By default kerberos on RHEL7 no longer uses /tmp/krb5cc_ as a store for kerberos tickets, it now favors linux keyrings.
I've changed the script to do a regular kinit using the keytab, which solves the fact hanging waiting for a password:
servers = Facter::Util::Resolution.exec("kinit -kt ~admin/admin.keytab admin && /sbin/runuser -l admin -c '/usr/sbin/ipa-replica-manage list' 2>/dev/null | /bin/egrep -v '#{fqdn}|winsync' | /bin/cut -d: -f1")