add example

docs/admin-guide/puppet/hiera.md

@@ -93,6 +93,29 @@ block: >
 and place either the string or the block at the required place in your Hiera YAML.
 
 
+Beside encrypting a complete e.g. content of a file, you can also encrypt only a single value. This can be done as follows:
+
+```yaml
+letsencrypt::eab-kid: >
+  ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBAD
+  ...
+
+letsencrypt::eab-hmac-key: >
+  ENC[PKCS7,MIIBygYJKoZIhvcNAQcDoIIBuzCCAbcCAQAxggEhMIIBHQIBAD
+  ...
+
+files::files:
+  /etc/letsencrypt/cli.ini:
+    mode: '0644'
+    content: |
+      server = https://one.digicert.com/mpki/api/v1/acme/v2/directory
+      # Server authentication. Due to having this, we do not need to do a DNS challenge.
+      eab-kid = %{lookup('lx-data::letsencrypt::eab-kid')}
+      eab-hmac-key = %{lookup('lx-data::letsencrypt::eab-hmac-key')}
+```
+
+`letsencrypt::eab-kid` and `letsencrypt::eab-hmac-key` are arbitrary key names, you can use any key name you want, just ensure that they are unique.
+
 ### Hiera Variable Interpolation
 
 Within Hiera also variable interpolation might be use to include other Hiera keys or facts, etc. into the values.