diff --git a/inventory/groups.yaml b/inventory/groups.yaml
index 188184b397..ecb07291e0 100644
--- a/inventory/groups.yaml
+++ b/inventory/groups.yaml
@@ -67,8 +67,6 @@ groups:
     - jvb[0-9]*.opendev.org
   kdc:
     - kdc[0-9]*.open*.org
-  kubernetes:
-    - opendev-k8s*.opendev.org
   letsencrypt:
     - etherpad[0-9]*.opendev.org
     - gitea[0-9]*.opendev.org
diff --git a/playbooks/base.yaml b/playbooks/base.yaml
index 1a5d126e8d..3ef04741e8 100644
--- a/playbooks/base.yaml
+++ b/playbooks/base.yaml
@@ -1,25 +1,12 @@
-- hosts: "!disabled"
-  name: "Base: set up users and base package repositories on all hosts"
-  roles:
-    - users
-    - base-repos
-
-# Run base-server seperately so that the update apt cache handler in base-repos
-# fires before we run base-server
 - hosts: "!disabled"
   name: "Base: set up common environment on all hosts"
   roles:
+    - users
+    - base-repos
     - base-server
     - timezone
     - unbound
     - exim
     - disable-puppet-agent
-
-# Do not run firewall rules on kubernetes hosts, they are managed by k8s-on-openstack.
-# TODO(mordred) snmpd should be able to be re-added to kubernetes hosts but we will
-# need to add cacti to sg-opendev-nodes and sg-opendev-master security groups first.
-- hosts: "!disabled:!kubernetes"
-  name: "Base: set up firewall rules"
-  roles:
     - snmpd
     - iptables
diff --git a/playbooks/roles/base-repos/tasks/main.yaml b/playbooks/roles/base-repos/tasks/main.yaml
index 7662da1fe0..fa42e5ac9d 100644
--- a/playbooks/roles/base-repos/tasks/main.yaml
+++ b/playbooks/roles/base-repos/tasks/main.yaml
@@ -6,3 +6,5 @@
         - "{{ ansible_facts.distribution }}.yaml"
         - "{{ ansible_facts.os_family }}.yaml"
   loop: "{{ query('first_found', params, errors='ignore') }}"
+
+- meta: flush_handlers