diff --git a/roles/kubernetes/secrets/tasks/gen_certs_script.yml b/roles/kubernetes/secrets/tasks/gen_certs_script.yml
index cf8881aabb296a4842183ec94fb79beeba35d7ae..ea243f4db9a654a9a9b29e59d4ae18d99c34b639 100644
--- a/roles/kubernetes/secrets/tasks/gen_certs_script.yml
+++ b/roles/kubernetes/secrets/tasks/gen_certs_script.yml
@@ -61,6 +61,7 @@
                   {% endif %}
                 {% endfor %}"
   delegate_to: "{{ groups['kube-master']|first }}"
+  run_once: true
   when: gen_certs|default(false)
   notify: set secret_changed