Idempotency fixes (#1838)

roles/kubernetes-apps/policy_controller/calico/tasks/main.yml

@@ -11,6 +11,7 @@
   shell: "{{ bin_dir }}/kubectl -n {{ system_namespace }} get rs calico-policy-controller -o=jsonpath='{$.spec.template.spec.containers[:1].image}' | cut -d':' -f2"
   register: existing_calico_policy_version
   run_once: true
+  changed_when: false
   failed_when: false
 
 # FIXME(mattymo): This should not be necessary