diff --git a/roles/kubernetes/tasks/Rocky.yml b/roles/kubernetes/tasks/Rocky.yml
index 987553a..ad7382c 100644
--- a/roles/kubernetes/tasks/Rocky.yml
+++ b/roles/kubernetes/tasks/Rocky.yml
@@ -156,36 +156,45 @@
         name: kubelet
         enabled: yes
         state: started
-    # - name: Ensure firewalld is running
-    #   ansible.builtin.service:
-    #     name: firewalld
-    #     state: started
-    #     enabled: true
-    #   when: inventory_hostname.endswith('-vm01.home.lan')
 
-    # - name: Open Kubernetes API server port (6443)
-    #   ansible.posix.firewalld:
-    #     port: 6443/tcp
-    #     permanent: yes
-    #     state: enabled
-    #     immediate: yes
-    #   when: inventory_hostname.endswith('-vm01.home.lan')
+    - name: Ensure firewalld is running
+      ansible.builtin.service:
+        name: firewalld
+        state: started
+        enabled: true
+      when: 
+        - inventory_hostname.endswith('-vm01.home.lan')
+        - "'firewalld' in ansible_facts.packages"
+        
+    - name: Open Kubernetes API server port (6443)
+      ansible.posix.firewalld:
+        port: 6443/tcp
+        permanent: yes
+        state: enabled
+        immediate: yes
+      when: 
+        - inventory_hostname.endswith('-vm01.home.lan')
+        - "'firewalld' in ansible_facts.packages"
 
-    # - name: Open etcd ports (2379-2380)
-    #   ansible.posix.firewalld:
-    #     port: 2379-2380/tcp
-    #     permanent: yes
-    #     state: enabled
-    #     immediate: yes
-    #   when: inventory_hostname.endswith('-vm01.home.lan')
 
-    # - name: Open kubelet and scheduler ports (10250-10252)
-    #   ansible.posix.firewalld:
-    #     port: 10250-10252/tcp
-    #     permanent: yes
-    #     state: enabled
-    #     immediate: yes
+    - name: Open etcd ports (2379-2380)
+      ansible.posix.firewalld:
+        port: 2379-2380/tcp
+        permanent: yes
+        state: enabled
+        immediate: yes
+      when: 
+        - inventory_hostname.endswith('-vm01.home.lan')
+        - "'firewalld' in ansible_facts.packages"
 
+    - name: Open kubelet and scheduler ports (10250-10252)
+      ansible.posix.firewalld:
+        port: 10250-10252/tcp
+        permanent: yes
+        state: enabled
+        immediate: yes
+      when: 
+        - "'firewalld' in ansible_facts.packages"
 
     - name: Restart containerd
       systemd:
@@ -305,39 +314,49 @@
       loop: "{{ aliases | dict2items }}"
       when: inventory_hostname.endswith('-vm01.home.lan')
 
-    # - name: Allow TCP 10250 from 192.168.77.0/24
-    #   firewalld:
-    #     rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="10250" protocol="tcp" accept'
-    #     permanent: yes
-    #     state: enabled
-    #     immediate: yes
+    - name: Allow TCP 10250 from 192.168.77.0/24
+      firewalld:
+        rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="10250" protocol="tcp" accept'
+        permanent: yes
+        state: enabled
+        immediate: yes
+      when: 
+        - "'firewalld' in ansible_facts.packages"
 
-    # - name: Allow UDP 8472 from 192.168.77.0/24
-    #   firewalld:
-    #     rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="8472" protocol="udp" accept'
-    #     permanent: yes
-    #     state: enabled
-    #     immediate: yes
+    - name: Allow UDP 8472 from 192.168.77.0/24
+      firewalld:
+        rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="8472" protocol="udp" accept'
+        permanent: yes
+        state: enabled
+        immediate: yes
+      when: 
+        - "'firewalld' in ansible_facts.packages"
+        
+    - name: Add flannel.1 interface to trusted zone
+      firewalld:
+        rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept'   # interface handling is tricky with rich_rule
+        permanent: yes
+        state: enabled
+        immediate: yes
+      when: 
+        - "'firewalld' in ansible_facts.packages"
 
-    # - name: Add flannel.1 interface to trusted zone
-    #   firewalld:
-    #     rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept'   # interface handling is tricky with rich_rule
-    #     permanent: yes
-    #     state: enabled
-    #     immediate: yes
+    - name: Add cni0 interface to trusted zone
+      firewalld:
+        rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept'
+        permanent: yes
+        state: enabled
+        immediate: yes
+      when: 
+        - "'firewalld' in ansible_facts.packages"
 
-    # - name: Add cni0 interface to trusted zone
-    #   firewalld:
-    #     rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept'
-    #     permanent: yes
-    #     state: enabled
-    #     immediate: yes
-
-    # - name: Ensure firewalld is restarted
-    #   ansible.builtin.service:
-    #     name: firewalld
-    #     state: stopped
-    #     enabled: false
+    - name: Ensure firewalld is restarted
+      ansible.builtin.service:
+        name: firewalld
+        state: stopped
+        enabled: false
+      when: 
+        - "'firewalld' in ansible_facts.packages"
     # ----------------------------
     # 1. Install Helm v3
     # ----------------------------