Generate a templated file on the agent, using secrets resolved agent side.

agent_side_template.pp

$variables = {
  'password' => Deferred('vault_lookup::lookup',
                  ["secret/test", 'https://vault.docker:8200']),
}

# use inline_epp(), and file() to compile the template source into the catalog
file { '/etc/secrets.conf':
  ensure => file,
  content => Deferred('inline_epp',
               [file('mymodule/secrets.conf.epp'), $variables]),
}

Note that this means that the template has to live in the files directory, not templates.

Also of note:

• The older inline_template() function isn't a Puppet4 function, so it cannot be deferred like this.
• Functions can be embedded directly in the template, but they don't seem to be able to resolve facts or other variables in scope, which would probably be surprising/unexpected.

`
$password = Deferred('vault_lookup::lookup',
["secret/test", 'https://vault.docker:8200'])
$hash_variables = {
'password' => $password,
}

# use inline_epp(), and file() to compile the template source into the catalog
file { '/etc/secrets.conf':
ensure => file,
content => Deferred('inline_epp',
[file('mymodule/secrets.conf.epp'), $hash_variables]),
}
`

Note ERB is not available when resolving deferred values.

It is possible to reference a template in the templates directory by first locating the module root with the function module_directory() in puppet and then adding the relative path to templates.