change puppet_admin_password does not trigger keytab update
A keytab is a file containing Kerberos principals and encrypted keys (which are derived from the Kerberos password). When you change your Kerberos password, you will need to recreate keytab.
So updating $freeipa::puppet_admin_password
should trigger keytab update.