diff --git a/roles/etcd/tasks/main.yml b/roles/etcd/tasks/main.yml
index 98890e23871c8ee7c6fc430a6df45223dfde4fca..7256927e195c2784c827bfaf4c4a555889d29072 100644
--- a/roles/etcd/tasks/main.yml
+++ b/roles/etcd/tasks/main.yml
@@ -19,6 +19,7 @@
   command: "openssl x509 -in {{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem -noout -serial"
   register: "etcd_client_cert_serial_result"
   changed_when: false
+  check_mode: no
   when:
     - inventory_hostname in groups['k8s_cluster']|union(groups['calico_rr']|default([]))|unique|sort
   tags:
diff --git a/roles/kubernetes/node/tasks/facts.yml b/roles/kubernetes/node/tasks/facts.yml
index d4bd428f585418f9adc757faa8f7c630c5d0920a..32c01805c82f5a12296ffea7765f9be061e707b8 100644
--- a/roles/kubernetes/node/tasks/facts.yml
+++ b/roles/kubernetes/node/tasks/facts.yml
@@ -4,6 +4,7 @@
     shell: "docker info | grep 'Cgroup Driver' | awk -F': ' '{ print $2; }'"
     register: docker_cgroup_driver_result
     changed_when: false
+    check_mode: no
 
   - name: set kubelet_cgroup_driver_detected fact for docker
     set_fact:
diff --git a/roles/kubernetes/node/tasks/main.yml b/roles/kubernetes/node/tasks/main.yml
index a342d9400ee9830e2eaaa4a7642ae196cb94a51b..29042b6805e3232b1dd5694c1435453e4373554e 100644
--- a/roles/kubernetes/node/tasks/main.yml
+++ b/roles/kubernetes/node/tasks/main.yml
@@ -52,6 +52,7 @@
   register: modinfo_br_netfilter
   failed_when: modinfo_br_netfilter.rc not in [0, 1]
   changed_when: false
+  check_mode: no
 
 - name: Verify br_netfilter module path exists
   file:
@@ -77,6 +78,7 @@
   command: "sysctl net.bridge.bridge-nf-call-iptables"
   failed_when: false
   changed_when: false
+  check_mode: no
   register: sysctl_bridge_nf_call_iptables
 
 - name: Enable bridge-nf-call tables
diff --git a/roles/kubernetes/node/tasks/pre_upgrade.yml b/roles/kubernetes/node/tasks/pre_upgrade.yml
index 72100373e3c0554ea5735d53b13eb87bcc8e3e1f..d9c2d07ef17e2efcd5da83816b9cdafbf4c4a2c9 100644
--- a/roles/kubernetes/node/tasks/pre_upgrade.yml
+++ b/roles/kubernetes/node/tasks/pre_upgrade.yml
@@ -11,6 +11,7 @@
     executable: /bin/bash
   failed_when: false
   changed_when: false
+  check_mode: no
   register: kubelet_container_check
 
 - name: "Pre-upgrade | copy /var/lib/cni from kubelet"
diff --git a/roles/network_plugin/calico/tasks/check.yml b/roles/network_plugin/calico/tasks/check.yml
index 4134944be43acc025597e7b72c9e021d6959cf73..974910a41ff6b2a515b41f98c0a5b8be9b7c5f21 100644
--- a/roles/network_plugin/calico/tasks/check.yml
+++ b/roles/network_plugin/calico/tasks/check.yml
@@ -41,6 +41,7 @@
   command: calicoctl.sh get ipPool {{ calico_pool_name }} -o json
   failed_when: False
   changed_when: False
+  check_mode: no
   register: calico
   run_once: True
   delegate_to: "{{ groups['kube_control_plane'][0] }}"