On 2017-09-19 11:53, Alexander Bokovoy wrote:
[...]
Please spend some time reading the documentation. It is vast and has a
lot of answers to questions people keep asking on these lists.

I've already spent some time reading the documentation. Since "ipa-getkeytab" worked I was not aware of the fact that "ipa-getkeytab -r" would need:
ipa service-allow-retrieve-keytab HTTP/cluster.idm.example.com --hosts={node01.idm.example.com,node02.idm.example.com}