diff --git a/kubernetes/map.jinja b/kubernetes/map.jinja
index 9cf805f..8181b6d 100644
--- a/kubernetes/map.jinja
+++ b/kubernetes/map.jinja
@@ -95,30 +95,6 @@
     },
 }, merge=salt['pillar.get']('kubernetes:control')) %}
 
-{%- if master.get('network', {}).get('engine') == 'calico' %}
-{% set calico = salt['grains.filter_by']({
-    'default': master.network.calico
-}, merge=salt['pillar.get']('kubernetes:master:network')) %}
-{% do calico.update({
-    'enabled': true,
-    'calicoctl_image': calico.calicoctl.image,
-    'cni_image': calico.cni.image,
-}) %}
-{% do master.network.calico.update(calico) %}
-{%- endif %}
-
-{%- if pool.get('network', {}).get('engine') == 'calico' %}
-{% set calico = salt['grains.filter_by']({
-    'default': pool.network.calico
-}, merge=salt['pillar.get']('kubernetes:pool:network')) %}
-{% do calico.update({
-    'enabled': true,
-    'calicoctl_image': calico.calicoctl.image,
-    'cni_image': calico.cni.image,
-}) %}
-{% do pool.network.calico.update(calico) %}
-{%- endif %}
-
 {%- set monitoring = salt['grains.filter_by']({
   'default': {
     'instance_minor_threshold_percent': 0.3,
diff --git a/kubernetes/master/calico.sls b/kubernetes/master/calico.sls
index 4d0fb48..1f21350 100644
--- a/kubernetes/master/calico.sls
+++ b/kubernetes/master/calico.sls
@@ -21,32 +21,16 @@
     - dir_mode: 755
     - template: jinja
 
-/tmp/calico/:
-  file.directory:
-      - user: root
-      - group: root
-
-copy-calico-ctl:
-  cmd.run:
-    - name: docker run --rm -v /tmp/calico/:/tmp/calico/ --entrypoint cp {{ master.network.calico.calicoctl_image }} -v /calicoctl /tmp/calico/
-    - require:
-      - file: /tmp/calico/
-    {%- if grains.get('noservices') %}
-    - onlyif: /bin/false
-    {%- endif %}
-
 /usr/bin/calicoctl:
   file.managed:
-    - source: /tmp/calico/calicoctl
+    - source: {{ master.network.calico.calicoctl_source }}
+    - source_hash: {{ master.network.calico.calicoctl_source_hash }}
     - mode: 751
     - user: root
     - group: root
-    - require:
-      - cmd: copy-calico-ctl
     {%- if grains.get('noservices') %}
     - onlyif: /bin/false
     {%- endif %}
-
 {%- if master.network.calico.get('systemd', true) %}
 
 /etc/systemd/system/calico-node.service:
diff --git a/kubernetes/pool/calico.sls b/kubernetes/pool/calico.sls
index 30f4956..3f2919f 100644
--- a/kubernetes/pool/calico.sls
+++ b/kubernetes/pool/calico.sls
@@ -1,80 +1,55 @@
 {%- from "kubernetes/map.jinja" import pool with context %}
 {%- if pool.enabled %}
 
-/tmp/calico/:
-  file.directory:
-      - user: root
-      - group: root
-
-copy-calico-ctl:
-  cmd.run:
-    - name: docker run --rm -v /tmp/calico/:/tmp/calico/ --entrypoint cp {{ pool.network.calico.calicoctl_image }} -v /calicoctl /tmp/calico/
-    - require:
-      - file: /tmp/calico/
-    {%- if grains.get('noservices') %}
-    - onlyif: /bin/false
-    {%- endif %}
-
 /usr/bin/calicoctl:
   file.managed:
-    - source: /tmp/calico/calicoctl
+    - source: {{ pool.network.calico.calicoctl_source }}
+    - source_hash: {{ pool.network.calico.calicoctl_source_hash }}
     - mode: 751
     - user: root
     - group: root
-    - require:
-      - cmd: copy-calico-ctl
-    {%- if grains.get('noservices') %}
-    - onlyif: /bin/false
-    {%- endif %}
-
-copy-calico-node:
-  cmd.run:
-    - name: docker run --rm -v /tmp/calico/:/tmp/calico/ --entrypoint cp {{ pool.network.calico.image }} -v /bin/birdcl /tmp/calico/
-    - require:
-      - file: /tmp/calico/
     {%- if grains.get('noservices') %}
     - onlyif: /bin/false
     {%- endif %}
 
 /usr/bin/birdcl:
   file.managed:
-    - source: /tmp/calico/birdcl
+    - source: {{ pool.network.calico.birdcl_source }}
+    - source_hash: {{ pool.network.calico.birdcl_source_hash }}
     - mode: 751
     - user: root
     - group: root
-    - require:
-      - cmd: copy-calico-node
     {%- if grains.get('noservices') %}
     - onlyif: /bin/false
     {%- endif %}
 
-copy-calico-cni:
-  cmd.run:
-    - name: docker run --rm -v /tmp/calico/:/tmp/calico/ --entrypoint cp {{ pool.network.calico.cni_image }} -vr /opt/cni/bin/ /tmp/calico/
-    - require:
-      - file: /tmp/calico/
-    {%- if grains.get('noservices') %}
-    - onlyif: /bin/false
-    {%- endif %}
-
-{%- for filename in ['calico', 'calico-ipam'] %}
-
-/opt/cni/bin/{{ filename }}:
+/opt/cni/bin/calico:
   file.managed:
-    - source: /tmp/calico/bin/{{ filename }}
+    - source: {{ pool.network.calico.cni_source }}
+    - source_hash: {{ pool.network.calico.cni_source_hash }}
     - mode: 751
     - makedirs: true
     - user: root
     - group: root
-    - require:
-      - cmd: copy-calico-cni
     - require_in:
       - service: calico_node
     {%- if grains.get('noservices') %}
     - onlyif: /bin/false
     {%- endif %}
 
-{%- endfor %}
+/opt/cni/bin/calico-ipam:
+  file.managed:
+    - source: {{ pool.network.calico.cni_ipam_source }}
+    - source_hash: {{ pool.network.calico.cni_ipam_source_hash }}
+    - mode: 751
+    - makedirs: true
+    - user: root
+    - group: root
+    - require_in:
+      - service: calico_node
+    {%- if grains.get('noservices') %}
+    - onlyif: /bin/false
+    {%- endif %}
 
 /etc/cni/net.d/10-calico.conf:
   file.managed:
diff --git a/tests/pillar/common_storageclass.sls b/tests/pillar/common_storageclass.sls
index 7d6e97d..91e6b04 100644
--- a/tests/pillar/common_storageclass.sls
+++ b/tests/pillar/common_storageclass.sls
@@ -23,8 +23,8 @@
     network:
       calico:
         enabled: true
-        calicoctl_image: calico/ctl
-        cni_image: calico/cni
+        calicoctl_source: calico/ctl
+        calicoctl_source_hash: d41d8cd98f00b204e9800998ecf8427e
         image: calico/node
         kube_controllers_image: calico/kube-controllers
         etcd:
diff --git a/tests/pillar/master_cluster.sls b/tests/pillar/master_cluster.sls
index b7b21d3..6a6a85c 100644
--- a/tests/pillar/master_cluster.sls
+++ b/tests/pillar/master_cluster.sls
@@ -64,8 +64,8 @@
     network:
       calico:
         enabled: true
-        calicoctl_image: calico/ctl
-        cni_image: calico/cni
+        calicoctl_source: calico/ctl
+        calicoctl_source_hash: d41d8cd98f00b204e9800998ecf8427e
         image: calico/node
         kube_controllers_image: calico/kube-controllers
         etcd:
diff --git a/tests/pillar/pool_cluster.sls b/tests/pillar/pool_cluster.sls
index 3a0eded..6a3e05d 100644
--- a/tests/pillar/pool_cluster.sls
+++ b/tests/pillar/pool_cluster.sls
@@ -48,8 +48,14 @@
     network:
       calico:
         enabled: true
-        calicoctl_image: calico/ctl
-        cni_image: calico/cni
+        calicoctl_source: calico/ctl
+        calicoctl_source_hash: d41d8cd98f00b204e9800998ecf8427e
+        birdcl_source: calico/birdcl
+        birdcl_source_hash: d41d8cd98f00b204e9800998ecf8427e
+        cni_source: calico/cni
+        cni_source_hash: d41d8cd98f00b204e9800998ecf8427e
+        cni_ipam_source: calico/cni-ipam
+        cni_ipam_source_hash: d41d8cd98f00b204e9800998ecf8427e
         image: calico/node
         kube_controllers_image: calico/kube-controllers
         etcd:
diff --git a/tests/pillar/pool_cluster_with_domain.sls b/tests/pillar/pool_cluster_with_domain.sls
index 018aec3..3567b40 100644
--- a/tests/pillar/pool_cluster_with_domain.sls
+++ b/tests/pillar/pool_cluster_with_domain.sls
@@ -49,8 +49,14 @@
     network:
       calico:
         enabled: true
-        calicoctl_image: calico/ctl
-        cni_image: calico/cni
+        calicoctl_source: calico/ctl
+        calicoctl_source_hash: d41d8cd98f00b204e9800998ecf8427e
+        birdcl_source: calico/birdcl
+        birdcl_source_hash: d41d8cd98f00b204e9800998ecf8427e
+        cni_source: calico/cni
+        cni_source_hash: d41d8cd98f00b204e9800998ecf8427e
+        cni_ipam_source: calico/cni-ipam
+        cni_ipam_source_hash: d41d8cd98f00b204e9800998ecf8427e
         image: calico/node
         kube_controllers_image: calico/kube-controllers
         etcd: