- set the facts soft limit for agents and servers - prevent warnings about reaching the default 2048 soft limit
- puppet clients can not request multiple dns alt_names - set puppetdbapi hosts to request multiple certificates
- manage the service - manage the package, version lock it - deploy the /etc/puppetlabs/puppet/puppet.conf from template for puppet clients only