Open ports for Metrics QDRs

This patch opens ports for internal communication of QDRs deployed
on controllers.

Change-Id: I192c19fdafe051f84be5845eaa665917b81f608a
(cherry picked from commit 706d9b3982)

deployment/metrics/qdr-container-puppet.yaml

@@ -161,9 +161,19 @@ outputs:
       config_settings:
         map_merge:
           - tripleo::metrics_qdr::firewall_rules:
-            '109 metrics qdr':
-              dport:
-                - {get_param: MetricsQdrPort}
+              map_merge:
+              - '109 metrics qdr':
+                  dport:
+                    - {get_param: MetricsQdrPort}
+              - map_merge:
+                  repeat:
+                    for_each:
+                      <%net_cidr%>: {get_param: [ServiceData, net_cidr_map, ctlplane]}
+                    template:
+                      '109 accept internal metrics qdr ctlplane subnet <%net_cidr%>':
+                        dport:
+                          - 5667
+                          - 5668
           - tripleo::profile::base::metrics::qdr::external_listener_addr:
               str_replace:
                 template: