The new feature flag for keeping /var/lib/operations/puppet in sync with upstream introduced in T1150: Add a way for self hosted labs puppetmasters to auto update themselves is awesome! But (there's always a but) there is an additional repository that is always forgotten until it causes a puppet run failure. Updating /var/lib/git/labs/private using GIT_SSH=/var/lib/git/ssh git pull --rebase or a fancier equivalent when the $::puppetmaster_autoupdate feature flag is set would be most excellent.