diff --git a/defaults/main.yml b/defaults/main.yml
index 98f1b96..a83d87f 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -37,7 +37,7 @@ k8s_taint_servers: false
 k8s_label_agents: false
 
 # fetch kubeconfig from the bootstrap node
-k8s_get_kubeconfig: true
+# k8s_get_kubeconfig: always | never
 
 # shared k8s api port
 k8s_api_port: 6443
diff --git a/tasks/main.yml b/tasks/main.yml
index 4c3ed4b..6174b11 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -110,10 +110,9 @@
     ansible.builtin.include_tasks: "shared/kubeconf.yml"
     when:
       - k8s_node_type == "bootstrap"
-      - k8s_get_kubeconf
     tags:
       - k8s-get-kubeconf
-  
+      - "{{ k8s_get_kubeconf | d('always') }}"
   - name: include secret block
     ansible.builtin.include_tasks: "shared/secrets.yml"
     when: