Explicitly pass Puppet configs/secrets. r=rail