The $vardir parameter in pupmod::master::sysconfig needs to be set to a directory that is under the master's vardir instead of the agent's vardir.
As it stands, it is possible for an upgrade of the puppetserver package to fail to be able to restart the service due to being unable to write to the temporary directory as noted in https://github.com/puppetlabs/puppetserver/blob/master/documentation/known_issues.markdown#tmp-directory-mounted-noexec
The following needs to happen:
Fix the parameter
Add documentation noting how to fix the issue manually (though encourage users to simply upgrade the pupmod module prior to upgrading the puppetserver package
Release a message to the mailing list with the discovery and links to the relevant documentation