Description of problem: ipa-client is required by RHVH but should not be mandatory for ovirt-host, it has direct dependency on krb5-workstation which is not allowed by DISA STIG security profile.
Can we remove the dependency from ovirt-host, but leave a package installed on RHVH? That way it will be removed only DISA STIG hardening is applied, but host stays functional as hypervisor.
This doesn't solve DISA-STIG support for RHV-H right? Wouldn't it be better to solve with scap profile for RHV? CC @wsato @mtessun what do you think?
Dropping the "move to optional part" from ovirt-host component as in ovirt it's done via ovirt-release rpm and in RHV it's done via adding the packages to the RHV-H channel.
It has been decided to revert this change and adjust the SCAP guide instead.