diff --git a/classes/cluster/sl-k8s-calico/kubernetes/control.yml b/classes/cluster/sl-k8s-calico/kubernetes/control.yml
index 1c0f9d1..9093496 100644
--- a/classes/cluster/sl-k8s-calico/kubernetes/control.yml
+++ b/classes/cluster/sl-k8s-calico/kubernetes/control.yml
@@ -1,7 +1,7 @@
 classes:
 - service.etcd.server.cluster
 - system.haproxy.proxy.listen.kubernetes.apiserver
-- system.linux.system.repo.docker_legacy
+- system.linux.system.repo.mcp.apt_mirantis.docker_legacy
 - system.salt.minion.cert.etcd_server
 - system.kubernetes.master.cluster
 - cluster.sl-k8s-calico.kubernetes.compute
@@ -24,10 +24,15 @@
   kubernetes:
     common:
       addons:
-        netchecker:
-          enabled: true
         helm:
-          enabled: true
+          enabled: ${_param:kubernetes_helm_enabled}
+        calico_policy:
+          enabled: ${_param:kubernetes_calico_policy_enabled}
+          image: ${_param:kubernetes_calico_policy_image}
+        netchecker:
+          enabled: ${_param:kubernetes_netchecker_enabled}
+          agent_image: ${_param:kubernetes_netchecker_agent_image}
+          server_image: ${_param:kubernetes_netchecker_server_image}
         coredns:
           enabled: ${_param:kubernetes_coredns_enabled}
         externaldns:
@@ -35,6 +40,8 @@
           image: ${_param:kubernetes_externaldns_image}
           provider: ${_param:kubernetes_externaldns_provider}
     master:
+      kubelet:
+        fail_on_swap: ${_param:kubelet_fail_on_swap}
       etcd:
         ssl:
           enabled: true
@@ -46,4 +53,6 @@
               enabled: true
       namespace:
         netchecker:
-          enabled: true
+          enabled: ${_param:kubernetes_netchecker_enabled}
+      auth:
+        mode: Node,RBAC