don't sync certs on masters, already done in another task

roles/kubernetes/node/tasks/secrets.yml

@@ -48,3 +48,4 @@
     - "{{ kube_cert_dir}}/node.pem"
     - "{{ kube_cert_dir}}/node-key.pem"
   delegate_to: "{{ groups['kube-master'][0] }}"
+  when: inventory_hostname not in "{{ groups['kube-master'] }}"