I am running the Puppet Server (v8) on a host and configured the Puppet agent (v8) on another host, all running on Rocky 8. I have installed the MySQL module from Puppet Forge.

How do I define an encrypted user password without overwriting the hiera.yaml and common.yaml in the MySQL module directory?

My Puppet folder structure on the server is:

etc/
├─ puppetlabs/
│  ├─ code/
│  │  ├─ environments/
│  │  │  ├─ production/
│  │  │  │  ├─ data/
│  │  │  │  │  ├─ common.yaml
│  │  │  │  ├─ modules/
│  │  │  │  ├─ manifests/
│  │  │  │  │  ├─ site.pp
│  │  │  │  ├─ hiera.yaml
│  │  ├─ modules/
│  │  │  ├─ mysql/
│  │  │  │  ├─ data/
│  │  │  │  │  ├─ common.yaml
│  │  │  │  ├─ manifest/
│  │  │  │  │  ├─ server.pp
│  │  │  │  ├─ hiera.yaml
│  │  │  │  ├─ and more...

I’m looking to encrypt the root password for MySQL using eyaml installed on the Puppet Server. I have run the following to generate the keys and encrypt the password:

eyaml createkeys
eyaml encrypt -l 'my_mysql_password' -s 'mypassword' 

The above generated an encrypted key in the format ENC[PKCS7,...==].

My production environment hiera.yaml is:
/etc/puppetlabs/code/environments/production/hiera.yaml

---
version: 5
defaults:
  datadir: data
  data_hash: yaml_data
hierarchy:
  - name: "Per-node data (yaml version)"
    path: "nodes/%{::trusted.certname}.yaml"
  - name: "Other YAML hierarchy levels"
    paths:
      - "common.yaml"
  - name: 'common'
    lookup_key: eyaml_lookup_key
    paths:
      - "common.yaml"
    options:
      pkcs7_private_key: /etc/puppetlabs/puppet/keys/private_key.pkcs7.pem
      pkcs7_public_key:  /etc/puppetlabs/puppet/keys/public_key.pkcs7.pem

My production environment common.yaml is:
/etc/puppetlabs/code/environments/production/data/common.yaml

---
mysql::server::root_password: >
  ENC[PKCS7,...==]

My production manifest contains:
/etc/puppetlabs/code/environments/production/manifests/site.pp

class { 'mysql::server':
        package_name            => 'mariadb-server',
        root_password           => lookup('mysql::server::root_password'),
        remove_default_accounts => true,
        restart                 => true,
        override_options => {
          mysqld => {
            'max_connections' => '500',
          },
        }
      }