anchor.diff:  
   . moves the host side of the pod's veth interface pair from the *lbr0* bridge
   (where Docker placed it when starting the container) to the OVS bridge *br0*.
  -. adds OpenFlow rules to the OVS database to route traffic addressed
  -to the new pod to the correct OVS port.
  -. in the case of the *multitenant* plugin, it also adds OpenFlow rules to tag
  -traffic coming from the pod with the pod's VNID, and to allow traffic into the
  -pod if the traffic's VNID matches the pod's VNID (or is the privileged VNID
  -0). (Non-matching traffic is filtered out by a generic rule.)
  +. adds OpenFlow rules to the OVS database to route traffic addressed to the new
  +pod to the correct OVS port.
  +ifdef::openshift-origin[]
  +. in the case of the *multitenant* plug-in, adds OpenFlow rules to tag traffic
  +coming from the pod with the pod's VNID, and to allow traffic into the pod if
  +the traffic's VNID matches the pod's VNID (or is the privileged VNID 0).
  +(Non-matching traffic is filtered out by a generic rule.)
  +endif::[]
   
   The pod is allocated an IP address in the cluster subnet by Docker itself
  -because Docker is told to use the *lbr0* bridge, which OpenShift SDN has assigned
  -the cluster gateway address (eg. 10.1.x.1/24).  Note that the *tun0* is also
  -assigned the cluster gateway IP address because it is the default gateway for all
  -traffic destined for external networks, but these two interfaces do not
  -conflict because the *lbr0* interface is only used for IPAM and no OpenShift
  -SDN pods are connected to it.
  +because Docker is told to use the *lbr0* bridge, which OpenShift SDN has
  +assigned the cluster gateway address (eg. 10.1.x.1/24). Note that the *tun0* is
  +also assigned the cluster gateway IP address because it is the default gateway
  +for all traffic destined for external networks, but these two interfaces do not
  +conflict because the *lbr0* interface is only used for IPAM and no OpenShift SDN
  +pods are connected to it.
   
   OpenShift SDN nodes also watch for subnet updates from the SDN master. When a new
   subnet is added, the node adds OpenFlow rules on *br0* so that packets with a
   destination IP address the remote subnet go to *vxlan0* (port 1 on *br0*) and thus
  -out onto the network. The *ovssubnet* plugin sends all packets across the VXLAN
  -with VNID 0, but the *multitenant* plugin uses the appropriate VNID for the
  -source container.
  -
  -==== Packet Flow
  +out onto the network.
  +ifdef::openshift-origin[]
  +The *ovssubnet* plug-in sends all packets across the VXLAN with VNID 0, but the
  +*multitenant* plug-in uses the appropriate VNID for the source container.
  +endif::[]
  +
  +=== Packet Flow
   
   Suppose we have two containers A and B where the peer virtual Ethernet device
   for container A's *eth0* is named *vethA* and the peer for container B's *eth0*
  
positive.code: *_eth0_* _(in A's netns) -> *vethA* -> *br0* -> *tun0* -> (NAT) -> *eth0* (physical device) -> Internet_
  
  Almost all packet delivery decisions are performed with OpenFlow rules in the
  OVS bridge *br0*.  This simplifies the network architecture of the multitenant
  plugin and provides flexible routing and (in the case of the *multitenant*
  plugin) enforceable network isolation.
  
  ==== Network Isolation With the multitenant Plugin
  
  When using the *multitenant* plugin, when a packet exits a pod assigned to a
  non-default project, the OVS bridge *br0* tags that packet with the project's
  assigned VNID.  If the packet is directed to another IP address in the node's
  cluster subnet, the OVS bridge only allows the packet to be delivered to the
  destination pod if the VNIDs match.
  
  
negative.code: 
  As described before, VNID 0 is privileged in that traffic with any VNID is
  allowed to enter any pod assigned VNID 0, and traffic with VNID 0 is allowed to
  enter any pod. Only the *default* OpenShift project is assigned VNID 0; all
  other projects are assigned unique, isolation-enabled VNIDs.
  endif::[]
  
  === External Access to the Cluster Network
  
  If a host that is external to OpenShift requires access to the cluster network,
  you have two options:
  