diff --git a/docs/FAQ.md b/docs/FAQ.md
index 2aa2c875..f8b01169 100644
--- a/docs/FAQ.md
+++ b/docs/FAQ.md
@@ -291,3 +291,16 @@ alertmanager:
 ### If you want to receive alerts **via Slack**, then do next:
 * See [this instruction](https://slack.com/help/articles/115005265063-Incoming-webhooks-for-Slack) and generate Slack Incoming Webhook 
 * Set `alertmanager_slack_webhook`, `alertmanager_slack_channel` variables in [AWS Secrets Manager](https://console.aws.amazon.com/secretsmanager/home?region=us-east-1#!/home) secret with the pattern `/${local.name_wo_region}/infra/layer2-k8s`.
+
+## Deleting Tigera-operator
+1. Run
+```bash
+kubectl delete installations.operator.tigera.io default
+```
+2. Set `enabled: false` for `id: tigera-operator` in the file **helm-releases.yaml** 
+3. Run `terraform apply` in the layer2-k8s folder
+4. Run
+```bash
+kubectl delete ns calico-apiserver calico-system
+```
+5. Restart all nodes
diff --git a/terraform/layer2-k8s/.terraform.lock.hcl b/terraform/layer2-k8s/.terraform.lock.hcl
index 34a0ddd4..a0d1eeb7 100644
--- a/terraform/layer2-k8s/.terraform.lock.hcl
+++ b/terraform/layer2-k8s/.terraform.lock.hcl
@@ -117,21 +117,21 @@ provider "registry.terraform.io/hashicorp/kubernetes" {
 }
 
 provider "registry.terraform.io/hashicorp/random" {
-  version = "3.1.2"
+  version = "3.1.3"
   hashes = [
-    "h1:9A6Ghjgad0KjJRxa6nPo8i8uFvwj3Vv0wnEgy49u+24=",
-    "zh:0daceba867b330d3f8e2c5dc895c4291845a78f31955ce1b91ab2c4d1cd1c10b",
-    "zh:104050099efd30a630741f788f9576b19998e7a09347decbec3da0b21d64ba2d",
-    "zh:173f4ef3fdf0c7e2564a3db0fac560e9f5afdf6afd0b75d6646af6576b122b16",
-    "zh:41d50f975e535f968b3f37170fb07937c15b76d85ba947d0ce5e5ff9530eda65",
-    "zh:51a5038867e5e60757ed7f513dd6a973068241190d158a81d1b69296efb9cb8d",
-    "zh:6432a568e97a5a36cc8aebca5a7e9c879a55d3bc71d0da1ab849ad905f41c0be",
-    "zh:6bac6501394b87138a5e17c9f3a41e46ff7833ad0ba2a96197bb7787e95b641c",
-    "zh:6c0a7f5faacda644b022e7718e53f5868187435be6d000786d1ca05aa6683a25",
-    "zh:74c89de3fa6ef3027efe08f8473c2baeb41b4c6cee250ba7aeb5b64e8c79800d",
+    "h1:7+wnAXQM7IpNEAQ6WZXdO0ZfQW/ncQFXYJ5T2KaR+Z8=",
+    "zh:26e07aa32e403303fc212a4367b4d67188ac965c37a9812e07acee1470687a73",
+    "zh:27386f48e9c9d849fbb5a8828d461fde35e71f6b6c9fc235bc4ae8403eb9c92d",
+    "zh:5f4edda4c94240297bbd9b83618fd362348cadf6bf24ea65ea0e1844d7ccedc0",
+    "zh:646313a907126cd5e69f6a9fafe816e9154fccdc04541e06fed02bb3a8fa2d2e",
+    "zh:7349692932a5d462f8dee1500ab60401594dddb94e9aa6bf6c4c0bd53e91bbb8",
     "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:b29eabbf0a5298f0e95a1df214c7cfe06ea9bcf362c63b3ad2f72d85da7d4685",
-    "zh:e891458c7a61e5b964e09616f1a4f87d0471feae1ec04cc51776e7dec1a3abce",
+    "zh:9034daba8d9b32b35930d168f363af04cecb153d5849a7e4a5966c97c5dc956e",
+    "zh:bb81dfca59ef5f949ef39f19ea4f4de25479907abc28cdaa36d12ecd7c0a9699",
+    "zh:bcf7806b99b4c248439ae02c8e21f77aff9fadbc019ce619b929eef09d1221bb",
+    "zh:d708e14d169e61f326535dd08eecd3811cd4942555a6f8efabc37dbff9c6fc61",
+    "zh:dc294e19a46e1cefb9e557a7b789c8dd8f319beca99b8c265181bc633dc434cc",
+    "zh:f9d758ee53c55dc016dd736427b6b0c3c8eb4d0dbbc785b6a3579b0ffedd9e42",
   ]
 }
 
diff --git a/terraform/layer2-k8s/README.md b/terraform/layer2-k8s/README.md
index 6121a8e7..652af543 100644
--- a/terraform/layer2-k8s/README.md
+++ b/terraform/layer2-k8s/README.md
@@ -19,7 +19,7 @@
 | <a name="provider_http"></a> [http](#provider\_http) | 2.1.0 |
 | <a name="provider_kubectl"></a> [kubectl](#provider\_kubectl) | 1.14.0 |
 | <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.10.0 |
-| <a name="provider_random"></a> [random](#provider\_random) | 3.1.2 |
+| <a name="provider_random"></a> [random](#provider\_random) | 3.1.3 |
 | <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
 
 ## Modules
@@ -51,6 +51,7 @@
 | <a name="module_kube_prometheus_stack_namespace"></a> [kube\_prometheus\_stack\_namespace](#module\_kube\_prometheus\_stack\_namespace) | ../modules/kubernetes-namespace | n/a |
 | <a name="module_loki_namespace"></a> [loki\_namespace](#module\_loki\_namespace) | ../modules/kubernetes-namespace | n/a |
 | <a name="module_reloader_namespace"></a> [reloader\_namespace](#module\_reloader\_namespace) | ../modules/kubernetes-namespace | n/a |
+| <a name="module_tigera_operator_namespace"></a> [tigera\_operator\_namespace](#module\_tigera\_operator\_namespace) | ../modules/kubernetes-namespace | n/a |
 | <a name="module_victoria_metrics_k8s_stack_namespace"></a> [victoria\_metrics\_k8s\_stack\_namespace](#module\_victoria\_metrics\_k8s\_stack\_namespace) | ../modules/kubernetes-namespace | n/a |
 
 ## Resources
@@ -63,7 +64,6 @@
 | [aws_s3_bucket_public_access_block.gitlab_runner_cache_public_access_block](https://registry.terraform.io/providers/aws/4.10.0/docs/resources/s3_bucket_public_access_block) | resource |
 | [helm_release.aws_loadbalancer_controller](https://registry.terraform.io/providers/helm/2.5.1/docs/resources/release) | resource |
 | [helm_release.aws_node_termination_handler](https://registry.terraform.io/providers/helm/2.5.1/docs/resources/release) | resource |
-| [helm_release.calico_daemonset](https://registry.terraform.io/providers/helm/2.5.1/docs/resources/release) | resource |
 | [helm_release.cert_manager](https://registry.terraform.io/providers/helm/2.5.1/docs/resources/release) | resource |
 | [helm_release.certificate](https://registry.terraform.io/providers/helm/2.5.1/docs/resources/release) | resource |
 | [helm_release.cluster_autoscaler](https://registry.terraform.io/providers/helm/2.5.1/docs/resources/release) | resource |
@@ -80,7 +80,9 @@
 | [helm_release.loki_stack](https://registry.terraform.io/providers/helm/2.5.1/docs/resources/release) | resource |
 | [helm_release.prometheus_operator](https://registry.terraform.io/providers/helm/2.5.1/docs/resources/release) | resource |
 | [helm_release.reloader](https://registry.terraform.io/providers/helm/2.5.1/docs/resources/release) | resource |
+| [helm_release.tigera_operator](https://registry.terraform.io/providers/helm/2.5.1/docs/resources/release) | resource |
 | [helm_release.victoria_metrics_k8s_stack](https://registry.terraform.io/providers/helm/2.5.1/docs/resources/release) | resource |
+| [kubectl_manifest.calico_felix](https://registry.terraform.io/providers/gavinbunney/kubectl/1.14.0/docs/resources/manifest) | resource |
 | [kubectl_manifest.istio_prometheus_service_monitor_cp](https://registry.terraform.io/providers/gavinbunney/kubectl/1.14.0/docs/resources/manifest) | resource |
 | [kubectl_manifest.istio_prometheus_service_monitor_dp](https://registry.terraform.io/providers/gavinbunney/kubectl/1.14.0/docs/resources/manifest) | resource |
 | [kubectl_manifest.kube_prometheus_stack_operator_crds](https://registry.terraform.io/providers/gavinbunney/kubectl/1.14.0/docs/resources/manifest) | resource |
diff --git a/terraform/layer2-k8s/eks-calico.tf b/terraform/layer2-k8s/eks-calico.tf
deleted file mode 100644
index 768b340b..00000000
--- a/terraform/layer2-k8s/eks-calico.tf
+++ /dev/null
@@ -1,33 +0,0 @@
-locals {
-  aws_calico = {
-    name          = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].id
-    enabled       = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].enabled
-    chart         = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].chart
-    repository    = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].repository
-    chart_version = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].chart_version
-    namespace     = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].namespace
-  }
-  aws_calico_values = <<VALUES
-calico:
-  typha:
-    logseverity: Warning #Debug, Info, Warning, Error, Fatal
-  node:
-    logseverity: Warning #Debug, Info, Warning, Error, Fatal
-VALUES
-}
-
-resource "helm_release" "calico_daemonset" {
-  count = local.aws_calico.enabled ? 1 : 0
-
-  name        = local.aws_calico.name
-  chart       = local.aws_calico.chart
-  repository  = local.aws_calico.repository
-  version     = local.aws_calico.chart_version
-  namespace   = local.aws_calico.namespace
-  max_history = var.helm_release_history_size
-
-  values = [
-    local.aws_calico_values
-  ]
-
-}
diff --git a/terraform/layer2-k8s/eks-tigera-operator.tf b/terraform/layer2-k8s/eks-tigera-operator.tf
new file mode 100644
index 00000000..383dc58e
--- /dev/null
+++ b/terraform/layer2-k8s/eks-tigera-operator.tf
@@ -0,0 +1,96 @@
+locals {
+  tigera_operator = {
+    name          = local.helm_releases[index(local.helm_releases.*.id, "tigera-operator")].id
+    enabled       = local.helm_releases[index(local.helm_releases.*.id, "tigera-operator")].enabled
+    chart         = local.helm_releases[index(local.helm_releases.*.id, "tigera-operator")].chart
+    repository    = local.helm_releases[index(local.helm_releases.*.id, "tigera-operator")].repository
+    chart_version = local.helm_releases[index(local.helm_releases.*.id, "tigera-operator")].chart_version
+    namespace     = local.helm_releases[index(local.helm_releases.*.id, "tigera-operator")].namespace
+  }
+
+  tigera_operator_values = <<VALUES
+installation:
+  kubernetesProvider: EKS
+VALUES
+}
+
+#tfsec:ignore:kubernetes-network-no-public-egress tfsec:ignore:kubernetes-network-no-public-ingress
+module "tigera_operator_namespace" {
+  count = local.tigera_operator.enabled ? 1 : 0
+
+  source = "../modules/kubernetes-namespace"
+  name   = local.tigera_operator.name
+  network_policies = [
+    {
+      name         = "default-deny"
+      policy_types = ["Ingress", "Egress"]
+      pod_selector = {}
+    },
+    {
+      name         = "allow-this-namespace"
+      policy_types = ["Ingress"]
+      pod_selector = {}
+      ingress = {
+        from = [
+          {
+            namespace_selector = {
+              match_labels = {
+                name = local.tigera_operator.namespace
+              }
+            }
+          }
+        ]
+      }
+    },
+    {
+      name         = "allow-egress"
+      policy_types = ["Egress"]
+      pod_selector = {}
+      egress = {
+        to = [
+          {
+            ip_block = {
+              cidr = "0.0.0.0/0"
+              except = [
+                "169.254.169.254/32"
+              ]
+            }
+          }
+        ]
+      }
+    }
+  ]
+}
+
+resource "kubectl_manifest" "calico_felix" {
+  count = local.tigera_operator.enabled ? 1 : 0
+
+  yaml_body = <<YAML
+apiVersion: crd.projectcalico.org/v1
+kind: FelixConfiguration
+metadata:
+  name: default
+spec:
+  logSeverityScreen: Warning
+  usageReportingEnabled: false
+YAML
+
+  depends_on = [
+    helm_release.tigera_operator
+  ]
+}
+
+resource "helm_release" "tigera_operator" {
+  count = local.tigera_operator.enabled ? 1 : 0
+
+  name        = local.tigera_operator.name
+  chart       = local.tigera_operator.chart
+  repository  = local.tigera_operator.repository
+  version     = local.tigera_operator.chart_version
+  namespace   = module.tigera_operator_namespace[count.index].name
+  max_history = var.helm_release_history_size
+
+  values = [
+    local.tigera_operator_values
+  ]
+}
diff --git a/terraform/layer2-k8s/eks-victoria-metrics-k8s-stack.tf b/terraform/layer2-k8s/eks-victoria-metrics-k8s-stack.tf
index 0763abc9..05725899 100644
--- a/terraform/layer2-k8s/eks-victoria-metrics-k8s-stack.tf
+++ b/terraform/layer2-k8s/eks-victoria-metrics-k8s-stack.tf
@@ -532,7 +532,7 @@ resource "helm_release" "victoria_metrics_k8s_stack" {
 
   depends_on = [
     kubectl_manifest.kube_prometheus_stack_operator_crds,
-    helm_release.calico_daemonset,
+    helm_release.tigera_operator,
     helm_release.ingress_nginx
   ]
 
diff --git a/terraform/layer2-k8s/helm-releases.yaml b/terraform/layer2-k8s/helm-releases.yaml
index 67e74639..df9a07be 100644
--- a/terraform/layer2-k8s/helm-releases.yaml
+++ b/terraform/layer2-k8s/helm-releases.yaml
@@ -11,12 +11,6 @@ releases:
     repository: https://aws.github.io/eks-charts
     chart_version: 0.18.1
     namespace: aws-node-termination-handler
-  - id: aws-calico
-    enabled: true
-    chart: aws-calico
-    repository: https://aws.github.io/eks-charts
-    chart_version: 0.3.11
-    namespace: kube-system
   - id: cert-manager
     enabled: false
     chart: cert-manager
@@ -90,7 +84,7 @@ releases:
     chart_version: 1.49.0
     namespace: kiali
   - id: kube-prometheus-stack
-    enabled: false
+    enabled: true
     chart: kube-prometheus-stack
     repository: https://prometheus-community.github.io/helm-charts
     chart_version: 34.10.0
@@ -107,8 +101,14 @@ releases:
     repository: https://stakater.github.io/stakater-charts
     chart_version: 0.0.110
     namespace: reloader
-  - id: victoria-metrics-k8s-stack
+  - id: tigera-operator
     enabled: true
+    chart: tigera-operator
+    repository: https://projectcalico.docs.tigera.io/charts
+    chart_version: v3.23.0
+    namespace: tigera-operator
+  - id: victoria-metrics-k8s-stack
+    enabled: false
     chart: victoria-metrics-k8s-stack
     repository: https://victoriametrics.github.io/helm-charts
     chart_version: 0.8.1