diff --git a/.kitchen.yml b/.kitchen.yml
index 8d54651..c227138 100644
--- a/.kitchen.yml
+++ b/.kitchen.yml
@@ -18,6 +18,9 @@
     - name: linux
       repo: git
       source: https://github.com/salt-formulas/salt-formula-linux
+    - name: contrail
+      repo: git
+      source: https://github.com/salt-formulas/salt-formula-opencontrail
 
   state_top:
     base:
diff --git a/kubernetes/files/opencontrail/network.conf b/kubernetes/files/opencontrail/network.conf
index 7db48f1..99618f4 100644
--- a/kubernetes/files/opencontrail/network.conf
+++ b/kubernetes/files/opencontrail/network.conf
@@ -12,4 +12,4 @@
 public-network = {{ master.network.public_network }}
 private-ip-range = {{ master.network.private_ip_range }}
 network-label = {{ master.network.get('network_label','name') }}
-service-label = {{ master.network.get('service_label','uses') }}
\ No newline at end of file
+service-label = {{ master.network.get('service_label','uses') }}
diff --git a/kubernetes/master/kube-addons.sls b/kubernetes/master/kube-addons.sls
index 9ac2cde..2fd3675 100644
--- a/kubernetes/master/kube-addons.sls
+++ b/kubernetes/master/kube-addons.sls
@@ -117,25 +117,6 @@
     - dir_mode: 755
     - makedirs: True
 
-{%- if master.network.engine == "opencontrail" %}
-
-/etc/kubernetes/addons/dashboard/dashboard-address.yaml:
-  file.managed:
-    - source: salt://kubernetes/files/kube-addons/dashboard/dashboard-address.yaml
-    - template: jinja
-    - group: root
-    - dir_mode: 755
-    - makedirs: True
-
-/etc/kubernetes/addons/dashboard/dashboard-endpoint.yaml:
-  file.managed:
-    - source: salt://kubernetes/files/kube-addons/dashboard/dashboard-endpoint.yaml
-    - template: jinja
-    - group: root
-    - dir_mode: 755
-    - makedirs: True
-{% endif %}
-
 {% endif %}
 
 {%- if master.addons.heapster_influxdb.enabled %}
diff --git a/kubernetes/master/opencontrail.sls b/kubernetes/master/opencontrail.sls
index 246b216..d5d4cb3 100644
--- a/kubernetes/master/opencontrail.sls
+++ b/kubernetes/master/opencontrail.sls
@@ -1,5 +1,17 @@
 {%- from "kubernetes/map.jinja" import master with context %}
 {%- if master.enabled %}
+
+linklocal_apiserver:
+  contrail.linklocal_service_present:
+    - name: kube_apiserver
+    - lls_ip: "{{ master.apiserver.internal_address }}"
+    - lls_port: 443
+    - ipf_addresses: "{{ master.apiserver.address }}"
+    - ipf_port: 443
+    {%- if grains.get('noservices') %}
+    - onlyif: /bin/false
+    {%- endif %}
+
 {%- if master.network.get('version', '3.0') != '3.0' %}
 
 opencontrail_kube_manager_package:
diff --git a/metadata/service/master/cluster.yml b/metadata/service/master/cluster.yml
index eee68bf..ffb5754 100644
--- a/metadata/service/master/cluster.yml
+++ b/metadata/service/master/cluster.yml
@@ -20,6 +20,7 @@
         allow_privileged: True
       apiserver:
         address: ${_param:cluster_local_address}
+        internal_address: ${_param:kubernetes_internal_api_address}
         insecure_address: 127.0.0.1
         insecure_port: 8080
         count: 3
@@ -47,7 +48,7 @@
             server: 127.0.0.1#10053
             log-facility: "-"
         dashboard:
-          enabled: True
+          enabled: False
         heapster_influxdb:
           enabled: False
         helm:
@@ -68,6 +69,11 @@
           enabled: False
           name: network-manager
           creates: deployment
+        virtlet:
+          enabled: False
+          hosts: ${_param:kubernetes_virtlet_hosts}
+          namespace: kube-system
+          image: Mirantis/virtlet:latest
       token:
         admin: ${_param:kubernetes_admin_token}
         kubelet: ${_param:kubernetes_kubelet_token}
diff --git a/metadata/service/master/single.yml b/metadata/service/master/single.yml
index d9d24a1..1a9cbf5 100644
--- a/metadata/service/master/single.yml
+++ b/metadata/service/master/single.yml
@@ -20,6 +20,7 @@
         allow_privileged: True
       apiserver:
         address: ${_param:single_address}
+        internal_address: ${_param:kubernetes_internal_api_address}
         insecure_address: 127.0.0.1
         insecure_port: 8080
         daemon_opts:
@@ -42,7 +43,7 @@
             server: 127.0.0.1#10053
             log-facility: "-"
         dashboard:
-          enabled: True
+          enabled: False
         heapster_influxdb:
           enabled: False
         helm:
diff --git a/tests/pillar/master_cluster.sls b/tests/pillar/master_cluster.sls
index 9c5dca0..29a3306 100644
--- a/tests/pillar/master_cluster.sls
+++ b/tests/pillar/master_cluster.sls
@@ -42,6 +42,7 @@
       name: node040
     apiserver:
       address: 10.0.175.100
+      internal_address: 182.22.97.1
       insecure_address: 127.0.0.1
       insecure_port: 8080
     ca: kubernetes
diff --git a/tests/pillar/master_contrail.sls b/tests/pillar/master_contrail.sls
index b1d5037..f9700c1 100644
--- a/tests/pillar/master_contrail.sls
+++ b/tests/pillar/master_contrail.sls
@@ -45,6 +45,7 @@
       name: node040
     apiserver:
       address: 10.0.175.100
+      internal_address: 185.22.97.1
       insecure_address: 127.0.0.1
       insecure_port: 8080
     ca: kubernetes
diff --git a/tests/pillar/master_contrail4_0.sls b/tests/pillar/master_contrail4_0.sls
index f900fe5..bb8ae96 100644
--- a/tests/pillar/master_contrail4_0.sls
+++ b/tests/pillar/master_contrail4_0.sls
@@ -39,6 +39,7 @@
       name: node040
     apiserver:
       address: 10.0.175.100
+      internal_address: 185.22.97.1
       insecure_address: 127.0.0.1
       insecure_port: 8080
     ca: kubernetes