puppet cert sudo now optional