This should not have been gated on options.setup_ca because we need the RA agent on all servers if there is a CA in the topology otherwise the non-CA servers won't be able to communicate with the CA. Fixes: https://pagure.io/freeipa/issue/9510 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>