Where do puppet logs go

Any open signing requests should be listed in puppet cert list on the master. If they don't show up there, there's no use trying to sign them. Once signed, they disappear from the list and will only show up in puppet cert list --all.

It appears your master is not receiving signing requests from the agent, since your list is empty There is a number of things that could be wrong. Let's start with these:

• Is the master running?
• Does the hostname 'puppet' or 'puppet.abc.com' resolve from the agent?
• Is TCP port 8140 on the master reachable from the agent (try: telnet puppet 8140)?
• What does syslog on the agent say?
• Try puppet agent --test on the agent, which will attempt to connect to the master and stay in foreground to show the output.

The systemd provider in Puppet today only uses two commands for the service enable state:

• systemctl is-enabled <unit>, checking return code for the current enable state
• systemctl enable/disable <unit> to change it

The enable command throws an error when you enable an instance of the getty@ service that doesn't already exist:

$ sudo systemctl enable getty@ttyUSB0.service
Failed to issue method call: No such file or directory

This is then causing the error shown in Puppet (though stderr doesn't seem to be displayed).

It looks to me like a gap in systemd that you aren't able to enable new instances of a template. There's already BZ#752774 in Fedora, but the comments suggest it might not be added any time soon.

You might be better off filing a feature request against Puppet to add support specifically for enabling new instances. In your feature request I'd suggest linking to Lennart's explanation of unit instances for background.