diff --git a/roles/kubernetes/secrets/tasks/gen_certs_script.yml b/roles/kubernetes/secrets/tasks/gen_certs_script.yml
index cf8881aab..ea243f4db 100644
--- a/roles/kubernetes/secrets/tasks/gen_certs_script.yml
+++ b/roles/kubernetes/secrets/tasks/gen_certs_script.yml
@@ -61,6 +61,7 @@
                   {% endif %}
                 {% endfor %}"
   delegate_to: "{{ groups['kube-master']|first }}"
+  run_once: true
   when: gen_certs|default(false)
   notify: set secret_changed