Note that currently the deployment-prep cluster needs per-host TLS certificates that are somehow created manually and commited as local hacks to the public and private puppet repositories on the project-local puppetmaster. This seems like a good opportunity to check if we can integrate the elastic puppetization with the new cfssl-based automated pki system and using the standard Envoy-based TLS termination stack.