Interesting... We don't use Ansible anymore but maybe could do something similar with Bolt if the pure Puppet solution ends up being too complicated