Unable to install undercloud due to Puppet hiera error when uncommenting password items in undercloud.conf

Issue

When one uncomments password items in undercloud.conf, the deployment will fail with a puppet hiera error.

The following fields were uncommented:

[stack@undercloud ~]$ grep None -B2 undercloud.conf
# appropriately.  If set, the undercloud install will configure all
# system hostname settings. (string value)
#undercloud_hostname = <None>
--
# Password used for MySQL databases. If left unset, one will be
# automatically generated. (string value)
undercloud_db_password = <None>
--
# Keystone admin token. If left unset, one will be automatically
# generated. (string value)
undercloud_admin_token = <None>
--
# Keystone admin password. If left unset, one will be automatically
# generated. (string value)
undercloud_admin_password = <None>
--
# Glance service password. If left unset, one will be automatically
# generated. (string value)
undercloud_glance_password = <None>
--
# Heat db encryption key(must be 16, 24, or 32 characters. If left
# unset, one will be automatically generated. (string value)
undercloud_heat_encryption_key = <None>
--
# Heat service password. If left unset, one will be automatically
# generated. (string value)
undercloud_heat_password = <None>
--
# Neutron service password. If left unset, one will be automatically
# generated. (string value)
undercloud_neutron_password = <None>
--
# Nova service password. If left unset, one will be automatically
# generated. (string value)
undercloud_nova_password = <None>
--
# Ironic service password. If left unset, one will be automatically
# generated. (string value)
undercloud_ironic_password = <None>
--
# Aodh service password. If left unset, one will be automatically
# generated. (string value)
undercloud_aodh_password = <None>
--
# Ceilometer service password. If left unset, one will be
# automatically generated. (string value)
undercloud_ceilometer_password = <None>
--
# Ceilometer metering secret. If left unset, one will be automatically
# generated. (string value)
undercloud_ceilometer_metering_secret = <None>
--
# Ceilometer snmpd password. If left unset, one will be automatically
# generated. (string value)
undercloud_ceilometer_snmpd_password = <None>
--
# Swift service password. If left unset, one will be automatically
# generated. (string value)
undercloud_swift_password = <None>
--
# Mistral service password. If left unset, one will be automatically
# generated. (string value)
undercloud_mistral_password = <None>
--
# Rabbitmq cookie. If left unset, one will be automatically generated.
# (string value)
undercloud_rabbit_cookie = <None>
--
# Rabbitmq password. If left unset, one will be automatically
# generated. (string value)
undercloud_rabbit_password = <None>
--
# Rabbitmq username. If left unset, one will be automatically
# generated. (string value)
undercloud_rabbit_username = <None>
--
# Heat stack domain admin password. If left unset, one will be
# automatically generated. (string value)
undercloud_heat_stack_domain_admin_password = <None>
--
# Swift hash suffix. If left unset, one will be automatically
# generated. (string value)
undercloud_swift_hash_suffix = <None>
--
# Sensu service password. If left unset, one will be automatically
# generated. (string value)
undercloud_sensu_password = <None>
--
# HAProxy stats password. If left unset, one will be automatically
# generated. (string value)
undercloud_haproxy_stats_password = <None>

This leads to the following error message

[stack@undercloud ~]$ openstack undercloud install
Logging to /home/stack/.instack/install-undercloud.log
Checking for a FQDN hostname...
Static hostname detected as undercloud.example.com
Transient hostname detected as undercloud.example.com
Running instack
(...)
dib-run-parts Sat Dec 17 14:16:16 EST 2016 Running /usr/libexec/os-refresh-config/configure.d/50-puppet-stack-config
+ set -o pipefail
+ set +e
+ puppet apply --detailed-exitcodes /etc/puppet/manifests/puppet-stack-config.pp
Error: (<unknown>): did not find expected alphabetic or numeric character while scanning an anchor at line 38 column 27 at /etc/puppet/manifests/puppet-stack-config.pp:16 on node undercloud.example.com
Wrapped exception:
(<unknown>): did not find expected alphabetic or numeric character while scanning an anchor at line 38 column 27
Error: (<unknown>): did not find expected alphabetic or numeric character while scanning an anchor at line 38 column 27 at /etc/puppet/manifests/puppet-stack-config.pp:16 on node undercloud.example.com
+ rc=1
+ set -e
+ echo 'puppet apply exited with exit code 1'
puppet apply exited with exit code 1
+ '[' 1 '!=' 2 -a 1 '!=' 0 ']'
+ exit 1
[2016-12-17 14:16:21,003] (os-refresh-config) [ERROR] during configure phase. [Command '['dib-run-parts', '/usr/libexec/os-refresh-config/configure.d']' returned non-zero exit status 1]

[2016-12-17 14:16:21,003] (os-refresh-config) [ERROR] Aborting...
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/lib/python2.7/site-packages/instack_undercloud/undercloud.py", line 845, in install
    _run_orc(instack_env)
  File "/usr/lib/python2.7/site-packages/instack_undercloud/undercloud.py", line 735, in _run_orc
    _run_live_command(args, instack_env, 'os-refresh-config')
  File "/usr/lib/python2.7/site-packages/instack_undercloud/undercloud.py", line 406, in _run_live_command
    raise RuntimeError('%s failed. See log for details.' % name)
RuntimeError: os-refresh-config failed. See log for details.
Command 'instack-install-undercloud' returned non-zero exit status 1