diff --git a/playbooks/byo/calico/roles b/playbooks/byo/calico/roles
deleted file mode 120000
index 20c4c58cfad..00000000000
--- a/playbooks/byo/calico/roles
+++ /dev/null
@@ -1 +0,0 @@
-../../../roles
\ No newline at end of file
diff --git a/playbooks/byo/calico/upgrade_versions.yml b/playbooks/byo/calico/upgrade_versions.yml
deleted file mode 100644
index 1253a4ea21f..00000000000
--- a/playbooks/byo/calico/upgrade_versions.yml
+++ /dev/null
@@ -1,25 +0,0 @@
----
-# Default variables for the Calico self-hosted upgrade.
-- set_fact:
-    calico_node_image: quay.io/calico/node:v2.6.7
-  when: calico_node_image is not defined
-- set_fact:
-    calico_url_policy_controller: "quay.io/calico/kube-controllers:v1.0.3"
-  when: calico_url_policy_controller is not defined
-- set_fact:
-    calico_cni_image: "quay.io/calico/cni:v1.11.2"
-  when: calico_cni_image is not defined
-- set_fact:
-    calico_ipv4pool_ipip: "always"
-  when: calico_ipv4pool_ipip is not defined
-
-# TODO: move these variables into a calico_common role which only has default values
-- set_fact:
-    calico_ipv4pool_ipip: "always"
-  when: calico_ipv4pool_ipip is not defined
-- set_fact:
-    cni_conf_dir: "/etc/cni/net.d/"
-  when: cni_conf_dir is not defined
-- set_fact:
-    cni_bin_dir: "/opt/cni/bin/"
-  when: cni_bin_dir is not defined
diff --git a/playbooks/openshift-master/private/config.yml b/playbooks/openshift-master/private/config.yml
index 05eab628876..97a57554300 100644
--- a/playbooks/openshift-master/private/config.yml
+++ b/playbooks/openshift-master/private/config.yml
@@ -79,7 +79,7 @@
     when: openshift_use_nuage | default(false) | bool
   - role: nuage_master
     when: openshift_use_nuage | default(false) | bool
-  - role: calico_master
+  - role: calico
     when: openshift_use_calico | default(false) | bool
   tasks:
   - import_role:
diff --git a/roles/calico/README.md b/roles/calico/README.md
index 5846abfbdd1..310eabeec3f 100644
--- a/roles/calico/README.md
+++ b/roles/calico/README.md
@@ -1,3 +1,48 @@
-# Calico
+# Calico (Master)
 
-Please see [calico_master](../calico_master/README.md)
+Configure Calico components for the Master host.
+
+## Requirements
+
+* Ansible 2.2
+
+## Installation
+
+To install, set the following inventory configuration parameters:
+
+* `openshift_use_calico=True`
+* `openshift_use_openshift_sdn=False`
+* `os_sdn_network_plugin_name='cni'`
+
+By default, Calico will share the etcd used by OpenShift.
+To configure Calico to use a separate instance of etcd, place etcd SSL client certs on your master,
+then set the following variables in your inventory.ini:
+
+* `calico_etcd_ca_cert_file=/path/to/etcd-ca.crt`
+* `calico_etcd_cert_file=/path/to/etcd-client.crt`
+* `calico_etcd_key_file=/path/to/etcd-client.key`
+* `calico_etcd_endpoints=https://etcd:2379`
+
+## Upgrading
+
+OpenShift-Ansible installs Calico as a self-hosted install. Previously, Calico ran as a systemd service. Running Calico
+in this manner is now deprecated, and must be upgraded to a hosted cluster. Please run the Legacy Upgrade playbook to
+upgrade your existing Calico deployment to a hosted deployment:
+
+        ansible-playbook -i inventory.ini playbooks/byo/calico/legacy_upgrade.yml
+
+## Additional Calico/Node and Felix Configuration Options
+
+Additional parameters that can be defined in the inventory are:
+
+
+| Environment | Description | Schema | Default |   
+|---------|----------------------|---------|---------|
+| CALICO_IPV4POOL_IPIP | IPIP Mode to use for the IPv4 POOL created at start up.	| off, always, cross-subnet	| always |
+| CALICO_LOG_DIR | Directory on the host machine where Calico Logs are written.| String	| /var/log/calico |
+
+### Contact Information
+
+Author: Dan Osborne <dan@projectcalico.org>
+
+For support, join the `#openshift` channel on the [calico users slack](calicousers.slack.com).
diff --git a/roles/calico_master/defaults/main.yaml b/roles/calico/defaults/main.yaml
similarity index 100%
rename from roles/calico_master/defaults/main.yaml
rename to roles/calico/defaults/main.yaml
diff --git a/roles/calico/files/calico.conf b/roles/calico/files/calico.conf
deleted file mode 100644
index 8bd0181308b..00000000000
--- a/roles/calico/files/calico.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-[keyfile]
-unmanaged-devices=interface-name:cali*;interface-name:tunl0
diff --git a/roles/calico/meta/main.yml b/roles/calico/meta/main.yml
index eeb3909b2ce..2b36764c4a5 100644
--- a/roles/calico/meta/main.yml
+++ b/roles/calico/meta/main.yml
@@ -13,5 +13,5 @@ galaxy_info:
   - cloud
   - system
 dependencies:
+- role: lib_utils
 - role: openshift_facts
-- role: container_runtime
diff --git a/roles/calico_master/tasks/certs.yml b/roles/calico/tasks/certs.yml
similarity index 100%
rename from roles/calico_master/tasks/certs.yml
rename to roles/calico/tasks/certs.yml
diff --git a/roles/calico/tasks/main.yml b/roles/calico/tasks/main.yml
index 9a1a7954752..a88bef2bdcd 100644
--- a/roles/calico/tasks/main.yml
+++ b/roles/calico/tasks/main.yml
@@ -1,47 +1,63 @@
 ---
-- name: Check for legacy service
-  stat:
-    path: /lib/systemd/system/calico.service
-    get_checksum: false
-    get_attributes: false
-    get_mime: false
-  register: sym
-- fail:
-    msg: You are running a systemd based installation of Calico. Please run the calico upgrade playbook to upgrade to a self-hosted installation.
-  when: sym.stat.exists
-
-- name: Configure NetworkManager to ignore Calico interfaces
-  copy:
-    src: files/calico.conf
-    dest: /etc/NetworkManager/conf.d/
-  when: using_network_manager | default(true) | bool
-  register: nm
-
-- name: restart NetworkManager
-  systemd:
-    name: NetworkManager
-    state: restarted
-  when: nm.changed
-
-# TODO: Move into shared vars file
-- name: Load default node image
+- include_tasks: certs.yml
+
+- name: Calico Master | oc adm policy add-scc-to-user privileged system:serviceaccount:kube-system:calico-node
+  oc_adm_policy_user:
+    user: system:serviceaccount:kube-system:calico-node
+    resource_kind: scc
+    resource_name: privileged
+    state: present
+
+- name: Calico Master | oc adm policy add-scc-to-user privileged system:serviceaccount:kube-system:calico-kube-controllers
+  oc_adm_policy_user:
+    user: system:serviceaccount:kube-system:calico-kube-controllers
+    resource_kind: scc
+    resource_name: privileged
+    state: present
+
+- name: Calico Master | oc adm policy add-scc-to-user privileged system:serviceaccount:kube-system:calico-upgrade-job
+  oc_adm_policy_user:
+    user: system:serviceaccount:kube-system:calico-upgrade-job
+    resource_kind: scc
+    resource_name: privileged
+    state: present
+
+- name: Set default selector for kube-system
+  command: >
+    {{ openshift_client_binary }}
+    --config={{ openshift.common.config_base }}/master/admin.kubeconfig
+    annotate  ns kube-system openshift.io/node-selector="" --overwrite
+
+- name: Calico Master | Create temp directory
+  command: mktemp -d /tmp/openshift-ansible-XXXXXXX
+  register: mktemp
+  changed_when: False
+
+- name: Calico Master | Parse node version
   set_fact:
-    calico_node_image: "quay.io/calico/node:v2.6.7"
-  when: calico_node_image is not defined
+    node_version: "{{ calico_node_image | regex_replace('^.*node:v?(.*)$', '\\1') }}"
+    cnx: "{{ calico_node_image | regex_replace('[^-]*', '\\0') }}"
 
 - name: Prepull Images
   command: "{{ openshift_container_cli }} pull {{ calico_node_image }}"
 
-- name: Apply node label
-  delegate_to: "{{ groups.oo_first_master.0 }}"
+- name: Calico Master | Write Calico v3
+  template:
+    dest: "{{ mktemp.stdout }}/calico.yml"
+    src: calicov3.yml.j2
+  when: (node_version | regex_search('^[0-9]\.[0-9]\.[0-9]') and node_version >= '3.0.0') or (node_version == 'master') or (cnx == "cnx" and node_version >= '2.0.0')
+
+- name: Calico Master | Launch Calico
   command: >
-    {{ openshift_client_binary }} --config={{ openshift.common.config_base }}/master/admin.kubeconfig label node {{ openshift.node.nodename | lower }} --overwrite projectcalico.org/ds-ready=true
-
-- name: Wait for node running
-  uri:
-    url: http://localhost:9099/readiness
-    status_code: 204
-  delay: 3
-  retries: 10
-  register: result
-  until: result.status == 204
+    {{ openshift_client_binary }} apply
+    -f {{ mktemp.stdout }}/calico.yml
+    --config={{ openshift.common.config_base }}/master/admin.kubeconfig
+  register: calico_create_output
+  failed_when: "('already exists' not in calico_create_output.stderr) and ('created' not in calico_create_output.stdout) and calico_create_output.rc != 0"
+  changed_when: ('created' in calico_create_output.stdout)
+
+- name: Calico Master | Delete temp directory
+  file:
+    name: "{{ mktemp.stdout }}"
+    state: absent
+  changed_when: False
diff --git a/roles/calico_master/templates/calico.yml.j2 b/roles/calico/templates/calico.yml.j2
similarity index 99%
rename from roles/calico_master/templates/calico.yml.j2
rename to roles/calico/templates/calico.yml.j2
index f8934845dba..384fa0d6a6a 100644
--- a/roles/calico_master/templates/calico.yml.j2
+++ b/roles/calico/templates/calico.yml.j2
@@ -66,7 +66,7 @@ metadata:
 data:
   # Configure this with the location of your etcd cluster.
   etcd_endpoints: "{{ calico_etcd_endpoints }}"
-  
+
   # Configure the Calico backend to use.
   calico_backend: "bird"
 
@@ -126,8 +126,6 @@ spec:
       annotations:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
-      nodeSelector:
-        projectcalico.org/ds-ready: "true"
       hostNetwork: true
       tolerations:
         # Make sure calico/node gets scheduled on all nodes.
diff --git a/roles/calico_master/templates/calicov3.yml.j2 b/roles/calico/templates/calicov3.yml.j2
similarity index 99%
rename from roles/calico_master/templates/calicov3.yml.j2
rename to roles/calico/templates/calicov3.yml.j2
index e7573296422..66b458f0c35 100644
--- a/roles/calico_master/templates/calicov3.yml.j2
+++ b/roles/calico/templates/calicov3.yml.j2
@@ -181,8 +181,6 @@ spec:
       annotations:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
-      nodeSelector:
-        projectcalico.org/ds-ready: "true"
       hostNetwork: true
       tolerations:
         # Make sure calico/node gets scheduled on all nodes.
@@ -290,7 +288,7 @@ spec:
             # chosen from this range. Changing this value after installation will have
             # no effect. This should fall within '--cluster-cidr'.
             - name: CALICO_IPV4POOL_CIDR
-              value: "{{ openshift.master.sdn_cluster_network_cidr }}"
+              value: "{{ openshift_cluster_network_cidr }}"
             - name: CALICO_IPV4POOL_IPIP
               value: "{{ calico_ipv4pool_ipip }}"
             # Disable IPv6 on Kubernetes.
diff --git a/roles/calico_master/README.md b/roles/calico_master/README.md
deleted file mode 100644
index 310eabeec3f..00000000000
--- a/roles/calico_master/README.md
+++ /dev/null
@@ -1,48 +0,0 @@
-# Calico (Master)
-
-Configure Calico components for the Master host.
-
-## Requirements
-
-* Ansible 2.2
-
-## Installation
-
-To install, set the following inventory configuration parameters:
-
-* `openshift_use_calico=True`
-* `openshift_use_openshift_sdn=False`
-* `os_sdn_network_plugin_name='cni'`
-
-By default, Calico will share the etcd used by OpenShift.
-To configure Calico to use a separate instance of etcd, place etcd SSL client certs on your master,
-then set the following variables in your inventory.ini:
-
-* `calico_etcd_ca_cert_file=/path/to/etcd-ca.crt`
-* `calico_etcd_cert_file=/path/to/etcd-client.crt`
-* `calico_etcd_key_file=/path/to/etcd-client.key`
-* `calico_etcd_endpoints=https://etcd:2379`
-
-## Upgrading
-
-OpenShift-Ansible installs Calico as a self-hosted install. Previously, Calico ran as a systemd service. Running Calico
-in this manner is now deprecated, and must be upgraded to a hosted cluster. Please run the Legacy Upgrade playbook to
-upgrade your existing Calico deployment to a hosted deployment:
-
-        ansible-playbook -i inventory.ini playbooks/byo/calico/legacy_upgrade.yml
-
-## Additional Calico/Node and Felix Configuration Options
-
-Additional parameters that can be defined in the inventory are:
-
-
-| Environment | Description | Schema | Default |   
-|---------|----------------------|---------|---------|
-| CALICO_IPV4POOL_IPIP | IPIP Mode to use for the IPv4 POOL created at start up.	| off, always, cross-subnet	| always |
-| CALICO_LOG_DIR | Directory on the host machine where Calico Logs are written.| String	| /var/log/calico |
-
-### Contact Information
-
-Author: Dan Osborne <dan@projectcalico.org>
-
-For support, join the `#openshift` channel on the [calico users slack](calicousers.slack.com).
diff --git a/roles/calico_master/tasks/main.yml b/roles/calico_master/tasks/main.yml
index 72c6f47b4c6..fddd48c2545 100644
--- a/roles/calico_master/tasks/main.yml
+++ b/roles/calico_master/tasks/main.yml
@@ -58,8 +58,8 @@
     -f {{ mktemp.stdout }}/calico.yml
     --config={{ openshift.common.config_base }}/master/admin.kubeconfig
   register: calico_create_output
-  failed_when: "calico_create_output.rc != 0"
-  changed_when: "('created' in calico_create_output.stdout) or ('configured' in calico_create_output.stdout)"
+  failed_when: "('already exists' not in calico_create_output.stderr) and ('created' not in calico_create_output.stdout) and calico_create_output.rc != 0"
+  changed_when: ('created' in calico_create_output.stdout)
 
 - name: Calico Master | Delete temp directory
   file: