Request for enhancement

The PR #7954 adds a new setting in kerberos client configuration but only for new installations:
auto_fast_armor = true is added in /etc/krb5.conf.d/freeipa-realm in the [realms] section.

The setting was intentionally not added on upgraded installations because it would require a bit of code checking that there is a working anonymous pkinit in the deployment. Currently the client doesn't have any upgrade script and all the actions are performed through post-install scriptlets from the freeipa.spec file.
IPA plans to introduce a client upgrade script (see #3149 for instance) that would also be useful in the ImageMode scenario. When this upgrade mechanism is available, IPA should add code automatically adding the auto_fast_armor=true setting if the deployment allows it.