Puppet generating variables inside script

Are you looking to keep both puppet masters up and running for a time, and migrate clients over a little at a time?

If so, you're stuck touching each client system regardless; whether it's to point to a new master, or add a hosts file entry, or some such. If that's the case, then you might as well just start the new master fresh and re-sign each client (it's better than a hosts file hack to work around the validation issues).

If not (if you're planning to take down the old server and cut everything over at once), then just take the old server's hostname over with the new server; the certificate will be recognized as valid if the clients are connecting to the new server on the old name (the name that is on the certificate).

No need to use a bash script, just use the next function I'm using for some other stuff to generate the shadow encrypted password:

 def shadow(self,password):
  SomeZolt="$6$"+''.join(random.choice(string.ascii_uppercase + string.digits) for x in range(9))+"$"
  return crypt.crypt(password, SomeZolt)

After which write additional functionality to your python script which will open the /etc/shadow file and write the encrypted password you get by using this function for this user thus making a line like:

some_user:!!:15579:0:99999:7:::

make look like:

some_user:$1$JShdquwdjsd38hSJhdqwdkwd:15579:0:99999:7:::

Thus some_user will have the assigned password.
Additionaly you can set the user directly in the puppet statement by changing it to:

user { $username:
  comment => "$email",
  home    => "/home/$username",
  shell   => "/bin/bash",
  uid     => $uid,
  gid     => $gid,
  password => "SomeAlreadyEncryptedPassword",
}   

You can use by the way the function specified to get the encrypted password and then insert it to the statement.