yet another way of maybe making finally sure that each reboot/reload starts the CCM properly

roles/rke2/tasks/fix_selinux.yml

@@ -6,16 +6,16 @@
 - name: Update CA trust
   shell: update-ca-trust
 
-#- name: kill the openstack ccm pods to make sure they boot in permissive mode
-#  shell: "/var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml rollout restart -n kube-system ds openstack-cloud-controller-manager "
-#  register: openstack_ccm_ready
-#  when: ( 'master' in group_names and not upgrade)
-#  ignore_errors: True
+- name: kill the openstack ccm pods to make sure they boot in permissive mode
+  shell: "/var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml rollout restart -n kube-system ds openstack-cloud-controller-manager "
+  register: openstack_ccm_restart
+  when: ( 'master' in group_names )
+  ignore_errors: True
 
 - name: Wait for openstack-cloud-controller deamon set to be ready
   shell: "/var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml wait --namespace=kube-system --for=condition=Ready pods --selector app=openstack-cloud-controller-manager --timeout=60s"
   register: openstack_ccm_ready
-  #when: ('master' in group_names)
+  when: ('master' in group_names)
   ignore_errors: True