title: Puppet lookup fails with expects a Sensitive value, got String
body: <p>I'm attempting to implement encrypted values in yaml in Hiera 5 to inject passwords securely into Puppet (enterprise) 5.3 via automatic lookup. There's excellent guidance from the <a href="https://puppet.com/blog/my-journey-securing-sensitive-data-puppet-code" rel="nofollow noreferrer">Puppet blog</a> and <a href="https://tickets.puppetlabs.com/browse/PUP-7284" rel="nofollow noreferrer">PUP-7284</a> on the necessary setup.</p>
  
  <p>However, I can't seem to get <code>lookup_options</code> correct to ensure conversion to a Sensitive type (to match the class parameters).</p>
  
  <p>Asserting with the <a href="https://puppet.com/docs/puppet/5.3/hiera_automatic.html#options" rel="nofollow noreferrer">puppet lookup</a> command fails with:</p>
  
  <pre><code>[user@rhel7 ~]$ puppet lookup my_module::db_pass --environment test --type Sensitive[String]
  Error: Could not run: Found value has wrong type, expects a Sensitive value, got String 
  </code></pre>
  
  <p>It also appears the <a href="https://puppet.com/docs/puppet/4.8/lookup_quick.html#setting-lookupoptions-in-data" rel="nofollow noreferrer">lookup_options</a> are being found and they look sensible:</p>
  
  <pre><code>[user@rhel7 ~]$ puppet lookup my_module::db_pass --environment test --explain-options
  Hierarchy entry "Passwords"
          Path "/etc/puppetlabs/code/environments/test/modules/my_module/data/secrets.eyaml"
            Original path: "secrets.eyaml"
            Found key: "lookup_options" value: {
              "^my_module::.*pass$" =&gt; {
                "convert_to" =&gt; "Sensitive"
              }
            }
  </code></pre>
  
  <p>Decryption works just fine (unfortunately to cleartext -- not sure if that's expected?)</p>
  
  <pre><code>[user@rhel7 ~]$ puppet lookup my_module::db_pass --environment test
  Found key: "my_module::db_pass" value: "password_is_taco"
  </code></pre>
  
  <p>The setup is as follows:</p>
  
  <pre><code>[user@rhel7 /etc/puppetlabs/puppet/environment/test/modules/my_module]$ cat hiera.eyaml
  ---
  version: 5
  defaults:
    data_hash: yaml_data
    datadir: data
  
  hierarchy:
    - name: "Passwords"
      lookup_key: eyaml_lookup_key
      paths:
        - "secrets.eyaml"
      options:
          pkcs7_private_key: "/etc/puppetlabs/puppet/keys/private_key.pkcs7.pem"
          pkcs7_public_key: "/etc/puppetlabs/puppet/keys/public_key.pkcs7.pem"
  </code></pre>
  
  <pre><code>[user@rhel7 /etc/puppetlabs/puppet/environment/test/modules/my_module]$ cat ./data/secrets.eyaml
  ---
  lookup_options:
    '^my_module::.*pass$':
      convert_to: "Sensitive"
  
  my_module::db_pass: &gt;
      ENC[PKCS7,MIIBqQYJKoZ...snip]
  </code></pre>
  
  <p>I've also been unsuccessful with different regexes and/or just using keys directly:</p>
  
  <pre><code>lookup_options:
    my_module::db_pass:
      convert_to: "Sensitive"
  </code></pre>
  
  <p>Apologies in advance for any minor copy-paste issues with obfuscated code :)</p>