- rebuilt vault, updated root token and unseak keys
- add certmanager script and config.yaml file - install into pyenv for certmanager - deploy to puppet-masters only