On Horizon/Compute/Instances/$instance/Puppet Configuration, I can add apply Puppet roles and set the role parameters ("Apply role") and disable them ("Remove role"). However I cannot change the role parameters of an already applied role. To do that, I have to remove the role and apply it again with the changed parameters.

As in the time between "Remove role" and "Apply role" Puppet may run on the instance with strange results, there should be a way in the UI to edit role parameters in an atomic way.