diff --git a/.gitmodules b/.gitmodules
index 6fcd6ce..9212e82 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,4 +1,4 @@
 [submodule "kubespray"]
   path = kubespray
   url = https://github.com/kubernetes-sigs/kubespray.git
-  branch = v2.18.0
+  branch = v2.19.0
diff --git a/group_vars/stage_devscr/kubespray.yml b/group_vars/stage_devscr/kubespray.yml
index 1eac399..f19810d 100644
--- a/group_vars/stage_devscr/kubespray.yml
+++ b/group_vars/stage_devscr/kubespray.yml
@@ -1,12 +1,2 @@
 ---
 helm_enabled: true
-external_cloud_provider: hcloud
-external_hcloud_cloud:
-  hcloud_api_token: '{{ hetzner_authentication_ccm_vault }}'
-  token_secret_name: hcloud
-  with_networks: true
-  service_account_name: cloud-controller-manager
-  controller_image_tag: "latest"
-  controller_extra_args: {}
-
-network_id: '{{ stage }}'
diff --git a/group_vars/stage_devscr/plain.yml b/group_vars/stage_devscr/plain.yml
index 4544955..c8c964e 100644
--- a/group_vars/stage_devscr/plain.yml
+++ b/group_vars/stage_devscr/plain.yml
@@ -112,6 +112,5 @@ netgo_msteams_hook_alerting: "{{ netgo_msteams_hook_alerting_vault }}"
 # push mirror: https://{{ stage }}-gitea-01.smardigo.digital/communication-keys.git
 gpg_key_smardigo_automation__private: '{{ gpg_key_smardigo_automation__private__vault }}'
 
-kubernetes_with_ccm: False # already done by kubespray
 kubernetes_with_awx: False
 kubernetes_with_gitea: True
diff --git a/kubernetes.yml b/kubernetes.yml
index 82e57a1..bf58f21 100644
--- a/kubernetes.yml
+++ b/kubernetes.yml
@@ -24,6 +24,8 @@
     - { role: kubernetes/namespace }
     - role: kubernetes/cloud_controller_manager
       when: kubernetes_with_ccm | default(True)
+      tags:
+        - ccm
     - { role: kubernetes/container_storage_interface }
     - { role: kubernetes/prometheus }
     - { role: kubernetes/cert_manager }