diff --git a/roles/k3s/defaults/main.yml b/roles/k3s/defaults/main.yml
index 8271af80..705779b7 100644
--- a/roles/k3s/defaults/main.yml
+++ b/roles/k3s/defaults/main.yml
@@ -9,6 +9,7 @@ k3s_extra_server_args: ""
 
 k3s_dry_run: no
 
+k3s_tunelo_cidr: "10.0.3.0/24"
 k3s_cluster_cidr: "192.168.64.0/18"
 k3s_cluster_node_blocksize: 28
 
diff --git a/roles/k3s/tasks/config-neutron.yml b/roles/k3s/tasks/config-neutron.yml
index c32b4c7c..a76f41c9 100644
--- a/roles/k3s/tasks/config-neutron.yml
+++ b/roles/k3s/tasks/config-neutron.yml
@@ -23,6 +23,28 @@
       enable_dhcp: no
   become: yes
 
+- name: Create tunelo-calico network
+  kolla_toolbox:
+      module_name: os_network
+      module_args:
+        auth: "{{ openstack_auth }}"
+        name: tunelo-calico
+        provider_network_type: flat
+        provider_physical_network: tunelo
+        shared: false
+  become: yes
+
+- name: Create tunelo-calico subnet
+  kolla_toolbox:
+      module_name: os_subnet
+      module_args:
+        auth: "{{ openstack_auth }}"
+        network_name: tunelo-calico
+        name: tunelo-calico-subnet
+        cidr: "{{ k3s_tunelo_cidr }}"
+        enable_dhcp: yes
+  become: yes
+
 # FIXME(jason): this doesn't actually add the subnet to the router!
 # When we have updated to a later Ansible we can potentially fetch the router's
 # interfaces with routers_info and then merge this interface into the list?