Check all places with check_mode: no for side effects (#8573)

and fix the one with side effect.

Also removes `notify` from this task as the task has `changed_when: false`
and notify is not going to fire.

roles/etcd/tasks/gen_certs_script.yml

@@ -156,11 +156,9 @@
     executable: /bin/bash
   no_log: true
   changed_when: false
-  check_mode: no
   when: (('calico_rr' in groups and inventory_hostname in groups['calico_rr']) or
         inventory_hostname in groups['k8s_cluster']) and
         sync_certs|default(false) and inventory_hostname not in groups['etcd']
-  notify: set etcd_secret_changed
 
 - name: Gen_certs | check certificate permissions
   file: