Allow ssh from all for undercloud

I89cff59947dda3f51482486c41a3d67c4aa36a3e broke SSH access on the
Undercloud, we shouldn't be that restrictive by default for the
undercloud and standalone (as deployed via tripleo deploy).

This change adds a new parameter called SshFirewallAllowAll that can be
used to include an allow all for ssh. By default it is disabled when
deploying the overcloud but is used by the undercloud and standalone to
allow access after installation.

Change-Id: Ie548f7216610e15af24c96f65a58cc8de603235c
Co-Authored-By: Alex Schultz <aschultz@redhat.com>
Related-Bug: #1826829
(cherry picked from commit 2b7cb19876)
(cherry picked from commit cba7c22857)

environments/undercloud.yaml

@@ -55,3 +55,4 @@ parameter_defaults:
   NeutronPublicInterface: eth1
   MistralExecutionFieldSizeLimit: 16384
   NeutronServicePlugins: ['router']
+  SshFirewallAllowAll: true

puppet/services/sshd.yaml

@@ -62,6 +62,10 @@ parameters:
       Subsystem: 'sftp  /usr/libexec/openssh/sftp-server'
     description: Mapping of sshd_config values
     type: json
+  SshFirewallAllowAll:
+    default: false
+    description: Set this to true to open up ssh access from all sources.
+    type: boolean
 
 outputs:
   role_data:
@@ -69,8 +73,17 @@ outputs:
     value:
       service_name: sshd
       config_settings:
-        tripleo::profile::base::sshd::bannertext: {get_param: BannerText}
-        tripleo::profile::base::sshd::motd: {get_param: MessageOfTheDay}
-        tripleo::profile::base::sshd::options: {get_param: SshServerOptions}
+        map_merge:
+          - tripleo::profile::base::sshd::bannertext: {get_param: BannerText}
+            tripleo::profile::base::sshd::motd: {get_param: MessageOfTheDay}
+            tripleo::profile::base::sshd::options: {get_param: SshServerOptions}
+          - if:
+            - {get_param: SshFirewallAllowAll}
+            - tripleo::sshd::firewall_rules:
+                '003 accept ssh from all':
+                  proto: 'tcp'
+                  dport: 22
+            - null
+
       step_config: |
         include ::tripleo::profile::base::sshd