From 39187941a4c5ee2297b890d99453c3152bbb3740 Mon Sep 17 00:00:00 2001
From: ebner <simon.ebner@psi.ch>
Date: Mon, 23 Feb 2026 15:23:14 +0100
Subject: [PATCH] add example

---
 docs/admin-guide/puppet/hiera.md | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/docs/admin-guide/puppet/hiera.md b/docs/admin-guide/puppet/hiera.md
index 2bcfda0a..19f28175 100644
--- a/docs/admin-guide/puppet/hiera.md
+++ b/docs/admin-guide/puppet/hiera.md
@@ -93,6 +93,29 @@ block: >
 and place either the string or the block at the required place in your Hiera YAML.
 
 
+Beside encrypting a complete e.g. content of a file, you can also encrypt only a single value. This can be done as follows:
+
+```yaml
+letsencrypt::eab-kid: >
+  ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBAD
+  ...
+
+letsencrypt::eab-hmac-key: >
+  ENC[PKCS7,MIIBygYJKoZIhvcNAQcDoIIBuzCCAbcCAQAxggEhMIIBHQIBAD
+  ...
+
+files::files:
+  /etc/letsencrypt/cli.ini:
+    mode: '0644'
+    content: |
+      server = https://one.digicert.com/mpki/api/v1/acme/v2/directory
+      # Server authentication. Due to having this, we do not need to do a DNS challenge.
+      eab-kid = %{lookup('lx-data::letsencrypt::eab-kid')}
+      eab-hmac-key = %{lookup('lx-data::letsencrypt::eab-hmac-key')}
+```
+
+`letsencrypt::eab-kid` and `letsencrypt::eab-hmac-key` are arbitrary key names, you can use any key name you want, just ensure that they are unique.
+
 ### Hiera Variable Interpolation
 
 Within Hiera also variable interpolation might be use to include other Hiera keys or facts, etc. into the values.