diff --git a/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/compute.yml b/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/compute.yml
index 58a8803..18d4302 100644
--- a/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/compute.yml
+++ b/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/compute.yml
@@ -9,7 +9,7 @@
   docker:
     host:
       pkgs:
-        - docker-engine=1.12.6-0~ubuntu-xenial
+        - ${_param:kubernetes_docker_package}
         - python-docker
   kubernetes:
     pool:
diff --git a/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/control.yml b/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/control.yml
index 78819b8..2caf3f1 100644
--- a/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/control.yml
+++ b/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/control.yml
@@ -32,11 +32,14 @@
             enabled: true
       namespace:
         netchecker:
-          enabled: true
+          enabled: ${_param:kubernetes_netchecker_enabled}
       addons:
+        helm:
+          enabled: ${_param:kubernetes_helm_enabled}
+        calico_policy:
+          enabled: ${_param:kubernetes_calico_policy_enabled}
+          image: ${_param:kubernetes_calico_policy_image}
         netchecker:
-          enabled: true
+          enabled: ${_param:kubernetes_netchecker_enabled}
           agent_image: ${_param:kubernetes_netchecker_agent_image}
           server_image: ${_param:kubernetes_netchecker_server_image}
-        helm:
-          enabled: true
diff --git a/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/init.yml b/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/init.yml
index 0806512..a381b5e 100644
--- a/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/init.yml
+++ b/classes/cluster/virtual-mcp11-k8s-calico-dyn/kubernetes/init.yml
@@ -15,14 +15,23 @@
     kubernetes_mtu: 1500
     etcd_initial_token: IN7KaRMSo3xkGxkjAAPtkRkAgqN4ZNRq
 
+    # docker package version
+    kubernetes_docker_package: docker-engine=1.12.6-0~ubuntu-xenial
+
     # component docker images
     kubernetes_calicoctl_image: docker-prod-virtual.docker.mirantis.net/mirantis/projectcalico/calico/ctl:latest
     kubernetes_calico_image: docker-prod-virtual.docker.mirantis.net/mirantis/projectcalico/calico/node:latest
     kubernetes_calico_cni_image: docker-prod-virtual.docker.mirantis.net/mirantis/projectcalico/calico/cni:latest
+    kubernetes_calico_policy_image: calico/kube-policy-controller:v0.5.4
     kubernetes_hyperkube_image: docker-prod-virtual.docker.mirantis.net/mirantis/kubernetes/hyperkube-amd64:v1.6.2-2
     kubernetes_netchecker_agent_image: quay.io/l23network/k8s-netchecker-agent:v1.0
     kubernetes_netchecker_server_image: quay.io/l23network/k8s-netchecker-server:v1.0
 
+    # switches of addons
+    kubernetes_helm_enabled: true
+    kubernetes_netchecker_enabled: true
+    kubernetes_calico_policy_enabled: false
+
     # addresses and hostnames
     kubernetes_internal_api_address: 10.254.0.1
     kubernetes_control_hostname: ctl
diff --git a/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/compute.yml b/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/compute.yml
index 6e9bf70..77ed2f5 100644
--- a/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/compute.yml
+++ b/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/compute.yml
@@ -9,7 +9,7 @@
   docker:
     host:
       pkgs:
-        - docker-engine=1.12.6-0~ubuntu-xenial
+        - ${_param:kubernetes_docker_package}
         - python-docker
   kubernetes:
     pool:
diff --git a/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/control.yml b/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/control.yml
index 09aade5..a98d70f 100644
--- a/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/control.yml
+++ b/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/control.yml
@@ -32,11 +32,14 @@
             enabled: true
       namespace:
         netchecker:
-          enabled: true
+          enabled: ${_param:kubernetes_netchecker_enabled}
       addons:
+        helm:
+          enabled: ${_param:kubernetes_helm_enabled}
+        calico_policy:
+          enabled: ${_param:kubernetes_calico_policy_enabled}
+          image: ${_param:kubernetes_calico_policy_image}
         netchecker:
-          enabled: true
+          enabled: ${_param:kubernetes_netchecker_enabled}
           agent_image: ${_param:kubernetes_netchecker_agent_image}
           server_image: ${_param:kubernetes_netchecker_server_image}
-        helm:
-          enabled: true
diff --git a/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/init.yml b/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/init.yml
index 0806512..a381b5e 100644
--- a/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/init.yml
+++ b/classes/cluster/virtual-mcp11-k8s-calico/kubernetes/init.yml
@@ -15,14 +15,23 @@
     kubernetes_mtu: 1500
     etcd_initial_token: IN7KaRMSo3xkGxkjAAPtkRkAgqN4ZNRq
 
+    # docker package version
+    kubernetes_docker_package: docker-engine=1.12.6-0~ubuntu-xenial
+
     # component docker images
     kubernetes_calicoctl_image: docker-prod-virtual.docker.mirantis.net/mirantis/projectcalico/calico/ctl:latest
     kubernetes_calico_image: docker-prod-virtual.docker.mirantis.net/mirantis/projectcalico/calico/node:latest
     kubernetes_calico_cni_image: docker-prod-virtual.docker.mirantis.net/mirantis/projectcalico/calico/cni:latest
+    kubernetes_calico_policy_image: calico/kube-policy-controller:v0.5.4
     kubernetes_hyperkube_image: docker-prod-virtual.docker.mirantis.net/mirantis/kubernetes/hyperkube-amd64:v1.6.2-2
     kubernetes_netchecker_agent_image: quay.io/l23network/k8s-netchecker-agent:v1.0
     kubernetes_netchecker_server_image: quay.io/l23network/k8s-netchecker-server:v1.0
 
+    # switches of addons
+    kubernetes_helm_enabled: true
+    kubernetes_netchecker_enabled: true
+    kubernetes_calico_policy_enabled: false
+
     # addresses and hostnames
     kubernetes_internal_api_address: 10.254.0.1
     kubernetes_control_hostname: ctl
diff --git a/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/compute.yml b/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/compute.yml
index 8ac1e8a..a844776 100644
--- a/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/compute.yml
+++ b/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/compute.yml
@@ -27,7 +27,7 @@
   docker:
     host:
       pkgs:
-        - docker-engine=1.12.6-0~ubuntu-xenial
+        - ${_param:kubernetes_docker_package}
         - python-docker
   kubernetes:
     pool:
diff --git a/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/control.yml b/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/control.yml
index 0116857..c4dcad2 100644
--- a/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/control.yml
+++ b/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/control.yml
@@ -32,13 +32,16 @@
       namespace:
         netchecker:
           enabled: true
-      addons:
+      namespace:
         netchecker:
-          enabled: true
+          enabled: ${_param:kubernetes_netchecker_enabled}
+      addons:
+        helm:
+          enabled: ${_param:kubernetes_helm_enabled}
+        netchecker:
+          enabled: ${_param:kubernetes_netchecker_enabled}
           agent_image: ${_param:kubernetes_netchecker_agent_image}
           server_image: ${_param:kubernetes_netchecker_server_image}
-        helm:
-          enabled: true
       network:
         engine: opencontrail
         public_ip_range: 185.22.97.128/26
diff --git a/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/init.yml b/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/init.yml
index acc7e93..8434c31 100644
--- a/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/init.yml
+++ b/classes/cluster/virtual-mcp11-k8s-contrail/kubernetes/init.yml
@@ -15,14 +15,23 @@
     kubernetes_dns_token: 0S1I4iJeFjq5fopPwwCwTp3xFpEZfeUl
     etcd_initial_token: IN7KaRMSo3xkGxkjAAPtkRkAgqN4ZNRq
 
+    # docker package version
+    kubernetes_docker_package: docker-engine=1.12.6-0~ubuntu-xenial
+
     # component docker images
     kubernetes_calicoctl_image: docker-prod-virtual.docker.mirantis.net/mirantis/projectcalico/calico/ctl:latest
     kubernetes_calico_image: docker-prod-virtual.docker.mirantis.net/mirantis/projectcalico/calico/node:latest
     kubernetes_calico_cni_image: docker-prod-virtual.docker.mirantis.net/mirantis/projectcalico/calico/cni:latest
+    kubernetes_calico_policy_image: calico/kube-policy-controller:v0.5.4
     kubernetes_hyperkube_image: docker-prod-virtual.docker.mirantis.net/mirantis/kubernetes/hyperkube-amd64:v1.6.2-2
     kubernetes_netchecker_agent_image: quay.io/l23network/k8s-netchecker-agent:v1.0
     kubernetes_netchecker_server_image: quay.io/l23network/k8s-netchecker-server:v1.0
 
+    # switches of addons
+    kubernetes_helm_enabled: true
+    kubernetes_netchecker_enabled: true
+    kubernetes_calico_policy_enabled: false
+
     # addresses and hostnames
     kubernetes_internal_api_address: 10.254.0.1
     kubernetes_control_hostname: ctl