Using a template with Deferred values

Templates are rendered on the primary server during catalog compilation. However, this won't work with deferred functions because their values aren't known at compile time. Instead, you need to defer the template rendering.

To defer the template rendering, you need to compile the template source into the catalog, and then render the string using the inline_epp() function. The template source must be in the files directory of your module for it to be accessible to the file() function. 

 $variables = {
      'password' => Deferred('vault_lookup::lookup',
                      ["secret/test", 'https://vault.docker:8200']),
    }

    # compile the template source into the catalog
    file { '/etc/secrets.conf':
      ensure  => file,
      content => Deferred('inline_epp',
                   [file('mymodule/secrets.conf.epp'), $variables]),
    }
Note: You cannot defer .erb style templates like this because of the way they use scope. Use .epp templates instead.