This has rotted in a few ways:
- I'm not sure that the state-of-the-art migration scripts are puppetized
- migration currently requires key-forwarding which is now disabled
- possibly openstack upstream provides actual ways to do this that don't require custom hacks