Perhaps the new sssd version from upstream or something in our config with it invalidates the kerberos keytab. IIRC somebody started to have troubles after CentOS released 7.3. We didn’t released anything that time (but some testing packages though).
The leave/join workaround creates a new machine password and a new keytab file.