I found a TODO in ipa-server-install:
# setup_kra is set to False until Dogtag 10.2 is available for IPA to
# Until then users that want to install the KRA need to use ipa-install-kra
# TODO set setup_kra = True when Dogtag 10.2 is available
setup_kra = False
Dogtag 10.2 is available, should it be setup_kra = True?
Freeipa-devel mailing list