diff --git a/ansible/roles/aodh/tasks/config.yml b/ansible/roles/aodh/tasks/config.yml
index b6720ba57513cc4059ca23917c688e915132cc30..ce986df30cc2f2b86310b83b5d4aa94dce42e3e2 100644
--- a/ansible/roles/aodh/tasks/config.yml
+++ b/ansible/roles/aodh/tasks/config.yml
@@ -63,6 +63,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/aodh/policy.json"
+  run_once: True
   register: aodh_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/barbican/tasks/config.yml b/ansible/roles/barbican/tasks/config.yml
index d4927eae5e62e2d05bcfa7fae8999cc4fa4b09b6..4fd0eb349bbb3ec4734aad2b7b9fe07d45cd398b 100644
--- a/ansible/roles/barbican/tasks/config.yml
+++ b/ansible/roles/barbican/tasks/config.yml
@@ -83,6 +83,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/barbican/policy.json"
+  run_once: True
   register: barbican_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/ceilometer/tasks/config.yml b/ansible/roles/ceilometer/tasks/config.yml
index 52ef3318a4227c3ef385004d49c3bea7aea3b9da..c829c08802812209b4627be140ac35c95b0f6290 100644
--- a/ansible/roles/ceilometer/tasks/config.yml
+++ b/ansible/roles/ceilometer/tasks/config.yml
@@ -109,6 +109,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/ceilometer/policy.json"
+  run_once: True
   register: ceilometer_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/ceph/tasks/start_rgw_keystone.yml b/ansible/roles/ceph/tasks/start_rgw_keystone.yml
index 5409644a198601ed768b6ae7ebd96ef2b42a5bb9..6c845253d1e1ba516aadd39636b2c29ca2d421a2 100644
--- a/ansible/roles/ceph/tasks/start_rgw_keystone.yml
+++ b/ansible/roles/ceph/tasks/start_rgw_keystone.yml
@@ -2,6 +2,7 @@
 - name: Check whether the swift service is enabled
   local_action: fail msg='Ceph-rgw-keystone is conflicted with swift, you should only enable one of them'
   when: enable_swift | bool
+  run_once: True
 
 - name: Creating the Swift service and endpoint
   kolla_toolbox:
diff --git a/ansible/roles/cinder/tasks/config.yml b/ansible/roles/cinder/tasks/config.yml
index 3f808ddde03f414dadf03c7fecede9582dac9763..1a3d6da3e3e62945449346c2d642cb691e72082e 100644
--- a/ansible/roles/cinder/tasks/config.yml
+++ b/ansible/roles/cinder/tasks/config.yml
@@ -69,6 +69,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/cinder/policy.json"
+  run_once: True
   register: cinder_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/cloudkitty/tasks/config.yml b/ansible/roles/cloudkitty/tasks/config.yml
index da333341f551edfdf7ec5a9b82ce820d640004ba..da56b0c3edc58759cc9eac6492b849a20353d46f 100644
--- a/ansible/roles/cloudkitty/tasks/config.yml
+++ b/ansible/roles/cloudkitty/tasks/config.yml
@@ -46,6 +46,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/cloudkitty/policy.json"
+  run_once: True
   register: cloudkitty_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/congress/tasks/config.yml b/ansible/roles/congress/tasks/config.yml
index dc78e501645f06a8eafa65fd38185e3220b6151c..1a3db435eeb2f6632a9932746999a6173afc6c7c 100644
--- a/ansible/roles/congress/tasks/config.yml
+++ b/ansible/roles/congress/tasks/config.yml
@@ -42,6 +42,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/congress/policy.json"
+  run_once: True
   register: congress_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/designate/tasks/config.yml b/ansible/roles/designate/tasks/config.yml
index f88ddb9a69d91b8f2289558510b09ff5b07cc4c1..7c333a6c308ede6b99113ac420c9882a632afd08 100644
--- a/ansible/roles/designate/tasks/config.yml
+++ b/ansible/roles/designate/tasks/config.yml
@@ -118,6 +118,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/designate/policy.json"
+  run_once: True
   register: designate_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/freezer/tasks/config.yml b/ansible/roles/freezer/tasks/config.yml
index 970e8715f02bcd0d4013a95121d15d937ee52cf5..aef83f44b26bd7517f7a32b8d8ea42d829e362c2 100644
--- a/ansible/roles/freezer/tasks/config.yml
+++ b/ansible/roles/freezer/tasks/config.yml
@@ -56,6 +56,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_config_directory }}/freezer/policy.json"
+  run_once: True
   register: freezer_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/glance/tasks/config.yml b/ansible/roles/glance/tasks/config.yml
index 719f92392a70164b14460e6283c4e1409f702a25..db3c69362f939e0866350e4e010519cc76316385 100644
--- a/ansible/roles/glance/tasks/config.yml
+++ b/ansible/roles/glance/tasks/config.yml
@@ -46,6 +46,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/glance/policy.json"
+  run_once: True
   register: glance_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/gnocchi/tasks/config.yml b/ansible/roles/gnocchi/tasks/config.yml
index 76cdb04d49351435cd3656808716edb2e2064413..afec2e4dc82b696b629936732febd38fb37399b0 100644
--- a/ansible/roles/gnocchi/tasks/config.yml
+++ b/ansible/roles/gnocchi/tasks/config.yml
@@ -63,6 +63,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/gnocchi/policy.json"
+  run_once: True
   register: gnocchi_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/heat/tasks/config.yml b/ansible/roles/heat/tasks/config.yml
index 0f8340ca9713e45721d15eae9ad5843c67063ba6..cbdd938ac4f76a053fcf5a78ddc66c90238b02dc 100644
--- a/ansible/roles/heat/tasks/config.yml
+++ b/ansible/roles/heat/tasks/config.yml
@@ -55,6 +55,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/heat/policy.json"
+  run_once: True
   register: heat_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/horizon/tasks/config.yml b/ansible/roles/horizon/tasks/config.yml
index 1ef693b41679752c4a38e7573d0b24a2c97ea6b4..12836efaabc6413610468f6e93337ae6cbc2e0ee 100644
--- a/ansible/roles/horizon/tasks/config.yml
+++ b/ansible/roles/horizon/tasks/config.yml
@@ -58,6 +58,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/horizon/{{ item.name }}_policy.json"
+  run_once: True
   register: custom_policy
   when: item.enabled | bool
   with_items:
diff --git a/ansible/roles/ironic/tasks/config.yml b/ansible/roles/ironic/tasks/config.yml
index a878f32f7ee3c2a172b3da39ad11fea70e2abcb0..57fad1ce491e9858500387a864e3d5c07efe8834 100644
--- a/ansible/roles/ironic/tasks/config.yml
+++ b/ansible/roles/ironic/tasks/config.yml
@@ -83,6 +83,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/ironic/policy.json"
+  run_once: True
   register: ironic_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/ironic/tasks/precheck.yml b/ansible/roles/ironic/tasks/precheck.yml
index 8a1b476bb418aee9a355845ba5ec48e019030995..0538436a6eed350343daf30ed353c04c07879e41 100644
--- a/ansible/roles/ironic/tasks/precheck.yml
+++ b/ansible/roles/ironic/tasks/precheck.yml
@@ -30,6 +30,7 @@
 
 - name: Checking ironic-agent files exist for Ironic
   local_action: stat path="{{ node_custom_config }}/ironic/{{ item }}"
+  run_once: True
   register: result
   failed_when: not result.stat.exists
   when:
diff --git a/ansible/roles/keystone/tasks/config.yml b/ansible/roles/keystone/tasks/config.yml
index b31357612ae6d774d59917ec1e4e542efa3e3dab..6f9ce59158ca8620165334277ec5021530ebb132 100644
--- a/ansible/roles/keystone/tasks/config.yml
+++ b/ansible/roles/keystone/tasks/config.yml
@@ -1,10 +1,12 @@
 ---
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/keystone/policy.json"
+  run_once: True
   register: keystone_policy
 
 - name: Check if Keystone Domain specific settings enabled
   local_action: stat path="{{ node_custom_config }}/keystone/domains"
+  run_once: True
   register: keystone_domain_directory
 
 - name: Ensuring config directories exist
diff --git a/ansible/roles/kuryr/tasks/config.yml b/ansible/roles/kuryr/tasks/config.yml
index 21d5f4958434f899133a311d24101c41f64db4e9..b5f999ba88e1c9d33a67ae01eaee63e35da694dc 100644
--- a/ansible/roles/kuryr/tasks/config.yml
+++ b/ansible/roles/kuryr/tasks/config.yml
@@ -59,6 +59,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/kuryr/policy.json"
+  run_once: True
   register: kuryr_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/magnum/tasks/config.yml b/ansible/roles/magnum/tasks/config.yml
index 9b4e71f880b781cb6184b3303a88333cd2a86e2e..2203b6f99cf2ac6cca0f9d15db0a0f065d36e245 100644
--- a/ansible/roles/magnum/tasks/config.yml
+++ b/ansible/roles/magnum/tasks/config.yml
@@ -46,6 +46,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/magnum/policy.json"
+  run_once: True
   register: magnum_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/manila/tasks/config.yml b/ansible/roles/manila/tasks/config.yml
index 49f077cf7591158ccb7196744f2f90a92a2c5957..0b7927c053cf2bd618a235f79b2fcf176351da11 100644
--- a/ansible/roles/manila/tasks/config.yml
+++ b/ansible/roles/manila/tasks/config.yml
@@ -73,6 +73,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/manila/policy.json"
+  run_once: True
   register: manila_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/mistral/tasks/config.yml b/ansible/roles/mistral/tasks/config.yml
index 4410e8384be503573822f3ae89f6785c55fc13e7..717dc7073b94bbd096ec201798741ab309aad721 100644
--- a/ansible/roles/mistral/tasks/config.yml
+++ b/ansible/roles/mistral/tasks/config.yml
@@ -42,6 +42,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/mistral/policy.json"
+  run_once: True
   register: mistral_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/murano/tasks/config.yml b/ansible/roles/murano/tasks/config.yml
index 392863d1b503b27bd0fead50635a55ed22c7d002..8f899fe6ce101bfc0d11a40533a545b734001d39 100644
--- a/ansible/roles/murano/tasks/config.yml
+++ b/ansible/roles/murano/tasks/config.yml
@@ -35,6 +35,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/murano/policy.json"
+  run_once: True
   register: murano_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/neutron/tasks/config.yml b/ansible/roles/neutron/tasks/config.yml
index bbb70b39f8ee193ca0a8c8eb841121692207f896..e64493b8f128648e96aa434353430e9d207420b8 100644
--- a/ansible/roles/neutron/tasks/config.yml
+++ b/ansible/roles/neutron/tasks/config.yml
@@ -265,6 +265,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/neutron/policy.json"
+  run_once: True
   register: neutron_policy
 
 - name: Copying over nsx.ini
diff --git a/ansible/roles/neutron/tasks/precheck.yml b/ansible/roles/neutron/tasks/precheck.yml
index f5329462b6d040a7a7f275a6d5e6a3cee79d0bcd..e357ab43833708330d572616683e5f7cabca67d4 100644
--- a/ansible/roles/neutron/tasks/precheck.yml
+++ b/ansible/roles/neutron/tasks/precheck.yml
@@ -19,6 +19,7 @@
 - name: Checking number of network agents
   local_action: fail msg="Number of network agents are less than two when enabling agent ha"
   changed_when: false
+  run_once: True
   when:
     - enable_neutron_agent_ha | bool
     - groups['neutron-dhcp-agent'] | length < 2
diff --git a/ansible/roles/nova/tasks/config.yml b/ansible/roles/nova/tasks/config.yml
index 2085d50d4f1cdf0831a8d02b451e0e3ab86184d9..29f5bc6294637d8a9c405a4c5b8ecd7d74052b81 100644
--- a/ansible/roles/nova/tasks/config.yml
+++ b/ansible/roles/nova/tasks/config.yml
@@ -115,6 +115,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/nova/policy.json"
+  run_once: True
   register: nova_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/nova/tasks/external-ceph.yml b/ansible/roles/nova/tasks/external-ceph.yml
index 2ce1bfca5750f278efab7fe91a32bfc4f8d335b9..23011f8779175e3039ca33f30003460122b1443e 100644
--- a/ansible/roles/nova/tasks/external-ceph.yml
+++ b/ansible/roles/nova/tasks/external-ceph.yml
@@ -10,12 +10,14 @@
 
 - name: Check nova keyring file
   local_action: stat path="{{ node_custom_config }}/nova/ceph.client.nova.keyring"
+  run_once: True
   register: nova_cephx_keyring_file
   failed_when: not nova_cephx_keyring_file.stat.exists
   when: external_ceph_cephx_enabled | bool
 
 - name: Check cinder keyring file
   local_action: stat path="{{ node_custom_config }}/nova/ceph.client.cinder.keyring"
+  run_once: True
   register: cinder_cephx_keyring_file
   failed_when: not cinder_cephx_keyring_file.stat.exists
   when:
@@ -61,11 +63,13 @@
 
 - name: Extract nova key from file
   local_action: shell cat "{{ nova_cephx_keyring_file.stat.path }}" | grep -E 'key\s*=' | awk '{ print $3 }'
+  run_once: True
   register: nova_cephx_raw_key
   when: external_ceph_cephx_enabled | bool
 
 - name: Extract cinder key from file
   local_action: shell cat "{{ cinder_cephx_keyring_file.stat.path }}" | grep -E 'key\s*=' | awk '{ print $3 }'
+  run_once: True
   register: cinder_cephx_raw_key
   when:
     - cinder_backend_ceph | bool
diff --git a/ansible/roles/octavia/tasks/precheck.yml b/ansible/roles/octavia/tasks/precheck.yml
index 2326739cd40f6ca419cef839a4185944a353b753..9aa417b9c83ef005fe69dac64b1a4421d06544cf 100644
--- a/ansible/roles/octavia/tasks/precheck.yml
+++ b/ansible/roles/octavia/tasks/precheck.yml
@@ -30,6 +30,7 @@
 
 - name: Checking certificate files exist for octavia
   local_action: stat path="{{ node_custom_config }}/octavia/{{ item }}"
+  run_once: True
   register: result
   failed_when: not result.stat.exists
   when: inventory_hostname in groups['octavia-worker']
diff --git a/ansible/roles/panko/tasks/config.yml b/ansible/roles/panko/tasks/config.yml
index 1b8e0a4c9eb0ff1392814f4e2943fe2253c10145..c79c265a2d2d07084d205959d9beab01927ec2b8 100644
--- a/ansible/roles/panko/tasks/config.yml
+++ b/ansible/roles/panko/tasks/config.yml
@@ -59,6 +59,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/panko/policy.json"
+  run_once: True
   register: panko_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/prechecks/tasks/service_checks.yml b/ansible/roles/prechecks/tasks/service_checks.yml
index 79614881e7b571e87c5292fef15a256e79dfc9a4..1b09a607a05aeb0678c1408d81a0f29ab1a1fb96 100644
--- a/ansible/roles/prechecks/tasks/service_checks.yml
+++ b/ansible/roles/prechecks/tasks/service_checks.yml
@@ -8,6 +8,7 @@
 
 - name: Checking empty passwords in passwords.yml. Run kolla-genpwd if this task fails
   local_action: command grep '^[^#].*:\s*$' "{{ CONFIG_DIR | default('/etc/kolla') }}/passwords.yml"
+  run_once: True
   register: result
   changed_when: false
   failed_when: result.stdout | regex_replace('(.*ssh_key.*)', '') | search(":")
diff --git a/ansible/roles/rally/tasks/config.yml b/ansible/roles/rally/tasks/config.yml
index be8d8ffbf5c4be3e48aaa2ff782e762d10135701..cd846cb3086d23041efb35e25200b345b86e199b 100644
--- a/ansible/roles/rally/tasks/config.yml
+++ b/ansible/roles/rally/tasks/config.yml
@@ -39,6 +39,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/rally/policy.json"
+  run_once: True
   register: rally_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/sahara/tasks/config.yml b/ansible/roles/sahara/tasks/config.yml
index 36456b0ccc5bae91c3976a60085b122a72c6e204..785c9875fe4f138b7c0c459062807e33908f5ff4 100644
--- a/ansible/roles/sahara/tasks/config.yml
+++ b/ansible/roles/sahara/tasks/config.yml
@@ -46,6 +46,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/sahara/policy.json"
+  run_once: True
   register: sahara_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/searchlight/tasks/config.yml b/ansible/roles/searchlight/tasks/config.yml
index a3868da315f44639d88cf8c0588f0c95d685d8f0..0e7f96809b08bc9b8b9ef09ea0ff774a719be06a 100644
--- a/ansible/roles/searchlight/tasks/config.yml
+++ b/ansible/roles/searchlight/tasks/config.yml
@@ -41,6 +41,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/searchlight/policy.json"
+  run_once: True
   register: searchlight_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/senlin/tasks/config.yml b/ansible/roles/senlin/tasks/config.yml
index 4bb2878ca50aac829fd15bd197d9657a82e1323b..76a1229c674695838b4c976b5bf6e3f46b0bf05e 100644
--- a/ansible/roles/senlin/tasks/config.yml
+++ b/ansible/roles/senlin/tasks/config.yml
@@ -46,6 +46,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/senlin/policy.json"
+  run_once: True
   register: senlin_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/swift/tasks/config.yml b/ansible/roles/swift/tasks/config.yml
index 3b81038ee945928bdb11f79ea92f68f229683617..82fd47cc15f77927ddc89e47b50c307f91815639 100644
--- a/ansible/roles/swift/tasks/config.yml
+++ b/ansible/roles/swift/tasks/config.yml
@@ -155,6 +155,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/swift/policy.json"
+  run_once: True
   register: swift_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/tacker/tasks/config.yml b/ansible/roles/tacker/tasks/config.yml
index 0918bd02f21322859e6d7a2ba9f21d0e86c0826b..145300e58275aefaaef769bc7c474956d272d071 100644
--- a/ansible/roles/tacker/tasks/config.yml
+++ b/ansible/roles/tacker/tasks/config.yml
@@ -44,6 +44,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/tacker/policy.json"
+  run_once: True
   register: tacker_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/watcher/tasks/config.yml b/ansible/roles/watcher/tasks/config.yml
index 5037c8746732ca7d1085d19c0dfaae4be66c095c..7cb1ba0a069cac12a4b4c6b647f7930cc597e2cb 100644
--- a/ansible/roles/watcher/tasks/config.yml
+++ b/ansible/roles/watcher/tasks/config.yml
@@ -48,6 +48,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/watcher/policy.json"
+  run_once: True
   register: watcher_policy
 
 - name: Copying over existing policy.json
diff --git a/ansible/roles/zun/tasks/config.yml b/ansible/roles/zun/tasks/config.yml
index 9712b48babac834c2d5a342a0af3316b9ec2ca9b..7935458606d11f46442e3055d13533572838064d 100644
--- a/ansible/roles/zun/tasks/config.yml
+++ b/ansible/roles/zun/tasks/config.yml
@@ -57,6 +57,7 @@
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ node_custom_config }}/zun/policy.json"
+  run_once: True
   register: zun_policy
 
 - name: Copying over existing policy.json