Generate Puppet certs for each volume?

[negz]

Talos performs a regex match against the client cert CN provided by callers (i.e. secret volume) in order to determine which secrets they get, optionally falling back to just giving the caller the secrets they ask for using URL params (i.e. secret volume's 'Tags').

Since secret volume is intended to manage secret volumes for attachment to Helios managed Docker containers it might be neat to request a Puppet certificate for each 'volume' (i.e. Docker container). Alternatively this could remain the responsibility of the caller.