One way around this is to set allow_tenant_isolation = False, which results in instances being booted as demo user (which has access to private network). We then run into another issue in that we have network_for_ssh = private, which is not a routable address. We have use_floatingip_for_ssh = True and ssh_connect_method = floating, but tempest does not appear to be creating floating IPs for these instances.
One way around this is to set allow_tenant_ isolation = False, which results in instances being booted as demo user (which has access to private network). We then run into another issue in that we have network_for_ssh = private, which is not a routable address. We have use_floatingip_ for_ssh = True and ssh_connect_method = floating, but tempest does not appear to be creating floating IPs for these instances.