secrets have to be accessible from the puppet master