diff --git a/roles/rke2/tasks/fix_selinux.yml b/roles/rke2/tasks/fix_selinux.yml
index fa7fed799107c61744135f3661ae909841a9ef3c..e35389f5c0f01006ffccdd98c97f1e3ac0f4e477 100644
--- a/roles/rke2/tasks/fix_selinux.yml
+++ b/roles/rke2/tasks/fix_selinux.yml
@@ -1,6 +1,7 @@
 - name: kill the openstack ccm pods to make sure they boot in permissive mode
-  shell: "/var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml --namespace=kube-system  rollout restart ds openstack-cloud-controller-manager"
+  shell: "/var/lib/rancher/rke2/bin/kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml rollout restart -n kube-system ds openstack-cloud-controller-manager "
   register: openstack_ccm_ready
+  when: ( 'master' in group_names )
 
 
 - name: Sleep for 300 seconds and continue with play