca(file(template_name).read(), parent_dir=currentdir, log_to_console=True)
     xt.execute(u)
diff --git a/xos/tosca/samples/helloworld-chain.yaml b/xos/tosca/samples/helloworld-chain.yaml
deleted file mode 100644
index 8b49106..0000000
--- a/xos/tosca/samples/helloworld-chain.yaml
+++ /dev/null
@@ -1,76 +0,0 @@
-tosca_definitions_version: tosca_simple_yaml_1_0
-
-description: Two services "service_one" and "service_two" with a tenancy relationship.
-
-imports:
-   - custom_types/xos.yaml
-
-topology_template:
-  node_templates:
-
-    Private-Indirect:
-      type: tosca.nodes.NetworkTemplate
-      properties:
-          access: indirect
-
-    mysite:
-      type: tosca.nodes.Site
-
-    trusty-server-multi-nic:
-      type: tosca.nodes.Image
-
-    service_vsg:
-      type: tosca.nodes.VSGService
-      requirements:
-          - helloworld_tenant:
-              node: service_helloworld
-              relationship: tosca.relationships.TenantOfService
-
-    service_helloworld:
-      type: tosca.nodes.Service
-      properties:
-          kind: helloworldservice_complete
-          view_url: /admin/helloworldservice_complete/helloworldservicecomplete/$id$/
-
-    tenant_helloworld:
-       type: tosca.nodes.Tenant
-       properties:
-           kind: helloworldservice_complete
-           service_specific_attribute: "{\"display_message\": \"Hello World from Tosca\"}"
-           model: services.helloworldservice_complete.models.HelloWorldTenantComplete
-       requirements:
-           - provider_service:
-               node: service_helloworld
-               relationship: tosca.relationships.MemberOfService
-
-
-    mysite_helloworld:
-      type: tosca.nodes.Slice
-      requirements:
-          - service:
-              node: service_helloworld
-              relationship: tosca.relationships.MemberOfService
-          - site:
-              node: mysite
-              relationship: tosca.relationships.MemberOfSite
-          - default_image:
-                node: trusty-server-multi-nic
-                relationship: tosca.relationships.DefaultImage
-      properties:
-          default_flavor: m1.small
-
-    helloworld_access:
-      type: tosca.nodes.network.Network
-      properties:
-          ip_version: 4
-      requirements:
-          - network_template:
-              node: Private-Indirect
-              relationship: tosca.relationships.UsesNetworkTemplate
-          - owner:
-              node: mysite_helloworld
-              relationship: tosca.relationships.MemberOfSlice
-          - connection:
-              node: mysite_helloworld
-              relationship: tosca.relationships.ConnectsToSlice
-
diff --git a/xos/tosca/samples/slice_default_image.yaml b/xos/tosca/samples/slice_default_image.yaml
index 91b95c7..ff63373 100644
--- a/xos/tosca/samples/slice_default_image.yaml
+++ b/xos/tosca/samples/slice_default_image.yaml
@@ -16,6 +16,9 @@
     trusty-server-multi-nic:
       type: tosca.nodes.Image
 
+    m1.small:
+      type: tosca.nodes.Flavor
+
     mysite_test1:
       type: tosca.nodes.Slice
       requirements:
@@ -25,6 +28,6 @@
           - default_image:
                 node: trusty-server-multi-nic
                 relationship: tosca.relationships.DefaultImage
-      properties:
-          default_flavor: m1.small
-
+          -default_flavor:
+                node: m1.small
+                relationship: tosca.relationships.DefaultFlavor
diff --git a/xos/tosca/samples/slicetag.yaml b/xos/tosca/samples/slicetag.yaml
new file mode 100644
index 0000000..ec064e3
--- /dev/null
+++ b/xos/tosca/samples/slicetag.yaml
@@ -0,0 +1,35 @@
+tosca_definitions_version: tosca_simple_yaml_1_0
+
+description: Setup CORD-related services -- vOLT, vCPE, vBNG.
+
+imports:
+   - custom_types/xos.yaml
+
+topology_template:
+  node_templates:
+    mysite_vsg:
+      type: tosca.nodes.Slice
+      properties:
+          no-create: True
+          no-delete: True
+          no-update: True
+
+    service_vsg:
+      type: tosca.nodes.Service
+      properties:
+          no-create: True
+          no-delete: True
+          no-update: True
+
+    mysite_vsg_foobar_tag:
+      type: tosca.nodes.Tag
+      properties:
+          name: foobar
+          value: xyz
+      requirements:
+          - target:
+              node: mysite_vsg
+              relationship: tosca.relationships.TagsObject
+          - service:
+              node: service_vsg
+              relationship: tosca.relationships.MemberOfService
diff --git a/xos/tosca/samples/vtn-service-chain.yaml b/xos/tosca/samples/vtn-service-chain.yaml
new file mode 100644
index 0000000..51933d6
--- /dev/null
+++ b/xos/tosca/samples/vtn-service-chain.yaml
@@ -0,0 +1,157 @@
+tosca_definitions_version: tosca_simple_yaml_1_0
+
+description: Two services "service_one" and "service_two" with a tenancy relationship.
+
+imports:
+   - custom_types/xos.yaml
+
+topology_template:
+  node_templates:
+
+    Private-Indirect:
+      type: tosca.nodes.NetworkTemplate
+      properties:
+          access: indirect
+
+    management:
+      type: tosca.nodes.network.Network.XOS
+      properties:
+          no-create: true
+          no-delete: true
+          no-update: true
+
+    mysite:
+      type: tosca.nodes.Site
+
+    trusty-server-multi-nic:
+      type: tosca.nodes.Image
+
+    service_vsg:
+      type: tosca.nodes.VSGService
+      requirements:
+          - one_tenant:
+              node: service_one
+              relationship: tosca.relationships.TenantOfService
+      properties:
+          no-create: true
+          no-delete: true
+
+    service_one:
+      type: tosca.nodes.Service
+      requirements:
+          - two_tenant:
+              node: service_two
+              relationship: tosca.relationships.TenantOfService
+      properties:
+          kind: one
+
+    service_two:
+      type: tosca.nodes.Service
+      properties:
+          kind: two
+
+    mysite_one:
+      type: tosca.nodes.Slice
+      properties:
+          network: noauto
+      requirements:
+          - service:
+              node: service_one
+              relationship: tosca.relationships.MemberOfService
+          - site:
+              node: mysite
+              relationship: tosca.relationships.MemberOfSite
+          - management:
+              node: management
+              relationship: tosca.relationships.ConnectsToNetwork
+
+    mysite_two:
+      type: tosca.nodes.Slice
+      properties:
+          network: noauto
+      requirements:
+          - service:
+              node: service_two
+              relationship: tosca.relationships.MemberOfService
+          - site:
+              node: mysite
+              relationship: tosca.relationships.MemberOfSite
+          - management:
+              node: management
+              relationship: tosca.relationships.ConnectsToNetwork
+
+    one_access:
+      type: tosca.nodes.network.Network
+      properties:
+          ip_version: 4
+      requirements:
+          - network_template:
+              node: Private-Indirect
+              relationship: tosca.relationships.UsesNetworkTemplate
+          - owner:
+              node: mysite_one
+              relationship: tosca.relationships.MemberOfSlice
+          - connection:
+              node: mysite_one
+              relationship: tosca.relationships.ConnectsToSlice
+
+    two_access:
+      type: tosca.nodes.network.Network
+      properties:
+          ip_version: 4
+      requirements:
+          - network_template:
+              node: Private-Indirect
+              relationship: tosca.relationships.UsesNetworkTemplate
+          - owner:
+              node: mysite_two
+              relationship: tosca.relationships.MemberOfSlice
+          - connection:
+              node: mysite_two
+              relationship: tosca.relationships.ConnectsToSlice
+
+    # Virtual machines
+    one_instance:
+      type: tosca.nodes.Compute
+      capabilities:
+        # Host container properties
+        host:
+         properties:
+           num_cpus: 1
+           disk_size: 10 GB
+           mem_size: 4 MB
+        # Guest Operating System properties
+        os:
+          properties:
+            # host Operating System image properties
+            architecture: x86_64
+            type: linux
+            distribution: Ubuntu
+            version: 14.10
+      requirements:
+          - slice:
+                node: mysite_one
+                relationship: tosca.relationships.MemberOfSlice
+
+    # Virtual machines
+    two_instance:
+      type: tosca.nodes.Compute
+      capabilities:
+        # Host container properties
+        host:
+         properties:
+           num_cpus: 1
+           disk_size: 10 GB
+           mem_size: 4 MB
+        # Guest Operating System properties
+        os:
+          properties:
+            # host Operating System image properties
+            architecture: x86_64
+            type: linux
+            distribution: Ubuntu
+            version: 14.10
+      requirements:
+          - slice:
+                node: mysite_two
+                relationship: tosca.relationships.MemberOfSlice
diff --git a/xos/xos/settings.py b/xos/xos/settings.py
index aa50e7d..0343adc 100644
--- a/xos/xos/settings.py
+++ b/xos/xos/settings.py
@@ -175,12 +175,15 @@
     'core',
     'services.hpc',
     'services.cord',
-    'services.helloworldservice_complete',
     'services.onos',
     'services.ceilometer',
     'services.requestrouter',
     'services.syndicate_storage',
+    'services.openvpn',
     'services.vtr',
+    'services.vrouter',
+    'services.vtn',
+    'services.fabric',
     'geoposition',
     'rest_framework_swagger',
 )
diff --git a/xos/xos/urls.py b/xos/xos/urls.py
index 1bc3885..570b768 100644
--- a/xos/xos/urls.py
+++ b/xos/xos/urls.py
@@ -9,7 +9,6 @@
 
 from core.views.legacyapi import LegacyXMLRPC
 from core.views.serviceGraph import ServiceGridView, ServiceGraphView
-from services.helloworld.view import *
 from core.models import *
 from rest_framework import generics
 from core.dashboard.sites import SitePlus
@@ -27,7 +26,6 @@
 urlpatterns = patterns('',
     # Examples:
     url(r'^observer', 'core.views.observer.Observer', name='observer'),
-    url(r'^helloworld', HelloWorldView.as_view(), name='helloWorld'),
     url(r'^serviceGrid', ServiceGridView.as_view(), name='serviceGrid'),
     url(r'^serviceGraph.png', ServiceGraphView.as_view(), name='serviceGraph'),
     url(r'^hpcConfig', 'core.views.hpc_config.HpcConfig', name='hpcConfig'),
diff --git a/xos/xos/wsgi.py b/xos/xos/wsgi.py
index 9b70770..55c6c1a 100644
--- a/xos/xos/wsgi.py
+++ b/xos/xos/wsgi.py
@@ -28,5 +28,3 @@
 application = get_wsgi_application()
 
 # Apply WSGI middleware here.
-# from helloworld.wsgi import HelloWorldApplication
-# application = HelloWorldApplication(application)
diff --git a/xos/xos/xml_util.py b/xos/xos/xml_util.py
index d3aefb1..77b968f 100644
--- a/xos/xos/xml_util.py
+++ b/xos/xos/xml_util.py
@@ -113,8 +113,8 @@
         specified root_node if specified, otherwise start at tree's root.
         """
 
-        if not element_name.startswith('//'):
-            element_name = '//' + element_name
+        if not name.startswith('//'):
+            name = '//' + name 
         elements = self.element.xpath('%s ' % name, namespaces=self.namespaces)
         for element in elements:
             parent = element.getparent()