Network services are typically considered to reside on-premises or in the cloud, but rarely bridge the two.
Systems like OpenStack are thought of as something you run locally (your own private cloud), out in the cloud and as an end-user (let's say you are using Rackspace or Dreamhost). But it's possible to take a hybrid approach in which some cloud services run in the cloud, and the private cloud resides on-premises.
One example of such as private cloud as-a-service is Platform9. I'll list some network-specific items, in case you're wondering how these items can be stitched together.
A big question for some cloud platforms like OpenStack is how an end-user can customize it (which customers like to do), if key services can run through SaaS. Networking for OpenStack is called Neutron, and there are vendor-specific plugins that work with OVS (Open vSwitch).
- Part of the provisioning process: What Platform9 does is insert the OVS-based drivers and vSwitch-compatible drivers into the provisioning process. So you get a customzed setup locally, while the whole system is still managed in the cloud. So with this sleight of hand, it's all possible. They also do this for VMware NSX plugins, Cisco ACI plugins, and some OpenStack ML2 plugins. In theory, any OpenStack Neutron API compatible plugin can work, but a commercial product like theirs needs to certify it.
- What about controllers?: Of course, controllers for ACI or NSX need to be installed by customers on their own on-premises setup, but the end result can be an NSX or ACI integrated version of OpenStack, provisioned to run on-premises, but the on-premises cloud orchestration is performed in the external cloud.
The uptake is that there no longer is a strict wall between on-premises deployment of network services and cloud based orchestration and control. These can be performed together.