Trying to set debconf-set-selections to preseed percona mysql password

preseed-no-file-template-support.sls

percona_preseed_require:
  pkg.latest:
    - pkgs:
      - debconf-utils

preseed_mysql_password_1:
  debconf.set_file:
    - source: salt://percona_galera/templates/preseed.answers
    - require:
      - pkg: percona_preseed_require

preseed.answers

percona-xtradb-cluster-server-5.5       percona-server-server/root_password     password '{{ salt['pillar.get]('secrets:mysql_root', '' ) }}'
percona-xtradb-cluster-server-5.5       percona-server-server/root_password_again       password '{{ salt['pillar.get]('secrets:mysql_root', '' )}}'

works-but-exposes-password.sls

percona_preseed_require:
  pkg.latest:
    - pkgs:
      - debconf-utils


preseed_mysql_password_1:
  debconf.set:
    - name: percona-xtradb-cluster-server-5.5
    - data:
        'percona-server-server/root_password': { 'type': 'password', 'value': '{{ salt['pillar.get']('secrets:mysql_root', '' ) }}' }
    - require:
      - pkg: percona_preseed_require


# If I add the other data line I have bellow behaves poorly if the state is run a second time.
#----------
#    State: - debconf
#    Name:      percona-xtradb-cluster-server-5.5
#    Function:  set
#        Result:    True
#        Comment:
#        Changes:   percona-server-server/root_password_again: [redacted]
#                   percona-server-server/root_password: [redacted]
# ----------
#    State: - debconf
#    Name:      percona-xtradb-cluster-server-5.5
#    Function:  set
#        Result:    True
#        Comment:   Unchanged answers: percona-server-server/root_password_again
#        Changes:   percona-server-server/root_password: [redacted]
#
preseed_mysql_password_2:
  debconf.set:
    - name: percona-xtradb-cluster-server-5.5
    - data:
        'percona-server-server/root_password_again': { 'type': 'password', 'value': '{{ salt['pillar.get']('secrets:mysql_root', '' ) }}' }
    - require:
      - pkg: percona_preseed_require
      - debconf: preseed_mysql_password_1