diff --git a/roles/rke2/selinux/my-openstack.te b/roles/rke2/selinux/my-openstack.te
index 9c3023b3f7eef5a352c84b05eef3570b07d3838f..0cdb1a0efa0e03acbeeabf86175ae1f46e58f709 100644
--- a/roles/rke2/selinux/my-openstack.te
+++ b/roles/rke2/selinux/my-openstack.te
@@ -5,8 +5,11 @@ require {
         type container_t;
         class dir read;
         class lnk_file read;
+        class file read;
+        class file write;
 }
 
 #============= container_t ==============
 allow container_t cert_t:dir read;
 allow container_t cert_t:lnk_file read;
+allow container_t cert_t:file {read write};
\ No newline at end of file
diff --git a/roles/rke2/tasks/kubeconfig.yml b/roles/rke2/tasks/kubeconfig.yml
index 2d19b94d2dd043639c857a74743d5d150f632cb7..72b769bdff81750efef9664870298d919f302f2a 100644
--- a/roles/rke2/tasks/kubeconfig.yml
+++ b/roles/rke2/tasks/kubeconfig.yml
@@ -10,24 +10,24 @@
   when:  ( 'master' in group_names )
 #  notify:
 #  - wait for RANCHER to come up
-- name: start rke2 on the servers
-  ansible.builtin.systemd:
-    name: "rke2-{{ node_type }}"
-    enabled: yes
-    masked: no
-    state: started
-    daemon_reload: yes
-  ignore_errors: True
-#  when:  ( 'servers' in group_names )
+# - name: start rke2 on the servers
+#   ansible.builtin.systemd:
+#     name: "rke2-{{ node_type }}"
+#     enabled: yes
+#     masked: no
+#     state: started
+#     daemon_reload: yes
+#   ignore_errors: True
+# #  when:  ( 'servers' in group_names )
 
-- name: start rke2 everywhere
-  ansible.builtin.systemd:
-    name: "rke2-{{ node_type }}"
-    enabled: yes
-    masked: no
-    state: started
-    daemon_reload: yes
-  ignore_errors: True
+# - name: start rke2 everywhere
+#   ansible.builtin.systemd:
+#     name: "rke2-{{ node_type }}"
+#     enabled: yes
+#     masked: no
+#     state: started
+#     daemon_reload: yes
+#   ignore_errors: True
 
 - name: wait for kubeconfig
   wait_for:
diff --git a/roles/rke2/tasks/main.yml b/roles/rke2/tasks/main.yml
index 185e567a8268449b0654e42bcc9d08c6b5dda4c1..28c947a4a1278ea82aa809ca7f1776f5f645f399 100644
--- a/roles/rke2/tasks/main.yml
+++ b/roles/rke2/tasks/main.yml
@@ -17,7 +17,7 @@
   when: state != 'absent' 
 
 - include_tasks: kubeconfig.yml
-  when: state != 'absent' #and 'master' in group_names 
+  when: state != 'absent' and 'master' in group_names 
 
 # Flush the handlers only for fresh installs
 #- name: Flush handlers
@@ -25,8 +25,8 @@
 
   
 #This task runs only after the full installer went through and had a bit of time to boot, then starts to enforce SELinux
-- include_tasks: fix_selinux.yml
-  when: state != 'absent' and 'control-plane' in group_names
+#- include_tasks: fix_selinux.yml
+#  when: state != 'absent' and 'control-plane' in group_names
 
 - name: uninstall rke2
   command: rke2-uninstall.sh
diff --git a/roles/rke2/tasks/setup_host.yml b/roles/rke2/tasks/setup_host.yml
index fefb62902bd5f0fd6cddee0cdf93b952bff00b30..8bd536bec251422d0ef9a6887c4505524b013add 100644
--- a/roles/rke2/tasks/setup_host.yml
+++ b/roles/rke2/tasks/setup_host.yml
@@ -13,13 +13,13 @@
     /usr/sbin/pvresize -y -q /dev/vda2 
     /usr/sbin/lvresize -y -q -r -l +100%FREE /dev/mapper/*root 
 
-- name: Upgrade to latest kernel
-  shell: |
-    dnf upgrade -y 
-    dnf updateinfo list --security --available
-    dnf install https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm --assumeyes
-    dnf --enablerepo=elrepo-kernel install kernel-ml --assumeyes
-    touch /.autorelabel
+# - name: Upgrade to latest kernel
+#   shell: |
+#     dnf upgrade -y 
+#     dnf updateinfo list --security --available
+#     dnf install https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm --assumeyes
+#     dnf --enablerepo=elrepo-kernel install kernel-ml --assumeyes
+#     touch /.autorelabel
     
 - name: install RHEL packages
   dnf:
@@ -71,15 +71,11 @@
     name: etcd
     group: etcd
 
-- name: Reboot but not on upgrades, so kernel updates only install at initial runs 
-  ansible.builtin.reboot:
-    reboot_timeout: 3600
-  when: ( not upgrade ) 
+# - name: Reboot but not on upgrades, so kernel updates only install at initial runs 
+#   ansible.builtin.reboot:
+#     reboot_timeout: 3600
+#   when: ( not upgrade ) 
 
-- name: Download root CA
-  get_url:
-    url: https://curl.se/ca/cacert.pem
-    dest: /etc/ssl/certs
 
 - name: Disable SELinux
   selinux:
@@ -87,6 +83,11 @@
     state: permissive
   when: ( 'control-plane' in group_names )
 
+- name: Download root CA
+  get_url:
+    url: https://curl.se/ca/cacert.pem
+    dest: /etc/ssl/certs
+
 - name: Update CA trust
   shell: update-ca-trust
   
@@ -129,3 +130,8 @@
     state: directory
     recurse: yes
 
+- name: Enable SELinux
+  selinux:
+    policy: targeted
+    state: enforcing
+
diff --git a/roles/rke2/tasks/templates.yml b/roles/rke2/tasks/templates.yml
index 619fd2e1b46579ea3e5f91ab463cd35aec06e702..f8e1c5e67f322f97c5598b4c09a2a9b70949b7a8 100644
--- a/roles/rke2/tasks/templates.yml
+++ b/roles/rke2/tasks/templates.yml
@@ -7,8 +7,8 @@
         dest: '/var/lib/rancher/rke2/server/manifests/{{ item.key }}.yaml'
       with_dict: "{{ manifests_config }}"
       when: item.value.enabled
-      #notify:
-      #  - restart rke2
+      notify:
+        - restart rke2
 
     - name: Remove manifest template files
       ansible.builtin.file: