From e95d51bb53ec806fdf3475163fc3772aa97a3c3f Mon Sep 17 00:00:00 2001
From: jiaychen <jiayu.chen@camptocamp.com>
Date: Wed, 26 Nov 2025 17:38:10 +0100
Subject: [PATCH] Use deferrable_epp for .my.cnf to ensure root password
 resolve correctly

---
 manifests/server/root_password.pp | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/manifests/server/root_password.pp b/manifests/server/root_password.pp
index 91b047626..6d234572b 100644
--- a/manifests/server/root_password.pp
+++ b/manifests/server/root_password.pp
@@ -37,16 +37,16 @@
     }
   }
 
-  $parameters = {
-    'root_password_set' => $root_password_set,
-    'root_password' => $root_password,
-    'options' => $options,
-  }
-
   if $mysql::server::create_root_my_cnf and $root_password_set {
-    # TODO: use EPP instead of ERB, as EPP can handle Data of Type Sensitive without further ado
     file { "${facts['root_home']}/.my.cnf":
-      content => epp('mysql/my.cnf.pass.epp',$parameters),
+      content => Sensitive(stdlib::deferrable_epp(
+          'mysql/my.cnf.pass.epp',
+          {
+            'root_password_set' => $root_password_set,
+            'root_password'     => $root_password,
+            'options'           => $options,
+          }
+      )),
       owner   => 'root',
       mode    => '0600',
     }