explicit hiera calls shouldn't be necessary, except from package_ensure