common.yaml

---

pkcs7_private_key: "/etc/puppetlabs/puppet/keys/private_key.pkcs7.pem"

testclass::secret: ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAXQSL1llpvXtwuCPquIBNgOvaEu4rYPY1XYLEqSi4iCTTaCaXj5GCcEmcyw68liLPRnCwp+E+OhWLOvhxEQM9BPrR+miU1Zol+bhkL3vIE84f8JVCvqOESBNfKiVoABd73CjaDVQfDXVJR8XR57JCRTTzNc+fk88pwcczTNFzUCRtnWYZxMtWudse4Z9jFkioDhsKYoQqugsqhobBpIzGnQOaoEJeUYALyqusVa7mZrNlT0xNBccNk2aAxGEdLay3LdCqOBpsnk/vMwzv1pw8OuT17UWKTSBhRxwg2w+Mk9TZHFKsZ9wmY0cMU+i83tC6jDlA7Clti9ypH0/y72tDhzA8BgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCymI8i2C1wRAJymKgNjbWxgBA854B413xC5Udmhhx4P4BG]

hiera.yaml

---
version: 5

defaults:
  datadir: "/etc/puppetlabs/code/environments/%{environment}/hieradata"

hierarchy:
  - name: Eyaml backend
    lookup_key: eyaml_lookup_key
    paths:
      - "nodes/%{clientcert}.yaml"
      - "environment/%{environment}.yaml"
      - "datacenter/%{datacenter}.yaml"
      - "virtual/%{virtual}.yaml"
      - 'common.yaml'
    options:
      pkcs7_private_key: "%{::pkcs7_private_key}"
      pkcs7_public_key: "/etc/puppetlabs/puppet/keys/public_key.pkcs7.pem"
  - name: Yaml backend
    data_hash: yaml_data
    paths:
      - "nodes/%{clientcert}.yaml"
      - "environment/%{environment}.yaml"
      - "datacenter/%{datacenter}.yaml"
      - "virtual/%{virtual}.yaml"
      - 'common.yaml'

script.log

[root@master puppet]# puppet lookup --node testnode testclass::secret --explain
Warning: ModuleLoader: module 'profile' has unresolved dependencies - it will only see those that are resolved. Use 'puppet module list --tree' to see information about modules
   (file & line not available)
Warning: Undefined variable 'pkcs7_private_key';
   (file & line not available)
Warning: This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Bool. There is further documentation for validate_legacy function in the README. at ["/etc/puppetlabs/code/environments/production/modules/ntp/manifests/init.pp", 39]:
   (at /etc/puppetlabs/code/environments/production/modules/stdlib/lib/puppet/functions/deprecation.rb:25:in `deprecation')
Warning: This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Absolute_Path. There is further documentation for validate_legacy function in the README. at ["/etc/puppetlabs/code/environments/production/modules/ntp/manifests/init.pp", 40]:
   (at /etc/puppetlabs/code/environments/production/modules/stdlib/lib/puppet/functions/deprecation.rb:25:in `deprecation')
Warning: This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::String. There is further documentation for validate_legacy function in the README. at ["/etc/puppetlabs/code/environments/production/modules/ntp/manifests/init.pp", 41]:
   (at /etc/puppetlabs/code/environments/production/modules/stdlib/lib/puppet/functions/deprecation.rb:25:in `deprecation')
Warning: This method is deprecated, please use the stdlib validate_legacy function, with Pattern[]. There is further documentation for validate_legacy function in the README. at ["/etc/puppetlabs/code/environments/production/modules/ntp/manifests/init.pp", 49]:
   (at /etc/puppetlabs/code/environments/production/modules/stdlib/lib/puppet/functions/deprecation.rb:25:in `deprecation')
Warning: This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Array. There is further documentation for validate_legacy function in the README. at ["/etc/puppetlabs/code/environments/production/modules/ntp/manifests/init.pp", 51]:
   (at /etc/puppetlabs/code/environments/production/modules/stdlib/lib/puppet/functions/deprecation.rb:25:in `deprecation')
Warning: This method is deprecated, please use the stdlib validate_legacy function, with Stdlib::Compat::Numeric. There is further documentation for validate_legacy function in the README. at ["/etc/puppetlabs/code/environments/production/modules/ntp/manifests/init.pp", 57]:
   (at /etc/puppetlabs/code/environments/production/modules/stdlib/lib/puppet/functions/deprecation.rb:25:in `deprecation')
Warning: Undefined variable '::pkcs7_private_key';
   (file & line not available)
Error: Could not run: No such file or directory @ rb_sysopen -

site.pp

function lookup_pkcs7_private_key(
  $pkcs7_private_key = '/dev/null',
) {
  lookup('pkcs7_private_key', {'default_value' => $pkcs7_private_key})
}

$pkcs7_private_key = lookup_pkcs7_private_key()


class testclass (
  $secret,
) {
  notify { 'secret':
    message => $secret,
  }
}

node 'testnode' {
  include testclass
}

trace.log

Error: Could not run: No such file or directory @ rb_sysopen -
/opt/puppetlabs/puppet/lib/ruby/gems/2.1.0/gems/hiera-eyaml-2.1.0/lib/hiera/backend/eyaml/encryptors/pkcs7.rb:48:in `read'
/opt/puppetlabs/puppet/lib/ruby/gems/2.1.0/gems/hiera-eyaml-2.1.0/lib/hiera/backend/eyaml/encryptors/pkcs7.rb:48:in `decrypt'
/opt/puppetlabs/puppet/lib/ruby/gems/2.1.0/gems/hiera-eyaml-2.1.0/lib/hiera/backend/eyaml/parser/encrypted_tokens.rb:15:in `encrypted_value'
/opt/puppetlabs/puppet/lib/ruby/gems/2.1.0/gems/hiera-eyaml-2.1.0/lib/hiera/backend/eyaml/parser/encrypted_tokens.rb:80:in `create_enc_token'
/opt/puppetlabs/puppet/lib/ruby/gems/2.1.0/gems/hiera-eyaml-2.1.0/lib/hiera/backend/eyaml/parser/encrypted_tokens.rb:100:in `create_token'
/opt/puppetlabs/puppet/lib/ruby/gems/2.1.0/gems/hiera-eyaml-2.1.0/lib/hiera/backend/eyaml/parser/encrypted_tokens.rb:90:in `create_token'
/opt/puppetlabs/puppet/lib/ruby/gems/2.1.0/gems/hiera-eyaml-2.1.0/lib/hiera/backend/eyaml/parser/parser.rb:71:in `parse_scanner'
/opt/puppetlabs/puppet/lib/ruby/gems/2.1.0/gems/hiera-eyaml-2.1.0/lib/hiera/backend/eyaml/parser/parser.rb:36:in `parse'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/functions/eyaml_lookup_key.rb:85:in `decrypt'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/functions/eyaml_lookup_key.rb:65:in `decrypt_value'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/functions/eyaml_lookup_key.rb:40:in `eyaml_lookup_key'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/functions/dispatch.rb:60:in `invoke'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/functions/dispatcher.rb:43:in `block in dispatch'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/functions/dispatcher.rb:42:in `catch'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/functions/dispatcher.rb:42:in `dispatch'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/functions/function.rb:46:in `block in call'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/functions/function.rb:45:in `catch'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/functions/function.rb:45:in `call'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/lookup_key_function_provider.rb:53:in `block in lookup_key'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/lookup_key_function_provider.rb:50:in `catch'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/lookup_key_function_provider.rb:50:in `lookup_key'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/lookup_key_function_provider.rb:31:in `block in invoke_with_location'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/invocation.rb:133:in `with'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/lookup_key_function_provider.rb:30:in `invoke_with_location'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/lookup_key_function_provider.rb:20:in `block (2 levels) in unchecked_key_lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/merge_strategy.rb:209:in `block (2 levels) in lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/merge_strategy.rb:209:in `catch'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/merge_strategy.rb:209:in `block in lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/merge_strategy.rb:209:in `each'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/merge_strategy.rb:209:in `lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/lookup_key_function_provider.rb:19:in `block in unchecked_key_lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/invocation.rb:133:in `with'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/lookup_key_function_provider.rb:18:in `unchecked_key_lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/configured_data_provider.rb:56:in `block (2 levels) in unchecked_key_lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/merge_strategy.rb:209:in `block (2 levels) in lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/merge_strategy.rb:209:in `catch'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/merge_strategy.rb:209:in `block in lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/merge_strategy.rb:209:in `each'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/merge_strategy.rb:209:in `lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/configured_data_provider.rb:55:in `block in unchecked_key_lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/invocation.rb:133:in `with'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/configured_data_provider.rb:48:in `unchecked_key_lookup'
/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/pops/lookup/global_data_provider.rb:51:in `unchecked_key_lookup'
[...]