Using a template with Deferred values

Templates are rendered on the primary server during catalog compilation. However, this does not work with deferred functions because their values aren't known at compile time. Instead, you need to defer the template rendering.

To defer the template rendering, you need to compile the template source into the catalog, and then render the string using the stdlib::deferrable_epp() function. The template source must be in the files directory of your module for it to be accessible to the file() function.

Note: All variables used by the template, including facts or other variables in scope, must be explicitly passed as the $variables parameter. This is because the agent does not have access to the full scope used by the server to render templates normally.
 $variables = {
      'password' => Deferred('vault_lookup::lookup',
                      ["secret/test", 'https://vault.docker:8200']),
    }

    # compile the template source into the catalog
    file { '/etc/secrets.conf':
      ensure  => file,
      content => stdlib::deferrable_epp('mymodule/secrets.conf.epp', $variables)
    }
Note: You cannot defer .erb style templates like this because of the way they use scope. Use .epp templates instead.