Hi
Perhaps some boot script to run the ipa-client-install command when a new instance boots up? I'm not sure how the system would behave if you run the ipa-client-install command multiple times, should the same machine name boots more than once.
For HBAC rules you can use "auto-member" to automatically put new hosts into particular host groups for which you would have existing HABC rules.
Regards
Angus