Another approach is to run the puppet agent via cron or SystemD timer. That both solves thundering herd and ensures you have a fresh process tree for each run --- which would address the glibc+nsswitch quirks around joining a domain. https://forge.puppet.com/modules/reidmv/puppet_run_scheduler/readme is one implementation of that strategy.