Merge "Move ipa check to external_deploy_tasks" into stable/victoria

deployment/etcd/etcd-container-puppet.yaml

@@ -205,25 +205,21 @@ outputs:
             - /var/lib/config-data/etcd/etc/etcd/:/etc/etcd:ro
             - /var/lib/etcd:/var/lib/etcd:ro
       host_prep_tasks:
-        list_concat:
+          - name: create /var/lib/etcd
+            file:
+              path: /var/lib/etcd
+              state: directory
+              setype: container_file_t
+      external_deploy_tasks:
+        if:
+          - internal_tls_enabled
           -
-            - name: create /var/lib/etcd
-              file:
-                path: /var/lib/etcd
-                state: directory
-                setype: container_file_t
-          -
-            if:
-              - internal_tls_enabled
-              -
-                - name: check if ipa server has required permissions
-                  import_role:
-                    name: tls_everywhere
-                    tasks_from: ipa-server-check
-                  tags:
-                    - opendev-validation
-                    - opendev-validation-tls-everywhere
-              - null
+            - name: check if ipa server has required permissions
+              when: step|int == 1
+              import_role:
+                name: tls_everywhere
+                tasks_from: ipa-server-check
+          - null
       upgrade_tasks: []
       metadata_settings:
         if: