diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index ab6845b..dad2e8c 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -1,6 +1,11 @@
 kubernetes formula
 ==================
 
+2018.3.1 (2018-03-15)
+
+- deprecate network.engine field
+- use subsection in network for CNI related setting
+
 2017.1.2 (2017-01-19)
 
 - fix cni copy order
diff --git a/README.rst b/README.rst
index 799495a..6b509c3 100644
--- a/README.rst
+++ b/README.rst
@@ -318,8 +318,8 @@
           kubelet:
             allow_privileged: true
           network:
-            cnis:
-            - calico
+            calico:
+              enabled: true
           service_addresses: 10.254.0.0/16
           storage:
             engine: glusterfs
@@ -364,8 +364,8 @@
               - host: 10.0.175.100
             host: 10.0.175.100
           network:
-            cnis:
-            - calico
+            calico:
+              enabled: true
           token:
             kube_proxy: DFvQ8GelB7afH3wClC9romaMPhquyyEe
             kubelet: 7bN5hJ9JD4fKjnFTkUKsvVNfuyEddw3r
@@ -418,9 +418,8 @@
             image: yashulyak/contrail-controller:latest
       master:
         network:
-          cnis:
-          - opencontrail
-          contrail:
+          opencontrail:
+            enabled: true
             default_domain: default-domain
             default_project: default-domain:default-project
             public_network: default-domain:default-project:Public
@@ -440,8 +439,8 @@
     kubernetes:
       pool:
         network:
-          cnis:
-          - opencontrail
+          opencontrail:
+            enabled: true
 
 
 Dashboard public IP must be configured when Contrail network is used:
@@ -487,8 +486,8 @@
     kubernetes:
       master:
         network:
-          cnis:
-          - flannel
+          flannel:
+            enabled: true
 
 On pools:
 
@@ -497,8 +496,8 @@
     kubernetes:
       pool:
         network:
-          cnis:
-          - flannel
+          flannel:
+            enabled: true
 
 Kubernetes with Calico
 -----------------------
@@ -510,9 +509,8 @@
     kubernetes:
       master:
         network:
-          cnis:
-          - calico
           calico:
+            enabled: true
             mtu: 1500
     # If you don't register master as node:
             etcd:
@@ -531,9 +529,8 @@
     kubernetes:
       pool:
         network:
-          cnis:
-          - calico
           calico:
+            enabled: true
             mtu: 1500
             etcd:
               members:
@@ -551,17 +548,15 @@
     kubernetes:
       pool:
         network:
-          cnis:
-          - calico
           calico:
+            enabled: true
             etcd:
               ssl:
                 enabled: true
       master:
         network:
-          cnis:
-          - calico
           calico:
+            enabled: true
             etcd:
               ssl:
                 enabled: true
@@ -573,16 +568,16 @@
     kubernetes:
       pool:
         network:
-          cnis:
-          - calico
+          calico:
+            enabled: true
           addons:
             calico_policy:
               enabled: true
 
       master:
         network:
-          cnis:
-          - calico
+          calico:
+            enabled: true
           addons:
             calico_policy:
               enabled: true
diff --git a/kubernetes/files/kube-addons/contrail-network-controller/contrail-network-controller-configmap.yml b/kubernetes/files/kube-addons/contrail-network-controller/contrail-network-controller-configmap.yml
index 1402d13..85bb373 100644
--- a/kubernetes/files/kube-addons/contrail-network-controller/contrail-network-controller-configmap.yml
+++ b/kubernetes/files/kube-addons/contrail-network-controller/contrail-network-controller-configmap.yml
@@ -14,14 +14,14 @@
     service-cluster-ip-range = {{ master.service_addresses }}
 
     [opencontrail]
-    default-domain = {{ master.network.contrail.get('default_domain', 'default-domain') }}
-    public-ip-range = {{ master.network.contrail.get('public_ip_range', '185.22.97.128/26') }}
-    cluster-service = {{ master.network.contrail.get('cluster_service', 'kube-system/default') }}
-    api-server = {{ master.network.contrail.config.api.host }}
-    api-port = {{ master.network.contrail.get('port', 8082) }}
-    default = {{ master.network.contrail.get('default_project', 'default-domain:default-project') }}
-    public-network = {{ master.network.contrail.get('public_network', 'default-domain:default-project:Public') }}
-    private-ip-range = {{ master.network.contrail.private_ip_range }}
-    network-label = {{ master.network.contrail.get('network_label', 'opencontrail.org/name') }}
-    service-label = {{ master.network.contrail.get('service_label', 'opencontrail.org/uses') }}
+    default-domain = {{ master.network.opencontrail.get('default_domain', 'default-domain') }}
+    public-ip-range = {{ master.network.opencontrail.get('public_ip_range', '185.22.97.128/26') }}
+    cluster-service = {{ master.network.opencontrail.get('cluster_service', 'kube-system/default') }}
+    api-server = {{ master.network.opencontrail.config.api.host }}
+    api-port = {{ master.network.opencontrail.get('port', 8082) }}
+    default = {{ master.network.opencontrail.get('default_project', 'default-domain:default-project') }}
+    public-network = {{ master.network.opencontrail.get('public_network', 'default-domain:default-project:Public') }}
+    private-ip-range = {{ master.network.opencontrail.private_ip_range }}
+    network-label = {{ master.network.opencontrail.get('network_label', 'opencontrail.org/name') }}
+    service-label = {{ master.network.opencontrail.get('service_label', 'opencontrail.org/uses') }}
     service-cluster-ip-range = {{ master.get('service_addresses', '10.254.0.0/16') }}
diff --git a/kubernetes/files/kube-addons/dashboard/dashboard-service.yaml b/kubernetes/files/kube-addons/dashboard/dashboard-service.yaml
index 717010d..3a5189f 100644
--- a/kubernetes/files/kube-addons/dashboard/dashboard-service.yaml
+++ b/kubernetes/files/kube-addons/dashboard/dashboard-service.yaml
@@ -12,7 +12,7 @@
 spec:
   selector:
     k8s-app: kubernetes-dashboard
-{%- if (common.addons.dashboard.cni is defined and common.addons.dashboard.cni != 'opencontrail') or 'opencontrail' not in master.network.cnis %}
+{%- if (common.addons.dashboard.cni is defined and common.addons.dashboard.cni != 'opencontrail') or master.network.get('opencontrail', {}).get('enabled', False) %}
   type: NodePort
 {%- endif %}
   ports:
diff --git a/kubernetes/files/kube-addons/virtlet/virtlet-ds.yml b/kubernetes/files/kube-addons/virtlet/virtlet-ds.yml
index 73a03fa..17a73ba 100644
--- a/kubernetes/files/kube-addons/virtlet/virtlet-ds.yml
+++ b/kubernetes/files/kube-addons/virtlet/virtlet-ds.yml
@@ -17,7 +17,7 @@
         runtime: virtlet
     spec:
       hostNetwork: true
-      {%- if "opencontrail" not in master.network.cnis %}
+      {%- if master.network.get('opencontrail', {}).get('enabled', False) %}
       dnsPolicy: ClusterFirstWithHostNet
       {%- endif %}
       # hostPID is true to (1) enable VMs to survive virtlet container restart
@@ -148,7 +148,7 @@
           {%- endif %}
         - name: vms-log
           mountPath: /var/log/vms
-        {%- if "opencontrail" in master.network.cnis %}
+        {%- if master.network.get('opencontrail', {}).get('enabled', False) %}
         - name: contrail-log
           mountPath: /var/log/contrail
         - name: contrail-data
@@ -277,7 +277,7 @@
       - configMap:
           name: virtlet-image-translations
         name: image-name-translations
-      {%- if "opencontrail" in master.network.cnis %}
+      {%- if master.network.get('opencontrail', {}).get('enabled', False) %}
       - hostPath:
           path: /var/log/contrail
         name: contrail-log
diff --git a/kubernetes/files/manifest/kube-proxy.manifest.pool b/kubernetes/files/manifest/kube-proxy.manifest.pool
index 55912ad..0bf9814 100644
--- a/kubernetes/files/manifest/kube-proxy.manifest.pool
+++ b/kubernetes/files/manifest/kube-proxy.manifest.pool
@@ -21,7 +21,7 @@
       --kubeconfig=/etc/kubernetes/proxy.kubeconfig
       --master={%- if pool.apiserver.insecure.enabled %}http://{{
 pool.apiserver.host }}:{{ pool.apiserver.insecure_port }}{%- else %}https://{{ pool.apiserver.host }}:{{ pool.apiserver.secure_port }}{%- endif %}
-{%- if 'calico' in pool.network.cnis %}
+{%- if pool.network.get('calico', {}).get('enabled', False) %}
       --proxy-mode=iptables
 {%- endif %}
 {%- for key, value in pool.get('proxy', {}).get('daemon_opts', {}).items() %}
diff --git a/kubernetes/files/opencontrail/4.0/contrail-kubernetes.conf b/kubernetes/files/opencontrail/4.0/contrail-kubernetes.conf
index b7a22cd..aa8233a 100644
--- a/kubernetes/files/opencontrail/4.0/contrail-kubernetes.conf
+++ b/kubernetes/files/opencontrail/4.0/contrail-kubernetes.conf
@@ -3,47 +3,47 @@
 kubernetes_api_server={{ master.apiserver.insecure_address }}
 kubernetes_api_port={{ master.apiserver.insecure_port }}
 kubernetes_api_secure_port={{ master.apiserver.secure_port }}
-service_subnets={{ master.network.contrail.get('service_subnets', '10.96.0.0/12') }}
-pod_subnets={{ master.network.contrail.get('pod_subnets', '10.32.0.0/12') }}
-cluster_name={{ master.network.contrail.get('cluster_name', 'default') }}
-cluster_project={{ master.network.contrail.get('cluster_project', '{}') }}
-cluster_network={{ master.network.contrail.get('cluster_network', '') }}
-kubernetes_cluster_domain={{ master.network.contrail.get('cluster_domain', 'default-domain') }}
-kubernetes_cluster_name={{ master.network.contrail.get('cluster_name', 'kubernetes') }}
-kubernetes_cluster_owner={{ master.network.contrail.get('cluster_owner', 'k8s') }}
-kubernetes_service_name={{ master.network.contrail.get('service_name', 'kubernetes') }}
+service_subnets={{ master.network.opencontrail.get('service_subnets', '10.96.0.0/12') }}
+pod_subnets={{ master.network.opencontrail.get('pod_subnets', '10.32.0.0/12') }}
+cluster_name={{ master.network.opencontrail.get('cluster_name', 'default') }}
+cluster_project={{ master.network.opencontrail.get('cluster_project', '{}') }}
+cluster_network={{ master.network.opencontrail.get('cluster_network', '') }}
+kubernetes_cluster_domain={{ master.network.opencontrail.get('cluster_domain', 'default-domain') }}
+kubernetes_cluster_name={{ master.network.opencontrail.get('cluster_name', 'kubernetes') }}
+kubernetes_cluster_owner={{ master.network.opencontrail.get('cluster_owner', 'k8s') }}
+kubernetes_service_name={{ master.network.opencontrail.get('service_name', 'kubernetes') }}
 
 [VNC]
-vnc_endpoint_ip = {{ master.network.contrail.config.api.host }}
-vnc_endpoint_port = {{ master.network.contrail.config.api.get('port', 8082) }}
-admin_user = {{ master.network.contrail.identity.get('auth_user', 'admin') }}
-admin_password = {{ master.network.contrail.identity.get('auth_password', 'admin') }}
-admin_tenant = {{ master.network.contrail.identity.get('auth_tenant', 'admin') }}
-rabbit_server={{ master.network.contrail.message_queue.host }}
-rabbit_port={{ master.network.contrail.message_queue.get('port', 5672) }}
-rabbit_user={{ master.network.contrail.message_queue.get('user', 'guest') }}
-rabbit_password={{ master.network.contrail.message_queue.get('password', 'guest') }}
-rabbit_vhost={{ master.network.contrail.message_queue.get('vhost', '/') }}
-rabbit_ha_mode={{ master.network.contrail.message_queue.get('ha_mode', False) }}
-rabbit_use_ssl={{ master.network.contrail.message_queue.get('use_ssl', False) }}
-{%- if master.network.contrail.message_queue.get('use_ssl', False) == True %}
-kombu_ssl_version={{ master.network.contrail.message_queue.ssl_version }}
-kombu_ssl_keyfile={{ master.network.contrail.message_queue.ssl_keyfile }}
-kombu_ssl_certfile={{ master.network.contrail.message_queue.ssl_certfile }}
-kombu_ssl_ca_certs={{ master.network.contrail.message_queue.ssl_ca_certs }}
+vnc_endpoint_ip = {{ master.network.opencontrail.config.api.host }}
+vnc_endpoint_port = {{ master.network.opencontrail.config.api.get('port', 8082) }}
+admin_user = {{ master.network.opencontrail.identity.get('auth_user', 'admin') }}
+admin_password = {{ master.network.opencontrail.identity.get('auth_password', 'admin') }}
+admin_tenant = {{ master.network.opencontrail.identity.get('auth_tenant', 'admin') }}
+rabbit_server={{ master.network.opencontrail.message_queue.host }}
+rabbit_port={{ master.network.opencontrail.message_queue.get('port', 5672) }}
+rabbit_user={{ master.network.opencontrail.message_queue.get('user', 'guest') }}
+rabbit_password={{ master.network.opencontrail.message_queue.get('password', 'guest') }}
+rabbit_vhost={{ master.network.opencontrail.message_queue.get('vhost', '/') }}
+rabbit_ha_mode={{ master.network.opencontrail.message_queue.get('ha_mode', False) }}
+rabbit_use_ssl={{ master.network.opencontrail.message_queue.get('use_ssl', False) }}
+{%- if master.network.opencontrail.message_queue.get('use_ssl', False) == True %}
+kombu_ssl_version={{ master.network.opencontrail.message_queue.ssl_version }}
+kombu_ssl_keyfile={{ master.network.opencontrail.message_queue.ssl_keyfile }}
+kombu_ssl_certfile={{ master.network.opencontrail.message_queue.ssl_certfile }}
+kombu_ssl_ca_certs={{ master.network.opencontrail.message_queue.ssl_ca_certs }}
 {%- endif %}
-cassandra_server_list={% for member in master.network.contrail.database.members %}{{ member.host }}:{{ member.get('port', '9160')}} {% endfor %}
-cassandra_user={{ master.network.contrail.database.get('user', None) }}
-cassandra_password={{ master.network.contrail.database.get('password', None) }}
+cassandra_server_list={% for member in master.network.opencontrail.database.members %}{{ member.host }}:{{ member.get('port', '9160')}} {% endfor %}
+cassandra_user={{ master.network.opencontrail.database.get('user', None) }}
+cassandra_password={{ master.network.opencontrail.database.get('password', None) }}
 cluster_id=
-public_fip_pool={{ master.network.contrail.get('public_pool', '{}') }}
+public_fip_pool={{ master.network.opencontrail.get('public_pool', '{}') }}
 
 [DEFAULTS]
 log_local=1
 log_level=SYS_DEBUG
 log_file=/var/log/contrail/contrail-kube-manager.log
-collectors={% for member in master.network.contrail.collector.members %}{{ member.host }}:8086 {% endfor %}
-nested_mode={{ master.network.contrail.get('nested_mode', 0) }}
+collectors={% for member in master.network.opencontrail.collector.members %}{{ member.host }}:8086 {% endfor %}
+nested_mode={{ master.network.opencontrail.get('nested_mode', 0) }}
 
 [SANDESH]
 #sandesh_ssl_enable=False
@@ -53,7 +53,7 @@
 #sandesh_ca_cert=/etc/contrail/ssl/certs/ca-cert.pem
 
 [AUTH]
-auth_token_url={{ master.network.contrail.identity.get('auth_token_url', None) }}
-auth_user={{ master.network.contrail.identity.get('auth_user', 'admin') }}
-auth_password={{ master.network.contrail.identity.get('auth_token_url', 'admin') }}
-auth_tenant={{ master.network.contrail.identity.get('auth_token_url', 'admin') }}
+auth_token_url={{ master.network.opencontrail.identity.get('auth_token_url', None) }}
+auth_user={{ master.network.opencontrail.identity.get('auth_user', 'admin') }}
+auth_password={{ master.network.opencontrail.identity.get('auth_token_url', 'admin') }}
+auth_tenant={{ master.network.opencontrail.identity.get('auth_token_url', 'admin') }}
diff --git a/kubernetes/files/opencontrail/network.conf b/kubernetes/files/opencontrail/network.conf
index db66c0d..eed285d 100644
--- a/kubernetes/files/opencontrail/network.conf
+++ b/kubernetes/files/opencontrail/network.conf
@@ -3,13 +3,13 @@
 service-cluster-ip-range = {{ master.service_addresses }}
 
 [opencontrail]
-default-domain = {{ master.network.contrail.get('default_domain', 'default-domain') }}
-public-ip-range = {{ master.network.contrail.public_ip_range }}
-cluster-service = {{ master.network.contrail.get('cluster_service', 'kube-system/default') }}
-api-server = {{ master.network.contrail.config.api.host }}
-api-port = {{ master.network.contrail.get('port', '8082') }}
-default-project = {{ master.network.contrail.get('default_project','default-domain:default-project') }}
-public-network = {{ master.network.contrail.public_network }}
-private-ip-range = {{ master.network.contrail.private_ip_range }}
-network-label = {{ master.network.contrail.get('network_label','name') }}
-service-label = {{ master.network.contrail.get('service_label','uses') }}
+default-domain = {{ master.network.opencontrail.get('default_domain', 'default-domain') }}
+public-ip-range = {{ master.network.opencontrail.public_ip_range }}
+cluster-service = {{ master.network.opencontrail.get('cluster_service', 'kube-system/default') }}
+api-server = {{ master.network.opencontrail.config.api.host }}
+api-port = {{ master.network.opencontrail.get('port', '8082') }}
+default-project = {{ master.network.opencontrail.get('default_project','default-domain:default-project') }}
+public-network = {{ master.network.opencontrail.public_network }}
+private-ip-range = {{ master.network.opencontrail.private_ip_range }}
+network-label = {{ master.network.opencontrail.get('network_label','name') }}
+service-label = {{ master.network.opencontrail.get('service_label','uses') }}
diff --git a/kubernetes/files/opencontrail/opencontrail.conf b/kubernetes/files/opencontrail/opencontrail.conf
index de28481..290cf2c 100644
--- a/kubernetes/files/opencontrail/opencontrail.conf
+++ b/kubernetes/files/opencontrail/opencontrail.conf
@@ -2,7 +2,7 @@
 {
     "cniVersion": "0.3.0",
     "contrail" : {
-        "apiserver": {"address": "{{ pool.network.contrail.config.api.host }}", "port": {{ pool.network.contrail.config.api.get('port', 8082) }}, "default-domain": "default-domain"},
+        "apiserver": {"address": "{{ pool.network.opencontrail.config.api.host }}", "port": {{ pool.network.opencontrail.config.api.get('port', 8082) }}, "default-domain": "default-domain"},
         "vrouter" : {
             "ip" : "127.0.0.1",
             "port" : 9091
diff --git a/kubernetes/map.jinja b/kubernetes/map.jinja
index 08054e4..e243a77 100644
--- a/kubernetes/map.jinja
+++ b/kubernetes/map.jinja
@@ -93,3 +93,45 @@
         'config_type': 'default',
     },
 }, merge=salt['pillar.get']('kubernetes:control')) %}
+
+{%- if master.get('network', {}).get('engine') == 'calico' %}
+{% set calico = salt['grains.filter_by']({
+    'default': master.network.calico
+}, merge=salt['pillar.get']('kubernetes:master:network')) %}
+{% do calico.update({
+    'enabled': true,
+    'calicoctl_image': calico.calicoctl.image,
+    'cni_image': calico.cni.image,
+}) %}
+{% do master.network.calico.update(calico) %}
+{%- elif master.get('network', {}).get('engine') == 'opencontrail' %}
+{% set opencontrail = salt['grains.filter_by']({
+    'default': master.network.opencontrail
+}, merge=salt['pillar.get']('kubernetes:master:network')) %}
+{% do opencontrail.update({
+    'enabled': true,
+    'cni_image': opencontrail.contrail_cni.image,
+}) %}
+{% do master.network.opencontrail.update(opencontrail) %}
+{%- endif %}
+
+{%- if pool.get('network', {}).get('engine') == 'calico' %}
+{% set calico = salt['grains.filter_by']({
+    'default': pool.network.calico
+}, merge=salt['pillar.get']('kubernetes:pool:network')) %}
+{% do calico.update({
+    'enabled': true,
+    'calicoctl_image': calico.calicoctl.image,
+    'cni_image': calico.cni.image,
+}) %}
+{% do pool.network.calico.update(calico) %}
+{%- elif pool.get('network', {}).get('engine') == 'opencontrail' %}
+{% set opencontrail = salt['grains.filter_by']({
+    'default': pool.network.opencontrail
+}, merge=salt['pillar.get']('kubernetes:pool:network')) %}
+{% do opencontrail.update({
+    'enabled': true,
+    'cni_image': opencontrail.contrail_cni.image,
+}) %}
+{% do pool.network.opencontrail.update(opencontrail) %}
+{%- endif %}
diff --git a/kubernetes/master/controller.sls b/kubernetes/master/controller.sls
index 697b039..fbfdd46 100644
--- a/kubernetes/master/controller.sls
+++ b/kubernetes/master/controller.sls
@@ -188,7 +188,7 @@
 {%- endif %}
 {%- endif %}
         --v={{ master.get('verbosity', 2) }}
-{%- if 'flannel' in master.network.cnis %}
+{%- if master.network.get('flannel', {}).get('enabled', False) %}
         --allocate-node-cidrs=true
         --cluster-cidr={{ master.network.flannel.private_ip_range }}
 {%- endif %}
diff --git a/kubernetes/master/init.sls b/kubernetes/master/init.sls
index 9994124..ee62c6b 100644
--- a/kubernetes/master/init.sls
+++ b/kubernetes/master/init.sls
@@ -2,18 +2,18 @@
 include:
 - kubernetes.master.service
 - kubernetes.master.kube-addons
-{%- if "flannel" in master.network.cnis %}
+{%- if master.network.get('flannel', {}).get('enabled', False) %}
 - kubernetes.master.flannel
 {%- endif %}
-{%- if "opencontrail" in master.network.cnis %}
+{%- if master.network.get('opencontrail', {}).get('enabled', False) %}
 - kubernetes.master.opencontrail
 {%- endif %}
-{%- if "calico" in master.network.cnis %}
+{%- if master.network.get('calico', {}).get('enabled', False) %}
 {%- if not pillar.kubernetes.pool is defined %}
 - kubernetes.master.calico
 {%- endif %}
 {%- endif %}
-{%- if "genie" in master.network.cnis %}
+{%- if master.network.get('genie', {}).get('enabled', False) %}
 {%- if not pillar.kubernetes.pool is defined %}
 - kubernetes.master.genie
 {%- endif %}
diff --git a/kubernetes/master/kube-addons.sls b/kubernetes/master/kube-addons.sls
index 2bd2b90..bdd1c90 100644
--- a/kubernetes/master/kube-addons.sls
+++ b/kubernetes/master/kube-addons.sls
@@ -9,7 +9,7 @@
     - group: root
     - mode: 0755
 
-{%- if "flannel" in master.network.cnis %}
+{%- if master.network.get('flannel', {}).get('enabled', False) %}
 /etc/kubernetes/addons/flannel/flannel.yml:
   file.managed:
     - source: salt://kubernetes/files/kube-addons/flannel/flannel.yml
@@ -19,7 +19,7 @@
     - makedirs: True
 {% endif %}
 
-{%- if "opencontrail" in master.network.cnis and master.network.contrail.get('version', 3.0) < 4.0 %}
+{%- if master.network.get('opencontrail', {}).get('enabled', False) and master.network.opencontrail.get('version', 3.0) < 4.0 %}
 /etc/kubernetes/addons/contrail-network-controller/contrail-network-controller-configmap.yml:
   file.managed:
     - source: salt://kubernetes/files/kube-addons/contrail-network-controller/contrail-network-controller-configmap.yml
@@ -36,7 +36,7 @@
     - dir_mode: 755
     - makedirs: True
 
-{%- elif "opencontrail" in master.network.cnis and master.network.contrail.get('version', 3.0) > 3.0 %}
+{%- elif master.network.get('opencontrail', {}).get('enabled', False) and master.network.opencontrail.get('version', 3.0) > 3.0 %}
 
 /etc/kubernetes/addons/contrail/contrail.yaml:
   file.managed:
@@ -67,7 +67,7 @@
 
 {% endif %}
 
-{%- if common.addons.get('calico_policy', {}).get('enabled', False) and "calico" in master.network.cnis %}
+{%- if common.addons.get('calico_policy', {}).get('enabled', False) and master.network.get('calico', {}).get('enabled', False) %}
 /etc/kubernetes/addons/calico_policy/calico-policy-controller.yml:
   file.managed:
     - source: salt://kubernetes/files/kube-addons/calico-policy/calico-policy-controller.yml
diff --git a/kubernetes/master/opencontrail.sls b/kubernetes/master/opencontrail.sls
index 05827fc..cde1535 100644
--- a/kubernetes/master/opencontrail.sls
+++ b/kubernetes/master/opencontrail.sls
@@ -1,16 +1,16 @@
 {%- from "kubernetes/map.jinja" import master with context %}
 {%- if master.enabled %}
-{%- if master.network.contrail.get('version', 3.0) != 3.0 %}
+{%- if master.network.opencontrail.get('version', 3.0) != 3.0 %}
 
 /etc/contrail/contrail-kubernetes.conf:
   file.managed:
-  - source: salt://kubernetes/files/opencontrail/{{ master.network.contrail.version }}/contrail-kubernetes.conf
+  - source: salt://kubernetes/files/opencontrail/{{ master.network.opencontrail.version }}/contrail-kubernetes.conf
   - template: jinja
   - makedirs: True
 
-#/etc/kubernetes/opencontrail/contrail-{{ master.network.contrail.version }}.yaml:
+#/etc/kubernetes/opencontrail/contrail-{{ master.network.opencontrail.version }}.yaml:
 #  file.managed:
-#  - source: salt://kubernetes/files/manifest/contrail-{{ master.network.contrail.version }}.manifest
+#  - source: salt://kubernetes/files/manifest/contrail-{{ master.network.opencontrail.version }}.manifest
 #  - template: jinja
 #  - makedirs: True
 
diff --git a/kubernetes/meta/collectd.yml b/kubernetes/meta/collectd.yml
index e1089f4..8237e25 100644
--- a/kubernetes/meta/collectd.yml
+++ b/kubernetes/meta/collectd.yml
@@ -2,16 +2,16 @@
 {%- from "kubernetes/map.jinja" import pool with context %}
 
 {%- if pool.get('enabled', False) %}
-{% set network = pool.get('network', []) %}
+{% set network = pool.get('network', {}) %}
 {%- else %}
 {%- if master.get('enabled', False) %}
-{% set network = master.get('network', []) %}
+{% set network = master.get('network', {}) %}
 {% endif %}
 {% endif %}
 
 {%- if master.get('enabled', False) or pool.get('enabled', False) %}
 local_plugin:
-  {%- if network.cnis is defined and 'calico' in network.cnis %}
+  {%- if network is defined and network.get('calico', {}).get('enabled', False) %}
   collectd_calico_felix:
    plugin: python
    template: kubernetes/files/collectd_calico_felix.conf
@@ -73,7 +73,7 @@
       k8s-proxy:
         match: hyperkube.*proxy
 {%- endif %}
-{%- if network.cnis is defined and 'calico' in network.cnis %}
+{%- if network is defined and network.get('calico', {}).get('enabled', False) %}
       calico-docker:
         match: docker run .*projectcalico/calico/node
       calico-felix:
diff --git a/kubernetes/meta/fluentd.yml b/kubernetes/meta/fluentd.yml
index 84a82b2..9c66b75 100644
--- a/kubernetes/meta/fluentd.yml
+++ b/kubernetes/meta/fluentd.yml
@@ -1,10 +1,10 @@
 {%- if pillar.get('fluentd', {}).get('agent', {}).get('enabled', False) %}
 {%- from "kubernetes/map.jinja" import pool, master %}
 {%- if pool.get('enabled', False) %}
-{% set network = pool.get('network', []) %}
+{% set network = pool.get('network', {}) %}
 {%- else %}
 {%- if master.get('enabled', False) %}
-{% set network = master.get('network', []) %}
+{% set network = master.get('network', {}) %}
 {% endif %}
 {% endif %}
 
@@ -36,7 +36,7 @@
               type: json
               time_format: '%Y-%m-%dT%H:%M:%S.%NZ'
               keep_time_key: false
-          {%- if network.cnis is defined and 'calico' in network.cnis %}
+          {%- if network is defined and network.get('calico', {}).get('enabled', False) %}
           bird:
             type: tail
             tag: kubernetes.calico.bird
@@ -96,7 +96,7 @@
                 value: 6
               - name: programname
                 value: ${ record['kubernetes']['container_name'] }
-          {%- if network.cnis is defined and 'calico' in network.cnis %}
+          {%- if network is defined and network.get('calico', {}).get('enabled', False) %}
           enrich_bird:
             tag: 'kubernetes.calico.bird'
             type: record_transformer
diff --git a/kubernetes/meta/grafana.yml b/kubernetes/meta/grafana.yml
index e91c594..3ca3f6a 100644
--- a/kubernetes/meta/grafana.yml
+++ b/kubernetes/meta/grafana.yml
@@ -2,7 +2,7 @@
 {%- from "kubernetes/map.jinja" import master with context %}
 
 {%- if master.get('enabled', False) %}
-{% set network = master.get('network', []) %}
+{% set network = master.get('network', {}) %}
 {% endif %}
 
 dashboard:
@@ -10,7 +10,7 @@
     datasource: prometheus
     format: json
     template: kubernetes/files/grafana_dashboards/kubernetes_cluster_prometheus.json
-{%- if network.cnis is defined and 'calico' in network.cnis %}
+{%- if network is defined and network.get('calico', {}).get('enabled', False) %}
   calico-prometheus:
     datasource: prometheus
     format: json
@@ -20,7 +20,7 @@
     datasource: influxdb
     format: json
     template: kubernetes/files/grafana_dashboards/kubernetes_influxdb.json
-{%- if network.cnis is defined and 'calico' in network.cnis %}
+{%- if inetwork is defined and network.get('calico', {}).get('enabled', False) %}
   calico:
     datasource: influxdb
     format: json
diff --git a/kubernetes/meta/heka.yml b/kubernetes/meta/heka.yml
index 1bd76d6..e62cc2d 100644
--- a/kubernetes/meta/heka.yml
+++ b/kubernetes/meta/heka.yml
@@ -4,14 +4,14 @@
 {% set kube_services = ('apiserver', 'scheduler', 'controller-manager') %}
 
 {%- if pool.get('enabled', False) %}
-{% set network = pool.get('network', []) %}
+{% set network = pool.get('network', {}) %}
 {%- else %}
 {%- if master.get('enabled', False) %}
-{% set network = master.get('network', []) %}
+{% set network = master.get('network', {}) %}
 {% endif %}
 {% endif %}
 
-{%- if network.cnis is defined and 'calico' in network.cnis %}
+{%- if network is defined and network.get('calico', {}).get('enabled', False) %}
 log_collector:
   decoder:
     calico_felix:
@@ -106,7 +106,7 @@
         periods: 0
         function: last
 {%- endif %}
-{%- if network.cnis is defined and 'calico' in network.cnis %}
+{%- if network is defined and network.get('calico', {}).get('enabled', False) %}
     calico_docker:
       description: "There is no docker calico-node process running"
       severity: down
@@ -194,7 +194,7 @@
       dimension:
         service: k8s-proxy-endpoint
 {%- endif %}
-{%- if network.cnis is defined and 'calico' in network.cnis %}
+{%- if network is defined and network.get('calico', {}).get('enabled', False) %}
     calico_docker:
       alerting: enabled
       triggers:
@@ -381,7 +381,7 @@
       dimension:
         cluster_name: k8s-master
         nagios_host: 00-top-clusters
-{%- if master.network.cnis is defined and 'calico' in master.network.cnis %}
+{%- if master.network is defined and master.network.get('calico', {}).get('enabled', False) %}
     calico_docker:
       policy: availability_of_members
       alerting: enabled
diff --git a/kubernetes/meta/prometheus.yml b/kubernetes/meta/prometheus.yml
index 60813cb..5dfad70 100644
--- a/kubernetes/meta/prometheus.yml
+++ b/kubernetes/meta/prometheus.yml
@@ -15,7 +15,7 @@
       api_ip: {{ pool.apiserver.host }}
       cert_name: prometheus-server.crt
       key_name: prometheus-server.key
-{%- if network.cnis is defined and 'calico' in network.cnis and network.calico.get('prometheus', {}).get('enabled', False) %}
+{%- if network.get('calico', {}).get('enabled', False) and network.calico.get('prometheus', {}).get('enabled', False) %}
     static:
       calico:
         endpoint:
@@ -190,7 +190,7 @@
         summary: 'Kubernetes service {{ $labels.process_name }} is down'
         description: 'Kubernetes service {{ $labels.process_name }} is down on node {{ $labels.host }}'
       {% endraw %}
-{%- if network.cnis is defined and 'calico' in network.cnis %}
+{%- if network.get('calico', {}).get('enabled', False) %}
     CalicoProcessDown:
       if: >-
         procstat_running{process_name=~"calico-felix|bird|bird6|confd"} == 0
diff --git a/kubernetes/meta/telegraf.yml b/kubernetes/meta/telegraf.yml
index 5046918..ede028a 100644
--- a/kubernetes/meta/telegraf.yml
+++ b/kubernetes/meta/telegraf.yml
@@ -2,10 +2,10 @@
 {%- from "kubernetes/map.jinja" import pool with context %}
 
 {%- if pool.get('enabled', False) %}
-{% set network = pool.get('network', []) %}
+{% set network = pool.get('network', {}) %}
 {%- else %}
 {%- if master.get('enabled', False) %}
-{% set network = master.get('network', []) %}
+{% set network = master.get('network', {}) %}
 {% endif %}
 {% endif %}
 
@@ -26,7 +26,7 @@
         hyperkube-kubelet:
           pattern: "hyperkube.*kubelet"
   {%- endif %}
-  {%- if network.cnis is defined and 'calico' in network.cnis %}
+  {%- if network is defined and network.get('calico', {}).get('enabled', False) %}
         hyperkube-proxy:
           pattern: "hyperkube.*proxy"
         calico-docker:
diff --git a/kubernetes/pool/init.sls b/kubernetes/pool/init.sls
index 3acb6f8..34e217a 100644
--- a/kubernetes/pool/init.sls
+++ b/kubernetes/pool/init.sls
@@ -1,17 +1,17 @@
 {%- from "kubernetes/map.jinja" import pool with context %}
 include:
 - kubernetes.pool.cni
-{%- if "calico" in pool.network.cnis %}
+{%- if pool.network.get('calico', {}).get('enabled', False) %}
 - kubernetes.pool.calico
 {%- endif %}
-{%- if "opencontrail" in pool.network.cnis %}
+{%- if pool.network.get('opencontrail', {}).get('enabled', False) %}
 - kubernetes.pool.opencontrail
 {%- endif %}
 - kubernetes.pool.service
-{%- if "flannel" in pool.network.cnis %}
+{%- if pool.network.get('flannel', {}).get('enabled', False) %}
 - kubernetes.pool.flannel
 {%- endif %}
-{%- if "genie" in pool.network.cnis %}
+{%- if pool.network.get('genie', {}).get('enabled', False) %}
 - kubernetes.pool.genie
 {%- endif %}
 - kubernetes.pool.kube-proxy
diff --git a/kubernetes/pool/kube-proxy.sls b/kubernetes/pool/kube-proxy.sls
index efadc34..c180a83 100644
--- a/kubernetes/pool/kube-proxy.sls
+++ b/kubernetes/pool/kube-proxy.sls
@@ -36,7 +36,7 @@
     - user: root
     - group: root
     - mode: 644
-    - contents: DAEMON_ARGS=" --logtostderr=true --v={{ pool.get('verbosity', 2) }} --kubeconfig=/etc/kubernetes/proxy.kubeconfig {%- if 'calico' in pool.network.cnis %} --proxy-mode=iptables{% endif %}{%- for key, value in pool.get('proxy', {}).get('daemon_opts', {}).items() %} --{{ key }}={{ value }}{%- endfor %}"
+    - contents: DAEMON_ARGS=" --logtostderr=true --v={{ pool.get('verbosity', 2) }} --kubeconfig=/etc/kubernetes/proxy.kubeconfig {%- if pool.network.get('calico', {}).get('enabled', False) %} --proxy-mode=iptables{% endif %}{%- for key, value in pool.get('proxy', {}).get('daemon_opts', {}).items() %} --{{ key }}={{ value }}{%- endfor %}"
 
 pool_services:
   service.running:
diff --git a/kubernetes/pool/opencontrail.sls b/kubernetes/pool/opencontrail.sls
index 419804a..255861b 100644
--- a/kubernetes/pool/opencontrail.sls
+++ b/kubernetes/pool/opencontrail.sls
@@ -11,7 +11,7 @@
     - dir_mode: 755
     - template: jinja
 
-{%- if pool.network.contrail.get('version', '3.0') == '3.0' %}
+{%- if pool.network.opencontrail.get('version', '3.0') == '3.0' %}
 
 /tmp/opencontrail:
   file.directory:
@@ -20,7 +20,7 @@
 
 copy-contrail-cni:
   cmd.run:
-    - name: docker cp $(docker create  {{ pool.network.contrail.cni_image }}):/opencontrail /tmp/opencontrail
+    - name: docker cp $(docker create  {{ pool.network.opencontrail.cni_image }}):/opencontrail /tmp/opencontrail
     - require:
       - file: /tmp/opencontrail
     {%- if grains.get('noservices') %}
diff --git a/tests/pillar/common_storageclass.sls b/tests/pillar/common_storageclass.sls
index 613cc13..11bae00 100644
--- a/tests/pillar/common_storageclass.sls
+++ b/tests/pillar/common_storageclass.sls
@@ -15,9 +15,8 @@
       kube-system:
         enabled: true
     network:
-      cnis:
-      - calico
       calico:
+        enabled: true
         calicoctl_image: calico/ctl
         cni_image: calico/cni
         etcd:
diff --git a/tests/pillar/master_cluster.sls b/tests/pillar/master_cluster.sls
index 06dcace..68a0e51 100644
--- a/tests/pillar/master_cluster.sls
+++ b/tests/pillar/master_cluster.sls
@@ -68,9 +68,8 @@
       address: 10.0.175.100
       allow_privileged: true
     network:
-      cnis:
-      - calico
       calico:
+        enabled: true
         calicoctl_image: calico/ctl
         cni_image: calico/cni
         etcd:
diff --git a/tests/pillar/master_contrail.sls b/tests/pillar/master_contrail.sls
index 627b032..b2941b1 100644
--- a/tests/pillar/master_contrail.sls
+++ b/tests/pillar/master_contrail.sls
@@ -2,9 +2,6 @@
   common:
     cluster_domain: cluster.local
     cluster_name: cluster
-    network:
-      cnis:
-      - opencontrail
     hyperkube:
       image: hyperkube-amd64:v1.6.4-3
       hash: hnsj0XqABgrSww7Nqo7UVTSZLJUt2XRd
@@ -75,9 +72,8 @@
       address: 10.0.175.100
       allow_privileged: true
     network:
-      cnis:
-      - opencontrail
-      contrail:
+      opencontrail:
+        enabled: true
         config:
           api:
             host: 10.0.170.70
diff --git a/tests/pillar/master_contrail4_0.sls b/tests/pillar/master_contrail4_0.sls
index e703b2e..3f62f67 100644
--- a/tests/pillar/master_contrail4_0.sls
+++ b/tests/pillar/master_contrail4_0.sls
@@ -2,9 +2,6 @@
   common:
     cluster_domain: cluster.local
     cluster_name: cluster
-    network:
-      cnis:
-      - opencontrail
     hyperkube:
       image: hyperkube-amd64:v1.6.4-3
       hash: hnsj0XqABgrSww7Nqo7UVTSZLJUt2XRd
@@ -72,9 +69,8 @@
       address: 10.0.175.100
       allow_privileged: true
     network:
-      cnis:
-      - opencontrail
-      contrail:
+      opencontrail:
+        enabled: true
         version: 4.0
         private_ip_range: 10.150.0.0/16
         config:
diff --git a/tests/pillar/pool_cluster.sls b/tests/pillar/pool_cluster.sls
index 21c8448..152cab3 100644
--- a/tests/pillar/pool_cluster.sls
+++ b/tests/pillar/pool_cluster.sls
@@ -48,9 +48,8 @@
       kube_proxy: DFvQ8GelB7afH3wClC9romaMPhquyyEe
     ca: kubernetes
     network:
-      cnis:
-      - calico
       calico:
+        enabled: true
         calicoctl_image: calico/ctl
         cni_image: calico/cni
         etcd:
diff --git a/tests/pillar/pool_cluster_with_domain.sls b/tests/pillar/pool_cluster_with_domain.sls
index 9ad7f69..194e060 100644
--- a/tests/pillar/pool_cluster_with_domain.sls
+++ b/tests/pillar/pool_cluster_with_domain.sls
@@ -49,9 +49,8 @@
       kube_proxy: DFvQ8GelB7afH3wClC9romaMPhquyyEe
     ca: kubernetes
     network:
-      cnis:
-      - calico
       calico:
+        enabled: true
         calicoctl_image: calico/ctl
         cni_image: calico/cni
         etcd:
diff --git a/tests/pillar/pool_contrail4_0.sls b/tests/pillar/pool_contrail4_0.sls
index 3b0595c..612187f 100644
--- a/tests/pillar/pool_contrail4_0.sls
+++ b/tests/pillar/pool_contrail4_0.sls
@@ -48,9 +48,8 @@
       kube_proxy: DFvQ8GelB7afH3wClC9romaMPhquyyEe
     ca: kubernetes
     network:
-      cnis:
-      - opencontrail
-      contrail:
+      opencontrail:
+        enabled: true
         version: 4.0
         config:
           api: