parameters not extrapolating via foreman-installer or from a post install deployment (possibly not picking up defaults)

[ikonia]

using Foreman 3.14. or using the foreman-puppet module standalone 21.0.0

The puppet master deployment output from the installer looks like this

# file managed by puppet
[main]
    basemodulepath = /etc/puppetlabs/code/environments/common:/etc/puppetlabs/code/modules:/opt/puppetlabs/puppet/modules:/usr/share/puppet/modules
    certname = dev01.no-dns.co.uk
    codedir = /etc/puppetlabs/code
    environmentpath = /etc/puppetlabs/code/environments
    hiera_config = $confdir/hiera.yaml
    hostprivkey = $privatekeydir/$certname.pem { mode = 640 }
    logdir = /var/log/puppetlabs/puppet
    pluginfactsource = puppet:///pluginfacts
    pluginsource = puppet:///plugins
    privatekeydir = $ssldir/private_keys { group = service }
    reports = foreman
    rundir = /var/run/puppetlabs
    server = dev01.no-dns.co.uk
    show_diff = false
    ssldir = /etc/puppetlabs/puppet/ssl
    vardir = /opt/puppetlabs/puppet/cache

[agent]
    classfile = $statedir/classes.txt
    default_schedules = false
    environment = production
    masterport = 8140
    noop = false
    report = true
    runinterval = 1800
    splay = false
    splaylimit = 1800
    usecacheonfailure = true

[server]
    autosign = /etc/puppetlabs/puppet/autosign.conf { mode = 0664 }
    ca = true
    certname = dev01.no-dns.co.uk
    external_nodes = /etc/puppetlabs/puppet/node.rb
    logdir = /var/log/puppetlabs/puppetserver
    node_terminus = exec
    parser = current
    rundir = /var/run/puppetlabs/puppetserver
    ssldir = /etc/puppetlabs/puppet/ssl
    storeconfigs = false
    strict_variables = false
    vardir = /opt/puppetlabs/server/data/puppetserver

in this output you can see values being output as the literal string set in the puppet modules config.pp
eg:

hostprivkey = $privatekeydir/$certname.pem { mode = 640 }

is the literal output of config.pp line 29

'hostprivkey': value => '$privatekeydir/$certname.pem { mode = 640 }';

you can see this behaviour repeated in this example with

privatekeydir = $ssldir/private_keys { group = service }

looking at ssldir = /etc/puppetlabs/puppet/ssl, you can see that $ssldir is set and resolves correctly, yet

This behaviour is replicated using module on an puppet agent trying to configure itself using thefomeman-puppet 21.0.0.
In a separate isolated environment the module reconfigures puppet.conf on a EL/Debian

# file managed by puppet
[main]
    certname = pupmodtest.no-dns.co.uk
    codedir = /etc/puppetlabs/code
    hostprivkey = $privatekeydir/$certname.pem { mode = 640 }
    logdir = /var/log/puppetlabs/puppet
    pluginfactsource = puppet:///pluginfacts
    pluginsource = puppet:///plugins
    privatekeydir = $ssldir/private_keys { group = service }
    rundir = /var/run/puppetlabs
    server = jarvis.no-dns.co.uk
    show_diff = false
    ssldir = /etc/puppetlabs/puppet/ssl
    vardir = /opt/puppetlabs/puppet/cache

[agent]
    classfile = $statedir/classes.txt
    default_schedules = false
    environment = puppetdev
    masterport = 8140
    noop = false
    report = true
    runinterval = 900
    splay = false
    splaylimit = 1800
    usecacheonfailure = true

again hostprivkey and privatekeydir are not resolved correctly

You can also see references to parameters not resolving correctly (but not literal output) in classfile under [agent]
classfile = $statedir/classes.txt also does not map to a actual resolved ouptut of a file system path