pull from the ganeti nodes instead of pushing from KVM1

The rationale here is we don't want to extend trust from the old
machine, which we do by giving them root access on the new server. By
giving root access to the *old* server, we don't give it access to
anything it already has (or will have, in the case of the ganeti
nodes).