we need to run puppet on all ganeti nodes

Otherwise ipsec doesn't get up and verify fails.

tsa/howto/ganeti.mdwn

@@ -845,14 +845,18 @@ catastrophic data loss bug in Ganeti or [[drbd]].
 
         rm /etc/no_modules_disabled
 
- 10. reboot again:
+ 10. run puppet across the ganeti cluster to ensure ipsec tunnels are
+     up:
+
+        cumin -p 0 'C:roles::ganeti::fsn' 'puppet agent -t'
+
+ 11. reboot again:
  
         reboot
 
- 11. Then the node is ready to be added to the cluster, by running
+ 12. Then the node is ready to be added to the cluster, by running
      this on the master node:
 
-        puppet agent -t
         gnt-node add \
           --secondary-ip 172.30.135.2 \
           --no-ssh-key-check \