lookup_sensitive.pp

function mymodule::my_privates (
  Variant[String, Numeric] $key,
  Hash                     $options,
  Puppet::LookupContext    $context,
) {
  case $key {
    'mymodule::secret1' : { Sensitive('There is no Santa on the evening coach') }
    'mymodule::secret2' : { Sensitive('All your base are belong to us') }
    default: { $context.not_found }
  }
}