On first install this will most likely trigger a reboot.
Ansible will wait for the host to come back up after running unattended-upgrades.

moved the unattended-upgrades and apply grsec lock to the a separate role.
This is the last role ran on both servers. It will:
 - run unattended-upgrades
 - reboot if necessary
 - check to see if the grsec lock is present
 - if it not present the machine will reboot
 - if grsec lock option is present ensure it is applied

The grsec kernel is installed in the common role.