12 files changed, 122 insertions, 75 deletions
diff --git a/doc/source/adminguide/index.rst b/doc/source/adminguide/index.rst
index 51228b3191..736a154b21 100644
--- a/doc/source/adminguide/index.rst
+++ b/doc/source/adminguide/index.rst
@@ -38,14 +38,14 @@ There are two main tools that a system administrator will find useful to manage
    nova.manage
    euca2ools
 
-nova-manage may only be run by users with admin priviledges.  euca2ools can be used by all users, though specific commands may be restricted by Role Based Access Control.  You can read more about creating and managing users in :doc:`managing.users`
+The nova-manage command may only be run by users with admin priviledges.  Commands for euca2ools can be used by all users, though specific commands may be restricted by Role Based Access Control.  You can read more about creating and managing users in :doc:`managing.users`
 
 User and Resource Management
 ----------------------------
 
-nova-manage and euca2ools provide the basic interface to perform a broad range of administration functions.  In this section, you can read more about how to accomplish specific administration tasks.  
+The nova-manage and euca2ools commands provide the basic interface to perform a broad range of administration functions.  In this section, you can read more about how to accomplish specific administration tasks.  
 
-For background on the core objects refenced in this section, see :doc:`../object.model`
+For background on the core objects referenced in this section, see :doc:`../object.model`
 
 .. toctree::
    :maxdepth: 1
diff --git a/doc/source/adminguide/managing.networks.rst b/doc/source/adminguide/managing.networks.rst
index c8df471e84..38c1cba78e 100644
--- a/doc/source/adminguide/managing.networks.rst
+++ b/doc/source/adminguide/managing.networks.rst
@@ -20,25 +20,10 @@ Networking Overview
 ===================
 In Nova, users organize their cloud resources in projects. A Nova project consists of a number of VM instances created by a user. For each VM instance, Nova assigns to it a private IP address. (Currently, Nova only supports Linux bridge networking that allows the virtual interfaces to connect to the outside network through the physical interface. Other virtual network technologies, such as Open vSwitch, could be supported in the future.) The Network Controller provides virtual networks to enable compute servers to interact with each other and with the public network.
 
-..
-    (perhaps some of this should be moved elsewhere)
-    Introduction
-    ------------
-
-    Nova consists of seven main components, with the Cloud Controller component representing the global state and interacting with all other components. API Server acts as the Web services front end for the cloud controller. Compute Controller provides compute server resources, and the Object Store component provides storage services. Auth Manager provides authentication and authorization services. Volume Controller provides fast and permanent block-level storage for the comput servers. Network Controller provides virtual networks to enable compute servers to interact with each other and with the public network. Scheduler selects the most suitable compute controller to host an instance.
-
-    .. todo:: Insert Figure 1 image from "An OpenStack Network Overview" contributed by Citrix
-
-    Nova is built on a shared-nothing, messaging-based architecture. All of the major components, that is Compute Controller, Volume Controller, Network Controller, and Object Store can be run on multiple servers. Cloud Controller communicates with Object Store via HTTP (Hyper Text Transfer Protocol), but it communicates with Scheduler, Network Controller, and Volume Controller via AMQP (Advanced Message Queue Protocol). To avoid blocking each component while waiting for a response, Nova uses asynchronous calls, with a call-back that gets triggered when a response is received.
-
-    To achieve the shared-nothing property with multiple copies of the same component, Nova keeps all the cloud system state in a distributed data store. Updates to system state are written into this store, using atomic transactions when required. Requests for system state are read out of this store. In limited cases, the read results are cached within controllers for short periods of time (for example, the current list of system users.) 
-
-    .. note:: The database schema is available on the `OpenStack Wiki <http://wiki.openstack.org/NovaDatabaseSchema>_`. 
-
 Nova Network Strategies
 -----------------------
 
-Currently, Nova supports three kinds of networks, implemented in three "Network Manager" types respectively: Flat Network Manager, Flat DHCP Network Manager, and VLAN Network Manager. The three kinds of networks can c-exist in a cloud system. However, the scheduler for selecting the type of network for a given project is not yet implemented. Here is a brief description of each of the different network strategies, with a focus on the VLAN Manager in a separate section. 
+Currently, Nova supports three kinds of networks, implemented in three "Network Manager" types respectively: Flat Network Manager, Flat DHCP Network Manager, and VLAN Network Manager. The three kinds of networks can co-exist in a cloud system. However, the scheduler for selecting the type of network for a given project is not yet implemented. Here is a brief description of each of the different network strategies, with a focus on the VLAN Manager in a separate section. 
 
 Read more about Nova network strategies here:
 
diff --git a/doc/source/adminguide/multi.node.install.rst b/doc/source/adminguide/multi.node.install.rst
index dcceb539bf..fcb76c5e53 100644
--- a/doc/source/adminguide/multi.node.install.rst
+++ b/doc/source/adminguide/multi.node.install.rst
@@ -19,7 +19,7 @@ Installing Nova on Multiple Servers
 ===================================
 
 When you move beyond evaluating the technology and into building an actual
-production environemnt, you will need to know how to configure your datacenter
+production environment, you will need to know how to configure your datacenter
 and how to deploy components across your clusters.  This guide should help you
 through that process.
 
@@ -35,7 +35,6 @@ Requirements for a multi-node installation
 * For a recommended HA setup, consider a MySQL master/slave replication, with as many slaves as you like, and probably a heartbeat to kick one of the slaves into being a master if it dies.
 * For performance optimization, split reads and writes to the database. MySQL proxy is the easiest way to make this work if running MySQL.
 
-
 Assumptions
 ^^^^^^^^^^^
 
@@ -69,14 +68,14 @@ Step 1 Use apt-get to get the latest code
 
 It is highly likely that there will be errors when the nova services come up since they are not yet configured. Don't worry, you're only at step 1!
 
-Step 2 Setup configuration files (installed in /etc/nova)
+Step 2 Setup configuration file (installed in /etc/nova)
 ---------------------------------------------------------
 
 Note: CC_ADDR=<the external IP address of your cloud controller>
 
-1. These need to be defined in EACH configuration file
+Nova development has consolidated all .conf files to nova.conf as of November 2010. References to specific .conf files may be ignored.
 
-::
+#. These need to be defined in the nova.conf configuration file::
 
    --sql_connection=mysql://root:nova@$CC_ADDR/nova # location of nova sql db
    --s3_host=$CC_ADDR  # This is where nova is hosting the objectstore service, which
@@ -87,31 +86,14 @@ Note: CC_ADDR=<the external IP address of your cloud controller>
    --ec2_url=http://$CC_ADDR:8773/services/Cloud
    --network_manager=nova.network.manager.FlatManager # simple, no-vlan networking type
 
-
-2. nova-manage specific flags
-
-::
-
-   --fixed_range=<network/prefix>   # ip network to use for VM guests, ex 192.168.2.64/26
-   --network_size=<# of addrs>      # number of ip addrs to use for VM guests, ex 64
-
-
-3. nova-network specific flags
-
-::
-
    --fixed_range=<network/prefix>   # ip network to use for VM guests, ex 192.168.2.64/26
    --network_size=<# of addrs>      # number of ip addrs to use for VM guests, ex 64
 
-4. Create a nova group
-
-::
+#. Create a nova group::
 
    sudo addgroup nova
 
-5. nova-objectstore specific flags < no specific config needed >
-
-Config files should be have their owner set to root:nova, and mode set to 0640, since they contain your MySQL server's root password.
+The Nova config file should have its owner set to root:nova, and mode set to 0640, since they contain your MySQL server's root password.
 
 ::
 
@@ -121,7 +103,7 @@ Config files should be have their owner set to root:nova, and mode set to 0640,
 Step 3 Setup the sql db
 -----------------------
 
-1. First you 'preseed' (using vishy's :doc:`../quickstart`). Run this as root.
+1. First you 'preseed' (using the Quick Start method :doc:`../quickstart`). Run this as root.
 
 ::
 
@@ -161,7 +143,7 @@ Step 3 Setup the sql db
    GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
    SET PASSWORD FOR 'root'@'%' = PASSWORD('nova');
 
-7. branch and install Nova
+7. Branch and install Nova
 
 ::
 
@@ -186,9 +168,7 @@ Step 4 Setup Nova environment
 
 Note: The nova-manage service assumes that the first IP address is your network (like 192.168.0.0), that the 2nd IP is your gateway (192.168.0.1), and that the broadcast is the very last IP in the range you defined (192.168.0.255). If this is not the case you will need to manually edit the sql db 'networks' table.o.
 
-On running this command, entries are made in the 'networks' and 'fixed_ips' table. However, one of the networks listed in the 'networks' table needs to be marked as bridge in order for the code to know that a bridge exists. We ended up doing this manually, (update query fired directly in the DB). Is there a better way to mark a network as bridged?
-
-Update: This has been resolved w.e.f 27/10. network is marked as bridged automatically based on the type of n/w manager selected.
+On running this command, entries are made in the 'networks' and 'fixed_ips' table. However, one of the networks listed in the 'networks' table needs to be marked as bridge in order for the code to know that a bridge exists. The Network is marked as bridged automatically based on the type of network manager selected.
 
 More networking details to create a network bridge for flat network
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
@@ -233,7 +213,6 @@ unzip them in your home directory, and add them to your environment::
    echo ". creds/novarc" >> ~/.bashrc
    ~/.bashrc
 
-
 Step 6 Restart all relevant services
 ------------------------------------
 
@@ -249,8 +228,8 @@ Restart relevant nova services::
 
 .. todo:: do we still need the content below?
 
-Bare-metal Provisioning
------------------------
+Bare-metal Provisioning Notes
+-----------------------------
 
 To install the base operating system you can use PXE booting.
 
diff --git a/doc/source/adminguide/network.vlan.rst b/doc/source/adminguide/network.vlan.rst
index 5bbc54bed5..c6c4e7f91e 100644
--- a/doc/source/adminguide/network.vlan.rst
+++ b/doc/source/adminguide/network.vlan.rst
@@ -50,7 +50,7 @@ The following diagram illustrates how the communication that occurs between the
 Goals
 -----
 
-* each project is in a protected network segment
+For our implementation of Nova, our goal is that each project is in a protected network segment. Here are the specifications we keep in mind for meeting this goal.
 
   * RFC-1918 IP space
   * public IP via NAT
@@ -59,19 +59,19 @@ Goals
   * limited (project-admin controllable) access to other project segments
   * all connectivity to instance and cloud API is via VPN into the project segment
 
-* common DMZ segment for support services (only visible from project segment)
+We also keep as a goal a common DMZ segment for support services, meaning these items are only visible from project segment:
 
   * metadata
   * dashboard
 
-
 Limitations
 -----------
 
+We kept in mind some of these limitations: 
+
 * Projects / cluster limited to available VLANs in switching infrastructure
 * Requires VPN for access to project segment
 
-
 Implementation
 --------------
 Currently Nova segregates project VLANs using 802.1q VLAN tagging in the 
diff --git a/doc/source/adminguide/single.node.install.rst b/doc/source/adminguide/single.node.install.rst
index 27597962aa..8572c5a4a5 100644
--- a/doc/source/adminguide/single.node.install.rst
+++ b/doc/source/adminguide/single.node.install.rst
@@ -9,7 +9,7 @@ The fastest way to get a test cloud running is through our :doc:`../quickstart`.
 Step 1 and 2: Get the latest Nova code system software
 ------------------------------------------------------
 
-Depending on your system, the mehod for accomplishing this varies
+Depending on your system, the method for accomplishing this varies
 
 .. toctree::
    :maxdepth: 1
@@ -63,8 +63,20 @@ You see an access key and a secret key export, such as these made-up ones:::
     export EC2_ACCESS_KEY=4e6498a2-blah-blah-blah-17d1333t97fd
     export EC2_SECRET_KEY=0a520304-blah-blah-blah-340sp34k05bbe9a7
 
+Step 5: Create the network 
+--------------------------
+
+Type or copy/paste in the following line to create a network prior to creating a project. 
+
+::
+
+    sudo nova-manage network create 10.0.0.0/8 1 64
+
+For this command, the IP address is the cidr notation for your netmask, such as 192.168.1.0/24. The value 1 is the total number of networks you want made, and the 64 value is the total number of ips in all networks.
+
+After running this command, entries are made in the 'networks' and 'fixed_ips' table in the database.
 
-Step 5: Create a project with the user you created
+Step 6: Create a project with the user you created
 --------------------------------------------------
 Type or copy/paste in the following line to create a project named IRT (for Ice Road Truckers, of course) with the newly-created user named anne.
 
@@ -94,7 +106,7 @@ Type or copy/paste in the following line to create a project named IRT (for Ice
     Data Base Updated
 
 
-Step 6: Unzip the nova.zip
+Step 7: Unzip the nova.zip
 --------------------------
 
 You should have a nova.zip file in your current working directory. Unzip it with this command:
@@ -116,7 +128,7 @@ You'll see these files extract.
      extracting: cacert.pem
 
 
-Step 7: Source the rc file
+Step 8: Source the rc file
 --------------------------
 Type or copy/paste the following to source the novarc file in your current working directory.
 
@@ -125,9 +137,9 @@ Type or copy/paste the following to source the novarc file in your current worki
     . novarc
 
 
-Step 8: Pat yourself on the back :)
+Step 9: Pat yourself on the back :)
 -----------------------------------
-Congratulations, your cloud is up and running, you’ve created an admin user, retrieved the user's credentials and put them in your environment.
+Congratulations, your cloud is up and running, you’ve created an admin user, created a network, retrieved the user's credentials and put them in your environment.
 
 Now you need an image.
 
diff --git a/doc/source/cloud101.rst b/doc/source/cloud101.rst
index 87db5af1eb..7c79d2a70f 100644
--- a/doc/source/cloud101.rst
+++ b/doc/source/cloud101.rst
@@ -54,6 +54,8 @@ Cloud computing offers different service models depending on the capabilities a
 The US-based National Institute of Standards and Technology offers definitions for cloud computing
 and the service models that are emerging. 
 
+These definitions are summarized from http://csrc.nist.gov/groups/SNS/cloud-computing/.
+
 SaaS - Software as a Service
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -72,12 +74,15 @@ IaaS - Infrastructure as a Service
 Provides infrastructure such as computer instances, network connections, and storage so that people 
 can run any software or operating system.
 
-.. todo:: Use definitions from http://csrc.nist.gov/groups/SNS/cloud-computing/ and attribute NIST
 
 Types of Cloud Deployments
 --------------------------
-.. todo:: describe public/private/hybrid/etc
 
+When you hear terms such as public cloud or private cloud, these refer to the deployment model for the cloud. A private cloud operates for a single organization, but can be managed on-premise or off-premise. A public cloud has an infrastructure that is available to the general public or a large industry group and is likely owned by a cloud services company. 
+
+The NIST also defines community cloud as shared by several organizations supporting a specific community with shared concerns. 
+
+A hybrid cloud can be a deployment model, as a composition of both public and private clouds, or a hybrid model for cloud computing may involve both virtual and physical servers.
 
 Work in the Clouds
 ------------------
diff --git a/doc/source/devref/cloudpipe.rst b/doc/source/devref/cloudpipe.rst
index 31bd85e817..fb104c160e 100644
--- a/doc/source/devref/cloudpipe.rst
+++ b/doc/source/devref/cloudpipe.rst
@@ -21,7 +21,7 @@
 Cloudpipe -- Per Project Vpns
 =============================
 
-Cloudpipe is a method for connecting end users to their project insnances in vlan mode.
+Cloudpipe is a method for connecting end users to their project instances in vlan mode.
 
 
 Overview
diff --git a/doc/source/images/novascreens.png b/doc/source/images/novascreens.png
new file mode 100644
index 0000000000..0fe3279cf8
--- /dev/null
+++ b/doc/source/images/novascreens.png
diff --git a/doc/source/images/novashvirtually.png b/doc/source/images/novashvirtually.png
new file mode 100644
index 0000000000..02c7e767c2
--- /dev/null
+++ b/doc/source/images/novashvirtually.png
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 9b2c8e1f8d..b9ba6208a4 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -26,7 +26,7 @@ Nova is written with the following design guidelines in mind:
 
 * **Component based architecture**: Quickly add new behaviors
 * **Highly available**: Scale to very serious workloads
-* **Fault-Tollerant**: Isloated processes avoid cascading failures
+* **Fault-Tolerant**: Isolated processes avoid cascading failures
 * **Recoverable**: Failures should be easy to diagnose, debug, and rectify
 * **Open Standards**: Be a reference implementation for a community-driven api
 * **API Compatibility**: Nova strives to provide API-compatible with popular systems like Amazon EC2
@@ -62,8 +62,6 @@ Administrator's Documentation
    adminguide/single.node.install
    adminguide/multi.node.install
 
-.. todo:: add swiftadmin
-
 Developer Docs
 ==============
 
diff --git a/doc/source/livecd.rst b/doc/source/livecd.rst
index 82cf4658a0..b355fa1801 100644
--- a/doc/source/livecd.rst
+++ b/doc/source/livecd.rst
@@ -1,2 +1,48 @@
 Installing the Live CD
 ======================
+
+If you'd like to set up a sandbox installation of Nova, you can use one of these Live CD images. 
+
+If you don't already have VirtualBox installed, you can download it from http://www.virtualbox.org/wiki/Downloads.
+ 
+Download the zip or iso file and then follow these steps to try Nova in a virtual environment.
+
+http://c0047913.cdn1.cloudfiles.rackspacecloud.com/OpenStackNova.x86_64-2010.1.2.iso (OpenSUSE image; root password is "linux" for this image)
+
+http://c0028699.cdn1.cloudfiles.rackspacecloud.com/nova-vm.zip (~900 MB) (log in information is nova/nova)
+
+Once a VM is configured and started, here are the basics:
+
+ #. Login to Ubuntu using ID nova and Password nova.
+
+ #. Switch to running as sudo (enter nova when prompted for the password)::
+
+    sudo -s
+
+ #. To run Nova for the first time, enter::
+
+    cd /var/openstack/
+
+ #. Now that you're in the correct directory, enter::
+
+    ./nova.sh run
+
+    .. image:: images/novashvirtually.png
+
+If it's already running, use screen -ls, and when the nova screen is presented,then enter screen -d -r nova.
+
+These are the steps to get an instance running (the image is already provided in this environment). Enter these commands in the "test" screen.
+
+::
+
+ euca-add-keypair test > test.pem
+ chmod 600 test.pem
+ euca-run-instances -k test -t m1.tiny ami-tiny
+ euca-describe-instances
+
+ ssh -i test.pem root@10.0.0.3
+
+To see output from the various workers, switch screen windows with Ctrl+A " (quotation mark). 
+
+    .. image:: images/novascreens.png 
+
diff --git a/doc/source/nova.concepts.rst b/doc/source/nova.concepts.rst
index ddf0f1b829..18368546bd 100644
--- a/doc/source/nova.concepts.rst
+++ b/doc/source/nova.concepts.rst
@@ -23,13 +23,13 @@ Nova Concepts and Introduction
 Introduction
 ------------
 
-Nova is the software that controls your Infrastructure as as Service (IaaS)
+Nova, also known as OpenStack Compute, is the software that controls your Infrastructure as as Service (IaaS)
 cloud computing platform.  It is similar in scope to Amazon EC2 and Rackspace
-CloudServers.  Nova does not include any virtualization software, rather it
+Cloud Servers.  Nova does not include any virtualization software, rather it
 defines drivers that interact with underlying virtualization mechanisms that
 run on your host operating system, and exposes functionality over a web API.
 
-This document does not attempt to explain fundamental concepts of cloud
+This site does not attempt to explain fundamental concepts of cloud
 computing, IaaS, virtualization, or other related technologies.  Instead, it
 focuses on describing how Nova's implementation of those concepts is achieved.
 
@@ -64,6 +64,19 @@ Concept: Instances
 
 An 'instance' is a word for a virtual machine that runs inside the cloud.
 
+Concept: System Architecture
+----------------------------
+
+Nova consists of seven main components, with the Cloud Controller component representing the global state and interacting with all other components. API Server acts as the Web services front end for the cloud controller. Compute Controller provides compute server resources, and the Object Store component provides storage services. Auth Manager provides authentication and authorization services. Volume Controller provides fast and permanent block-level storage for the comput servers. Network Controller provides virtual networks to enable compute servers to interact with each other and with the public network. Scheduler selects the most suitable compute controller to host an instance.
+
+    .. image:: images/Novadiagram.png 
+
+Nova is built on a shared-nothing, messaging-based architecture. All of the major components, that is Compute Controller, Volume Controller, Network Controller, and Object Store can be run on multiple servers. Cloud Controller communicates with Object Store via HTTP (Hyper Text Transfer Protocol), but it communicates with Scheduler, Network Controller, and Volume Controller via AMQP (Advanced Message Queue Protocol). To avoid blocking each component while waiting for a response, Nova uses asynchronous calls, with a call-back that gets triggered when a response is received.
+
+To achieve the shared-nothing property with multiple copies of the same component, Nova keeps all the cloud system state in a distributed data store. Updates to system state are written into this store, using atomic transactions when required. Requests for system state are read out of this store. In limited cases, the read results are cached within controllers for short periods of time (for example, the current list of system users.) 
+
+    .. note:: The database schema is available on the `OpenStack Wiki <http://wiki.openstack.org/NovaDatabaseSchema>_`. 
+
 Concept: Storage
 ----------------
 
@@ -104,9 +117,9 @@ Concept: API
 Concept: Networking
 -------------------
 
-Nova has a concept of Fixed Ips and Floating ips.  Fixed ips are assigned to an instance on creation and stay the same until the instance is explicitly terminated.  Floating ips are ip addresses that can be dynamically associated with an instance.  This address can be disassociated and associated with another instance at any time.
+Nova has a concept of Fixed IPs and Floating IPs.  Fixed IPs are assigned to an instance on creation and stay the same until the instance is explicitly terminated.  Floating ips are ip addresses that can be dynamically associated with an instance.  This address can be disassociated and associated with another instance at any time.
 
-There are multiple strategies available for implementing fixed ips:
+There are multiple strategies available for implementing fixed IPs:
 
 Flat Mode
 ~~~~~~~~~
@@ -116,7 +129,7 @@ The simplest networking mode.  Each instance receives a fixed ip from the pool.
 Flat DHCP Mode
 ~~~~~~~~~~~~~~
 
-This is similar to the flat mode, in that all instances are attached to the same bridge.  In this mode nova does a bit more configuration, it will attempt to bridge into an ethernet device (eth0 by default).  It will also run dnsmasq as a dhcpserver listening on this bridge.  Instances receive their fixed ips by doing a dhcpdiscover.
+This is similar to the flat mode, in that all instances are attached to the same bridge.  In this mode nova does a bit more configuration, it will attempt to bridge into an ethernet device (eth0 by default).  It will also run dnsmasq as a dhcpserver listening on this bridge.  Instances receive their fixed IPs by doing a dhcpdiscover.
 
 VLAN DHCP Mode
 ~~~~~~~~~~~~~~
@@ -150,7 +163,7 @@ See doc:`nova.manage` in the Administration Guide for more details.
 Concept: Flags
 --------------
 
-python-gflags
+Nova uses python-gflags for a distributed command line system, and the flags can either be set when running a command at the command line or within flag files. When you install Nova packages, each nova service gets its own flag file. For example, nova-network.conf is used for configuring the nova-network service, and so forth. 
 
 
 Concept: Plugins
@@ -187,8 +200,17 @@ Concept: Scheduler
 Concept: Security Groups
 ------------------------
 
-Security groups
+In Nova, a security group is a named collection of network access rules, like firewall policies. These access rules specify which incoming network traffic should be delivered to all VM instances in the group, all other incoming traffic being discarded. Users can modify rules for a group at any time. The new rules are automatically enforced for all running instances and instances launched from then on.
+
+When launching VM instances, the project manager specifies which security groups it wants to join. It will become a member of these specified security groups when it is launched. If no groups are specified, the instances is assigned to the default group, which by default allows all network traffic from other members of this group and discards traffic from other IP addresses and groups. If this does not meet a user's needs, the user can modify the rule settings of the default group.
+
+A security group can be thought of as a security profile or a security role - it promotes the good practice of managing firewalls by role, not by machine. For example, a user could stipulate that servers with the "webapp" role must be able to connect to servers with the "mysql" role on port 3306. Going further with the security profile analogy, an instance can be launched with membership of multiple security groups - similar to a server with multiple roles. Because all rules in security groups are ACCEPT rules, it's trivial to combine them.
+
+Each rule in a security group must specify the source of packets to be allowed, which can either be a subnet anywhere on the Internet (in CIDR notation, with 0.0.0./0 representing the entire Internet) or another security group. In the latter case, the source security group can be any user's group. This makes it easy to grant selective access to one user's instances from instances run by the user's friends, partners, and vendors. 
+
+The creation of rules with other security groups specified as sources helps users deal with dynamic IP addressing. Without this feature, the user would have had to adjust the security groups each time a new instance is launched. This practice would become cumbersome if an application running in Nova is very dynamic and elastic, for example scales up or down frequently.
 
+Security groups for a VM are passed at launch time by the cloud controller to the compute node, and applied at the compute node when a VM is started.
 
 Concept: Certificate Authority
 ------------------------------