$password_hash was not being encrypted which caused an ALTER ROLE to be run every time the puppet agent runs. This should fix that.