diff --git a/roles/rke2/tasks/fix_selinux.yml b/roles/rke2/tasks/fix_selinux.yml
index c343e297028a4ce38f0583a173c7ccfd7efedc0d..e422e8091b2547741545090afc376617f6b9e58e 100644
--- a/roles/rke2/tasks/fix_selinux.yml
+++ b/roles/rke2/tasks/fix_selinux.yml
@@ -6,16 +6,16 @@
 - name: Update CA trust
   shell: update-ca-trust
 
-#- name: kill the openstack ccm pods to make sure they boot in permissive mode
-#  shell: "/var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml rollout restart -n kube-system ds openstack-cloud-controller-manager "
-#  register: openstack_ccm_ready
-#  when: ( 'master' in group_names and not upgrade)
-#  ignore_errors: True
+- name: kill the openstack ccm pods to make sure they boot in permissive mode
+  shell: "/var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml rollout restart -n kube-system ds openstack-cloud-controller-manager "
+  register: openstack_ccm_restart
+  when: ( 'master' in group_names )
+  ignore_errors: True
 
 - name: Wait for openstack-cloud-controller deamon set to be ready
   shell: "/var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml wait --namespace=kube-system --for=condition=Ready pods --selector app=openstack-cloud-controller-manager --timeout=60s"
   register: openstack_ccm_ready
-  #when: ('master' in group_names)
+  when: ('master' in group_names)
   ignore_errors: True