deferred_epp.pp

# <module>/functions/deferred_epp.pp
# note: depends on puppetlabs/stdlib
function deferred_epp(String $template, Hash $variables) >> Deferred {
  if($template[0] == '/') {
    $path = $template
  }
  else {
    $parts = $template.split('/')
    $mod   = get_module_path($parts[0])
    $file  = $parts[1,-1].join('/')
    $path  = "${mod}/templates/${file}"
  }

  Deferred("inline_epp", [file($path), $variables])
}

$variables = {
    'password' => Deferred('vault_lookup::lookup',
                    ["secret/test", 'https://vault.docker:8200']),
}

file { '/etc/secret.conf':
    ensure  => file,
    owner   => 'root',
    mode    => '0600',
    content => deferred_epp('mod/template.epp', $variables),
}

We should add find_template() function analog to find_file() in puppet. (The underlying implementation in Puppet::Pops::Parser::Files already supports finding template in the method find_template(template, environment))