Ok, I understand r10k's "get repo from anywhere, make puppet environment mashup" - but I have trouble believing that this is the only way to do things.
The philosophy of the DevOps repo is that anyone should be able to reproduce our infrastructure - but that doesn't mean we have to actually deploy from that repo : just that that repo should contain everything that we do deploy.
First of all - where is the r10k code repo ? It would be much easier to comment on this stuff seeing it in action. Is there a repo with your config anywhere ?
I presume this is referring to https://github.com/bazinski/puppet-fail2ban right ?
So, your deployment scenarios locally can point to individual repos (without submodules), as they are doing now. Those same repos can be added a submodules to the DevOps repo. Since you are not deploying from DevOps, but we are just using it as a reference, we can still collaborate properly, since we are still pointing to the same repos (the original one), and we can refer to the same hash/commits in the case issues arise.
What do you think ?