If you are not using the password in an Exec, then the methods suggested by Kazimieras Aliulis may not work for you.
If it were me, I would probably just modify the
/etc/puppet/utils/gen_password script to always return the same password per-service/host. You would have puppet call the generte like this
Then in the script you would check to see if a password had been generated for that system, and if it had return it. If not then generate a new one, store it in and return it.
If at all possible don't store and return the unecrypted password. Instead generate and return the salted password hash.
Of course if you could skip using passwords altogether and instead use certificates or keys for authentication that would be even better.