Also restrict "ganeti/kvm host" purpose