diff --git a/README.rst b/README.rst
index 8750f07..74623ec 100644
--- a/README.rst
+++ b/README.rst
@@ -417,18 +417,19 @@
       master:
         network:
           engine: opencontrail
-          default_domain: default-domain
-          default_project: default-domain:default-project
-          public_network: default-domain:default-project:Public
-          public_ip_range: 185.22.97.128/26
-          private_ip_range: 10.150.0.0/16
-          service_cluster_ip_range: 10.254.0.0/16
-          network_label: name
-          service_label: uses
-          cluster_service: kube-system/default
-          config:
-            api:
-              host: 10.0.170.70
+          contrail:
+            default_domain: default-domain
+            default_project: default-domain:default-project
+            public_network: default-domain:default-project:Public
+            public_ip_range: 185.22.97.128/26
+            private_ip_range: 10.150.0.0/16
+            service_cluster_ip_range: 10.254.0.0/16
+            network_label: name
+            service_label: uses
+            cluster_service: kube-system/default
+            config:
+              api:
+                host: 10.0.170.70
 On pools:
 
 .. code-block:: yaml
diff --git a/kubernetes/files/kube-addons/contrail-network-controller/contrail-network-controller-configmap.yml b/kubernetes/files/kube-addons/contrail-network-controller/contrail-network-controller-configmap.yml
index 4252e5a..1402d13 100644
--- a/kubernetes/files/kube-addons/contrail-network-controller/contrail-network-controller-configmap.yml
+++ b/kubernetes/files/kube-addons/contrail-network-controller/contrail-network-controller-configmap.yml
@@ -14,14 +14,14 @@
     service-cluster-ip-range = {{ master.service_addresses }}
 
     [opencontrail]
-    default-domain = {{ master.network.get('default_domain', 'default-domain') }}
-    public-ip-range = {{ master.network.get('public_ip_range', '185.22.97.128/26') }}
-    cluster-service = {{ master.network.get('cluster_service', 'kube-system/default') }}
-    api-server = {{ master.network.config.api.host }}
-    api-port = {{ master.network.get('port', 8082) }}
-    default = {{ master.network.get('default_project', 'default-domain:default-project') }}
-    public-network = {{ master.network.get('public_network', 'default-domain:default-project:Public') }}
-    private-ip-range = {{ master.network.private_ip_range }}
-    network-label = {{ master.network.get('network_label', 'opencontrail.org/name') }}
-    service-label = {{ master.network.get('service_label', 'opencontrail.org/uses') }}
+    default-domain = {{ master.network.contrail.get('default_domain', 'default-domain') }}
+    public-ip-range = {{ master.network.contrail.get('public_ip_range', '185.22.97.128/26') }}
+    cluster-service = {{ master.network.contrail.get('cluster_service', 'kube-system/default') }}
+    api-server = {{ master.network.contrail.config.api.host }}
+    api-port = {{ master.network.contrail.get('port', 8082) }}
+    default = {{ master.network.contrail.get('default_project', 'default-domain:default-project') }}
+    public-network = {{ master.network.contrail.get('public_network', 'default-domain:default-project:Public') }}
+    private-ip-range = {{ master.network.contrail.private_ip_range }}
+    network-label = {{ master.network.contrail.get('network_label', 'opencontrail.org/name') }}
+    service-label = {{ master.network.contrail.get('service_label', 'opencontrail.org/uses') }}
     service-cluster-ip-range = {{ master.get('service_addresses', '10.254.0.0/16') }}
diff --git a/kubernetes/files/opencontrail/4.0/contrail-kubernetes.conf b/kubernetes/files/opencontrail/4.0/contrail-kubernetes.conf
index 83587bc..b7a22cd 100644
--- a/kubernetes/files/opencontrail/4.0/contrail-kubernetes.conf
+++ b/kubernetes/files/opencontrail/4.0/contrail-kubernetes.conf
@@ -3,47 +3,47 @@
 kubernetes_api_server={{ master.apiserver.insecure_address }}
 kubernetes_api_port={{ master.apiserver.insecure_port }}
 kubernetes_api_secure_port={{ master.apiserver.secure_port }}
-service_subnets={{ master.network.get('service_subnets', '10.96.0.0/12') }}
-pod_subnets={{ master.network.get('pod_subnets', '10.32.0.0/12') }}
-cluster_name={{ master.network.get('cluster_name', 'default') }}
-cluster_project={{ master.network.get('cluster_project', '{}') }}
-cluster_network={{ master.network.get('cluster_network', '') }}
-kubernetes_cluster_domain={{ master.network.get('cluster_domain', 'default-domain') }}
-kubernetes_cluster_name={{ master.network.get('cluster_name', 'kubernetes') }}
-kubernetes_cluster_owner={{ master.network.get('cluster_owner', 'k8s') }}
-kubernetes_service_name={{ master.network.get('service_name', 'kubernetes') }}
+service_subnets={{ master.network.contrail.get('service_subnets', '10.96.0.0/12') }}
+pod_subnets={{ master.network.contrail.get('pod_subnets', '10.32.0.0/12') }}
+cluster_name={{ master.network.contrail.get('cluster_name', 'default') }}
+cluster_project={{ master.network.contrail.get('cluster_project', '{}') }}
+cluster_network={{ master.network.contrail.get('cluster_network', '') }}
+kubernetes_cluster_domain={{ master.network.contrail.get('cluster_domain', 'default-domain') }}
+kubernetes_cluster_name={{ master.network.contrail.get('cluster_name', 'kubernetes') }}
+kubernetes_cluster_owner={{ master.network.contrail.get('cluster_owner', 'k8s') }}
+kubernetes_service_name={{ master.network.contrail.get('service_name', 'kubernetes') }}
 
 [VNC]
-vnc_endpoint_ip = {{ master.network.config.api.host }}
-vnc_endpoint_port = {{ master.network.config.api.get('port', 8082) }}
-admin_user = {{ master.network.identity.get('auth_user', 'admin') }}
-admin_password = {{ master.network.identity.get('auth_password', 'admin') }}
-admin_tenant = {{ master.network.identity.get('auth_tenant', 'admin') }}
-rabbit_server={{ master.network.message_queue.host }}
-rabbit_port={{ master.network.message_queue.get('port', 5672) }}
-rabbit_user={{ master.network.message_queue.get('user', 'guest') }}
-rabbit_password={{ master.network.message_queue.get('password', 'guest') }}
-rabbit_vhost={{ master.network.message_queue.get('vhost', '/') }}
-rabbit_ha_mode={{ master.network.message_queue.get('ha_mode', False) }}
-rabbit_use_ssl={{ master.network.message_queue.get('use_ssl', False) }}
-{%- if master.network.message_queue.get('use_ssl', False) == True %}
-kombu_ssl_version={{ master.network.message_queue.ssl_version }}
-kombu_ssl_keyfile={{ master.network.message_queue.ssl_keyfile }}
-kombu_ssl_certfile={{ master.network.message_queue.ssl_certfile }}
-kombu_ssl_ca_certs={{ master.network.message_queue.ssl_ca_certs }}
+vnc_endpoint_ip = {{ master.network.contrail.config.api.host }}
+vnc_endpoint_port = {{ master.network.contrail.config.api.get('port', 8082) }}
+admin_user = {{ master.network.contrail.identity.get('auth_user', 'admin') }}
+admin_password = {{ master.network.contrail.identity.get('auth_password', 'admin') }}
+admin_tenant = {{ master.network.contrail.identity.get('auth_tenant', 'admin') }}
+rabbit_server={{ master.network.contrail.message_queue.host }}
+rabbit_port={{ master.network.contrail.message_queue.get('port', 5672) }}
+rabbit_user={{ master.network.contrail.message_queue.get('user', 'guest') }}
+rabbit_password={{ master.network.contrail.message_queue.get('password', 'guest') }}
+rabbit_vhost={{ master.network.contrail.message_queue.get('vhost', '/') }}
+rabbit_ha_mode={{ master.network.contrail.message_queue.get('ha_mode', False) }}
+rabbit_use_ssl={{ master.network.contrail.message_queue.get('use_ssl', False) }}
+{%- if master.network.contrail.message_queue.get('use_ssl', False) == True %}
+kombu_ssl_version={{ master.network.contrail.message_queue.ssl_version }}
+kombu_ssl_keyfile={{ master.network.contrail.message_queue.ssl_keyfile }}
+kombu_ssl_certfile={{ master.network.contrail.message_queue.ssl_certfile }}
+kombu_ssl_ca_certs={{ master.network.contrail.message_queue.ssl_ca_certs }}
 {%- endif %}
-cassandra_server_list={% for member in master.network.database.members %}{{ member.host }}:{{ member.get('port', '9160')}} {% endfor %}
-cassandra_user={{ master.network.database.get('user', None) }}
-cassandra_password={{ master.network.database.get('password', None) }}
+cassandra_server_list={% for member in master.network.contrail.database.members %}{{ member.host }}:{{ member.get('port', '9160')}} {% endfor %}
+cassandra_user={{ master.network.contrail.database.get('user', None) }}
+cassandra_password={{ master.network.contrail.database.get('password', None) }}
 cluster_id=
-public_fip_pool={{ master.network.get('public_pool', '{}') }}
+public_fip_pool={{ master.network.contrail.get('public_pool', '{}') }}
 
 [DEFAULTS]
 log_local=1
 log_level=SYS_DEBUG
 log_file=/var/log/contrail/contrail-kube-manager.log
-collectors={% for member in master.network.collector.members %}{{ member.host }}:8086 {% endfor %}
-nested_mode={{ master.network.get('nested_mode', 0) }}
+collectors={% for member in master.network.contrail.collector.members %}{{ member.host }}:8086 {% endfor %}
+nested_mode={{ master.network.contrail.get('nested_mode', 0) }}
 
 [SANDESH]
 #sandesh_ssl_enable=False
@@ -53,7 +53,7 @@
 #sandesh_ca_cert=/etc/contrail/ssl/certs/ca-cert.pem
 
 [AUTH]
-auth_token_url={{ master.network.identity.get('auth_token_url', None) }}
-auth_user={{ master.network.identity.get('auth_user', 'admin') }}
-auth_password={{ master.network.identity.get('auth_token_url', 'admin') }}
-auth_tenant={{ master.network.identity.get('auth_token_url', 'admin') }}
+auth_token_url={{ master.network.contrail.identity.get('auth_token_url', None) }}
+auth_user={{ master.network.contrail.identity.get('auth_user', 'admin') }}
+auth_password={{ master.network.contrail.identity.get('auth_token_url', 'admin') }}
+auth_tenant={{ master.network.contrail.identity.get('auth_token_url', 'admin') }}
diff --git a/kubernetes/files/opencontrail/network.conf b/kubernetes/files/opencontrail/network.conf
index 5ea6398..db66c0d 100644
--- a/kubernetes/files/opencontrail/network.conf
+++ b/kubernetes/files/opencontrail/network.conf
@@ -3,13 +3,13 @@
 service-cluster-ip-range = {{ master.service_addresses }}
 
 [opencontrail]
-default-domain = {{ master.network.get('default_domain', 'default-domain') }}
-public-ip-range = {{ master.network.public_ip_range }}
-cluster-service = {{ master.network.get('cluster_service', 'kube-system/default') }}
-api-server = {{ master.network.config.api.host }}
-api-port = {{ master.network.get('port', '8082') }}
-default-project = {{ master.network.get('default_project','default-domain:default-project') }}
-public-network = {{ master.network.public_network }}
-private-ip-range = {{ master.network.private_ip_range }}
-network-label = {{ master.network.get('network_label','name') }}
-service-label = {{ master.network.get('service_label','uses') }}
+default-domain = {{ master.network.contrail.get('default_domain', 'default-domain') }}
+public-ip-range = {{ master.network.contrail.public_ip_range }}
+cluster-service = {{ master.network.contrail.get('cluster_service', 'kube-system/default') }}
+api-server = {{ master.network.contrail.config.api.host }}
+api-port = {{ master.network.contrail.get('port', '8082') }}
+default-project = {{ master.network.contrail.get('default_project','default-domain:default-project') }}
+public-network = {{ master.network.contrail.public_network }}
+private-ip-range = {{ master.network.contrail.private_ip_range }}
+network-label = {{ master.network.contrail.get('network_label','name') }}
+service-label = {{ master.network.contrail.get('service_label','uses') }}
diff --git a/kubernetes/files/opencontrail/opencontrail.conf b/kubernetes/files/opencontrail/opencontrail.conf
index d675318..3b42588 100644
--- a/kubernetes/files/opencontrail/opencontrail.conf
+++ b/kubernetes/files/opencontrail/opencontrail.conf
@@ -2,7 +2,7 @@
 {
     "cniVersion": "0.2.0",
     "contrail" : {
-        "apiserver": {"address": "{{ pool.network.config.api.host }}", "port": {{ pool.network.config.api.get('port', 8082) }}, "default-domain": "default-domain"},
+        "apiserver": {"address": "{{ pool.network.contrail.config.api.host }}", "port": {{ pool.network.contrail.config.api.get('port', 8082) }}, "default-domain": "default-domain"},
         "vrouter" : {
             "ip" : "127.0.0.1",
             "port" : 9091
diff --git a/kubernetes/master/kube-addons.sls b/kubernetes/master/kube-addons.sls
index 2d7d150..1f052f4 100644
--- a/kubernetes/master/kube-addons.sls
+++ b/kubernetes/master/kube-addons.sls
@@ -19,7 +19,7 @@
     - makedirs: True
 {% endif %}
 
-{%- if master.network.engine == "opencontrail" and master.network.get('version', 3.0) < 4.0 %}
+{%- if master.network.engine == "opencontrail" and master.network.contrail.get('version', 3.0) < 4.0 %}
 /etc/kubernetes/addons/contrail-network-controller/contrail-network-controller-configmap.yml:
   file.managed:
     - source: salt://kubernetes/files/kube-addons/contrail-network-controller/contrail-network-controller-configmap.yml
@@ -36,7 +36,7 @@
     - dir_mode: 755
     - makedirs: True
 
-{%- elif master.network.engine == "opencontrail" and master.network.get('version', 3.0) > 3.0 %}
+{%- elif master.network.engine == "opencontrail" and master.network.contrail.get('version', 3.0) > 3.0 %}
 
 /etc/kubernetes/addons/contrail/contrail.yaml:
   file.managed:
diff --git a/kubernetes/master/opencontrail.sls b/kubernetes/master/opencontrail.sls
index 462f992..05827fc 100644
--- a/kubernetes/master/opencontrail.sls
+++ b/kubernetes/master/opencontrail.sls
@@ -1,16 +1,16 @@
 {%- from "kubernetes/map.jinja" import master with context %}
 {%- if master.enabled %}
-{%- if master.network.get('version', 3.0) != 3.0 %}
+{%- if master.network.contrail.get('version', 3.0) != 3.0 %}
 
 /etc/contrail/contrail-kubernetes.conf:
   file.managed:
-  - source: salt://kubernetes/files/opencontrail/{{ master.network.version }}/contrail-kubernetes.conf
+  - source: salt://kubernetes/files/opencontrail/{{ master.network.contrail.version }}/contrail-kubernetes.conf
   - template: jinja
   - makedirs: True
 
-#/etc/kubernetes/opencontrail/contrail-{{ master.network.version }}.yaml:
+#/etc/kubernetes/opencontrail/contrail-{{ master.network.contrail.version }}.yaml:
 #  file.managed:
-#  - source: salt://kubernetes/files/manifest/contrail-{{ master.network.version }}.manifest
+#  - source: salt://kubernetes/files/manifest/contrail-{{ master.network.contrail.version }}.manifest
 #  - template: jinja
 #  - makedirs: True
 
diff --git a/kubernetes/pool/opencontrail.sls b/kubernetes/pool/opencontrail.sls
index 6fc008d..419804a 100644
--- a/kubernetes/pool/opencontrail.sls
+++ b/kubernetes/pool/opencontrail.sls
@@ -11,7 +11,7 @@
     - dir_mode: 755
     - template: jinja
 
-{%- if pool.network.get('version', '3.0') == '3.0' %}
+{%- if pool.network.contrail.get('version', '3.0') == '3.0' %}
 
 /tmp/opencontrail:
   file.directory:
@@ -20,7 +20,7 @@
 
 copy-contrail-cni:
   cmd.run:
-    - name: docker cp $(docker create  {{ pool.network.contrail_cni.image }}):/opencontrail /tmp/opencontrail
+    - name: docker cp $(docker create  {{ pool.network.contrail.cni_image }}):/opencontrail /tmp/opencontrail
     - require:
       - file: /tmp/opencontrail
     {%- if grains.get('noservices') %}
diff --git a/tests/pillar/master_contrail.sls b/tests/pillar/master_contrail.sls
index c9b2ab3..a023108 100644
--- a/tests/pillar/master_contrail.sls
+++ b/tests/pillar/master_contrail.sls
@@ -75,20 +75,21 @@
       allow_privileged: true
     network:
       engine: opencontrail
-      config:
-        api:
-          host: 10.0.170.70
-      port: 8082
-      default_domain: default-domain
-      default_project: default-domain:default-project
-      public_network: default-domain:default-project:Public
-      public_ip_range: 185.22.97.128/26
-      private_ip_range: 10.150.0.0/16
-      service_cluster_ip_range: 10.254.0.0/16
-      network_label: name
-      service_label: uses
-      cluster_service: kube-system/default
-      image: tianon/true
+      contrail:
+        config:
+          api:
+            host: 10.0.170.70
+        port: 8082
+        default_domain: default-domain
+        default_project: default-domain:default-project
+        public_network: default-domain:default-project:Public
+        public_ip_range: 185.22.97.128/26
+        private_ip_range: 10.150.0.0/16
+        service_cluster_ip_range: 10.254.0.0/16
+        network_label: name
+        service_label: uses
+        cluster_service: kube-system/default
+        image: tianon/true
     service_addresses: 10.254.0.0/16
     storage:
       engine: glusterfs
diff --git a/tests/pillar/master_contrail4_0.sls b/tests/pillar/master_contrail4_0.sls
index dbf8e87..8aaf016 100644
--- a/tests/pillar/master_contrail4_0.sls
+++ b/tests/pillar/master_contrail4_0.sls
@@ -72,25 +72,26 @@
       allow_privileged: true
     network:
       engine: opencontrail
-      version: 4.0
-      private_ip_range: 10.150.0.0/16
-      config:
-        api:
+      contrail:
+        version: 4.0
+        private_ip_range: 10.150.0.0/16
+        config:
+          api:
+            host: 127.0.0.1
+        message_queue:
           host: 127.0.0.1
-      message_queue:
-        host: 127.0.0.1
-      identity:
-        password: password
-      database:
-        members:
-        - host: 127.0.0.1
-        - host: 127.0.0.1
-        - host: 127.0.0.1
-      collector:
-        members:
-        - host: 127.0.0.1
-        - host: 127.0.0.1
-        - host: 127.0.0.1
+        identity:
+          password: password
+        database:
+          members:
+          - host: 127.0.0.1
+          - host: 127.0.0.1
+          - host: 127.0.0.1
+        collector:
+          members:
+          - host: 127.0.0.1
+          - host: 127.0.0.1
+          - host: 127.0.0.1
     storage:
       engine: glusterfs
       members:
diff --git a/tests/pillar/pool_contrail4_0.sls b/tests/pillar/pool_contrail4_0.sls
index da58e06..ce5331e 100644
--- a/tests/pillar/pool_contrail4_0.sls
+++ b/tests/pillar/pool_contrail4_0.sls
@@ -51,7 +51,8 @@
     ca: kubernetes
     network:
       engine: opencontrail
-      version: 4.0
-      config:
-        api:
-          host: 127.0.0.1
+      contrail:
+        version: 4.0
+        config:
+          api:
+            host: 127.0.0.1