Deferred functions
A Deferred function (also known as an agent side function) is a function with the Deferred type applied to it. This causes the function to run locally on a client when the catalog is applied, rather than on a Puppet server during compilation. The catalog for a deferred function contains what to run on the client rather than the output of the function. The deferred type was introduced in Puppet 6.0 and is available in all later versions.
This is typically used when the compilation server can’t access a necessary source in a function – for example, when retrieving a secret from a HashiCorp Vault server, where security is set up to only allow the client to access a secret.
The syntax for applying Deferred is as follows:
Deferred( name of function, [arguments])
The following is an example of retrieving a secret from vault. This can be used within a user resource for exampleapp to set the password from a Vault path of exampleapp/password:
