This seems to have done the trick:

    ipa permission-add 'modify host krbPrincipalKey' --permissions='write' --type='host' --attrs='krbPrincipalKey,krbLastPwdChange'

FreeIPA's debug mode is nice :)