i'm just nervous that the puppetserver container might need a lot more work to get to that state due to the sheer number of moving parts still

It's basically a no-op. The access model is already using GID 0, it's all in place. What needs to change is the documentation and a regression introduced in the big restructure. At my work we use the server image as is already, except for a different UID. Also different JDK version, but that's a different story... We also use openvoxdb, forked with openshift compatibility already. As well as the r10k container, not openshift compatible yet, same as it is upstream, we just execute it using GID 0 as common denominator for the server.