diff --git a/playbooks/groups/copr-keygen.yml b/playbooks/groups/copr-keygen.yml
index 1ccb073a86..204da5b190 100644
--- a/playbooks/groups/copr-keygen.yml
+++ b/playbooks/groups/copr-keygen.yml
@@ -13,7 +13,7 @@
   - include: "{{ tasks }}/persistent_cloud.yml"
   - name: gather facts
     setup:
-    always_run: True
+    check_mode: no
     ignore_errors: True
     register: facts
   - name: install python2 and dnf stuff
diff --git a/playbooks/groups/mirrorlist2.yml b/playbooks/groups/mirrorlist2.yml
index df09e0bf6e..dd32f8775d 100644
--- a/playbooks/groups/mirrorlist2.yml
+++ b/playbooks/groups/mirrorlist2.yml
@@ -30,7 +30,7 @@
   - name: check the selinux context of webdir
     command: matchpathcon /srv/web
     register: webdir
-    always_run: yes
+    check_mode: no
     changed_when: "1 != 1"
     tags:
     - config
diff --git a/playbooks/groups/osbs-master.yml b/playbooks/groups/osbs-master.yml
index 237debdcb7..702ffb4a82 100644
--- a/playbooks/groups/osbs-master.yml
+++ b/playbooks/groups/osbs-master.yml
@@ -294,7 +294,7 @@
     - name: register origin_version_out rpm query
       shell: "rpm -q origin --qf '%{Version}'"
       register: origin_version_out
-      always_run: true
+      check_mode: no
       changed_when: False
 
     - set_fact:
diff --git a/playbooks/groups/osbs-node.yml b/playbooks/groups/osbs-node.yml
index 59639bc8ca..1a6c770e50 100644
--- a/playbooks/groups/osbs-node.yml
+++ b/playbooks/groups/osbs-node.yml
@@ -289,7 +289,7 @@
 #     - name: register origin_version_out rpm query
 #       shell: "rpm -q origin --qf '%{Version}'"
 #       register: origin_version_out
-#       always_run: true
+#       check_mode: no
 #       changed_when: False
 
 #     - set_fact:
diff --git a/playbooks/hosts/artboard.fedorainfracloud.org.yml b/playbooks/hosts/artboard.fedorainfracloud.org.yml
index 53c1ae6328..76d0346cef 100644
--- a/playbooks/hosts/artboard.fedorainfracloud.org.yml
+++ b/playbooks/hosts/artboard.fedorainfracloud.org.yml
@@ -50,7 +50,7 @@
   - name: check the selinux context of the artboard dirs
     command: matchpathcon "/srv/persist/artboard/(.*)"
     register: webcontext
-    always_run: yes
+    check_mode: no
     changed_when: false
     tags:
     - config
diff --git a/playbooks/hosts/fed-cloud09.cloud.fedoraproject.org.yml b/playbooks/hosts/fed-cloud09.cloud.fedoraproject.org.yml
index cf5a376e65..2a71d116fc 100644
--- a/playbooks/hosts/fed-cloud09.cloud.fedoraproject.org.yml
+++ b/playbooks/hosts/fed-cloud09.cloud.fedoraproject.org.yml
@@ -286,110 +286,110 @@
   # ceilometer
   - shell: source /root/keystonerc_admin && keystone service-list | grep ceilometer | awk '{print $2}'
     register: SERVICE_ID
-    always_run: yes
+    check_mode: no
     changed_when: false
   - shell: source /root/keystonerc_admin && keystone endpoint-list | grep {{SERVICE_ID.stdout}} | awk '{print $2}'
     register: ENDPOINT_ID
-    always_run: yes
+    check_mode: no
     changed_when: false
   - shell: source /root/keystonerc_admin && keystone endpoint-list |grep {{SERVICE_ID.stdout}} |grep -v {{ controller_publicname }} && (keystone endpoint-delete {{ENDPOINT_ID.stdout}} && keystone endpoint-create --region 'RegionOne' --service {{SERVICE_ID.stdout}} --publicurl 'https://{{ controller_publicname }}:8777'  --adminurl 'https://{{ controller_publicname }}:8777' --internalurl 'https://{{ controller_publicname }}:8777' ) || true
   # cinder
   - shell: source /root/keystonerc_admin && keystone service-list | grep 'cinder ' | awk '{print $2}'
     register: SERVICE_ID
-    always_run: yes
+    check_mode: no
     changed_when: false
   - shell: source /root/keystonerc_admin && keystone endpoint-list | grep {{SERVICE_ID.stdout}} | awk '{print $2}'
     register: ENDPOINT_ID
-    always_run: yes
+    check_mode: no
     changed_when: false
   - shell: source /root/keystonerc_admin && keystone endpoint-list |grep {{SERVICE_ID.stdout}} |grep -v {{ controller_publicname }} && (keystone endpoint-delete {{ENDPOINT_ID.stdout}} && keystone endpoint-create --region 'RegionOne' --service {{SERVICE_ID.stdout}} --publicurl 'https://{{ controller_publicname }}:8776/v1/%(tenant_id)s'  --adminurl 'https://{{ controller_publicname }}:8776/v1/%(tenant_id)s' --internalurl 'https://{{ controller_publicname }}:8776/v1/%(tenant_id)s' ) || true
   # cinderv2
   - shell: source /root/keystonerc_admin && keystone service-list | grep 'cinderv2' | awk '{print $2}'
     register: SERVICE_ID
-    always_run: yes
+    check_mode: no
     changed_when: false
   - shell: source /root/keystonerc_admin && keystone endpoint-list | grep {{SERVICE_ID.stdout}} | awk '{print $2}'
     register: ENDPOINT_ID
-    always_run: yes
+    check_mode: no
     changed_when: false
   - shell: source /root/keystonerc_admin && keystone endpoint-list |grep {{SERVICE_ID.stdout}} |grep -v {{ controller_publicname }} && (keystone endpoint-delete {{ENDPOINT_ID.stdout}} && keystone endpoint-create --region 'RegionOne' --service {{SERVICE_ID.stdout}} --publicurl 'https://{{ controller_publicname }}:8776/v2/%(tenant_id)s'  --adminurl 'https://{{ controller_publicname }}:8776/v2/%(tenant_id)s' --internalurl 'https://{{ controller_publicname }}:8776/v2/%(tenant_id)s' ) || true
   # glance
   - shell: source /root/keystonerc_admin && keystone service-list | grep 'glance' | awk '{print $2}'
     register: SERVICE_ID
-    always_run: yes
+    check_mode: no
     changed_when: false
   - shell: source /root/keystonerc_admin && keystone endpoint-list | grep {{SERVICE_ID.stdout}} | awk '{print $2}'
     register: ENDPOINT_ID
-    always_run: yes
+    check_mode: no
     changed_when: false
   - shell: source /root/keystonerc_admin && keystone endpoint-list |grep {{SERVICE_ID.stdout}} |grep -v {{ controller_publicname }} && (keystone endpoint-delete {{ENDPOINT_ID.stdout}} && keystone endpoint-create --region 'RegionOne' --service {{SERVICE_ID.stdout}} --publicurl 'https://{{ controller_publicname }}:9292'  --adminurl 'https://{{ controller_publicname }}:9292' --internalurl 'https://{{ controller_publicname }}:9292' ) || true
   # neutron
   - shell: source /root/keystonerc_admin && keystone service-list | grep 'neutron' | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: SERVICE_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list | grep {{SERVICE_ID.stdout}} | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: ENDPOINT_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list |grep {{SERVICE_ID.stdout}} |grep -v {{ controller_publicname }} && (keystone endpoint-delete {{ENDPOINT_ID.stdout}} && keystone endpoint-create --region 'RegionOne' --service {{SERVICE_ID.stdout}} --publicurl 'https://{{ controller_publicname }}:9696/'  --adminurl 'https://{{ controller_publicname }}:9696/' --internalurl 'https://{{ controller_publicname }}:9696/' ) || true
   # nova
   - shell: source /root/keystonerc_admin && keystone service-list | grep 'nova ' | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: SERVICE_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list | grep {{SERVICE_ID.stdout}} | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: ENDPOINT_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list |grep {{SERVICE_ID.stdout}} |grep -v {{ controller_publicname }} && (keystone endpoint-delete {{ENDPOINT_ID.stdout}} && keystone endpoint-create --region 'RegionOne' --service {{SERVICE_ID.stdout}} --publicurl 'https://{{ controller_publicname }}:8774/v2/%(tenant_id)s'  --adminurl 'https://{{ controller_publicname }}:8774/v2/%(tenant_id)s' --internalurl 'https://{{ controller_publicname }}:8774/v2/%(tenant_id)s' ) || true
   # nova_ec2
   - shell: source /root/keystonerc_admin && keystone service-list | grep 'nova_ec2' | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: SERVICE_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list | grep {{SERVICE_ID.stdout}} | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: ENDPOINT_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list |grep {{SERVICE_ID.stdout}} |grep -v {{ controller_publicname }} && (keystone endpoint-delete {{ENDPOINT_ID.stdout}} && keystone endpoint-create --region 'RegionOne' --service {{SERVICE_ID.stdout}} --publicurl 'https://{{ controller_publicname }}:8773/services/Cloud'  --adminurl 'https://{{ controller_publicname }}:8773/services/Admin' --internalurl 'https://{{ controller_publicname }}:8773/services/Cloud' ) || true
   # novav3
   - shell: source /root/keystonerc_admin && keystone service-list | grep 'novav3' | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: SERVICE_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list | grep {{SERVICE_ID.stdout}} | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: ENDPOINT_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list |grep {{SERVICE_ID.stdout}} |grep -v {{ controller_publicname }} && (keystone endpoint-delete {{ENDPOINT_ID.stdout}} && keystone endpoint-create --region 'RegionOne' --service {{SERVICE_ID.stdout}} --publicurl 'https://{{ controller_publicname }}:8774/v3'  --adminurl 'https://{{ controller_publicname }}:8774/v3' --internalurl 'https://{{ controller_publicname }}:8774/v3' ) || true
   # swift
   - shell: source /root/keystonerc_admin && keystone service-list | grep 'swift ' | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: SERVICE_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list | grep {{SERVICE_ID.stdout}} | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: ENDPOINT_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list |grep {{SERVICE_ID.stdout}} |grep -v {{ controller_publicname }} && (keystone endpoint-delete {{ENDPOINT_ID.stdout}} && keystone endpoint-create --region 'RegionOne' --service {{SERVICE_ID.stdout}} --publicurl 'https://{{controller_publicname}}:8080/v1/AUTH_%(tenant_id)s'  --adminurl 'https://{{controller_publicname}}:8080' --internalurl 'https://{{controller_publicname}}:8080/v1/AUTH_%(tenant_id)s' ) || true
   # swift_s3
   - shell: source /root/keystonerc_admin && keystone service-list | grep 'swift_s3' | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: SERVICE_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list | grep {{SERVICE_ID.stdout}} | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: ENDPOINT_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list |grep {{SERVICE_ID.stdout}} |grep -v {{ controller_publicname }} && (keystone endpoint-delete {{ENDPOINT_ID.stdout}} && keystone endpoint-create --region 'RegionOne' --service {{SERVICE_ID.stdout}} --publicurl 'https://{{ controller_publicname }}:8080'  --adminurl 'https://{{ controller_publicname }}:8080' --internalurl 'https://{{ controller_publicname }}:8080' ) || true
   # keystone --- !!!!! we need to use ADMIN_TOKEN here - this MUST be last before we restart OS and set up haproxy
   - shell: source /root/keystonerc_admin && keystone service-list | grep 'keystone' | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: SERVICE_ID
   - shell: source /root/keystonerc_admin && keystone endpoint-list | grep {{SERVICE_ID.stdout}} | awk '{print $2}'
-    always_run: yes
+    check_mode: no
     changed_when: false
     register: ENDPOINT_ID
   - ini_file: dest=/etc/keystone/keystone.conf section=ssl option=certfile value=/etc/haproxy/fedorainfracloud.org.combined
@@ -1211,12 +1211,12 @@
   # default is 10 instances, 20 cores, 51200 RAM, 10 floating IPs
   - shell: source /root/keystonerc_admin && keystone tenant-list | grep 'copr ' | awk '{print $2}'
     register: TENANT_ID
-    always_run: true
+    check_mode: no
     changed_when: false
   - shell: source /root/keystonerc_admin && nova quota-update --instances 40 --cores 80 --ram 300000 --floating-ips 10 --security-groups 20 {{ TENANT_ID.stdout }}
 
   - shell: source /root/keystonerc_admin && keystone tenant-list | grep 'coprdev ' | awk '{print $2}'
-    always_run: true
+    check_mode: no
     changed_when: false
     register: TENANT_ID
   - shell: source /root/keystonerc_admin && nova quota-update --instances 40 --cores 80 --ram 300000 --floating-ips 10 --security-groups 20 {{ TENANT_ID.stdout }}
@@ -1226,14 +1226,14 @@
 # nova quota-update cannot do so.
 #
   - shell: source /root/keystonerc_admin && keystone tenant-list | grep 'persistent ' | awk '{print $2}'
-    always_run: true
+    check_mode: no
     changed_when: false
     register: TENANT_ID
   - shell: source /root/keystonerc_admin && nova quota-update --instances 60 --cores 150 --ram 288300 --security-groups 20 {{ TENANT_ID.stdout }}
 
 # Transient quota
   - shell: source /root/keystonerc_admin && keystone tenant-list | grep 'transient ' | awk '{print $2}'
-    always_run: true
+    check_mode: no
     changed_when: false
     register: TENANT_ID
   - shell: source /root/keystonerc_admin && nova quota-update --instances 30 --cores 60 --ram 102400 --security-groups 20 {{ TENANT_ID.stdout }}
diff --git a/playbooks/include/proxies-websites.yml b/playbooks/include/proxies-websites.yml
index 5ffe862f2e..c567987332 100644
--- a/playbooks/include/proxies-websites.yml
+++ b/playbooks/include/proxies-websites.yml
@@ -27,7 +27,7 @@
   - name: check the selinux context of webdir
     command: matchpathcon /srv/web
     register: webdir
-    always_run: yes
+    check_mode: no
     changed_when: "1 != 1"
     tags:
     - config
diff --git a/playbooks/manual/update-firmware.yml b/playbooks/manual/update-firmware.yml
index 9660fba34f..8b62d10e72 100644
--- a/playbooks/manual/update-firmware.yml
+++ b/playbooks/manual/update-firmware.yml
@@ -49,13 +49,13 @@
 
   tasks:
   - name: Create drop place for upgrades
-    always_run: true
+    check_mode: no
     when: ansible_virtualization_role == "host"
     file: path=/root/firmware-upgrades
           state=directory
 
   - name: Check which updates to copy
-    always_run: true
+    check_mode: no
     stat: path=/root/firmware-upgrades/{{ item.1}}.applied
     register: is_applied_results
     when: item.0.vendor == ansible_system_vendor and item.0.product == ansible_product_name
@@ -64,7 +64,7 @@
     - files
 
   - name: Copy updates
-    always_run: true
+    check_mode: no
     copy: src={{ bigfiles }}/firmware/{{ item.item.0.dirname }}/{{ item.item.1}}
           dest=/root/firmware-upgrades/
           mode=0700
@@ -75,7 +75,7 @@
 
   # Dell updates here
   - name: Check Dell updates
-    always_run: true
+    check_mode: no
     command: /root/firmware-upgrades/{{ item.item.1}} -qc
     register: check_results
     failed_when: "'System(s) supported by this package' in check_results.stdout"
@@ -105,7 +105,7 @@
 
   # We are cleaning up all files we copied, regardless of update result
   - name: Delete update files
-    always_run: true
+    check_mode: no
     file: path=/root/firmware-upgrades/{{ item.item.1 }}
           state=absent
     when: "'stat' in item and not item.stat.exists"
diff --git a/playbooks/manual/upgrade/autocloud.yml b/playbooks/manual/upgrade/autocloud.yml
index 575fc65aec..87b12cc602 100644
--- a/playbooks/manual/upgrade/autocloud.yml
+++ b/playbooks/manual/upgrade/autocloud.yml
@@ -13,7 +13,7 @@
   tasks:
   - name: clean all metadata
     command: dnf clean all
-    always_run: yes
+    check_mode: no
   - name: dnf update autocloud packages from main repo
     dnf: name="autocloud*" state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/badges.yml b/playbooks/manual/upgrade/badges.yml
index 894beff025..33c57656ab 100644
--- a/playbooks/manual/upgrade/badges.yml
+++ b/playbooks/manual/upgrade/badges.yml
@@ -13,7 +13,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update tahrir/badges packages from main repo
     yum: name={{item}} state=latest
     when: not testing
@@ -42,7 +42,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update tahrir/badges packages from main repo
     yum: name={{item}} state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/bodhi.yml b/playbooks/manual/upgrade/bodhi.yml
index ef64729cf5..052e5ddfd8 100644
--- a/playbooks/manual/upgrade/bodhi.yml
+++ b/playbooks/manual/upgrade/bodhi.yml
@@ -30,7 +30,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update bodhi-server packages from main repo
     yum: name="bodhi-server" state=latest
   - name: yum update bodhi-server packages from testing repo
diff --git a/playbooks/manual/upgrade/bugzilla2fedmsg.yml b/playbooks/manual/upgrade/bugzilla2fedmsg.yml
index 264489933e..80d8ccacef 100644
--- a/playbooks/manual/upgrade/bugzilla2fedmsg.yml
+++ b/playbooks/manual/upgrade/bugzilla2fedmsg.yml
@@ -13,7 +13,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update bugzilla2fedmsg packages from main repo
     yum: name="python-bugzilla2fedmsg" state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/datagrepper.yml b/playbooks/manual/upgrade/datagrepper.yml
index 5b36594a65..46fe2eea0c 100644
--- a/playbooks/manual/upgrade/datagrepper.yml
+++ b/playbooks/manual/upgrade/datagrepper.yml
@@ -13,7 +13,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update datagrepper packages from main repo
     yum: name="datagrepper" state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/datanommer.yml b/playbooks/manual/upgrade/datanommer.yml
index 23aa6d9a71..543ed1a4f7 100644
--- a/playbooks/manual/upgrade/datanommer.yml
+++ b/playbooks/manual/upgrade/datanommer.yml
@@ -21,7 +21,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update datanommer packages from main repo
     yum: name="*datanommer*" state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/fedimg.yml b/playbooks/manual/upgrade/fedimg.yml
index 7dc98e8085..96ad4b06c8 100644
--- a/playbooks/manual/upgrade/fedimg.yml
+++ b/playbooks/manual/upgrade/fedimg.yml
@@ -13,7 +13,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update fedimg packages from main repo
     yum: name="python-fedimg" state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/fedmsg.yml b/playbooks/manual/upgrade/fedmsg.yml
index 828ca566be..2ced492f6a 100644
--- a/playbooks/manual/upgrade/fedmsg.yml
+++ b/playbooks/manual/upgrade/fedmsg.yml
@@ -38,7 +38,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update fedmsg packages from the main repo
     yum: name={{item}} state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/fmn.yml b/playbooks/manual/upgrade/fmn.yml
index f815509235..af6e845f55 100644
--- a/playbooks/manual/upgrade/fmn.yml
+++ b/playbooks/manual/upgrade/fmn.yml
@@ -13,7 +13,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update FMN packages from main repo
     yum: name="python-fmn*" state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/hotness.yml b/playbooks/manual/upgrade/hotness.yml
index bc2ec4ff56..cfdbf5753a 100644
--- a/playbooks/manual/upgrade/hotness.yml
+++ b/playbooks/manual/upgrade/hotness.yml
@@ -13,7 +13,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update hotness packages from main repo
     yum: name="the-new-hotness" state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/mote.yml b/playbooks/manual/upgrade/mote.yml
index aaa482d8d5..7ff598074c 100644
--- a/playbooks/manual/upgrade/mote.yml
+++ b/playbooks/manual/upgrade/mote.yml
@@ -13,7 +13,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update mote packages from main repo
     yum: name="mote" state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/packages.yml b/playbooks/manual/upgrade/packages.yml
index 36e9c1247f..e8fea5ed97 100644
--- a/playbooks/manual/upgrade/packages.yml
+++ b/playbooks/manual/upgrade/packages.yml
@@ -13,7 +13,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update fedora-packages packages from main repo
     yum: name="fedora-packages" state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/pdc.yml b/playbooks/manual/upgrade/pdc.yml
index b741e56be6..d642c3a044 100644
--- a/playbooks/manual/upgrade/pdc.yml
+++ b/playbooks/manual/upgrade/pdc.yml
@@ -11,7 +11,7 @@
   pre_tasks:
   - name: clean all metadata
     command: yum clean all
-    always_run: yes
+    check_mode: no
   - name: yum update PDC packages
     yum: name="{{item}}" state=latest
     with_items:
@@ -43,7 +43,7 @@
   pre_tasks:
   - name: clean all metadata
     command: yum clean all
-    always_run: yes
+    check_mode: no
   - name: yum update PDC packages
     yum: name="{{item}}" state=latest
     with_items:
diff --git a/playbooks/manual/upgrade/statscache.yml b/playbooks/manual/upgrade/statscache.yml
index 816e1c337e..91d8af8dd6 100644
--- a/playbooks/manual/upgrade/statscache.yml
+++ b/playbooks/manual/upgrade/statscache.yml
@@ -13,7 +13,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update statscache packages from main repo
     yum: name="statscache*" state=latest
     when: not testing
diff --git a/playbooks/manual/upgrade/tagger.yml b/playbooks/manual/upgrade/tagger.yml
index a891a96c97..353b573ce4 100644
--- a/playbooks/manual/upgrade/tagger.yml
+++ b/playbooks/manual/upgrade/tagger.yml
@@ -13,7 +13,7 @@
   tasks:
   - name: clean all metadata {%if testing%}(with infrastructure-testing on){%endif%}
     command: yum clean all {%if testing%} --enablerepo=infrastructure-testing {%endif%}
-    always_run: yes
+    check_mode: no
   - name: yum update fedora-tagger packages from main repo
     yum: name="fedora-tagger" state=latest
     when: not testing
diff --git a/playbooks/transient_cloud_instance.yml b/playbooks/transient_cloud_instance.yml
index 51396dc01b..61b1ae8e40 100644
--- a/playbooks/transient_cloud_instance.yml
+++ b/playbooks/transient_cloud_instance.yml
@@ -47,7 +47,7 @@
 
   - name: gather facts
     setup:
-    always_run: True
+    check_mode: no
     ignore_errors: True
     register: facts
 
diff --git a/roles/ask/tasks/main.yml b/roles/ask/tasks/main.yml
index f7eab81877..718dbdd53c 100644
--- a/roles/ask/tasks/main.yml
+++ b/roles/ask/tasks/main.yml
@@ -135,7 +135,7 @@
 - name: check log file
   command: stat /var/log/askbot/askfedora.log
   register: logstat
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   failed_when: no
   tags:
diff --git a/roles/autocloud/backend/tasks/main.yml b/roles/autocloud/backend/tasks/main.yml
index 350bd06240..d2a78017a5 100644
--- a/roles/autocloud/backend/tasks/main.yml
+++ b/roles/autocloud/backend/tasks/main.yml
@@ -23,7 +23,7 @@
   command: redis-cli --scan --pattern tunirports
   changed_when: False
   register: tunirports
-  always_run: true
+  check_mode: no
   tags:
   - autocloud
   - autocloud/backend
@@ -83,7 +83,7 @@
   - gcc
   - vagrant
   register: virtualbox_installed
-  always_run: true
+  check_mode: no
   when: autocloud_specialization == 'virtualbox'
   notify:
   - restart fedmsg-hub
diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml
index d6acfb11d7..f9b81fe513 100644
--- a/roles/base/tasks/main.yml
+++ b/roles/base/tasks/main.yml
@@ -26,7 +26,7 @@
   ignore_errors: true
   changed_when: false
   failed_when: "1 != 1"
-  always_run: true
+  check_mode: no
   tags:
    - config
    - resolvconf
@@ -49,7 +49,7 @@
   register: if_uuid
   changed_when: false
   failed_when: 'if_uuid.stdout == ""'
-  always_run: yes
+  check_mode: no
   when: ansible_distribution_major_version|int >=7 and nmclitest|success and ( not ansible_ifcfg_blacklist )
   tags:
    - config
diff --git a/roles/base/tasks/watchdog.yml b/roles/base/tasks/watchdog.yml
index 65e0dcaef6..7b03566b9d 100644
--- a/roles/base/tasks/watchdog.yml
+++ b/roles/base/tasks/watchdog.yml
@@ -1,7 +1,7 @@
 - name: See if theres a watchdog device
   stat: path=/dev/watchdog
   when: ansible_virtualization_role == 'guest'
-  always_run: true
+  check_mode: no
   failed_when: no
   register: watchdog_dev
 
diff --git a/roles/batcave/tasks/main.yml b/roles/batcave/tasks/main.yml
index ba7f42286e..f6f67ab0cc 100644
--- a/roles/batcave/tasks/main.yml
+++ b/roles/batcave/tasks/main.yml
@@ -343,7 +343,7 @@
 - name: check the selinux context of webdir
   command: matchpathcon /srv/web
   register: webdir
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - config
@@ -369,7 +369,7 @@
 - name: check the selinux context of ansible
   command: matchpathcon /git/ansible
   register: webdir
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - config
@@ -391,7 +391,7 @@
 - name: check the selinux context of badges
   command: matchpathcon /git/badges
   register: webdir
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - config
@@ -413,7 +413,7 @@
 - name: check the selinux context of dns
   command: matchpathcon /git/dns
   register: webdir
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - config
@@ -435,7 +435,7 @@
 - name: check the selinux context of infra-docs
   command: matchpathcon /git/infra-docs
   register: webdir
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - config
diff --git a/roles/beaker/virthost/tasks/main.yml b/roles/beaker/virthost/tasks/main.yml
index 6211926299..40f5d14f26 100644
--- a/roles/beaker/virthost/tasks/main.yml
+++ b/roles/beaker/virthost/tasks/main.yml
@@ -122,7 +122,7 @@
 - name: get vm list
   virt: command=list_vms
   register: result
-  always_run: yes
+  check_mode: no
 
 - name: generate libvirt xml files for clients
   template:
diff --git a/roles/bkernel/tasks/main.yml b/roles/bkernel/tasks/main.yml
index 50953d11e9..82c73291a6 100644
--- a/roles/bkernel/tasks/main.yml
+++ b/roles/bkernel/tasks/main.yml
@@ -18,7 +18,7 @@
 
 - name: setup opensc in pcscd
   shell: modutil -dbdir /etc/pki/pesign -list | grep -q Fedora ||  modutil -force -dbdir /etc/pki/pesign -add opensc -libfile /usr/lib64/pkcs11/opensc-pkcs11.so
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - bkernel
diff --git a/roles/bodhi2/base/tasks/main.yml b/roles/bodhi2/base/tasks/main.yml
index 2e2a94aa59..18c191b937 100644
--- a/roles/bodhi2/base/tasks/main.yml
+++ b/roles/bodhi2/base/tasks/main.yml
@@ -128,7 +128,7 @@
 #- name: check the selinux context of the bugzilla cookie
 #  command: matchpathcon /var/tmp/bodhi-bz.cookie
 #  register: cookiecontext
-#  always_run: yes
+#  check_mode: no
 #  changed_when: "1 != 1"
 #  tags:
 #  - config
diff --git a/roles/cgit/make_pkgs_list/tasks/main.yml b/roles/cgit/make_pkgs_list/tasks/main.yml
index 7f1abfef56..061a9e1886 100644
--- a/roles/cgit/make_pkgs_list/tasks/main.yml
+++ b/roles/cgit/make_pkgs_list/tasks/main.yml
@@ -48,7 +48,7 @@
 - name: check the selinux context of the repo list
   command: matchpathcon /srv/git/pkgs-git-repos-list
   register: gitlistcontext
-  always_run: yes
+  check_mode: no
   changed_when: false
   tags:
   - config
diff --git a/roles/check-compose/tasks/main.yml b/roles/check-compose/tasks/main.yml
index 0ef21f6e63..0d91c4833b 100644
--- a/roles/check-compose/tasks/main.yml
+++ b/roles/check-compose/tasks/main.yml
@@ -53,7 +53,7 @@
 - name: Check if python-client has ever been installed
   command: "python -c 'import openqa_client'"
   register: instclient
-  always_run: true
+  check_mode: no
   changed_when: "1 != 1"
   failed_when: "1 != 1"
 
diff --git a/roles/collectd/base/tasks/main.yml b/roles/collectd/base/tasks/main.yml
index bf0894e8e1..d1bd68ddd4 100644
--- a/roles/collectd/base/tasks/main.yml
+++ b/roles/collectd/base/tasks/main.yml
@@ -113,7 +113,7 @@
 - name: check to see if its even installed yet
   shell: semodule -l | grep fi-collectd | wc -l
   register: ficgeneral_grep
-  always_run: true
+  check_mode: no
   changed_when: "'0' in ficgeneral_grep.stdout"
   tags:
   - collectd
@@ -138,7 +138,7 @@
   shell: semodule -l | grep fi-pstorefs | wc -l
   when: ansible_distribution_major_version|int != 6
   register: ficpstorefs_grep
-  always_run: true
+  check_mode: no
   changed_when: "'0' in ficpstorefs_grep.stdout"
   tags:
   - collectd
diff --git a/roles/collectd/fcomm-queue/tasks/main.yml b/roles/collectd/fcomm-queue/tasks/main.yml
index a641c71fcf..49b0f2905b 100644
--- a/roles/collectd/fcomm-queue/tasks/main.yml
+++ b/roles/collectd/fcomm-queue/tasks/main.yml
@@ -39,7 +39,7 @@
 - name: check to see if its even installed yet
   shell: semodule -l | grep fi-collectd-fcomm | wc -l
   register: ficfcomm_grep
-  always_run: True
+  check_mode: no
   changed_when: "'0' in ficfcomm_grep.stdout"
   tags:
   - collectd
diff --git a/roles/copr/backend/tasks/main.yml b/roles/copr/backend/tasks/main.yml
index f754c72d84..18a1d34340 100644
--- a/roles/copr/backend/tasks/main.yml
+++ b/roles/copr/backend/tasks/main.yml
@@ -58,7 +58,7 @@
 - name: check known_hosts file
   command: stat /home/copr/.ssh/known_hosts
   register: hostsstat
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   ignore_errors: yes
 
diff --git a/roles/copr/base/tasks/main.yml b/roles/copr/base/tasks/main.yml
index c02e92eb84..af4644f499 100644
--- a/roles/copr/base/tasks/main.yml
+++ b/roles/copr/base/tasks/main.yml
@@ -62,7 +62,7 @@
   register: offloading
   failed_when: offloading.rc == 2
   changed_when: "1 != 1"
-  always_run: True
+  check_mode: no
 
 - name: disable offloading
   command: ethtool -K eth0 tso off gro off gso off
diff --git a/roles/copr/dist_git/tasks/main.yml b/roles/copr/dist_git/tasks/main.yml
index b55e54bb4e..7ba0ba0e11 100644
--- a/roles/copr/dist_git/tasks/main.yml
+++ b/roles/copr/dist_git/tasks/main.yml
@@ -57,7 +57,7 @@
 - name: read pub key into var
   command: cat /home/copr-service/.ssh/id_rsa.pub
   register: cat_pubkey
-  always_run: yes
+  check_mode: no
   changed_when: false
 
 - set_fact: pubkey="{{cat_pubkey.stdout|join('')}}"
diff --git a/roles/distgit/tasks/main.yml b/roles/distgit/tasks/main.yml
index b72f8a7d7d..ae11834337 100644
--- a/roles/distgit/tasks/main.yml
+++ b/roles/distgit/tasks/main.yml
@@ -74,7 +74,7 @@
 - name: check the selinux context of the distgit root directory
   command: matchpathcon /srv/git
   register: distgitcontext
-  always_run: yes
+  check_mode: no
   changed_when: false
   tags:
   - config
@@ -269,7 +269,7 @@
 - name: Get admin users
   command: "/srv/web/infra/ansible/scripts/users-from-fas @sysadmin-main {{ admin_groups }}"
   register: admin_user_list
-  always_run: True
+  check_mode: no
   changed_when: "1 != 1"
   run_once: True
   delegate_to: localhost
@@ -366,7 +366,7 @@
 - name: check the selinux context of the Lookaside Cache root directory
   command: matchpathcon /srv/cache
   register: lcachecontext
-  always_run: yes
+  check_mode: no
   changed_when: false
   tags:
   - config
@@ -436,7 +436,7 @@
 - name: check the selinux context of the upload CGI script
   command: matchpathcon /srv/web/upload.cgi
   register: upcgicontext
-  always_run: yes
+  check_mode: no
   changed_when: false
   tags:
   - config
diff --git a/roles/dnf-automatic/tasks/main.yml b/roles/dnf-automatic/tasks/main.yml
index 563f3222af..2047ae3a4a 100644
--- a/roles/dnf-automatic/tasks/main.yml
+++ b/roles/dnf-automatic/tasks/main.yml
@@ -31,7 +31,7 @@
   - name: check if dnf-automatic.timer is active
     command: systemctl is-active dnf-automatic.timer
     register: automaticative
-    always_run: yes
+    check_mode: no
     changed_when: 1 != 1
     ignore_errors: true
 
diff --git a/roles/dns/tasks/main.yml b/roles/dns/tasks/main.yml
index 9dda746d16..5a87ea5433 100644
--- a/roles/dns/tasks/main.yml
+++ b/roles/dns/tasks/main.yml
@@ -92,7 +92,7 @@
 - name: check semanage ports
   command: semanage port -l
   register: semanageoutput
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - dns
diff --git a/roles/download/tasks/main.yml b/roles/download/tasks/main.yml
index 7813c064de..ec91e36c79 100644
--- a/roles/download/tasks/main.yml
+++ b/roles/download/tasks/main.yml
@@ -23,7 +23,7 @@
 - name: check the selinux context rsyncd log
   command: matchpathcon /var/log/rsyncd-fedora.log
   register: rsyncdlog
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - config
@@ -45,7 +45,7 @@
 - name: check the selinux context pubdir
   command: matchpathcon /srv/pub
   register: pubdir
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - config
diff --git a/roles/fedmsg/base/tasks/main.yml b/roles/fedmsg/base/tasks/main.yml
index 9a253d6461..4ec38e588d 100644
--- a/roles/fedmsg/base/tasks/main.yml
+++ b/roles/fedmsg/base/tasks/main.yml
@@ -328,7 +328,7 @@
 - name: check semanage ports
   command: semanage port -l
   register: semanageoutput
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - fedmsg/base
@@ -342,7 +342,7 @@
 - name: Check if the nrpe user exists
   shell: /usr/bin/getent passwd nrpe | /usr/bin/wc -l | tr -d ' '
   register: nrpe_exists
-  always_run: true
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - fedmsg/base
diff --git a/roles/freemedia/tasks/main.yml b/roles/freemedia/tasks/main.yml
index a6525a4eae..d5e87f66e2 100644
--- a/roles/freemedia/tasks/main.yml
+++ b/roles/freemedia/tasks/main.yml
@@ -70,7 +70,7 @@
 - name: check the selinux context freemedia
   command: matchpathcon /srv/web/freemedia
   register: freemediacontext
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   ignore_errors: true
   tags:
diff --git a/roles/haproxy/tasks/main.yml b/roles/haproxy/tasks/main.yml
index 14a80aadd5..1552e9c1ba 100644
--- a/roles/haproxy/tasks/main.yml
+++ b/roles/haproxy/tasks/main.yml
@@ -71,7 +71,7 @@
 - name: check to see if its even installed yet
   shell: semodule -l | grep fi-haproxy | wc -l
   register: fi_haproxy_grep
-  always_run: true
+  check_mode: no
   changed_when: "'0' in fi_haproxy_grep.stdout"
   tags:
   - haproxy
@@ -87,7 +87,7 @@
 
 - name: check haproxy cfg to make sure it is valid
   command: haproxy -c -f /etc/haproxy/haproxy.cfg
-  always_run: true
+  check_mode: no
   register: haproxyconfigcheck
   changed_when: haproxyconfigcheck.rc != 0
   tags:
diff --git a/roles/infinote/tasks/main.yml b/roles/infinote/tasks/main.yml
index e1703cf77c..9c8210a116 100644
--- a/roles/infinote/tasks/main.yml
+++ b/roles/infinote/tasks/main.yml
@@ -80,7 +80,7 @@
 - name: check the selinux context of /srv/web
   command: matchpathcon /srv/web
   register: webdir
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - infinote
diff --git a/roles/koji_builder/tasks/main.yml b/roles/koji_builder/tasks/main.yml
index 1d59c5b9bc..38629ed336 100644
--- a/roles/koji_builder/tasks/main.yml
+++ b/roles/koji_builder/tasks/main.yml
@@ -215,7 +215,7 @@
 - name: check for max_loop with grub2
   command: cat /etc/grub2.cfg
   register: max_loop
-  always_run: yes
+  check_mode: no
   changed_when: '1 != 1'
   when: ansible_distribution_major_version|int != 6 and ansible_architecture == 'x86_64'
   tags:
@@ -224,7 +224,7 @@
 - name: check for max_loop with grub1
   command: cat /etc/grub.conf
   register: max_loop
-  always_run: yes
+  check_mode: no
   changed_when: '1 != 1'
   when: ansible_distribution == 'RedHat' and ansible_architecture == 'x86_64' and ansible_distribution_major_version|int == 6
   tags:
diff --git a/roles/koji_hub/tasks/main.yml b/roles/koji_hub/tasks/main.yml
index 72ffc6307d..7f29032828 100644
--- a/roles/koji_hub/tasks/main.yml
+++ b/roles/koji_hub/tasks/main.yml
@@ -347,7 +347,7 @@
   command: matchpathcon /mnt/fedora_koji
   register: mnt_fedora_koji_context
   when: env == "staging"
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - koji_hub
diff --git a/roles/koji_reminder/tasks/main.yml b/roles/koji_reminder/tasks/main.yml
index 5fdcd069ec..bb5af918fc 100644
--- a/roles/koji_reminder/tasks/main.yml
+++ b/roles/koji_reminder/tasks/main.yml
@@ -13,7 +13,7 @@
 - name: check log file
   command: stat /var/log/koji-cert-reminder.log
   register: logstat
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   ignore_errors: true
   tags:
diff --git a/roles/mirrormanager/mirrorlist2/tasks/main.yml b/roles/mirrormanager/mirrorlist2/tasks/main.yml
index cca2b3fd1c..0d32bd781f 100644
--- a/roles/mirrormanager/mirrorlist2/tasks/main.yml
+++ b/roles/mirrormanager/mirrorlist2/tasks/main.yml
@@ -61,7 +61,7 @@
 #- name: check to see if its even installed yet
 #  shell: semodule -l | grep mirrorlist2 | wc -l
 #  register: ficgeneral_grep
-#  always_run: true
+#  check_mode: no
 #  changed_when: "'0' in ficgeneral_grep.stdout"
 #  tags:
 #  - mirrorlist2
diff --git a/roles/nagios/client/tasks/main.yml b/roles/nagios/client/tasks/main.yml
index cacb7224ca..bc2cb00405 100644
--- a/roles/nagios/client/tasks/main.yml
+++ b/roles/nagios/client/tasks/main.yml
@@ -214,7 +214,7 @@
 - name: Check if the fedmsg group exists
   shell: /usr/bin/getent group fedmsg | /usr/bin/wc -l | tr -d ' '
   register: fedmsg_exists
-  always_run: true
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - nagios/client
diff --git a/roles/nfs/client/tasks/main.yml b/roles/nfs/client/tasks/main.yml
index d46917cb99..bf48624df7 100644
--- a/roles/nfs/client/tasks/main.yml
+++ b/roles/nfs/client/tasks/main.yml
@@ -13,7 +13,7 @@
 - name: check for netapp route
   command: ip route show
   register: netapproute
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - nfs/client
diff --git a/roles/openqa/dispatcher/tasks/main.yml b/roles/openqa/dispatcher/tasks/main.yml
index 55efa9319a..6793f27f12 100644
--- a/roles/openqa/dispatcher/tasks/main.yml
+++ b/roles/openqa/dispatcher/tasks/main.yml
@@ -63,7 +63,7 @@
   register: instclient
   changed_when: "1 != 1"
   failed_when: "1 != 1"
-  always_run: true
+  check_mode: no
 
 - name: Install openQA-python-client
   command: "python setup.py install"
@@ -84,7 +84,7 @@
   register: insttools
   changed_when: "1 != 1"
   failed_when: "1 != 1"
-  always_run: true
+  check_mode: no
 
 - name: Install openqa_fedora_tools
   command: "python setup.py install"
diff --git a/roles/openqa/server/tasks/main.yml b/roles/openqa/server/tasks/main.yml
index 93a6b82187..2fdd0e91f3 100644
--- a/roles/openqa/server/tasks/main.yml
+++ b/roles/openqa/server/tasks/main.yml
@@ -106,7 +106,7 @@
   register: testsbranch
   failed_when: "1 != 1"
   changed_when: "1 != 1"
-  always_run: true
+  check_mode: no
 
 - name: Check out the tests
   git:
@@ -142,7 +142,7 @@
   register: diskcheck
   failed_when: "1 != 1"
   changed_when: "1 != 1"
-  always_run: true
+  check_mode: no
 
 - name: Ensure libvirt is running if needed to create images
   service: name=libvirtd enabled=yes state=started
diff --git a/roles/openqa/worker/tasks/tap-setup.yml b/roles/openqa/worker/tasks/tap-setup.yml
index 221c6b9064..80645fcf0f 100644
--- a/roles/openqa/worker/tasks/tap-setup.yml
+++ b/roles/openqa/worker/tasks/tap-setup.yml
@@ -16,7 +16,7 @@
   register: ifcfgusb0
   failed_when: "1 != 1"
   changed_when: "1 != 1"
-  always_run: true
+  check_mode: no
   when: deployment_type is defined
 
 - name: Check if there's an annoying ifcfg-eth1 lurking
@@ -24,7 +24,7 @@
   register: ifcfgeth1
   failed_when: "1 != 1"
   changed_when: "1 != 1"
-  always_run: true
+  check_mode: no
   when: deployment_type is defined
 
 - name: Make sure usb0 doesn't get in our way
diff --git a/roles/people/tasks/main.yml b/roles/people/tasks/main.yml
index ae0a92610d..554bc23cfb 100644
--- a/roles/people/tasks/main.yml
+++ b/roles/people/tasks/main.yml
@@ -72,7 +72,7 @@
 - name: check the selinux context of the users home git dirs
   command: matchpathcon "/home/fedora/someone/public_git"
   register: gitcontext
-  always_run: yes
+  check_mode: no
   changed_when: false
   tags:
   - config
@@ -88,7 +88,7 @@
 - name: check the selinux context of the project dirs
   command: matchpathcon "/project"
   register: gitcontext
-  always_run: yes
+  check_mode: no
   changed_when: false
   tags:
   - config
@@ -104,7 +104,7 @@
 - name: check the selinux context of the web dir
   command: matchpathcon "/srv/web"
   register: gitcontext
-  always_run: yes
+  check_mode: no
   changed_when: false
   tags:
   - config
@@ -120,7 +120,7 @@
 - name: check the selinux context of the people dir
   command: matchpathcon "/srv/people"
   register: gitcontext
-  always_run: yes
+  check_mode: no
   changed_when: false
   tags:
   - config
@@ -136,7 +136,7 @@
 - name: check the selinux context of the planet dir
   command: matchpathcon "/srv/planet"
   register: gitcontext
-  always_run: yes
+  check_mode: no
   changed_when: false
   tags:
   - config
@@ -154,7 +154,7 @@
 - name: check the selinux context alias of the home dir
   command: matchpathcon "/srv/home"
   register: gitcontext
-  always_run: yes
+  check_mode: no
   changed_when: false
   tags:
   - config
@@ -173,7 +173,7 @@
 #
 - name: set default xfs quotas on /srv
   command: xfs_quota -x -c 'limit bsoft=2g bhard=2g -d' /srv
-  always_run: true
+  check_mode: no
   register: xfs_quotaoutput
   changed_when: "xfs_quotaoutput.rc != 0"
   tags:
@@ -215,7 +215,7 @@
   - { user: tflink, quota: 10g }
   - { user: thunderbirdtr, quota: 3g }
   - { user: zpericic, quota: 5g }
-  always_run: true
+  check_mode: no
   register: xfs_quotaoutput
   changed_when: "xfs_quotaoutput.rc != 0"
   tags:
diff --git a/roles/phabricator/tasks/main.yml b/roles/phabricator/tasks/main.yml
index 2d2cfeea16..b69ebf5f06 100644
--- a/roles/phabricator/tasks/main.yml
+++ b/roles/phabricator/tasks/main.yml
@@ -150,7 +150,7 @@
 - name: check to see if sshd port is already known by selinux
   shell: semanage port -l | grep ssh
   register: sshd_selinux_port
-  always_run: yes
+  check_mode: no
   changed_when: false
 
 - name: allow alternate sshd port
diff --git a/roles/planet/tasks/main.yml b/roles/planet/tasks/main.yml
index 8519805640..1936ca6f4c 100644
--- a/roles/planet/tasks/main.yml
+++ b/roles/planet/tasks/main.yml
@@ -54,7 +54,7 @@
 - name: check the selinux context of the planet dir
   command: matchpathcon "/srv/planet"
   register: gitcontext
-  always_run: yes
+  check_mode: no
   changed_when: false
   tags:
     - config
diff --git a/roles/serial-console/tasks/main.yml b/roles/serial-console/tasks/main.yml
index 2feec5c6a4..a333188fb8 100644
--- a/roles/serial-console/tasks/main.yml
+++ b/roles/serial-console/tasks/main.yml
@@ -4,7 +4,7 @@
 - name: check for grub serial setup
   command: cat /etc/grub2.cfg
   register: serial
-  always_run: yes
+  check_mode: no
   changed_when: '1 != 1'
   tags:
   - serial-console
diff --git a/roles/supybot/tasks/main.yml b/roles/supybot/tasks/main.yml
index 775810c933..cde985a2e2 100644
--- a/roles/supybot/tasks/main.yml
+++ b/roles/supybot/tasks/main.yml
@@ -55,7 +55,7 @@
 - name: check the selinux context of the /srv/web/meetbot dir
   command: matchpathcon /srv/web/meetbot
   register: context
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - config
diff --git a/roles/tagger/tasks/main.yml b/roles/tagger/tasks/main.yml
index c3bc19e527..a21a87cdc8 100644
--- a/roles/tagger/tasks/main.yml
+++ b/roles/tagger/tasks/main.yml
@@ -85,7 +85,7 @@
 - name: check log file
   command: stat /var/log/fedoratagger.log
   register: logstat
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   ignore_errors: true
   tags:
diff --git a/roles/torrent/tasks/main.yml b/roles/torrent/tasks/main.yml
index 58e5cdca0a..8026af33c2 100644
--- a/roles/torrent/tasks/main.yml
+++ b/roles/torrent/tasks/main.yml
@@ -75,7 +75,7 @@
 - name: check the selinux context of webdir
   command: matchpathcon /srv/web
   register: webdir
-  always_run: yes
+  check_mode: no
   changed_when: "1 != 1"
   tags:
   - config
diff --git a/tasks/growroot_cloud.yml b/tasks/growroot_cloud.yml
index 35f493eb54..630c91957c 100644
--- a/tasks/growroot_cloud.yml
+++ b/tasks/growroot_cloud.yml
@@ -12,7 +12,7 @@
 - name: growpart the second partition (/) to full size
   command: growpart /dev/vda 2
   register: growpart
-  always_run: true
+  check_mode: no
   changed_when: "growpart.rc != 1"
   #failed_when: growpart.rc == 2
   ignore_errors: true
diff --git a/tasks/growroot_cloud_el7.yml b/tasks/growroot_cloud_el7.yml
index 986d6bff27..0803064e77 100644
--- a/tasks/growroot_cloud_el7.yml
+++ b/tasks/growroot_cloud_el7.yml
@@ -12,7 +12,7 @@
 - name: growpart the first partition (/) to full size
   command: growpart /dev/vda 1
   register: growpart
-  always_run: true
+  check_mode: no
   changed_when: "growpart.rc != 1"
   failed_when: growpart.rc == 2
 
diff --git a/tasks/persistent_cloud.yml b/tasks/persistent_cloud.yml
index a0e6a02994..c43ce8cbc2 100644
--- a/tasks/persistent_cloud.yml
+++ b/tasks/persistent_cloud.yml
@@ -5,7 +5,7 @@
   register: host_is_up
   ignore_errors: true
   changed_when: false
-  always_run: true
+  check_mode: no
 
 - name: clean out old known_hosts (name based entries)
   local_action: known_hosts path={{item}} host={{inventory_hostname}} state=absent
@@ -56,7 +56,7 @@
   changed_when: volume_available.rc == 0
   ignore_errors: True
   when: volumes is defined
-  always_run: True
+  check_mode: no
 
 #
 # If it is attach it.
@@ -97,7 +97,7 @@
 
 - name: gather facts
   setup:
-  always_run: True
+  check_mode: no
   ignore_errors: True
   register: facts
 
diff --git a/tasks/virt_instance_create.yml b/tasks/virt_instance_create.yml
index 358e29d54f..fa0b53ebcc 100644
--- a/tasks/virt_instance_create.yml
+++ b/tasks/virt_instance_create.yml
@@ -6,7 +6,7 @@
   delegate_to: "{{ vmhost }}"
   virt: command=list_vms
   register: result
-  always_run: yes
+  check_mode: no
 
 - name: ensure the lv for the guest is made
   lvol: lv={{ inventory_hostname }} vg={{ volgroup }} size={{ lvm_size }} state=present