We do, the conditional block above this revokes the keytab if it's a rebuild, which makes this work:

   options.merge!(:random => 1) unless host["result"]["has_keytab"]

We can't send random => 1 if a host is still enrolled. Sorry, maybe it's not the clearest code here...