I'm reviving this thread about r10k. I managed to get a token created that allows read-only access to just the repositories I need on Github. Now here's my next problem: How does R10k know when to apply my fine-grained token to my private repositories versus when I'm just pulling from a public repo? I can (and did for testing) hard code the token in the Puppetfile but that seems pretty stupid to do. R10k did pull down my private stuff so I know my token is good. I don't see anything in the documentation that says, "do this when pulling private repos modules."