Magnum likes to give out floating IPs to access a cluster. This is how we tested in codfw1dev. This wouldn't work for us as an offering, so we're going to try another route.
Namely creating an internal subnet for magnum to use.
If the network is not external enough the cluster will fail to build and complain. According to https://docs.openstack.org/magnum/latest/user/#clustertemplate we need the following on the network for it to be accepted:
‘router:external’ must be ‘True’
https://docs.openstack.org/magnum/latest/user/#network-for-vms
Might suggest that this is all a fool's errand