diff --git a/kubernetes/_common.sls b/kubernetes/_common.sls
index 6fe6fea..2b7f54e 100644
--- a/kubernetes/_common.sls
+++ b/kubernetes/_common.sls
@@ -69,34 +69,10 @@
 
 {%- endif %}
 
-{%- if common.addons.get('virtlet', {}).get('enabled') %}
-
-/usr/bin/criproxy:
-  file.managed:
-    - source: https://github.com/mirantis/criproxy/releases/download/{{ common.addons.virtlet.get('criproxy_version', 'v0.10.0') }}/criproxy
-    - mode: 750
-    - makedirs: true
-    - user: root
-    - group: root
-    - source_hash: {{ common.addons.virtlet.get('criproxy_source', 'md5=52717b1f70f15558ef4bdb0e4d4948da') }}
-    {%- if grains.get('noservices') %}
-    - onlyif: /bin/false
-    {%- endif %}
+{%- if common.addons.get('virtlet', {}).get('enabled') and not pillar.kubernetes.master is defined %}
 
 {%- if not common.get('containerd', {}).get('enabled') %}
 
-{%- if not pillar.kubernetes.pool is defined %}
-
-/etc/default/dockershim:
-  file.managed:
-  - source: salt://kubernetes/files/dockershim/default.master
-  - template: jinja
-  - user: root
-  - group: root
-  - mode: 644
-
-{%- else %}
-
 /etc/default/dockershim:
   file.managed:
   - source: salt://kubernetes/files/dockershim/default.pool
@@ -105,8 +81,6 @@
   - group: root
   - mode: 644
 
-{%- endif %}
-
 /etc/systemd/system/dockershim.service:
   file.managed:
     - source: salt://kubernetes/files/systemd/dockershim.service
@@ -128,6 +102,18 @@
 
 {%- endif %}
 
+/usr/bin/criproxy:
+  file.managed:
+    - source: https://github.com/mirantis/criproxy/releases/download/{{ common.addons.virtlet.get('criproxy_version', 'v0.10.0') }}/criproxy
+    - mode: 750
+    - makedirs: true
+    - user: root
+    - group: root
+    - source_hash: {{ common.addons.virtlet.get('criproxy_source', 'md5=52717b1f70f15558ef4bdb0e4d4948da') }}
+    {%- if grains.get('noservices') %}
+    - onlyif: /bin/false
+    {%- endif %}
+
 /etc/criproxy:
   file.directory:
     - user: root
@@ -166,12 +152,10 @@
 /etc/criproxy:
   file.absent
 
-{%- if not common.get('containerd', {}).get('enabled') %}
 dockershim_service:
   service.dead:
   - name: dockershim
   - enable: False
-{%- endif %}
 
 criproxy_service:
   service.dead:
@@ -202,7 +186,7 @@
 
 {% endif %}
 
-{%- if not pillar.kubernetes.pool is defined %}
+{%- if pillar.kubernetes.master is defined %}
 
 /etc/default/kubelet:
   file.managed:
diff --git a/kubernetes/files/kubelet/default.master b/kubernetes/files/kubelet/default.master
index 748686d..75eaa72 100644
--- a/kubernetes/files/kubelet/default.master
+++ b/kubernetes/files/kubelet/default.master
@@ -2,6 +2,21 @@
 {%- from "kubernetes/map.jinja" import master with context -%}
 {%- from "kubernetes/map.jinja" import version %}
 
+{%- if master.get('network', {}).get('opencontrail', {}).get('enabled', false) %}
+{%- if master.get('network', {}).get('opencontrail', {}).get('version', 3.0) >= 4.0 %}
+{%- if master.get('enabled', false) %}
+{# in case of OC4 there should not be CNI used #}
+{%- set add_networking_plugin_conf = False %}
+{%- endif %}
+{%- else %}
+{# in case of OC3 CNI should be everywhere #}
+{%- set add_networking_plugin_conf = True %}
+{%- endif %}
+{%- else %}
+{# In case of calico or any compute node - CNI should be everywhere #}
+{%- set add_networking_plugin_conf = True %}
+{%- endif %}
+
 # test_args has to be kept at the end, so they'll overwrite any prior configuration
 DAEMON_ARGS="\
 --pod-manifest-path=/etc/kubernetes/manifests \
@@ -9,7 +24,10 @@
 --allow-privileged={{ master.kubelet.allow_privileged }} \
 --cluster_dns={{ common.addons.dns.server }} \
 --cluster_domain={{ common.addons.dns.domain|replace('_', '-') }} \
+{%- if add_networking_plugin_conf %}
+--network-plugin=cni \
 --cni-bin-dir={{ master.apiserver.get('cni_bin_dir', '/opt/cni/bin') }} \
+{%- endif %}
 --hostname-override={{ master.host.name }} \
 --v={{ master.get('verbosity', 2) }} \
 --node-labels=node-role.kubernetes.io/master=true \
@@ -32,8 +50,8 @@
 {%- endif %}
 {%- endif %}
 {%- if common.get('containerd', {}).get('enabled') %}
---container-runtime={{ pool.get('container-runtime', 'remote') }} \
---container-runtime-endpoint={{ pool.get('image-service-endpoint', 'unix:///run/containerd/containerd.sock') }} \
+--container-runtime={{ master.get('container-runtime', 'remote') }} \
+--container-runtime-endpoint={{ master.get('container-runtime-endpoint', 'unix:///run/containerd/containerd.sock') }} \
 {%- endif %}
 {%- for key, value in master.get('kubelet', {}).get('daemon_opts', {}).items() %}
 --{{ key }}={{ value }} \