New in Puppet 6 is a capability called the Deferred type that allows agents to execute a Puppet function to resolve a data value at the time of catalog application.
When compiling catalogs, functions are normally executed on the puppet master with results entered into the catalog directly. The complete and fully resolved catalog is then sent to the agent for application. Starting in Puppet 6, functions can now be deferred until the agent applies the catalog, meaning the agent executes the function on the agent instead of the master. The upshot of this is that agents can use a function to fetch data like secrets directly rather than having the Puppet master act as an intermediary. Builds with this functionality are now available from the puppet6 nightly repos.