Puppet server v7 only runs on Bookworm. So almost all existing puppetmasters will need to be rebuild as new VMs. Steps for each server will include:
* build new server VM, apply "profile::puppet::agent::force_puppet7: true", allow puppet to stabilize, apply "role::puppetserver::cloud_vps_project", allow puppet to stabilize
* Migrate local changes in operations/puppet and labs/private to the new server
* clone certs from existing v5 puppet server to new puppet server
** is this possible if the new server has a different name than the old one?
* move clients from old server to new server
An alternative to cloning certs is to just treat the move from old puppet master to new puppet server as clean break requiring regeneration of all certs (the same dance that we do when moving from the central puppet master to a project-local one).